Re: [kitten] [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-03.txt

[Benjamin Kaduk <[e-mail]>]

On Mon, Jun 19, 2017 at 06:43:31PM +0200, Martin Rex wrote:
> 
> I have always been wondering about the following issue about
> Microsoft Kerberos and the RC4-enctype:

Just to note explicitly: I am listed in the To: line of this message
but am definitely not the right person to answer the questions here.

> To be able to use AES enctypes with Microsoft Kerberos, not only
> the client, the server and the domain controllers must be using
> Vista or higher, but I assume that *also* Active Directory must
> be running a Domain functional level 2008 or higher (rather than
> domain functional level 2003).

Such an assumption is plausible.

> Can Active Directory store AES enctype longterm secrets of service accounts
> (for 2-token Kerberos authentication) when the domain controllers
> are Windows 2008, 2008R2 or maybe even 2012R2, but domain functional
> level is still at Windows 2003?

I don't know.

> If not, is it documented anywhere that _after_ upgrading a windows
> domain to functional level 2008+, and _before_ being able to use
> AES enctypes with serice accounts, it will be necessary to
> _manually_ _administratively_ set a new password (or the same password)
> for each and every service account, otherwise only RC4-enctypes and
> NTLM-authentication will work for that service account (unless storing
> passwords with reversible encryption has been enabled for a service
> account, I assume).

Such a property is a natural consequence of a design that stores
only the string2key'd keys and not the original passwords.  (I
think I heard vague rumors that very old AD DCs did in fact store
actual user passwords, but cannot substantiate such rumors.)

> 
> Kerberos with RC4 enctypes seemed to always have worked instantly after
> upgrading Windows domains, but AES enctypes seem to have never worked.

I suspect that what is going on is that RC4 always existed and is
always supported, but AES was added later and so had backwards
compatibility requirements that involved not breaking existing
deployments, so you had to explicitly opt-in all parties to the
exchange.  It's hard to know for sure when the risk of breaking
things has gone away and it's safe to enable the new feature by
default.

> 
> Does anyone know about the exact details, and why RC4-enctypes seem
> to work so much better in Windows?
> 
> (I'm not a real Kerberos user myself, but I've worked on a number of
>  support calls, and for some customers, administratively setting a
>  new password seemed to fix some of the Kerberos authentication issues,
>  and I am mainly guessing at potential issues here).

Your guesses seem reasonable to me, but I'm also just guessing,
myself.

-Ben