# What authenticated encryption do kerberos use in windows?

I have learned about the kerberos protocol and seen that the windows version uses a couple of authenticated encryption schemas (like rc4-hmac-md5).

What type of authenticated encryption is it? Is it a:

1. Encrypt-then-MAC

2. Encrypt-and-MAC

3. MAC-then-Encrypt

Thank you

The only reasonably secure Kerberos algorithm types that Windows supports are aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96. Neither of these are great choices since they use SHA-1, but HMAC-SHA-1 is still secure in this context, although SHA-1 on the whole should still be avoided. In these algorithms, it's encrypt-and-MAC: the plaintext is prepended with a random string, the MAC and encryption are both done over that preprended plaintext, and the MAC is appended.
For systems using the more modern aes128-cts-hmac-sha256-128 and aes256-cts-hmac-sha384-192, they are encrypt-then-MAC: the MAC is computed over the ciphertext. Windows doesn't support that, however, although most Unix systems do.