[33758] in Kerberos
Re: "best" enctype?
daemon@ATHENA.MIT.EDU (Luke Howard)
Mon Aug 15 11:50:43 2011
Mime-Version: 1.0 (Apple Message framework v1244.3)
From: Luke Howard <lukeh@padl.com>
In-Reply-To: <4E48AE33.6060802@d6.com>
Date: Mon, 15 Aug 2011 15:50:13 +0000
Message-Id: <DA83BF4C-0132-467D-8773-170779338962@padl.com>
To: Chris Hecker <checker@d6.com>
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 15/08/2011, at 5:27 AM, Chris Hecker wrote:
>
> I have a closed system that doesn't need to interoperate with any other
> kerberos servers. Shuld I just force everything to
> ENCTYPE_AES256_CTS_HMAC_SHA1_96? Is there a downside to doing this?
In configuration files, do what you like but -- if you're writing code, I would try and be a little more flexible. e.g. you could call krb5_get_permitted_enctypes() and select the first (I'm sure Greg will have a better idea).
-- Luke
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
