[15541] in Kerberos_V5_Development
Re: krb5-1.8-beta2 is available
daemon@ATHENA.MIT.EDU (Tom Yu)
Fri Feb 26 12:51:12 2010
To: Marcus Watts <mdw@umich.edu>
From: Tom Yu <tlyu@mit.edu>
Date: Fri, 26 Feb 2010 12:50:51 -0500
In-Reply-To: <E1Nl3p5-0002IC-Gd@bruson.ifs.umich.edu> (Marcus Watts's message
of "Fri, 26 Feb 2010 12:17:55 -0500")
Message-ID: <ldveik7sx6s.fsf@cathode-dark-space.mit.edu>
MIME-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Marcus Watts <mdw@umich.edu> writes:
> The README file says
>> variable that enables "weak" enctypes, which now defaults to "false"
>> beginning with krb5-1.8. The krb5-1.8 release includes additional
>> measures to ease the transition away from single-DES.
>
> The README doesn't say what those other measures are.
You're right; we should more obviously state what those measures are.
Off the top of my head:
* enctype config enhancements (so you can do "DEFAULT +des", etc.)
* new API to allow applications (e.g. AFS) to explicitly reenable weak
crypto
* some stuff related to the kadmin history key
Am I missing anything?
> As folks said, you don't have krb5-1.8b1-getprinc.patch.
Thank you for that patch. We are holding it for the 1.8.1 patch
release.
> Things that I'd love to see in some future version of the code,
>
> * a configure option that actually *removes* the single-des
> cryptosystem from the built code (as opposed to merely disabling it).
We considered the related idea of outright removing the code that does
single-DES. Having a configure option to not build the single-DES
code does sound better. It's an awfully big hammer, but I can see why
some sites might want that.
How soon do people think it would be appropriate to add such an
option? (It won't achieve much code size reduction unless it also
removes triple-DES, at least if building the builtin crypto.)
> * python 2.6 support.
By this do you mean API bindings in python? For which APIs?
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
