Kerberos Summary

Every service request needs a ticket.
Tickets come from the TGS (except the ticket for the TGS!).
Workstations cannot understand tickets, they are encrypted using the server key.
Every ticket has an associated session key.
Tickets are reusable.