RFC 8429
Deprecate Triple-DES (3DES) and RC4 in Kerberos
Deprecate Triple-DES (3DES) and RC4 in Kerberos 🎀
Okay bestie, so this is RFC 8429, titled Deprecate Triple-DES (3DES) and RC4 in Kerberos 💅. It was written by B. Kaduk (Akamai) and M. Short (Microsoft Corporation) in October 2018, and it's a Best Current Practice, so it's BCP 218 👑. It updates RFC 3961 and RFC 4120 🦋. It doesn't obsolete anything, but it does move RFC 4757 to Historic status. The ISSN is 2070-1721 ✨.
Abstract ✨
Triple-DES (3DES) and RC4 are slowly getting weaker cryptographically, so it's time to start deprecating them in Kerberos 🥀. RFC 4757 gets moved to Historic status because none of the encryption types it specifies should be used anymore 🙈. RFC 3961 gets updated to note that the triple-DES encryption types are deprecated, and RFC 4120 gets updated to drop the recommendation to implement triple-DES encryption and checksum types 💜.
Status of This Memo
This memo documents an Internet Best Current Practice 🌸.
This document comes from the Internet Engineering Task Force (IETF) 🧚. It represents the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG) ✨. More info on BCPs is in Section 2 of RFC 7841 💅.
For the current status of this document, any errata, and how to send feedback, check https://www.rfc-editor.org/info/rfc8429 🔥.
Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved 🌈.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the date this document was published 📜. Please actually read these carefully, bestie, because they spell out your rights and restrictions for this document 🫶. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 💖.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Requirements Notation . . . . . . . . . . . . . . . . . . . . 3
3. Affected Specifications . . . . . . . . . . . . . . . . . . . 3
4. Affected Encryption Types . . . . . . . . . . . . . . . . . . 4
5. RC4 Weakness . . . . . . . . . . . . . . . . . . . . . . . . 4
5.1. Statistical Biases . . . . . . . . . . . . . . . . . . . 4
5.2. Password Hash . . . . . . . . . . . . . . . . . . . . . . 5
5.3. Cross-Protocol Key Reuse . . . . . . . . . . . . . . . . 5
5.4. Interoperability Concerns . . . . . . . . . . . . . . . . 6
6. Triple-DES Weakness . . . . . . . . . . . . . . . . . . . . . 6
6.1. Password-Based Keys . . . . . . . . . . . . . . . . . . . 7
6.2. Block Size . . . . . . . . . . . . . . . . . . . . . . . 7
6.3. Interoperability Concerns . . . . . . . . . . . . . . . . 7
7. Recommendations . . . . . . . . . . . . . . . . . . . . . . . 8
8. Security Considerations . . . . . . . . . . . . . . . . . . . 8
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
10.1. Normative References . . . . . . . . . . . . . . . . . . 9
10.2. Informative References . . . . . . . . . . . . . . . . . 9
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 10
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 101. Introduction ✨
Okay so the triple-DES (3DES) and RC4 encryption types (enctypes) are getting steadily weaker cryptographically, which means the deprecation process should start for their use in Kerberos 🥺. That's why RFC 4757 is moving to Historic status, since none of the encryption types it specifies should be used 💀. RFC 3961 is updated to note that the triple-DES encryption types are deprecated 🍓. RFC 4120 also gets updated to remove the recommendation to implement triple-DES encryption and checksum types 🌸.
2. Requirements Notation 🦋
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 🎀.
3. Affected Specifications 🧚
The RC4 Kerberos encryption types (including rc4-hmac) are specified in [RFC4757], which has been moved to Historic status 🍂.
The des3-cbc-sha1-kd encryption type is specified in [RFC3961] 💜. There are also extra triple-DES encryption type codepoints that are in use and listed in the IANA registry, but they don't have a formal specification. The big ones are des3-cbc-md5 and des3-cbc-sha1 👀. These unspecified encryption types are deprecated by this document too 🙅♀️.
The Kerberos specification ([RFC4120]) includes recommendations for which encryption and checksum types to implement, and the deprecated encryption and checksum types are now disrecommended to implement 🌈.
Now, the RC4 and triple-DES encryption types are still being used in some deployments, but these status changes are made to discourage their use 🫶.
4. Affected Encryption Types 💅
The following encryption types are deprecated. The numbers are the official identifiers, and the names are just for convenience 🔥.
