1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
|
<pre>Internet Engineering Task Force (IETF) L. Hornquist Astrand
Request for Comments: 6649 Apple, Inc.
BCP: 179 T. Yu
Obsoletes: <a href="./rfc1510">1510</a> MIT Kerberos Consortium
Updates: <a href="./rfc1964">1964</a>, <a href="./rfc4120">4120</a>, <a href="./rfc4121">4121</a>, <a href="./rfc4757">4757</a> July 2012
Category: Best Current Practice
ISSN: 2070-1721
<span class="h1">Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms</span>
<span class="h1">in Kerberos</span>
Abstract
The Kerberos 5 network authentication protocol, originally specified
in <a href="./rfc1510">RFC 1510</a>, can use the Data Encryption Standard (DES) for
encryption. Almost 30 years after first publishing DES, the National
Institute of Standards and Technology (NIST) finally withdrew the
standard in 2005, reflecting a long-established consensus that DES is
insufficiently secure. By 2008, commercial hardware costing less
than USD 15,000 could break DES keys in less than a day on average.
DES is long past its sell-by date. Accordingly, this document
updates <a href="./rfc1964">RFC 1964</a>, <a href="./rfc4120">RFC 4120</a>, <a href="./rfc4121">RFC 4121</a>, and <a href="./rfc4757">RFC 4757</a> to deprecate the
use of DES, RC4-HMAC-EXP, and other weak cryptographic algorithms in
Kerberos. Because <a href="./rfc1510">RFC 1510</a> (obsoleted by <a href="./rfc4120">RFC 4120</a>) supports only
DES, this document recommends the reclassification of <a href="./rfc1510">RFC 1510</a> as
Historic.
Status of This Memo
This memo documents an Internet Best Current Practice.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
BCPs is available in <a href="./rfc5741#section-2">Section 2 of RFC 5741</a>.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
<a href="http://www.rfc-editor.org/info/rfc6649">http://www.rfc-editor.org/info/rfc6649</a>.
<span class="grey">Hornquist Astrand & Yu Best Current Practice [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc6649">RFC 6649</a> Deprecate DES in Kerberos July 2012</span>
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents
(<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
<span class="grey">Hornquist Astrand & Yu Best Current Practice [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc6649">RFC 6649</a> Deprecate DES in Kerberos July 2012</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
The original specification of the Kerberos 5 network authentication
protocol [<a href="./rfc1510" title=""The Kerberos Network Authentication Service (V5)"">RFC1510</a>] supports only the Data Encryption Standard (DES)
for encryption. For many years, the cryptographic community has
regarded DES as providing inadequate security, mostly because of its
small key size. Accordingly, this document recommends the
reclassification of [<a href="./rfc1510" title=""The Kerberos Network Authentication Service (V5)"">RFC1510</a>] (obsoleted by [<a href="./rfc4120" title=""The Kerberos Network Authentication Service (V5)"">RFC4120</a>]) as Historic
and updates current Kerberos-related specifications [<a href="./rfc1964" title=""The Kerberos Version 5 GSS-API Mechanism"">RFC1964</a>],
[<a href="./rfc4120" title=""The Kerberos Network Authentication Service (V5)"">RFC4120</a>], and [<a href="./rfc4121" title=""The Kerberos Version 5 Generic Security Service Application Program Interface (GSS-API) Mechanism: Version 2"">RFC4121</a>] to deprecate the use of DES and other weak
cryptographic algorithms in Kerberos, including some unkeyed
checksums and hashes, along with the weak 56-bit "export strength"
RC4 variant encryption type of [<a href="./rfc4757" title=""The RC4-HMAC Kerberos Encryption Types Used by Microsoft Windows"">RFC4757</a>].
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Requirements Notation</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Affected Specifications</span>
The original IETF specification of Kerberos 5 [<a href="./rfc1510" title=""The Kerberos Network Authentication Service (V5)"">RFC1510</a>] only supports
DES for encryption. [<a href="./rfc4120" title=""The Kerberos Network Authentication Service (V5)"">RFC4120</a>] obsoletes [<a href="./rfc1510" title=""The Kerberos Network Authentication Service (V5)"">RFC1510</a>] and updates the
Kerberos specification to include additional cryptographic
algorithms, but still permits the use of DES. [<a href="./rfc3961" title=""Encryption and Checksum Specifications for Kerberos 5"">RFC3961</a>] describes
the Kerberos cryptographic system and includes support for DES
encryption types, but it does not specify requirement levels for
them.
