RFC 4757
The RC4-HMAC Kerberos Encryption Types Used by Microsoft Windows
RFC 4757 💖 The RC4-HMAC Kerberos Encryption Types Used by Microsoft Windows
okay bestie, RFC 4757 is literally about the RC4-HMAC Kerberos encryption types that Microsoft Windows uses 🎀✨ It was written by K. Jaganathan, L. Zhu, and J. Brezak, all from Microsoft Corporation, and it came out in the Network Working Group in December 2006. It's Informational, so it's not a standards-track spec 🌸 The title block doesn't list anything it obsoletes or updates, so there's no drama there 💅
Status of This Memo 🦋
this memo is here to give info to the Internet community. it doesn't specify an Internet standard of any kind, and distribution of it is unlimited 🫶
Copyright Notice 🌈
Copyright (C) The IETF Trust (2006).
IESG Note 👑
so this doc describes the RC4 Kerberos encryption types that first showed up in Microsoft Windows 2000 😭 ever since, a bunch of Kerberos implementations have picked them up, and the IETF Kerberos community is cool with publishing it as an informational doc so people can understand this widely used tech 💜 BUT 🙈 these types have enough operations for the base Kerberos spec [RFC4120], and they don't have all the operations the Kerberos cryptography framework [RFC3961] needs. so it's not generally possible to build future Kerberos extensions with them. the Kerberos encryption type negotiation mechanism [RFC4537] is one way to still use those extensions even when a Kerberos setup is running on long-term RC4 keys ✨ and because this spec doesn't implement the operations RFC 3961 requires, plus there are security concerns with RC4 and MD4 (see Section 8), it is not appropriate for the standards track. 💀
Abstract 🍓
Microsoft Windows 2000's Kerberos brought in a new encryption type that's built on the RC4 encryption algorithm and uses an MD5 HMAC for checksums 😭 It's an option alongside the older DES-based encryption types.
the RC4-HMAC encryption types exist to make upgrading existing Windows NT environments easier, give you strong crypto (128-bit key lengths), and give you exportable encryption (it meets United States government export restriction requirements) 🔥 this doc explains how those types are implemented.
Table of Contents 🧚
1. Introduction ....................................................3
1.1. Conventions Used in This Document ..........................3
2. Key Generation ..................................................3
3. Basic Operations ................................................4
4. Checksum Types ..................................................5
5. Encryption Types ................................................6
6. Key Strength Negotiation ........................................8
7. GSS-API Kerberos V5 Mechanism Type ..............................8
7.1. Mechanism Specific Changes .................................8
7.2. GSS-API MIC Semantics ......................................9
7.3. GSS-API WRAP Semantics ....................................11
8. Security Considerations ........................................15
9. IANA Considerations ............................................15
10. Acknowledgements ..............................................15
11. References ....................................................16
11.1. Normative References .....................................16
11.2. Informative References ...................................161. Introduction ✨
okay so Microsoft Windows 2000's Kerberos came with new encryption and checksum types, and there were two reasons 💅 first, 56-bit DES encryption couldn't be exported early in development for export reasons. second, when you upgraded from Windows NT 4.0 to Windows 2000, accounts didn't have the right DES keying material to do standard DES encryption 😭 on top of that, 3DES wasn't exportable when Windows 2000 came out, and the team wanted one flavor of encryption for both US and international products. so, slay, one clean solution.
so there are two new encryption types and one new checksum type in Microsoft Windows 2000 🦋
lowkey important: these cryptosystems aren't meant to be complete, general-purpose Kerberos encryption or checksum systems as defined in [RFC3961]. there's no one-to-one mapping between the operations in this document and the primitives described in [RFC3961] 🙈
1.1. Conventions Used in This Document 🎀
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as described in [RFC2119].
2. Key Generation 🔑
so on upgrade from existing Windows NT domains, user accounts won't have a DES-based key ready to use the DES base encryption types from [RFC4120] and [RFC3961] 😭 the RC4-HMAC key is the same as the existing Windows NT key (the NT Password Hash) for compatibility reasons 🌸 once the account password changes, the DES-based keys get created and maintained. after that, the DES keys are available and DES-based encryption types can be used with Kerberos ✨
the RC4-HMAC string to key function looks like this:
String2Key(password)
K = MD4(UNICODE(password))RC4-HMAC keys are generated from the Windows UNICODE version of the password. each Windows UNICODE character is encoded in little-endian format, 2 octets each. then an MD4 [RFC1320] hash is run on just the UNICODE characters of the password, not including the terminating zero octets 💜
for an account with the password "foo", String2Key("foo") gives you:
0xac, 0x8e, 0x65, 0x7f, 0x83, 0xdf, 0x82, 0xbe,
0xea, 0x5d, 0x43, 0xbd, 0xaf, 0x78, 0x00, 0xcc3. Basic Operations 🍓
the MD5 HMAC function is defined in [RFC2104]. it's used in this encryption type for checksum operations, so check [RFC2104] if you want the details of how it works. in this doc, this function is called HMAC(Key, Data), which returns the checksum using the given key on the data 🦋
the basic MD5 hash operation is used in this encryption type and defined in [RFC1321]. in this doc, it's called MD5(Data), which returns the checksum of the data 🌈
RC4 is a stream cipher licensed by RSA Data Security. in this doc, the function is called RC4(Key, Data), which returns the encrypted data using the given key on the data 💅
these encryption types use key derivation. with each message, the message type (T) is used as part of the keying material 🫶 the list below sums up the key derivation values used in the different operations. these are different from the key derivations used in other Kerberos encryption types, so be careful bestie 🙈 T = the message type, encoded as a little-endian four-byte integer.
- AS-REQ PA-ENC-TIMESTAMP padata timestamp, encrypted with the client key (T=1)
- AS-REP Ticket and TGS-REP Ticket (includes TGS session key or application session key), encrypted with the service key (T=2)
- AS-REP encrypted part (includes TGS session key or application session key), encrypted with the client key (T=8)
- TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with the TGS session key (T=4)
- TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with the TGS authenticator subkey (T=5)
- TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator cksum, keyed with the TGS session key (T=6)
- TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes TGS authenticator subkey), encrypted with the TGS session key T=7)
- TGS-REP encrypted part (includes application session key), encrypted with the TGS session key (T=8)
- TGS-REP encrypted part (includes application session key), encrypted with the TGS authenticator subkey (T=8)
- AP-REQ Authenticator cksum, keyed with the application session key (T=10)
- AP-REQ Authenticator (includes application authenticator subkey), encrypted with the application session key (T=11)
- AP-REP encrypted part (includes application session subkey), encrypted with the application session key (T=12)
- KRB-PRIV encrypted part, encrypted with a key chosen by the application. Also for data encrypted with GSS Wrap (T=13)
- KRB-CRED encrypted part, encrypted with a key chosen by the application (T=14)
- KRB-SAFE cksum, keyed with a key chosen by the application. Also for data signed in GSS MIC (T=15)
relative to the RFC-1964 key uses, these are the T = 0 cases ✨
T = 0 in the generation of sequence number for the MIC token
T = 0 in the generation of sequence number for the WRAP token
T = 0 in the generation of encrypted data for the WRAPPED tokenall strings in this doc are ASCII unless said otherwise. the length of an ASCII-encoded string includes the trailing terminator character (0) 🎀 concat(a,b,c,...) returns the logical concatenation (left to right) of its arguments, and nonce(n) returns a pseudo-random number of "n" octets 🧚
4. Checksum Types 💜
there's one checksum type used in this encryption type. its Kerberos constant is:
#define KERB_CHECKSUM_HMAC_MD5 (-138)the function is defined like this, where K is the Key and T is the message type encoded as a little-endian four-byte integer 🔥
CHKSUM(K, T, data)
Ksign = HMAC(K, "signaturekey") //includes zero octet at end
tmp = MD5(concat(T, data))
CHKSUM = HMAC(Ksign, tmp)5. Encryption Types ✨
okay so there are two encryption types in this part, and they're both giving "old-school but still serving" 💅 The Kerberos constants for them are:
#define KERB_ETYPE_RC4_HMAC 23
#define KERB_ETYPE_RC4_HMAC_EXP 24The basic encryption function works like this 🦋
T = the message type, encoded as a little-endian four-byte integer.
OCTET L40[14] = "fortybits";The header field on the encrypted data in KDC messages looks like this 🎀
typedef struct _RC4_MDx_HEADER {
OCTET Checksum[16];
OCTET Confounder[8];
} RC4_MDx_HEADER, *PRC4_MDx_HEADER;ENCRYPT (K, export, T, data)
{
struct EDATA {
struct HEADER {
OCTET Checksum[16];
OCTET Confounder[8];
} Header;
OCTET Data[0];
} edata;
if (export){
*((DWORD *)(L40+10)) = T;
K1 = HMAC(K, L40); // where the length of L40 in
// octets is 14
}
else
{
K1 = HMAC(K, &T); // where the length of T in octets
// is 4
}
memcpy (K2, K1, 16);
if (export) memset (K1+7, 0xAB, 9);
nonce (edata.Confounder, 8);
memcpy (edata.Data, data);
edata.Checksum = HMAC (K2, edata);
K3 = HMAC (K1, edata.Checksum);
RC4 (K3, edata.Confounder);
RC4 (K3, data.Data);
}DECRYPT (K, export, T, edata)
{
// edata looks like
struct EDATA {
struct HEADER {
OCTET Checksum[16];
OCTET Confounder[8];
} Header;
OCTET Data[0];
} edata;
if (export){
*((DWORD *)(L40+10)) = T;
HMAC (K, L40, 14, K1);
}
else
{
HMAC (K, &T, 4, K1);
}
memcpy (K2, K1, 16);
if (export) memset (K1+7, 0xAB, 9);
K3 = HMAC (K1, edata.Checksum);
RC4 (K3, edata.Confounder);
RC4 (K3, edata.Data);
// verify generated and received checksums
checksum = HMAC (K2, concat(edata.Confounder, edata.Data));
if (checksum != edata.Checksum)
printf("CHECKSUM ERROR !!!!!!\n");
}The KDC message gets encrypted using the ENCRYPT function, but without the Checksum in the RC4_MDx_HEADER. That's the vibe 🫶
The character constant "fortybits" comes from the era when a 40-bit key length was the most you could export from the United States. 🌍 Now it's used to recognize that the key length is of "exportable" length. Fun fact (well, ngl, a slightly awkward one): in this description the key size is actually 56 bits. 🙈
The pseudo-random operation [RFC3961] for both enctypes above is defined as follows:
pseudo-random(K, S) = HMAC-SHA1(K, S)where K is the protocol key and S is the input octet string. HMAC-SHA1 is defined in [RFC2104], and the output of HMAC-SHA1 is the 20-octet digest. ✨
6. Key Strength Negotiation
Kerberos clients and servers can negotiate over key length if they're using mutual authentication. 🤝 If the client can't do full-strength encryption, it may propose a key in the "subkey" field of the authenticator, using a weaker encryption type. Then the server must either return the same key or suggest its own key in the subkey field of the AP reply message. The key used to encrypt data is derived from the key the server returns. 🔑
And if the client can do strong encryption but the server can't, the client may propose a subkey in the AP reply without first being sent a subkey in the authenticator. Plot twist, but make it make sense 💖
7. GSS-API Kerberos V5 Mechanism Type
7.1. Mechanism Specific Changes
The Generic Security Service Application Program Interface (GSS-API) per-message tokens also need new checksum and encryption types. 🧚 The GSS-API per-message tokens get adapted to support these new encryption types. See [RFC1964] Section 1.2.2.
The only supported quality of protection is:
#define GSS_KRB5_INTEG_C_QOP_DEFAULT 0x0When you're using this RC4-based encryption type, the sequence number is always sent in big-endian rather than little-endian order. 🍓
The Windows 2000 implementation also defines new GSS-API flags in the initial token passed when initializing a security context. ✨ These flags get passed in the checksum field of the authenticator. See [RFC1964] Section 1.1.1.
GSS_C_DCE_STYLE: this flag was added for Microsoft's implementation of Distributed Computing Environment Remote Procedure Call (DCE RPC), which initially expected three legs of authentication. 🎀 Setting it causes an extra AP reply to be sent from the client back to the server after the client receives the server's AP reply. The context negotiation tokens also don't have GSS-API per-message tokens. They're raw AP messages that don't include object identifiers.
