Kerberos supports several types of encryption for securing session keys and the tickets. The type used for a particular ticket or session key is automatically negotiated when you request a ticket or a service.
| How to... | Learn about... |
|---|---|
In the table of Encryption Types below, some encryption types are noted as weak. Most of them are encryption types that used to be strong but now, with more computing power available, are considered weak and therefore undesirable. However, they are still sometimes used for backwards compatibility. If Kerberos is installed in a network that contains some older machines running operating systems that do not support the newer encryption types, administrators can choose to allow the weaker encryption when connecting to the older machines.
| Encryption Type | Description |
|---|---|
| des- | The DES (Data Encryption Standard)
family is a symmetric block cipher. It was designed to handle only
56-bit keys which is not enough for modern computing power. It is now
considered to be weak encryption.
|
| des3- | The triple DES family improves on
the original DES (Data Encryption Standard) by using 3 separate 56-bit
keys. Some modes of 3DES are considered weak while others are strong
(if slow).
|
| aes | The AES Advanced Encryption Standard
family, like DES and 3DES, is a symmetric block cipher and was designed
to replace them. It can use multiple key sizes. Kerberos specifies use
for 256-bit and 128-bit keys.
|
| rc4 or arcfour |
The RC4 (Rivest Cipher 4) is a symmetric stream cipher that can use
multiple key sizes. The exportable variations are considered weak, but
other variations are strong.
|