Subject: mandatory encryption types for kerberos-revisions

From: Ken Raeburn <[email-masked]>
Date: Tue, 07 Aug 2001 16:45:49 +0100

The current draft says:

    Encryption and checksum methods

    The following encryption and checksum mechanisms must be
    supported.  Implementations may support other mechanisms as well,
    but the additional mechanisms may only be used when communicating
    with principals known to also support them: This list is to be
    determined and should correspond to section
    6.

    Encryption: DES-CBC-MD5, DES3-CBC-SHA1-KD, RIJNDAEL(decide identifier)
    Checksums: CRC-32, DES-MAC, DES-MAC-K, DES-MD5, HMAC-SHA1-DES3-KD

Obviously, since Rijndael isn't in the draft, it can't be on the list,
but what types should we make requirements for specification 2?

I think we've agreed on triple-DES with key derivation, and
des-cbc-md5 is a good idea because RFC 1510 required it.  Should we
add des-cbc-crc?  It's less secure, but at least in MIT-based
implementations, I suspect it's the most commonly used.

The new description of checksums doesn't even include des-mac or
des-mac-k; they're both considered deprecated.  The others, we're
actually using.

So I'd suggest something like this for required mechanisms:

    Encryption: DES-CBC-MD5, DES3-CBC-SHA1-KD, DES-CBC-CRC(?)
    Checksums: CRC-32, DES-MD5, HMAC-SHA1-DES3-KD

What do people think?

Ken

P.S.  This sort of ignores the issue that some implementations may be
application-specific and targeted for environments where one
cryptosystem is mandated for all cases, and thus code implementing the
others may be unused, even if required to claim conformance....

P.P.S.  I'm also ignoring for the moment other cryptosystems under
discussion for possible addition to kerberos-revisions, such as
des3-md5 and rijndael.