#define GSS_C_DCE_STYLE 0x1000GSS_C_IDENTIFY_FLAG: this one lets the client tell the server that it should only let the server application identify the client by name and ID, but not impersonate the client. 🕵️♀️
#define GSS_C_IDENTIFY_FLAG 0x2000GSS_C_EXTENDED_ERROR_FLAG: setting this flag means the client wants to be told about extended error information. 🚨 In particular, Windows 2000 status codes may come back in the data field of a Kerberos error message, which helps the client understand a server failure more precisely. The server may also return errors to the client that are normally handled at the application layer in the server, so the client can try to recover. After receiving an error message, the client may attempt to resubmit an AP request. 💪
#define GSS_C_EXTENDED_ERROR_FLAG 0x4000These flags are only used if a client knows about these conventions when using the Security Support Provider Interface (SSPI) on the Windows platform. They're not generally used by default. 🙅♀️
When NetBIOS addresses are used in the GSS-API, they're identified by the GSS_C_AF_NETBIOS value. 🌸 It's defined as:
#define GSS_C_AF_NETBIOS 0x14NetBIOS addresses are 16-octet addresses, typically made of 1 to 15 characters, trailing blank (ASCII char 20) filled, with a 16th octet of 0x0. 🦋
7.2. GSS-API MIC Semantics
The GSS-API checksum type and algorithm are defined in Section 5. 💜 Only the first 8 octets of the checksum are used. The resulting checksum is stored in the SGN_CKSUM field. See [RFC1964] Section 1.2 for GSS_GetMIC() and GSS_Wrap(conf_flag=FALSE).
The GSS_GetMIC token has the following format 👑
Byte no Name Description
0..1 TOK_ID Identification field.
Tokens emitted by GSS_GetMIC() contain
the hex value 01 01 in this field.
2..3 SGN_ALG Integrity algorithm indicator.
11 00 - HMAC
4..7 Filler Contains ff ff ff ff
8..15 SND_SEQ Sequence number field.
16..23 SGN_CKSUM Checksum of "to-be-signed data",
calculated according to algorithm
specified in SGN_ALG field.The MIC mechanism used for GSS-MIC-based messages goes like this 🧠
GetMIC(Kss, direction, export, seq_num, data)
{
struct Token {
struct Header {
OCTET TOK_ID[2];
OCTET SGN_ALG[2];
OCTET Filler[4];
};
OCTET SND_SEQ[8];
OCTET SGN_CKSUM[8];
} Token;
Token.TOK_ID = 01 01;
Token.SGN_SLG = 11 00;
Token.Filler = ff ff ff ff;
// Create the sequence number
if (direction == sender_is_initiator)
{
memset(Token.SEND_SEQ+4, 0xff, 4)
}
else if (direction == sender_is_acceptor)
{
memset(Token.SEND_SEQ+4, 0, 4)
}
Token.SEND_SEQ[0] = (seq_num & 0xff000000) >> 24;
Token.SEND_SEQ[1] = (seq_num & 0x00ff0000) >> 16;
Token.SEND_SEQ[2] = (seq_num & 0x0000ff00) >> 8;
Token.SEND_SEQ[3] = (seq_num & 0x000000ff);
// Derive signing key from session key
Ksign = HMAC(Kss, "signaturekey");
// length includes terminating null
// Generate checksum of message - SGN_CKSUM
// Key derivation salt = 15
Sgn_Cksum = MD5((int32)15, Token.Header, data);
// Save first 8 octets of HMAC Sgn_Cksum
Sgn_Cksum = HMAC(Ksign, Sgn_Cksum);
memcpy(Token.SGN_CKSUM, Sgn_Cksum, 8);
// Encrypt the sequence number
// Derive encryption key for the sequence number
// Key derivation salt = 0
if (exportable)
{
Kseq = HMAC(Kss, "fortybits", (int32)0);
// len includes terminating null
memset(Kseq+7, 0xab, 7)
}
else
{
Kseq = HMAC(Kss, (int32)0);
}
Kseq = HMAC(Kseq, Token.SGN_CKSUM);
// Encrypt the sequence number
RC4(Kseq, Token.SND_SEQ);
}7.3. GSS-API WRAP Semantics
There are two encryption keys for GSS-API message tokens: one that's 128 bits in strength and one that's 56 bits in strength, as defined in Section 6. 🔐
All padding is rounded up to 1 byte. One byte is needed to say that there is 1 byte of padding. 😌 The DES-based mechanism type uses 8-byte padding. See [RFC1964] Section 1.2.2.3.
