Projects/Disable DES - Revision history

Ghudson at 17:27, 12 October 2010

2010-10-12T17:27:31Z

TomYu: more details; more knobs

2009-01-30T22:37:48Z

more details; more knobs

TomYu: move "future work" to a separate project

2009-01-29T18:36:41Z

move "future work" to a separate project

TomYu at 02:01, 29 January 2009

2009-01-29T02:01:42Z

TomYu at 01:39, 27 January 2009

2009-01-27T01:39:31Z

TomYu: New page: {{project-early}} This project will disable the single-DES encryption algorithms by default. A future (post-1.7) release will remove the code that supports single-DES. In order to make t...

2009-01-21T01:54:30Z

New page: {{project-early}} This project will disable the single-DES encryption algorithms by default. A future (post-1.7) release will remove the code that supports single-DES. In order to make t...

New page

{{project-early}}
This project will disable the single-DES encryption algorithms by default. A future (post-1.7) release will remove the code that supports single-DES.

In order to make this more future-proof, the configuration of enctypes will be enhanced to allow for inclusions and exclusions, e.g.

<pre>
permitted_enctypes = DEFAULT +des-cbc-crc
</pre>

or
<pre>
permitted_enctypes = DEFAULT -arcfour-hmac
</pre>

where <code>DEFAULT</code> designates the default set of enctypes.

Not included are facilities to enable or disable groups of enctypes, e.g. all DES-based enctypes. That will be a separate project.

← Older revision		Revision as of 17:27, 12 October 2010
Line 1:		Line 1:
−	{{project-~~review~~\|~~2009-02-13~~}}	+	{{project-rel\|1.8}}

	The single-DES cipher is now widely recognized as being weak. (See RFC 4772 among others.) A future (post-1.7) release will remove the code that supports single-DES enctypes. To prepare for this future change, methods of disabling the use of single-DES enctypes must be available before then, in addition to other transition strategies. Mailing list discussion implies that using a single switch is to coarse for orderly transition, but there also should not be too many new knobs. Implementation timeline is the krb5-1.7 release.		The single-DES cipher is now widely recognized as being weak. (See RFC 4772 among others.) A future (post-1.7) release will remove the code that supports single-DES enctypes. To prepare for this future change, methods of disabling the use of single-DES enctypes must be available before then, in addition to other transition strategies. Mailing list discussion implies that using a single switch is to coarse for orderly transition, but there also should not be too many new knobs. Implementation timeline is the krb5-1.7 release.

@@ Line 1: / Line 1: @@
 {{project-review|2009-02-13}}
 A future project, [[Projects/Enctype_config_enhancements|enctype config enhancements]], will make it possible to implement this sort of enctype policy in a more generalized way.
 ==Review==

← Older revision		Revision as of 18:36, 29 January 2009
Line 4:		Line 4:
	For now, the '''allow_weak_crypto''' libdefault boolean (which aligns with Heimdal) will control whether "weak" crypto is allowed. The crypto library will gain an internal API, krb5_c_weak_enctype(), which will indicate whether a given enctype is "weak". The krb5_keytypes structure will have a flags word that will contain a bit indicating whether a given enctype is weak.		For now, the '''allow_weak_crypto''' libdefault boolean (which aligns with Heimdal) will control whether "weak" crypto is allowed. The crypto library will gain an internal API, krb5_c_weak_enctype(), which will indicate whether a given enctype is "weak". The krb5_keytypes structure will have a flags word that will contain a bit indicating whether a given enctype is weak.

−	In the future, in a separate project, in order to make this more future-proof, the configuration of enctypes will be enhanced to allow for inclusions and exclusions, e.g.
		+	A future project, [[Projects/Enctype_config_enhancements\|enctype config enhancements]], will make it possible to implement this sort of enctype policy in a more generalized way.
−
−	<pre>
−	permitted_enctypes = DEFAULT +des-cbc-crc
−	</pre>
−
−	or
−	<pre>
−	permitted_enctypes = DEFAULT -arcfour-hmac
−	</pre>
−
−	where <code>DEFAULT</code> designates the default set of enctypes.
−

	==Review==		==Review==

@@ Line 1: / Line 1: @@
-{{project-early}}
+{{project-review|2009-02-13}}
 This project will disable the single-DES encryption algorithms by default.  A future (post-1.7) release will remove the code that supports single-DES.
-For now, the '''allow_weak_crypto''' libdefault boolean will control whether "weak" crypto is allowed.  The crypto library will gain an internal API, krb5_c_weak_enctype(), which will indicate whether a given enctype is "weak".  The krb5_keytypes structure will have a flags word that will contain a bit indicating whether a given enctype is weak.
+For now, the '''allow_weak_crypto''' libdefault boolean (which aligns with Heimdal) will control whether "weak" crypto is allowed.  The crypto library will gain an internal API, krb5_c_weak_enctype(), which will indicate whether a given enctype is "weak".  The krb5_keytypes structure will have a flags word that will contain a bit indicating whether a given enctype is weak.
-In the future, in order to make this more future-proof, the configuration of enctypes will be enhanced to allow for inclusions and exclusions, e.g.
+In the future, in a separate project, in order to make this more future-proof, the configuration of enctypes will be enhanced to allow for inclusions and exclusions, e.g.
 <pre>
@@ Line 16: / Line 16: @@
 where <code>DEFAULT</code> designates the default set of enctypes.