Session key
nIssues to both client and service by authentication service that uniquely identifies their session
Authenticator
nUser’s
timestamp encrypted with the session key
Ticket granting service (TGS)
nApplication separate from AS that also runs on the KDC
nTGS issues client a ticket granting ticket (TGT)