The RC4-HMAC GSS_Wrap() token has the following format ✨
Byte no Name Description
0..1 TOK_ID Identification field.
Tokens emitted by GSS_Wrap() contain
the hex value 02 01 in this field.
2..3 SGN_ALG Checksum algorithm indicator.
11 00 - HMAC
4..5 SEAL_ALG ff ff - none
00 00 - DES-CBC
10 00 - RC4
6..7 Filler Contains ff ff
8..15 SND_SEQ Encrypted sequence number field.
16..23 SGN_CKSUM Checksum of plaintext padded data,
calculated according to algorithm
specified in SGN_ALG field.
24..31 Confounder Random confounder.
32..last Data Encrypted or plaintext padded data.The encryption mechanism used for GSS-wrap-based messages is as follows:
WRAP(Kss, encrypt, direction, export, seq_num, data)
{
struct Token { // 32 octets
struct Header {
OCTET TOK_ID[2];
OCTET SGN_ALG[2];
OCTET SEAL_ALG[2];
OCTET Filler[2];
};
OCTET SND_SEQ[8];
OCTET SGN_CKSUM[8];
OCTET Confounder[8];
} Token;
Token.TOK_ID = 02 01;
Token.SGN_SLG = 11 00;
Token.SEAL_ALG = (no_encrypt)? ff ff : 10 00;
Token.Filler = ff ff;
// Create the sequence number
if (direction == sender_is_initiator)
{
memset(&Token.SEND_SEQ[4], 0xff, 4)
}
else if (direction == sender_is_acceptor)
{
memset(&Token.SEND_SEQ[4], 0, 4)
}
Token.SEND_SEQ[0] = (seq_num & 0xff000000) >> 24;
Token.SEND_SEQ[1] = (seq_num & 0x00ff0000) >> 16;
Token.SEND_SEQ[2] = (seq_num & 0x0000ff00) >> 8;
Token.SEND_SEQ[3] = (seq_num & 0x000000ff);
// Generate random confounder
nonce(&Token.Confounder, 8);
// Derive signing key from session key
Ksign = HMAC(Kss, "signaturekey");
// Generate checksum of message -
// SGN_CKSUM + Token.Confounder
// Key derivation salt = 15
Sgn_Cksum = MD5((int32)15, Token.Header,
Token.Confounder);
// Derive encryption key for data
// Key derivation salt = 0
for (i = 0; i < 16; i++) Klocal[i] = Kss[i] ^ 0xF0;
// XOR
if (exportable)
{
Kcrypt = HMAC(Klocal, "fortybits", (int32)0);
// len includes terminating null
memset(Kcrypt+7, 0xab, 7);
}
else
{
Kcrypt = HMAC(Klocal, (int32)0);
}
// new encryption key salted with seq
Kcrypt = HMAC(Kcrypt, (int32)seq);
// Encrypt confounder (if encrypting)
if (encrypt)
RC4(Kcrypt, Token.Confounder);
// Sum the data buffer
Sgn_Cksum += MD5(data); // Append to checksum
// Encrypt the data (if encrypting)
if (encrypt)
RC4(Kcrypt, data);
// Save first 8 octets of HMAC Sgn_Cksum
Sgn_Cksum = HMAC(Ksign, Sgn_Cksum);
memcpy(Token.SGN_CKSUM, Sgn_Cksum, 8);
// Derive encryption key for the sequence number
// Key derivation salt = 0
if (exportable)
{
Kseq = HMAC(Kss, "fortybits", (int32)0);
// len includes terminating null
memset(Kseq+7, 0xab, 7)
}
else
{
Kseq = HMAC(Kss, (int32)0);
}
Kseq = HMAC(Kseq, Token.SGN_CKSUM);
// Encrypt the sequence number
RC4(Kseq, Token.SND_SEQ);
// Encrypted message = Token + Data
}The character constant "fortybits" is a bit of history 🕰️ It came from the time when a 40-bit key length was all the US would let you export 🇺🇸 Now it just flags that the key is of "exportable" length. ngl the actual key size in this description is 56 bits 🔑✨
8. Security Considerations ✨
Okay bestie, this part is serious 🫶 These encryption types use a stream cipher, so you have to be careful. If you don't use a different IV in each direction when you're working with a session key, the encryption is weak 💀 Using the sequence number as the IV fixes that. Slay.
