X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/blobdiff_plain/83038ab3f26a53b81b01f408ac38d49905cb12e9..bd76670e508833f45c28b48be5c036a176bf642e:/doc/kerberized-server.mdwn

diff --git a/doc/kerberized-server.mdwn b/doc/kerberized-server.mdwn
index 763f8ea..0231907 100644
--- a/doc/kerberized-server.mdwn
+++ b/doc/kerberized-server.mdwn
@@ -15,7 +15,7 @@ and then **set a new (random) key**.
     # k5srvutil change
     # k5srvutil delold
 
-Note that the `k5srvutil` command will also generate keys for the DES and RC4 ciphers, which are considered weak.
+Note that the `k5srvutil` command will also generate keys for the 3DES and RC4 ciphers, which are considered weak.
 You are strongly advised to read the "Upgrading cryptographic strength" section below on how to generate only AES keys instead.
 
 If you're using Debathena, you can install the `debathena-ssh-server-config` package to configure Kerberos authentication on the server side. If not, make sure your `/etc/ssh/sshd_config` file includes the lines
@@ -41,7 +41,7 @@ later add get this file by default.)
 
 ## Upgrading cryptographic strength
 
-You may wish to change the encryption algorithms (*enctypes*) included in your keytab. With server principals (like `daemon/servername.mit.edu` or `host/servername.mit.edu`) it is particularly important to support *only* strong algorithms. If you support a weak algorithm, an attacker can request a service ticket encrypted with that key, allowing them to do an offline attack and potentially extract your secret key.
+You may wish to change the encryption algorithms (*enctypes*) included in your keytab. With server principals (like `daemon/servername.mit.edu` or `host/servername.mit.edu`) it is particularly important to support *only* strong algorithms. If you support a weak algorithm, an attacker can request an initial ticket encrypted with that key, allowing them to do an offline attack and potentially extract the secret key.
 
 To change the supported enctypes, run `kadmin`: