This is a nice reminder that symmetric cryptography is PQ-safe, but barebones kerberos does not solve the initial authentication problem - the exact purpose of

This is a nice reminder that symmetric cryptography is PQ-safe, but barebones kerberos does not solve the initial authentication problem - the exact purpose of a TLS handshake. Kerberos relies on the client and kerberos authority (KDC) having a pre-shared password; the KDC uses it to send encrypted messages to the client, and also for giving the client a message encrypted for a service the client wishes to talk to (these are kerberos tickets). In that sense, Kerberos does look a lot like a trusted third party facilitating a TLS handshake with all-symmetric cryptography! A very neat analogy. It would be ludicrous to require all clients to have a pre-shared secret password with the CA, and to require the CA be an available participant in every handshake in an uncacheable way. Still, it's fun to imagine this. Anyway, some notes for completeness: there does exist a PKINIT extension for Kerberos, where an x.509 certificate from a trusted authority authenticates the kerberos authority (KDC) for the clients, and authenticates the clients without a password. This relies on a signature system, so that's out of scope if we're talking about ditching TLS in a PQ setting. I suppose one could imagine distributing kerberos keytabs instead of certificates.