There are two classes of attack on RC4 described in [MIRONOV]. Strong distinguishers can tell an RC4 keystream apart from randomness at the start of the stream. Weak distinguishers can work on any part of the keystream, and the best ones, described in [FMcG] and [MANTIN05], can use data from multiple, different keystreams 😭 So, if you encrypt the same data (like a password) enough times in separate RC4 keystreams, an adversary can end up leaking information. Scary! The encryption types in this document defend against that by building a brand new keystream for every message 🛡️ Still, it is RECOMMENDED not to use the RC4 encryption types defined in this document for high-volume connections. 🙈
Weaknesses in MD4 [BOER91] were shown by den Boer and Bosselaers in 1991. In August 2004, Xiaoyun Wang, et al., reported MD4 collisions made by hand calculation [WANG04]. Implementations based on Wang's algorithm can find collisions in real time 💀 But the way this document uses MD4 doesn't rely on MD4's collision resistance. Also, MD4 is always used inside a keyed hash here. No evidence has suggested keyed MD4 hashes are vulnerable to collision-based attacks, but no study has directly proved that HMAC-MD4 is secure. The existing study just assumed the hash function used in HMAC is collision proof. So it is RECOMMENDED not to use the RC4 encryption types defined in this document if stronger options, like aes256-cts-hmac-sha1-96 [RFC3962], are available. Pick the stronger one when you can, periodt 💅🔥
9. IANA Considerations ✨
Section 5 of this document defines two Kerberos encryption types: rc4-hmac (23) and rc4-hmac-exp (24) 🎀 The Kerberos parameters registration page at <http://www.iana.org/assignments/kerberos-parameters> has been updated to reference this document for these two encryption types.
10. Acknowledgements ✨
The authors wanted to thank Sam Hartman, Ken Raeburn, and Qunli Li for their insightful comments 🫶🌸
11. References ✨
11.1. Normative References
- [RFC1320] Rivest, R., "The MD4 Message-Digest Algorithm", RFC 1320, April 1992.
- [RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April 1992.
- [RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", RFC 1964, June 1996.
- [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC3961] Raeburn, K., "Encryption and Checksum Specifications for Kerberos 5", RFC 3961, February 2005.
- [RFC3962] Raeburn, K., "Advanced Encryption Standard (AES) Encryption for Kerberos 5", RFC 3962, February 2005.
- [RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The Kerberos Network Authentication Service (V5)", RFC 4120, July 2005.
- [RFC4537] Zhu, L., Leach, P., and K. Jaganathan, "Kerberos Cryptosystem Negotiation Extension", RFC 4537, June 2006.
11.2. Informative References
- [BOER91] den Boer, B. and A. Bosselaers, "An Attack on the Last Two Rounds of MD4", Proceedings of the 11th Annual International Cryptology Conference on Advances in Cryptology, pages: 194 - 203, 1991.
- [FMcG] Fluhrer, S. and D. McGrew, "Statistical Analysis of the Alleged RC4 Keystream Generator", Fast Software Encryption: 7th International Workshop, FSE 2000, April 2000,
<http://www.mindspring.com/~dmcgrew/rc4-03.pdf>. - [MANTIN05] Mantin, I., "Predicting and Distinguishing Attacks on RC4 Keystream Generator", Advances in Cryptology -- EUROCRYPT 2005: 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, May 2005.
- [MIRONOV] Mironov, I., "(Not So) Random Shuffles of RC4", Advances in Cryptology -- CRYPTO 2002: 22nd Annual International Cryptology Conference, August 2002,
<http://eprint.iacr.org/2002/067.pdf>. - [WANG04] Wang, X., Lai, X., Feng, D., Chen, H., and X. Yu, "Cryptanalysis of Hash functions MD4 and RIPEMD", August 2004,
<http://www.infosec.sdu.edu.cn/paper/md4-ripemd-attck.pdf>.
Authors' Addresses
- Karthik Jaganathan, Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, US. EMail: karthikj@microsoft.com
- Larry Zhu, Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, US. EMail: lzhu@microsoft.com
- John Brezak, Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, US. EMail: jbrezak@microsoft.com
Full Copyright Statement
Copyright (C) The IETF Trust (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST, AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the Internet Society. 💜
📦 where this page comes from
- ietf: rfc4757 2006-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms