>I created a presentation PDF a while back that I've placed on the Web >which goes into detail on Kerberos enctypes in terms of how they are >used, negotiated and controlled via *.conf parameters. It can be >downloaded via my blog: > >http://blogs.sun.com/roller/page/wfiveash?entry=everything_you_wanted_to_know
This is a good presentation. I have two comments: - In my experience, encryption type settings are the herpes of the Kerberos world - once they get out "into the wild", they spread magically to other systems and it's damn hard to get rid of them. If you have your applicatation server enctypes set correctly, you should almost never need them. I'd stress that setting these enctype settings on the client should only be used rarely (say, you're using MIT Kerberos that supports AES, but one of your developers uses a Java Kerberos implementation that only supports single-DES). I know you mention this in your last slide, but I'd put something stronger in there. - I know you know this, but on slide 8 you imply with the diagrams that the ticket in the AS_REP is double-encrypted, and of course it's not; only the session key and a few other bits are encrypted by the user's long-term key. A minor nit, but I only wanted to point it out for accuracy's sake. --Ken ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
