Re: [kitten] SPAKE and non-deterministic RFC 3961 checksums

[Benjamin Kaduk <[e-mail]>]

On Mon, Sep 25, 2017 at 10:04:15PM -0700, Henry B (Hank) Hotz, CISSP wrote:
> 
> > On Sep 25, 2017, at 7:25 PM, Benjamin Kaduk <[e-mail]> wrote:
> > 
> > That said, Greg noted on IRC that if we do have a "no DES and SPAKE
> > together" requirement, the KDC knows the initial reply key and can
> > do the right thing fairly easiliy, including rejecting optimistic
> > attempts from (broken) clients.  So, I'm starting to come around to
> > the camp of "prevent SPAKE with 1DES, and require all future mandatory
> > checksum types to be deterministic".  (Possibly all future checksum
> > types entirely, but that may be too aggressive.)
> 
> Do we really have that many single-des deployments to worry about anymore? Everything I know of, including AFS and AD/Windows, has better alternatives available and just waiting to be turned on. Surely nobody is still using JGSS in Java 1.4.

As I understand it, there is not much (any?) modern software that strictly
requires single-DES, but there are also many sites where the effort to
upgrade has not been expended.  Even in ATHENA.MIT.EDU, we have cross-realm
keys that are actively used (albeit not for terribly critical functionality)
that remain single-DES because of the logistical challenges involved in
getting both KDC administrators in contact and with a trusted channel.

-Ben