Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not completely clueless as to what it means, but I'd like to understand it at a higher level.

The highest encryption type used by Active Directory domain controllers for Kerberos authentication traffic is AES256-CTS-HMAC-SHA1-96.

The first part: AES256-CTS. That's AES with a 256-bit symmetric key operating in Cipher Text Stealing mode. Where does the 256 bits of key material come from?

The last part: HMAC-SHA1-96. I get that it's using a hash-bashed message authentication code, using SHA1 for the hash. But what does the 96 mean? An SHA1 hash is 160 bits...

share|improve this question
up vote 3 down vote accepted

Decoding AES256-CTS-HMAC-SHA1-96

  • AES256 = AES using 256-bit key
  • CTS = ciphertext stealing
  • HMAC-SHA1-96 = HMAC using SHA-1 hash function with mac truncated to 96 bits.

The benefits of HMAC truncation are discussed in FIPS PUB 198-1, chapter 5. For HMAC-SHA1 96 bits is very common truncation, used for instance by IPsec/ESP.

For figuring out what key material is used, it is decided by Kerberos. Please, read the appropriate standards.

share|improve this answer
HMAC truncation... Interesting! – Ryan Ries Nov 9 '13 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.