+----------------+--------------------------+
| enctype number | enctype convenience name |
+----------------+--------------------------+
| 5 | des3-cbc-md5 |
| | |
| 7 | des3-cbc-sha1 |
| | |
| 16 | des3-cbc-sha1-kd |
| | |
| 23 | rc4-hmac |
+----------------+--------------------------+5. RC4 Weakness 🥀
So RC4's weakness as a TLS cipher, which comes from statistical biases in the keystream, is already super well publicized [RFC7465], and those biases are a real concern for anyone using the RC4 cipher 😭. BUT the RC4 Kerberos enctypes have extra flaws on top of that 💀. These flaws reduce the security of applications that use the enctypes. The weakening happens for a few reasons: the weakness of the password hashing algorithm, the reuse of key material across protocols, and the lack of a salt when hashing the password 🙈.
5.1. Statistical Biases 🌸
The RC4 stream cipher is known to have statistical biases in its output, and those have led to practical attacks against protocols like TLS that use RC4 [RFC7465] 🧐. At least some of these attacks depend on repeated encryptions of thousands of copies of the same plaintext. It's easy for malicious javascript on a website to cause that kind of traffic, but it's unclear whether there's an easy way to get a kerberized application to generate those repeated encryptions 👀. The statistical biases are strongest in the earlier bits of the output stream. That's somewhat mitigated by the confounder used in Kerberos messages, since the first 64 bits of plaintext are a random confounder and are therefore no use to an attacker who can retrieve them 🎀.
Still, the statistical biases in the RC4 keystream extend well past 64 bits and give an attacker potential attack surface 😬. Continuing to use a known weak algorithm just invites more attacks to get developed 🥲.
5.2. Password Hash 🔐
Kerberos long-term keys can be either random (like the ones that might live in a service's keytab) or derived from a password (like for individual users logging into a system) 🧚. A Kerberos encryption type's specification must include a "string2key" algorithm for generating a raw crypto key from a string (aka a password) 📜. Modern encryption types, like the ones using the AES and Camellia block ciphers, use a string2key function based on the Password-Based Key Derivation Function 2 (PBKDF2) algorithm. This algorithm does a bunch of iterations of a cryptographic hash function, and it's designed to make brute-force password guessing way more expensive 💪. There's also an option to specify a higher iteration count for a given principal, which gives some wiggle room as computing power goes up 🌟.
It's also best practice, when deriving cryptographic secrets from user passwords, to feed the hash function a value that's unique to both the user and the realm of authentication. That user-specific input is called a "salt" 🧂. The default salt for Kerberos principals includes both the principal's name and the realm's name, which follows those best practices 💖. However, the RC4 encryption types ignore the salt input to the string2key function. The function itself is a single iteration of the MD4 hash function applied to the UTF-16 encoded password, with no salt at all 😱. MD4 is really old, and it's considered weak and unsuitable for new cryptographic applications at this time [RFC6150] 🥀.
No salt in the hash is contrary to cryptographic best practices, and it lets an attacker build a "rainbow table" of password hashes. Those tables apply to all principals in all Kerberos realms 🌈. With how many poor-quality, user-picked passwords are out there, a rainbow table built from a database of common passwords would probably be able to compromise a sizable number of Kerberos principals in any realm that uses RC4 encryption types for password-derived keys 💀.
5.3. Cross-Protocol Key Reuse 🔁
The unsalted MD4 choice for the Kerberos string2key function was deliberate 🫠. It let systems get converted in-place from the old NT LAN Manager (NTLM) logon protocol [MS-NLMP] over to Kerberos ✨.
Unfortunately, there are still systems using NTLM for authentication to applications, and that can end up with application servers holding the NT password hash of user passwords 😩. Because the RC4 string2key function was picked to be compatible with the NTLM scheme, those application servers also hold the long-term Kerberos key for those users, even though they don't know the password 🙃. Reusing that long-term key/password hash across protocols was convenient for migrating to Kerberos, but it's now a vulnerability in Kerberos as long as NTLM is still being used 🔥.
