• A serious problem with having all authentication rely on a single KDC is that it is a single point 
of failure. 
• If the KDC is unavailable, it is impossible to access remote resources, making the network 
unusable to everyone. 
• A single KDC might be a performance bottleneck, since all logins and all attempts to start 
conversations to anything must involve communication with the KDC.
• For these reasons it is desirable to have multiple KDCs, where each KDC is interchangeable 
with every other KDC. They share the same master KDC key and have identical databases of 
principal names and master keys.
• Keeping the databases at all the KDCs the same is done by having one site hold the master 
copy to which any updates must be made. An update consists of adding an entry for 
, modifying an entry (for instance to change a key), or deleting an entry. 
• Other sites download the database periodically, either on a timer or as a result of a human 
issuing a command. Having a single master copy avoids problems such as combining updates 
made at different replicas and resolving conflicting updates.