The specification of the Kerberos Generic Security Services
Application Programming Interface (GSS-API) mechanism [<a href="./rfc1964" title=""The Kerberos Version 5 GSS-API Mechanism"">RFC1964</a>] and
its updated version [<a href="./rfc4121" title=""The Kerberos Version 5 Generic Security Service Application Program Interface (GSS-API) Mechanism: Version 2"">RFC4121</a>] define checksum and encryption
mechanisms based on DES. With the existence of newer encryption
types for Kerberos GSS-API defined in [<a href="./rfc4121" title=""The Kerberos Version 5 Generic Security Service Application Program Interface (GSS-API) Mechanism: Version 2"">RFC4121</a>], Microsoft's
RC4-HMAC-based GSS-API mechanism, and MIT's DES3 (which is not
published as an RFC), there is no need to support the old DES-based
integrity (SGN) and confidentiality (SEAL) types.
[<a id="ref-RFC4757">RFC4757</a>] describes the RC4-HMAC encryption types used by Microsoft
Windows and allows for a 56-bit "export strength" variant. (The
character constant "fortybits" used in the definition is a historical
reference and does not refer to the actual key size of the encryption
type.)
<span class="grey">Hornquist Astrand & Yu Best Current Practice [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc6649">RFC 6649</a> Deprecate DES in Kerberos July 2012</span>
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. DES Insecurity</span>
The insecurity of DES has been evident for many years. Even around
the time of its first publication, cryptographers raised the
possibility that 56 bits was too small a key size for DES. The
National Institute of Standards and Technology (NIST) officially
withdrew DES in 2005 [<a href="#ref-DES-Withdrawal">DES-Withdrawal</a>], and also announced a
transition period that ended on May 19, 2007 [<a href="#ref-DES-Transition-Plan">DES-Transition-Plan</a>].
The IETF has also published its position in [<a href="./rfc4772" title=""Security Implications of Using the Data Encryption Standard (DES)"">RFC4772</a>], in which the
recommendation summary is very clear: "don't use DES".
In 2006, researchers demonstrated the ability to find a DES key via
brute-force search in an average of less than 9 days using less than
EUR 10,000 worth of hardware [<a href="#ref-Break-DES" title=""How to break DES for EUR 8,980"">Break-DES</a>]. By 2008, a company was
offering hardware capable of breaking a DES key in less than a day on
average [<a href="#ref-DES-1day" title=""Break DES in less than a single day"">DES-1day</a>] that cost less than USD 15,000 [<a href="#ref-DES-Crack" title=""DES Brute Force Cracking Efforts 1977 to 2010"">DES-Crack</a>].
Brute-force key searches of DES will only get faster and cheaper.
(The aforementioned company markets its device for one-click recovery
of lost DES keys.) It is clear that it is well past time to retire
the use of DES in Kerberos.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Recommendations</span>
This document hereby removes the following RECOMMENDED types from
[<a href="./rfc4120" title=""The Kerberos Network Authentication Service (V5)"">RFC4120</a>]:
Encryption: DES-CBC-MD5(3)
Checksums: DES-MD5 (8, named RSA-MD5-DES in [<a href="./rfc3961" title=""Encryption and Checksum Specifications for Kerberos 5"">RFC3961</a>]).
Kerberos implementations and deployments SHOULD NOT implement or
deploy the following single DES encryption types: DES-CBC-CRC(1),
DES-CBC-MD4(2), DES-CBC-MD5(3) (updates [<a href="./rfc4120" title=""The Kerberos Network Authentication Service (V5)"">RFC4120</a>]).
Kerberos implementations and deployments SHOULD NOT implement or
deploy the following "export strength" RC4 variant encryption type:
RC4-HMAC-EXP(24) (updates [<a href="./rfc4757" title=""The RC4-HMAC Kerberos Encryption Types Used by Microsoft Windows"">RFC4757</a>]). This document does not add any
sort of requirement for conforming implementations to implement
RC4-HMAC(23).
Kerberos implementations and deployments SHOULD NOT implement or
deploy the following checksum types: CRC32(1), RSA-MD4(2),
RSA-MD4-DES(3), DES-MAC(4), DES-MAC-K(5), RSA-MD4-DES-K(6),
RSA-MD5-DES(8) (updates [<a href="./rfc4120" title=""The Kerberos Network Authentication Service (V5)"">RFC4120</a>]).