5.4. Interoperability Concerns
okay so the RC4 Kerberos enctype is still hanging around in loads of environments bc of interop stuff 😭🫶 in those sites RC4 is the strongest enctype that still lets two parties talk Kerberos to each other. the Kerberos stuff shipped with Windows XP and Windows Server 2003 only supports single-DES and RC4 💀 and single-DES is deprecated [RFC6649], so machines on those OSes have to use RC4. no cap, that's a lot 🙈
similarly, some cross-realm setups had their cross-realm key set up back when one side only spoke RC4, or machines that only do RC4 still need to grab a cross-realm Ticket-Granting Ticket. it's hard to inventory every client in a realm and know what implementations those client principals run, so people worry that turning RC4 off will break some machine the realm admins don't even know about 😬
fortunately, modern (i.e., supported) Kerberos implementations have a secure alternative to RC4: AES ✨ Windows has supported AES since 2007-2008 with Windows Vista and Server 2008 💖 MIT Kerberos [MITKRB5] has fully supported AES enctypes since 2004 with version 1.3.2, including the Kerberos mechanism for the Generic Security Service Application Program Interface (GSSAPI) 🦋 Heimdal [HEIMDAL] has fully supported AES since 2005 with version 0.7 🌸 yes, there may still be issues running ten-year-old unsupported software alongside new stuff, but those kinds of issues don't seem unique to Kerberos, and the admins in those environments are expected to be capable of devising workarounds 🧚
6. Triple-DES Weakness
triple-DES for Kerberos isn't as cooked as RC4 🥲 but there's still plenty of reason to deprecate it 💅 same as the RC4 enctypes, the string2key algorithm is weak. also, the triple-DES enctypes weren't implemented in every Kerberos implementation, and the 64-bit block size may be problematic in some environments 🍓
6.1. Password-Based Keys
the n-fold-based string2key function used by the des3-cbc-sha1-kd enctype is an ad hoc construction that should not be considered cryptographically sound 💀 it's known to not provide effective mixing of the input bits and is computationally easy to evaluate 😭 so it doesn't slow down brute-force attacks the way the computationally demanding PBKDF2 algorithm used by more modern enctypes does. the salt is used by des3-cbc-sha1-kd's string2key function, unlike RC4, but a brute-force dictionary attack on common passwords may still be feasible 🙈
6.2. Block Size
triple-DES is based on the single-DES primitive, it just adds extra key material and nested encryption ✨ so it inherits the 64-bit cipher block size from single-DES 💅 that means an attacker who can collect approximately 2**32 blocks of ciphertext has a good chance of finding a cipher block collision (the "birthday attack"), which could reveal a couple of blocks of plaintext 😳
a cipher block collision wouldn't necessarily leak the key itself, so the plaintext it reveals would be limited. for some sites, that may be an acceptable risk, but it's still considered a weakness in the enctype 🫠
6.3. Interoperability Concerns
the triple-DES enctypes were implemented by MIT Kerberos super early (ca. 1999) and were present in the 1.2 release, but they got superseded when enctypes 17 and 18 (AES) were implemented (by 2003) 🕰️ the AES enctypes were in the 1.3 release. Heimdal also had a version of triple-DES in 1999 (the GSSAPI bits stayed non-interoperable with MIT for a while after that), and it got AES support in 2005 with its 0.7 release 🌈 both Heimdal and MIT krb5 have supported the AES enctypes for some 12 years, so it's expected that deployments supporting triple-DES but not AES are quite rare 🦋
the Kerberos implementation in Microsoft Windows has never implemented the triple-DES enctype 🙅 AES showed up with Windows Vista and Windows Server 2008, and older stuff like Windows XP and Windows Server 2003 only did the RC4 and single-DES enctypes 💀
triple-DES is very slow for encryption, especially compared to AES using the hardware acceleration in modern CPUs 🐢 there are no areas where triple-DES has advantages over other enctypes, except in the rare case where AES isn't available 🫶
