UCF STIG Viewer Logo

The use of DES encryption suites must not be allowed for Kerberos encryption.


Overview

Finding ID Version Rule ID IA Controls Severity
V-21954 3.154 SV-32706r3_rule Medium
Description
Certain encryption types are no longer considered secure. This setting configures a minimum encryption type for Kerberos, preventing the use of the DES encryption suites.
STIG Date
Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide 2019-06-18

Details

Check Text ( C-78961r2_chk )
Review the value to the following registry key to verify the DES_CBC_CRC and DES_CBC_MD5 encryption suites are not allowed.

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\
Value Name: SupportedEncryptionTypes
Type: REG_DWORD

The values are determined by the selection of encryption suites in the policy "Network Security: Configure encryption types allowed for Kerberos".

Due to the various possible combinations, it is not possible to include all acceptable values as viewed directly in the registry.

The value must be converted to binary to determine configuration of specific bits. This will determine whether this is a finding.

Note the value for the registry key.
For example when all suites, including the DES suites are selected, the value will be "0x7fffffff (2147483647)".

Open the Windows calculator (Run/Search for "calc").
Select "View", then "Programmer".
Select "Dword" and either "Hex" or "Dec".
Enter the appropriate form of the value found for the registry key (e.g., Hex - enter 0x7fffffff, Dec - enter 2147483647).
Select "Bin".

The returned value may vary in length, up to 32 characters.

If either of the 2 right most characters are "1", this is a finding.

If both of the 2 right most characters are "0", this is not a finding.
Fix Text (F-86119r1_fix)
Configure the policy for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected:

RC4_HMAC_MD5
AES128_HMAC_SHA1
AES256_HMAC_SHA1
Future encryption types

Options such as RC4_HMAC_MD5 may also be excluded to align with STIGs for later Windows versions. Changes should be thoroughly tested before implementing in a domain.