diff options
| author | Ben Kaduk <kaduk@mit.edu> | 2013-05-31 12:40:10 -0400 |
|---|---|---|
| committer | Ben Kaduk <kaduk@mit.edu> | 2013-05-31 13:09:45 -0400 |
| commit | fa6de1bf73926751a2f68bff31ef020eb7db9260 (patch) | |
| tree | 23234bd3f27230cb5f993cfcdc2b85fd7cb9cbb6 /doc | |
| parent | 7425e9b69566c241c54eb2686fb37f216122423f (diff) | |
| download | krb5-fa6de1bf73926751a2f68bff31ef020eb7db9260.tar.gz krb5-fa6de1bf73926751a2f68bff31ef020eb7db9260.tar.xz krb5-fa6de1bf73926751a2f68bff31ef020eb7db9260.zip | |
Clarify retiring-des based on user feedback
Explain why DES keys should be removed from principals, and clarify
that allow_weak_crypto overrides all other configuration.
ticket: 7654 (new)
tags: pullup
target_version: 1.11.4
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/admin/advanced/retiring-des.rst | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/doc/admin/advanced/retiring-des.rst b/doc/admin/advanced/retiring-des.rst index da9d1fcf7a..cbca1b7983 100644 --- a/doc/admin/advanced/retiring-des.rst +++ b/doc/admin/advanced/retiring-des.rst @@ -298,6 +298,19 @@ as new DES keys are still being generated, and will be used if requested by a client. To make more progress removing DES from the realm, the KDC should be configured to not generate such keys by default. +.. note:: + + An attacker posing as a client can implement a brute force attack against + a DES key for any principal, if that key is in the current (highest-kvno) + key list. This attack is only possible if **allow_weak_crypto = true** + is enabled on the KDC. Setting the **+requires_preauth** flag on a + principal forces this attack to be an online attack, much slower than + the offline attack otherwise available to the attacker. However, setting + this flag on a service principal is not always advisable; see the entry in + :ref:`add_principal` for details. + +The following KDC configuration will not generate DES keys by default: + :: [realms] @@ -357,8 +370,11 @@ generate DES keys by default. Entry for principal kaduk@ZONE.MIT.EDU with kvno 3, encryption type des3-cbc-sha1 added to keytab WRFILE:kaduk-zone.keytab. Once all principals have been re-keyed, DES support can be disabled on the -KDC, and client machines can remove **allow_weak_crypto = true** from -their :ref:`krb5.conf(5)` configuration files, completing the migration. +KDC (**allow_weak_crypto = false**), and client machines can remove +**allow_weak_crypto = true** from their :ref:`krb5.conf(5)` configuration +files, completing the migration. **allow_weak_crypto** takes precedence over +all places where DES enctypes could be explicitly configured. DES keys will +not be used, even if they are present, when **allow_weak_crypto = false**. Support for legacy services ~~~~~~~~~~~~~~~~~~~~~~~~~~~ |