A lot of good information on Kerbero's encryption methods discussed here, but I there is a second question that arises. Does use of SHA-1 in the overall algorithm weaken Kerberos? If so, will security scanners potentially block certain Kerberos tickets that use it?

  • $\begingroup$ Which version? web.mit.edu/kerberos/krb5-devel/doc/admin/enctypes.html $\endgroup$ – kelalaka Mar 16 '20 at 23:46
  • $\begingroup$ Context is Windows Server 2012 R2, so Kerberos 5+ $\endgroup$ – PrometheusRising Mar 17 '20 at 0:01
  • 1
    $\begingroup$ 5+ is a generic term. What is the lifetime of a ticket on your system? $\endgroup$ – kelalaka Mar 17 '20 at 9:19
  • 1
    $\begingroup$ It seems mainly used in HMAC with output size 96 bits. HMAC is pretty robust, even if used with a weaker hash function or reduced output size... $\endgroup$ – Maarten Bodewes Mar 17 '20 at 15:34
  • $\begingroup$ @MaartenBodewes But ( insert here a good meme) it uses 96 bits. I think one should only consider that if the lifetime of the ticket is not indefinite. $\endgroup$ – kelalaka Mar 17 '20 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.