[19296] in Kerberos_V5_Development
Re: krb5-1.14-beta1 is available
daemon@ATHENA.MIT.EDU (Tom Yu)
Fri Oct 9 21:28:24 2015
From: Tom Yu <tlyu@mit.edu>
To: Wang Weijun <weijun.wang@oracle.com>
Date: Fri, 09 Oct 2015 21:28:15 -0400
In-Reply-To: <1F55B133-2D51-45DA-92D2-7E2F05623AD3@oracle.com> (Wang Weijun's
message of "Sat, 10 Oct 2015 09:22:07 +0800")
Message-ID: <ldvmvvrcy1c.fsf@sarnath.mit.edu>
MIME-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
supported_enctypes also defines the default keysalts for
randomly-generated keys; we don't have a separate setting for keysalts
of randomly-generated keys.
There is currently no change for the AS-REQ enctypes (controlled by
default_tkt_enctypes) in krb5-1.14.
-Tom
Wang Weijun <weijun.wang@oracle.com> writes:
> So in kadmin if a principal is created with -pw there are only strong keys but if password is chosen randomly 3DES and RC4 keys will also be generated? I will need to download it to try out.
>
> Also, is there any change on the client side, say, in a AS-REQ, what is inside the etypes list?
>
> Thanks
> Max
>
>> On Oct 10, 2015, at 9:13 AM, Tom Yu <tlyu@mit.edu> wrote:
>>
>> This is a challenging to explain concisely, but basically in Kerberos,
>> 3DES and RC4 are still reasonably strong for randomly generated keys but
>> not for password-derived ones.
>>
>> krb5-devel/doc is master, not the release branch, but it's close enough
>> for now.
>>
>> -Tom
>>
>> Wang Weijun <weijun.wang@oracle.com> writes:
>>
>>> You mean all 3DES and RC4 etypes as described in https://tools.ietf.org/html/draft-kaduk-kitten-des-des-des-die-die-die-00? I see 16 and 23 still not marked weak in http://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/kdc_conf.html#encryption-types.
>>>
>>> BTW, is the krb5-devel/doc pages always synced with the latest public beta?
>>>
>>> Thanks
>>> Max
>>>
>>>> On Oct 10, 2015, at 4:44 AM, Tom Yu <tlyu@mit.edu> wrote:
>>>>
>>>>
>>>> * Remove the triple-DES and RC4 encryption types from the default
>>>> value of supported_enctypes, which determines the default key and
>>>> salt types for new password-derived keys. By default, keys will
>>>> only created only for AES128 and AES256. This mitigates some types
>>>> of password guessing attacks.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