It is possible to safely use the RSA-MD5(7) checksum type, but only
with additional protection, such as the protection that an encrypted
Authenticator provides. Implementations MAY use RSA-MD5 inside an
<span class="grey">Hornquist Astrand & Yu Best Current Practice [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc6649">RFC 6649</a> Deprecate DES in Kerberos July 2012</span>
encrypted Authenticator for backward compatibility with systems that
do not support newer checksum types (updates [<a href="./rfc4120" title=""The Kerberos Network Authentication Service (V5)"">RFC4120</a>]). One example
is that some legacy systems only support RC4-HMAC(23) [<a href="./rfc4757" title=""The RC4-HMAC Kerberos Encryption Types Used by Microsoft Windows"">RFC4757</a>] for
encryption when DES is not available; these systems use RSA-MD5
checksums inside Authenticators encrypted with RC4-HMAC.
Kerberos GSS mechanism implementations and deployments SHOULD NOT
implement or deploy the following SGN ALG: DES MAC MD5(0000),
MD2.5(0100), DES MAC(0200) (updates [<a href="./rfc1964" title=""The Kerberos Version 5 GSS-API Mechanism"">RFC1964</a>]).
Kerberos GSS mechanism implementations and deployments SHOULD NOT
implement or deploy the following SEAL ALG: DES(0000) (updates
[<a href="./rfc1964" title=""The Kerberos Version 5 GSS-API Mechanism"">RFC1964</a>]).
The effect of the two last sentences is that this document deprecates
<a href="./rfc1964#section-1.2">Section 1.2 of [RFC1964]</a>.
This document hereby recommends the reclassification of [<a href="./rfc1510" title=""The Kerberos Network Authentication Service (V5)"">RFC1510</a>] as
Historic.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. Security Considerations</span>
Removing support for single DES improves security because DES is
considered to be insecure. RC4-HMAC-EXP has a similarly inadequate
key size, so removing support for it also improves security.
Kerberos defines some encryption types that are either underspecified
or that only have number assignments but no specifications.
Implementations should make sure that they only implement and enable
secure encryption types.
The security considerations of [<a href="./rfc4757" title=""The RC4-HMAC Kerberos Encryption Types Used by Microsoft Windows"">RFC4757</a>] continue to apply to
RC4-HMAC, including the known weaknesses of RC4 and MD4, and this
document does not change the Informational status of [<a href="./rfc4757" title=""The RC4-HMAC Kerberos Encryption Types Used by Microsoft Windows"">RFC4757</a>] for
now. The main reason to not actively discourage the use of RC4-HMAC
is that it is the only encryption type that interoperates with older
versions of Microsoft Windows once DES and RC4-HMAC-EXP are removed.
These older versions of Microsoft Windows will likely be in use until
at least 2015.
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. Acknowledgements</span>
Mattias Amnefelt, Ran Atkinson, Henry Hotz, Jeffrey Hutzelman, Leif
Johansson, Simon Josefsson, and Martin Rex have read the document and
provided suggestions for improvements. Sam Hartman proposed moving
[<a href="./rfc1510" title=""The Kerberos Network Authentication Service (V5)"">RFC1510</a>] to Historic. Michiko Short provided information about the
dates of end of support for Windows releases.
<span class="grey">Hornquist Astrand & Yu Best Current Practice [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc6649">RFC 6649</a> Deprecate DES in Kerberos July 2012</span>
<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>. References</span>
<span class="h3"><a class="selflink" id="section-8.1" href="#section-8.1">8.1</a>. Normative References</span>
[<a id="ref-RFC1964">RFC1964</a>] Linn, J., "The Kerberos Version 5 GSS-API Mechanism",
<a href="./rfc1964">RFC 1964</a>, June 1996.
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
[<a id="ref-RFC3961">RFC3961</a>] Raeburn, K., "Encryption and Checksum Specifications for
Kerberos 5", <a href="./rfc3961">RFC 3961</a>, February 2005.
[<a id="ref-RFC4120">RFC4120</a>] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
Kerberos Network Authentication Service (V5)", <a href="./rfc4120">RFC 4120</a>,
July 2005.
