A lot of good information on Kerbero's encryption methods discussed here, but I there is a second question that arises. Does use of SHA-1 in the overall algorithm weaken Kerberos? If so, will security scanners potentially block certain Kerberos tickets that use it?

  • $\begingroup$ Which version? web.mit.edu/kerberos/krb5-devel/doc/admin/enctypes.html $\endgroup$
    – kelalaka
    Mar 16, 2020 at 23:46
  • $\begingroup$ Context is Windows Server 2012 R2, so Kerberos 5+ $\endgroup$ Mar 17, 2020 at 0:01
  • 1
    $\begingroup$ 5+ is a generic term. What is the lifetime of a ticket on your system? $\endgroup$
    – kelalaka
    Mar 17, 2020 at 9:19
  • 1
    $\begingroup$ It seems mainly used in HMAC with output size 96 bits. HMAC is pretty robust, even if used with a weaker hash function or reduced output size... $\endgroup$
    – Maarten Bodewes
    Mar 17, 2020 at 15:34
  • $\begingroup$ @MaartenBodewes But ( insert here a good meme) it uses 96 bits. I think one should only consider that if the lifetime of the ticket is not indefinite. $\endgroup$
    – kelalaka
    Mar 17, 2020 at 17:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.