This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Kerberos Encryption Types
Kerberos Encryption Types

Version management

Difference between version and

At line 1 added 79 lines
!!! Overview
[{$pagename}] ([etype]) are defined in an [IANA Registry] at: [Kerberos Encryption Type Numbers|https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml#kerberos-parameters-1|target='_blank']
These are signed values ranging from -2147483648 to 2147483647.
* Positive values should be assigned only for algorithms specified in accordance with this specification for use with [Kerberos] or related [protocols].
* Negative values are for private use; local and experimental algorithms should use these values.
* Zero is reserved and may not be assigned.
!! [{$pagename}] [Microsoft Windows]
[{$pagename}] for [Microsoft Windows] is decided by the [MsDS-SupportedEncryptionTypes] values or the defaults if not set.
[MsDS-SupportedEncryptionTypes] values can be set from a [Group Policy Object].
The default [{$pagename}] for [Windows Vista]/[Windows 7] [clients] is [AES]256 and [Windows XP] and [Windows Server 2003] [clients] default to [RC4].
This implies that when [Windows Vista]/[Windows 7] client will initially attempt to use [AES] when talking to a [Domain Controller] during the [Kerberos] [Kerberos Pre-Authentication] stage, [Windows Server 2003] DC‘s on the other hand don‘t support using [AES] with [Kerberos] which is why they log the [Windows Event Log] and ask the client to try again with one of [{$pagename}] the DC supports (which usually ends up as [RC4]).
Table shows those that are likely to be encountered.
%%zebra-table
%%sortable
%%table-filter
||Encryption type||Aliases||etype (dec)||etype (hex)||[msDS|MsDS-SupportedEncryptionTypes]||Description RFC||[Windows|Microsoft Windows] support||[MIT] [Kerberos] support||Notes
|[DES]-[CBC]-[CRC]| |1|0x0001|0x0001|[DES] cbc mode with [CRC]-32|[RFC 3961] section 6.2.3|[Windows Server 2000], __disabled__ by default as of [Windows Server 2008]R2|All versions|[Cryptographically Weak] & [Deprecated]
|[DES]-[CBC]-[MD4]| |2|0x0002| |DES cbc mode with RSA-MD4|[RFC 3961] section 6.2.2|Not supported|All versions|[Cryptographically Weak] & [Deprecated]
|[DES]-[CBC]-[MD5]|des|3|0x0003|0x0002|[DES] cbc mode with [RSA]-[MD5]|[RFC 3961] section 6.2.1|[Windows Server 2000]+, __disabled__ by default as of [Windows Server 2008] R2|All versions|[Cryptographically Weak] & [Deprecated]
|[DES]-[CBC]-raw| |4|0x0004| |[DES] cbc mode raw|[RFC 3961] marked as "reserved"|Not supported|Unknown|Weak & deprecated, not defined in any [RFC]
|[DES3]-[CBC]-raw| |6|0x0006| |[Triple DES] cbc mode raw|[RFC 3961] marked as "reserved"|Not supported|Unknown|[Cryptographically Weak] & [Deprecated], not defined in any RFC
|[DES3]-[CBC]-[SHA-1]|des3-hmac-sha1\\des3-cbc-sha1-kd|16|0x0010| |[Triple DES] cbc mode with [HMAC]/[SHA-1]|[RFC 3961], section 6.3|Not supported|1.1|
|[AES]128-[CTS]-[HMAC-SHA1]-96|aes128-cts\\aes128-sha1|17|0x0011|0x0008|[AES]-128 [CTS] mode with 96-[bit] [SHA-1] [HMAC]|[RFC 3962]|[Windows Server 2008]+|1.3|
|[AES]256-[CTS]-[HMAC-SHA1]-96|aes256-cts\\aes256-sha1|18|0x0012|0x0010|[AES]-256 [CTS] mode with 96-[bit] [SHA-1] [HMAC]|[RFC 3962|[Windows Server 2008]+|[Windows Server 2008] R2 |1.3|
|[AES]128-cts-hmac-sha256-128|aes128-sha2|19|0x0013| |[AES]-128 [CTS] mode with 128-bit [SHA-256] [HMAC]|[RFC 3962]|Not supported|1.15|RFC was only published in October 2016
|[AES]256-cts-hmac-sha384-192|aes256-sha2|20|0x0014| |[AES]-256 [CTS] mode with 192-bit [SHA-384] [HMAC]|[RFC 3962]|Not supported|1.15|RFC was only published in October 2016
|[RC4]-[HMAC]|rc4-hmac\\[RC4]-[HMAC]-[MD5]|23|0x0017| |ArcFour with [HMAC]/[MD5]|[RFC 4757]|[Windows Server 2000]+|1.3|
|[RC4]-[HMAC]|[RC4]-[HMAC]-[MD5]-[EXP|Export-grade]|24|0x0018| |[Exportable|Export-grade] ArcFour ([RC4]) with [HMAC]/[MD5]|[RFC 4757]|[Windows Server 2000]+|1.3|[Cryptographically Weak] & [Deprecated]
|[camellia]128-cts-cmac|camellia128-cts|25|0x0019| |[Camellia]-128 [CTS] mode with [CMAC]|[RFC 4757]|Not supported|1.9|
|[camellia]256-cts-cmac|[camellia]256-cts|26|0x001a| |[Camellia]-256 [CTS] mode with [CMAC]|[RFC 4757]|Not supported|1.9|
/%
/%
/%
!! [Kerberos Cryptosystem Negotiation Extension]
[Kerberos] allows negotiation of [ciphers] to be used by use of the [Kerberos Cryptosystem Negotiation Extension]
!! [{$pagename}] with [DES]
In practical terms, a [Windows Client] starts a [Kerberos] [Protocol] [Communication] a list of supported [{$pagename}] ([Etypes]). The [KDC] responds to the list with the most secure [{$pagename}]s they both support. For example, a Windows 7 computer sends an [AS_REQ]. You can how it looks in [Wireshark]:
[{Image src='Kerberos Encryption Types/as_req-kerberos.png' caption='AS_REQ' align=left width=768 height=768 style='font-size: 120%}].
\\The [KDC] responds that it requires pre-authentication and sends a list of its supported encryption types: ([DES] was enabled for demonstration purposes):
[{Image src='Kerberos Encryption Types/as_resp-kerberos.png' caption='KDC RESP' align=left width=768 height=768 style='font-size: 120%}].
\\Some [Operating System] are not always configured to use [{$pagename}] at the same [cipher] levels and may not support negotiation or [Kerberos Pre-Authentication] or they may not support [AES] [ciphers].
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop