Kerberos (protocol)
Upon receiving messages C and D, the TGS retrieves message B out of message C. It decrypts message B using the TGS secret key. This gives it the Client/TGS Session Key. Using this key, the TGS decrypts message D (Authenticator) and sends the following two messages to the client: