IETF RFC 6649
[ACTIVE]
Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos
Metadata
- Publisher
- IETF
- Doc Type
- Best Practice
- Pages
- 7
- Abstract
- The Kerberos 5 network authentication protocol, originally specified in RFC 1510, can use the Data Encryption Standard (DES) for encryption. Almost 30 years after first publishing DES, the National Institute of Standards and Technology (NIST) finally withdrew the standard in 2005, reflecting a long-established consensus that DES is insufficiently secure. By 2008, commercial hardware costing less than USD 15,000 could break DES keys in less than a day on average. DES is long past its sell-by date. Accordingly, this document updates RFC 1964, RFC 4120, RFC 4121, and RFC 4757 to deprecate the use of DES, RC4-HMAC-EXP, and other weak cryptographic algorithms in Kerberos. Because RFC 1510 (obsoleted by RFC 4120) supports only DES, this document recommends the reclassification of RFC 1510 as Historic. This memo documents an Internet Best Current Practice.
- Publication Date
- 2012-07-01
- Status Note
- Best Current Practice
- DOI
10.17487/RFC6649- Link
- https://doi.org/10.17487/RFC6649
- Author(s)
- Love AstrandTaylor Yu
Latest version of IETF RFC 6649
Document Versions — IETF RFC 6649
-
▶ IETF RFC 6649 (2012-07-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IETF RFC 1964 [Active*]
- IETF RFC 2119 [Active*]
- IETF RFC 3961 [Active*]
- IETF RFC 4120 [Active*]
- IETF RFC 4121 [Active*]
- IETF RFC 4757 [Active*]
Bibliographic Reference(s)
- NIST FIPS 46-3 [Withdrawn]
- National Institute of Standards and Technology, "DES Transition Plan", May 2005, < http://csrc.nist.gov/groups/ STM/common_documents/DESTranPlan.pdf >. EXTERNAL
- Scott, T., "DES Brute Force Cracking Efforts 1977 to 2010", 2010, < http://www.tjscott.net/security.extras/ des.crack.efforts.pdf >. EXTERNAL
- Kumar, S., Paar, C., Pelzl, J., Pfeiffer, G., Rupp, A., and M. Schimmler, "How to break DES for EUR 8,980", SHARCS'06 - Special-purpose Hardware for Attacking Cryptographic Systems, April 2006, < http:// www.copacobana.org/paper/copacobana_SHARCS2006.pdf >. EXTERNAL
- SciEngines GmbH, "Break DES in less than a single day", < http://www.sciengines.com/company/news-a-events/ 74-des-in-1-day.html >. EXTERNAL
- IETF RFC 1510 [Superseded*]
- RFC4772 — RFC4772 EXTERNAL
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC6649.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 6649, Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos. Available at https://doi.org/10.17487/RFC6649
Snippet:
IETF RFC 6649, Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos. Available at https://doi.org/10.17487/RFC6649
HTML (ISO 690 compliant)
Preview:
IETF RFC 6649, Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos. Available at https://doi.org/10.17487/RFC6649
Snippet:
<span class="citation"><cite>IETF RFC 6649</cite>, Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos. Available at <a href="https://doi.org/10.17487/RFC6649" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6649</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 6649, Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos
doi: 10.17487/RFC6649
url: https://doi.org/10.17487/RFC6649
doi: 10.17487/RFC6649
url: https://doi.org/10.17487/RFC6649
Snippet:
<li> <cite id="bib-rfc6649">IETF RFC 6649</cite>, Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos <span class="doi">10.17487/RFC6649</span> </li>
Referenced By
- IETF RFC 7530 [Active*]
- IETF RFC 8429 [Active*]