Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 18 Nov 2012 18:15:17 +0100
From: buawig <buawig@...il.com>
To: john-users@...ts.openwall.com
Subject: support for weak kerberos etypes

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

for kerberos setups that are vulnerable to etype downgrade attacks[1]
it would be great to have john support for a few weaker etypes that
require less cracking effort than etype 18 (aes256-cts-hmac-sha1-96).

The following etypes are supported by a default Windows 7 client:

etype 	| name
- ------------------------
1	| des-cbc-crc
3	| des-cbc-md5
24	| rc4-hmac-exp
- -135?	| rc4-hmac-old-exp*
23	| rc4-hmac 	(support available)
17	| aes128-cts-hmac-sha1-96
18	| aes256-cts-hmac-sha1-96 (support available)

WinXP (pcap file from [2]):
- -133?	| rc4-hmac-old*
- -128?	| rc4-md4*

from centos 6.3 (from Dhiru pcap file [3])
16	| des3-cbc-sha1

*) non-existing according to IANA, wireshark disector bug?

IANA list of etypes with references to RFCs:
https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml#kerberos-parameters-1

[1]
http://media.blackhat.com/bh-us-10/whitepapers/Stender_Engel_Hill/BlackHat-USA-2010-Stender-Engel-Hill-Attacking-Kerberos-Deployments-wp.pdf
[2]
http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=krb-816.zip
[3] http://dl.dropbox.com/u/1522424/KerberosCaptures.tar.gz
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJQqRelAAoJEJeRHQyF0ukMtEoP/RJpYBuiFPOLm/Y6mxw/Gfkx
/zero+JKCBjCg3eVFgM3B5tHTbeNyTzsx0rO2k1PjcnNdJonj0B/VYVYryoTeNlV
SepxgYDrXeUXBeJ1gLgSHnajKvwhI6MFgZuxNStxMNsWV/0xY22ypugFC/b1zoQ2
dMaYhf2TjcdBnv2lSpSKZYxwM6cvy8eT7xab3LU9wghMUnNb2CABn/yc9THE7SXF
psIBPIkK5bW+Te40IAhPYrqG1WQ/FBMDe8jZMIMeiW2DqQuMT3zseuHnDzURK61Z
LdPHx8fl5gZCV7X3YHJFvlOL8Bqhvh6v9XtsVELjSYM6Rr91OLQ6wZYJDUOEhxMo
jCC4jDqbGeOgldyEvElvNfmwlrnAnInkDfATdicT46BjPQzZ8rPDoSRSr+OwAkkk
jRZ5ZalflCX0q9V7lHn0iuVZTHw1PHo+GLMjrG4knxn1Rlfhtvs4pSkruECNQe6R
KIscxsmrYSgVpEAJf3hTBrYyquadQFdoaZlJHhYjFGwZA3W1RznUqRpLUGEbmQ/P
ZpqgbNsGeNSdaTFSr13VXnSgLySbLZrrybRLGalX5hOLJWOdFMZLwo4rt4jpo5Cj
7VVmb9qzso2iqxoLKuqm62gZ8qn/w7pish09nlCFkHhRAlr5LEiCN8T7wVbTS4ru
yQ22CiQVJcjSjnQzjwEE
=C4Fy
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.