[33759] in Kerberos
Re: "best" enctype?
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon Aug 15 13:38:08 2011
From: Russ Allbery <rra@stanford.edu>
To: Luke Howard <lukeh@padl.com>
In-Reply-To: <DA83BF4C-0132-467D-8773-170779338962@padl.com> (Luke Howard's
message of "Mon, 15 Aug 2011 15:50:13 +0000")
Date: Mon, 15 Aug 2011 10:38:00 -0700
Message-ID: <87bovqbmo7.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Luke Howard <lukeh@padl.com> writes:
> On 15/08/2011, at 5:27 AM, Chris Hecker wrote:
>> I have a closed system that doesn't need to interoperate with any other
>> kerberos servers. Shuld I just force everything to
>> ENCTYPE_AES256_CTS_HMAC_SHA1_96? Is there a downside to doing this?
> In configuration files, do what you like but -- if you're writing code,
> I would try and be a little more flexible. e.g. you could call
> krb5_get_permitted_enctypes() and select the first (I'm sure Greg will
> have a better idea).
Yes, for configuration it's not a horrible idea, but in your code, if
someone breaks AES and you want to switch to Camellia or something else,
you don't want to have to do code patches.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