7. Recommendations
okay this is the part where we clean house 🧹 this document hereby removes the following RECOMMENDED types from [RFC4120]:
Encryption: DES3-CBC-SHA1-KD
Checksum: HMAC-SHA1-DES3-KDKerberos implementations and deployments SHOULD NOT implement or deploy the following triple-DES encryption types: DES3-CBC-MD5(5), DES3-CBC-SHA1(7), and DES3-CBC-SHA1-KD(16) (updates [RFC3961] and [RFC4120]) 🚫
Kerberos implementations and deployments SHOULD NOT implement or deploy the RC4 encryption type RC4-HMAC(23) 🚫
Kerberos implementations and deployments SHOULD NOT implement or deploy the following checksum types: RSA-MD5(7), RSA-MD5-DES3(9), HMAC-SHA1-DES3-KD(12), and HMAC-SHA1-DES3(13) (updates [RFC3961] and [RFC4120]) 🚫
Kerberos GSS mechanism implementations and deployments SHOULD NOT implement or deploy the following SGN_ALGs: HMAC MD5(1100) and HMAC SHA1 DES3 KD(0400). (With all its content now deprecated, [RFC4757] has been made Historic by this document.) 🪦
Kerberos GSS mechanism implementations and deployments SHOULD NOT implement or deploy the following SEAL_ALGs: RC4(1000) and DES3KD(0200) 🚫
per this document, [RFC4757] has been reclassified as Historic 🪦
8. Security Considerations
🔒 this whole document is literally about security. the use of the triple-DES and RC4 Kerberos encryption types is not secure, and they should not be used. no exceptions, bestie 💀
9. IANA Considerations
IANA has updated the "Kerberos Encryption Type Numbers" registry [IANA-KRB] to note that 1) encryption types 1, 2, 3, and 24 are deprecated, with [RFC6649] as the reference and that 2) encryption types 5, 7, 16, and 23 are deprecated, with this document as the reference 📋✨
similarly, IANA has updated the "Kerberos Checksum Type Numbers" registry [IANA-KRB] to note that 1) checksum type values 1, 2, 3, 4, 5, 6, and 8 are deprecated, with [RFC6649] as the reference, and that 2) checksum type values 7, 12, and 13 are deprecated, with this document as the reference 📋💅
10. References
10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3961] Raeburn, K., "Encryption and Checksum Specifications for
Kerberos 5", RFC 3961, DOI 10.17487/RFC3961, February
2005, <https://www.rfc-editor.org/info/rfc3961>.
[RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
Kerberos Network Authentication Service (V5)", RFC 4120,
DOI 10.17487/RFC4120, July 2005,
<https://www.rfc-editor.org/info/rfc4120>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.10.2. Informative References
[HEIMDAL] Heimdal Project, "The Heimdal Kerberos 5, PKIX, CMS, GSS-
API, SPNEGO, NTLM, Digest-MD5 and, SASL implementation",
<https://www.h5l.org/>.
[IANA-KRB]
IANA, "Kerberos Parameters",
<https://www.iana.org/assignments/kerberos-parameters/>.
[MITKRB5] MIT, "Kerberos: The Network Authentication Protocol",
<https://web.mit.edu/kerberos/>.
[MS-NLMP] Microsoft Corporation, "[MS-NLMP]: NT LAN Manager (NTLM)
Authentication Protocol", September 2017,
<https://msdn.microsoft.com/en-us/library/cc236621.aspx>.
[RFC4757] Jaganathan, K., Zhu, L., and J. Brezak, "The RC4-HMAC
Kerberos Encryption Types Used by Microsoft Windows",
RFC 4757, DOI 10.17487/RFC4757, December 2006,
<https://www.rfc-editor.org/info/rfc4757>.
[RFC6150] Turner, S. and L. Chen, "MD4 to Historic Status",
RFC 6150, DOI 10.17487/RFC6150, March 2011,
<https://www.rfc-editor.org/info/rfc6150>.
[RFC6649] Hornquist Astrand, L. and T. Yu, "Deprecate DES, RC4-HMAC-
EXP, and Other Weak Cryptographic Algorithms in Kerberos",
BCP 179, RFC 6649, DOI 10.17487/RFC6649, July 2012,
<https://www.rfc-editor.org/info/rfc6649>.
[RFC7465] Popov, A., "Prohibiting RC4 Cipher Suites", RFC 7465,
DOI 10.17487/RFC7465, February 2015,
<https://www.rfc-editor.org/info/rfc7465>.Acknowledgements
so many people have helped us understand how weak these enctypes are over the years 🫶 there are way too many of them to name here, but you know who you are 💖
Authors' Addresses
Benjamin Kaduk
Akamai Technologies
Email: kaduk@mit.edu
Michiko Short
Microsoft Corporation
Email: michikos@microsoft.comthat's the whole RFC, bestie 🌈✨
📦 where this page comes from
- ietf: rfc8429 2018-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms