Kerberos

initial(9) asserts the ticket came from the AS exchange, issued against the client's long-term key rather than derived from a ticket-granting ticket. pre-authent(10) asserts the KDC verified pre-authentication data before issuing, and it is carried forward onto later tickets while initial(9) is not.

FAST encrypts the pre-authentication conversation itself under an armor key that is not derived from the user's password, so the encrypted-timestamp ciphertext and the KDC's error replies stop being an observable, guessable, spoofable channel.

Error 7 says no principal matching the requested sname and realm exists in that KDC's database; error 6 says the same about the client name in cname and crealm. They point at opposite halves of the request: a service registration problem versus a sign-in one.

By default the ticket's session key, which the KDC issued and every exchange presenting that ticket shares. If the Authenticator proposes a subkey the peers may use that sub-session key instead, and when the AP-REP returns one, the service's choice governs.

Because the advertised mechTypes list travels before any key exists, an active attacker could delete the strong mechanism from it. The mechListMIC is a checksum over that list, computed once a context exists; request-mic(3) demands it.