Node: Supported Encryption Types, Next: Salts, Previous: Configuration Files, Up: Configuration Files
Any tag in the configuration files which requires a list of encryption types can be set to some combination of the following strings.
des-cbc-crc
des-cbc-md4
des-cbc-md5
des3-cbc-sha1
des3-hmac-sha1
des3-cbc-sha1-kd
des-hmac-sha1
aes256-cts-hmac-sha1-96
aes256-cts
aes128-cts-hmac-sha1-96
aes128-cts
arcfour-hmac
rc4-hmac
arcfour-hmac-md5
arcfour-hmac-exp
rc4-hmac-exp
arcfour-hmac-md5-exp
While aes128-cts and aes256-cts are supported for all Kerberos operations, they are not supported by the GSSAPI. AES GSSAPI support will be added after the necessary standardization work is completed.
By default, AES is enabled on clients and application servers. Because of the lack of support for GSSAPI, AES is disabled in the default KDC supported_enctypes kdc.conf. Sites wishing to use AES encryption types on their KDCs need to be careful not to give GSSAPI services AES keys. If GSSAPI services are given AES keys, then services will start to fail in the future when clients supporting AES for GSSAPI are deployed before updated servers that support AES for GSSAPI. Sites may wish to use AES for user keys and for the ticket granting ticket key, although doing so requires specifying what encryption types are used as each principal is created. Alternatively sites can use the default configuration which will make AES support available in clients and servers but not actually use this support until a future version of Kerberos adds support to GSSAPI.