[<a id="ref-RFC4121">RFC4121</a>] Zhu, L., Jaganathan, K., and S. Hartman, "The Kerberos
Version 5 Generic Security Service Application Program
Interface (GSS-API) Mechanism: Version 2", <a href="./rfc4121">RFC 4121</a>,
July 2005.
[<a id="ref-RFC4757">RFC4757</a>] Jaganathan, K., Zhu, L., and J. Brezak, "The RC4-HMAC
Kerberos Encryption Types Used by Microsoft Windows",
<a href="./rfc4757">RFC 4757</a>, December 2006.
<span class="h3"><a class="selflink" id="section-8.2" href="#section-8.2">8.2</a>. Informative References</span>
[<a id="ref-Break-DES">Break-DES</a>] Kumar, S., Paar, C., Pelzl, J., Pfeiffer, G., Rupp, A.,
and M. Schimmler, "How to break DES for EUR 8,980",
SHARCS'06 - Special-purpose Hardware for Attacking
Cryptographic Systems, April 2006, <<a href="http://www.copacobana.org/paper/copacobana_SHARCS2006.pdf">http://</a>
<a href="http://www.copacobana.org/paper/copacobana_SHARCS2006.pdf">www.copacobana.org/paper/copacobana_SHARCS2006.pdf</a>>.
[<a id="ref-DES-1day">DES-1day</a>] SciEngines GmbH, "Break DES in less than a single day",
<<a href="http://www.sciengines.com/company/news-a-events/74-des-in-1-day.html">http://www.sciengines.com/company/news-a-events/</a>
<a href="http://www.sciengines.com/company/news-a-events/74-des-in-1-day.html">74-des-in-1-day.html</a>>.
[<a id="ref-DES-Crack">DES-Crack</a>] Scott, T., "DES Brute Force Cracking Efforts 1977 to
2010", 2010, <<a href="http://www.tjscott.net/security.extras/des.crack.efforts.pdf">http://www.tjscott.net/security.extras/</a>
<a href="http://www.tjscott.net/security.extras/des.crack.efforts.pdf">des.crack.efforts.pdf</a>>.
[<a id="ref-DES-Transition-Plan">DES-Transition-Plan</a>]
National Institute of Standards and Technology, "DES
Transition Plan", May 2005, <<a href="http://csrc.nist.gov/groups/STM/common_documents/DESTranPlan.pdf">http://csrc.nist.gov/groups/</a>
<a href="http://csrc.nist.gov/groups/STM/common_documents/DESTranPlan.pdf">STM/common_documents/DESTranPlan.pdf</a>>.
<span class="grey">Hornquist Astrand & Yu Best Current Practice [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc6649">RFC 6649</a> Deprecate DES in Kerberos July 2012</span>
[<a id="ref-DES-Withdrawal">DES-Withdrawal</a>]
National Institute of Standards and Technology,
"Announcing Approval of the Withdrawal of Federal
Information Processing Standard (FIPS) 46-3, Data
Encryption Standard (DES); FIPS 74, Guidelines for
Implementing and Using the NBS Data Encryption Standard;
and FIPS 81, DES Modes of Operation", Federal Register
Vol. 70, No. 96, Document 05-9945, 70 FR 28907-28908,
May 2005, <<a href="http://www.gpo.gov/fdsys/pkg/FR-2005-05-19/pdf/05-9945.pdf">http://www.gpo.gov/fdsys/pkg/</a>
<a href="http://www.gpo.gov/fdsys/pkg/FR-2005-05-19/pdf/05-9945.pdf">FR-2005-05-19/pdf/05-9945.pdf</a>>.
[<a id="ref-RFC1510">RFC1510</a>] Kohl, J. and B. Neuman, "The Kerberos Network
Authentication Service (V5)", <a href="./rfc1510">RFC 1510</a>, September 1993.
[<a id="ref-RFC4772">RFC4772</a>] Kelly, S., "Security Implications of Using the Data
Encryption Standard (DES)", <a href="./rfc4772">RFC 4772</a>, December 2006.
Authors' Addresses
Love Hornquist Astrand
Apple, Inc.
Cupertino, California
USA
EMail: lha@apple.com
Tom Yu
MIT Kerberos Consortium
77 Massachusetts Ave.
Cambridge, Massachusetts
USA
EMail: tlyu@mit.edu
Hornquist Astrand & Yu Best Current Practice [Page 7]
</pre>
|
