From: Greg Hudson Date: Thu, 13 Jul 2017 04:17:20 +0000 (-0400) Subject: (no commit message) X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/commitdiff_plain/10df2f67cff0cbe9d72b011ae08e5e5472108f34?ds=sidebyside --- diff --git a/doc/kerberized-server.mdwn b/doc/kerberized-server.mdwn index a87d552..0231907 100644 --- a/doc/kerberized-server.mdwn +++ b/doc/kerberized-server.mdwn @@ -41,7 +41,7 @@ later add get this file by default.) ## Upgrading cryptographic strength -You may wish to change the encryption algorithms (*enctypes*) included in your keytab. With server principals (like `daemon/servername.mit.edu` or `host/servername.mit.edu`) it is particularly important to support *only* strong algorithms. If you support a weak algorithm, an attacker can request a service ticket encrypted with that key, allowing them to do an offline attack and potentially extract your secret key. +You may wish to change the encryption algorithms (*enctypes*) included in your keytab. With server principals (like `daemon/servername.mit.edu` or `host/servername.mit.edu`) it is particularly important to support *only* strong algorithms. If you support a weak algorithm, an attacker can request an initial ticket encrypted with that key, allowing them to do an offline attack and potentially extract the secret key. To change the supported enctypes, run `kadmin`: