does the encrypt affect the way user passwords are hashed in the KDC. (I assume password hashses are stored, not passwords in the clear?)
________________________________________ From: Greg Hudson <[email protected]> Sent: Tuesday, June 23, 2026 4:12 PM To: Charles Hedrick; [email protected] Subject: Re: why is aes sha1 the default encryption type On 6/23/26 08:43, Charles Hedrick via Kerberos wrote: > When there's a perfectly good aes sha2 type? 1. It is highly interoperable. Every Kerberos implementation of significance implements aes-sha1, going back many years. Microsoft either hasn't implemented aes-sha2 or only implemented it in 2025 (I can't easily tell which), so the clock has at best barely started on that kind of reach for aes-sha2. 2. The known flaws in SHA-1 do not affect its use as a MAC. 3. Kerberos enctype negotation isn't perfect. It works well enough for client interoperability, but when provisioning keytabs for servers you have to select an enctype that the server software supports. There is also this edge case if it hasn't been fixed on the Microsoft side: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9089 I get that using SHA-1 in any capacity can run afoul of regulatory systems, which aren't always nuanced enough to recognize that it is still believed to be secure as a MAC. But changing the default doesn't necessarily help with compliance; as long as the system can negotiate down to aes-sha1 then it still has SHA-1 in its attack surface. ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
