Re: [kitten] [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-03.txt

[Michiko Short <[e-mail]>]

inline

-----Original Message-----
From: Martin Rex [mailto:[e-mail]] 
Sent: Monday, June 19, 2017 9:44 AM
To: Benjamin Kaduk <[e-mail]>
Cc: [e-mail]
Subject: Re: [kitten] [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-03.txt

Benjamin Kaduk wrote:
> 
> As far as I know, this version is ready to be sent to the IESG for 
> approval.
> 
> The -03 adds this text (including known typo):
> 
>    Fortuntately, modern (i.e., supported) Kerberos implementations
>    support a secure alternative to RC4, in the form of AES.  Windows has
>    supported AES since 2007-2008 with the release of Windows Vista and
>    Server 2008, respectively; MIT Kerberos [MITKRB5] has fully supported
>    AES (including the GSSAPI mechanism) since 2004 with the release of
>    version 1.3.2; Heimdal [HEIMDAL] has fully supported AES since 2005
>    with the release of version 0.7.  Though there may still be issues
>    running ten-year-old unsupported software in mixed environments with
>    new software, issues of that sort seem unlikely to be unique to
>    Kerberos, and the aministrators of such environments are expected to
>    be capable of devising workarounds.
> 
> It would be good to get independent confirmation of those 
> dates/release numbers; the windows ones I took from Michiko's email 
> and the Heimdal one from Chaskiel's mail.  (I did the MIT research 
> myself, and picked 1.3.2 to include the GSSAPI mechanism instead of
> 1.3 which had the bare enctype.)


I have always been wondering about the following issue about Microsoft Kerberos and the RC4-enctype:
[Michiko Short] Not sure this is only a MS issue. 

To be able to use AES enctypes with Microsoft Kerberos, not only the client, the server and the domain controllers must be using Vista or higher, but I assume that *also* Active Directory must be running a Domain functional level 2008 or higher (rather than domain functional level 2003).
[Michiko Short]  correct. This is why we had a matrix published with the AES announcement since Kerberos uses encryption for multiple things and thus DFL is one of the things that must be understood. I probably should revise that table and add to our docs for clarity, but I believe there have been a couple of blogs in the AskDS and protocol licensee space released since that Vista announcement. 

Can Active Directory store AES enctype longterm secrets of service accounts (for 2-token Kerberos authentication) when the domain controllers are Windows 2008, 2008R2 or maybe even 2012R2, but domain functional level is still at Windows 2003?
[Michiko Short] The problem with mixed modes domains (which I would assume applies to MIT & Heimdal as well) is that the DC can only create the keys it knows. When we shipped the GP to configure etype support we had to fix the DC logic to create all keys it knew vs supported to avoid the problem that when you flip the config on a DC then everything needs to change password. It is also why AES support becomes DFL. You cannot have a key used with the DC which is not understood by one or move DCs. 

If not, is it documented anywhere that _after_ upgrading a windows domain to functional level 2008+, and _before_ being able to use AES enctypes with serice accounts, it will be necessary to _manually_ _administratively_ set a new password (or the same password) for each and every service account, otherwise only RC4-enctypes and NTLM-authentication will work for that service account (unless storing passwords with reversible encryption has been enabled for a service account, I assume).
[Michiko Short] Actually it is more subtle than that. But I agree, when we evangelize RC4 deprecation in AD, we create better documentation. 

Kerberos with RC4 enctypes seemed to always have worked instantly after upgrading Windows domains, but AES enctypes seem to have never worked.
[Michiko Short] RC4 is supported by every version of Windows so it will work as it is the default. AES came later and unfortunately requires a lot of manual work. 

Does anyone know about the exact details, and why RC4-enctypes seem to work so much better in Windows?
[Michiko Short] Every version of Windows supports it and was the default in the design. 

(I'm not a real Kerberos user myself, but I've worked on a number of  support calls, and for some customers, administratively setting a  new password seemed to fix some of the Kerberos authentication issues,  and I am mainly guessing at potential issues here).


-Martin