9 ms·
Microsoft will finally kill obsolete cipher that has wreaked decades of havoc
- JoachimS 11mo ago"RC4, short for Rivist Cipher 4". No, "Ron's Code 4". And the default will now be AES-SHA1, where SHA-1 is to be deprecate by NIST in 2030. (https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm https://www.nist.gov/news-events/news/2022/12/nist-retires-s...)
- suprfsat 10mo agoRonald's Kryptosystem 4
- ComputerGuru 10mo agoSHA1 as a MAC for AES encryption is different from SHA-1 as a hash algorithm and remains secure, though there are of course better alternatives.
- ZeroConcerns 11mo agoReasonable! Anyone who cares about AD security has been AES-only for at least a year now, and most likely much longer, and it's not like these mitigations are especially hard, unless you're still running some seriously obsolete software.
- deleted 11mo ago[deleted]
- JackSlateur 11mo agoAnyone who cares about AD security has left AD for a long time, no ?
- stefanfisk 10mo agoWhat’s the alternative?
- qubex 10mo agoNetInfo. I’ll show myself out.
- cryptonector 10mo agoWow, NetInfo. What a blast from the past. To be clear NetInfo is not an alternative. It's just not generic enough and not really a good fit for Windows. NetInfo is too much a Unix solution, so there's no cross-realm/domain "forest" functionality, no support for SIDs, etc.
- chuckadams 10mo agoNo takers for NIS?
- polski-g 10mo agoFreeIPA
- JackSlateur 10mo agoWhat is your need ? DNS ? Auth ? File sharing ? Print sharing ? GPO ? Remote control ? SSO ? Authentication or authorization ?
- stefanfisk 10mo agoYes.
- brendoelfrendo 10mo agoAD is perfectly fine. It's actually really good at what it is: a highly-available Kerberos implementation with an integrated directory server. It's not as dominant as it used to be because there are better ways to handle identity for web applications and zero-trust environments, but I don't think that diminishes what AD was good at.
- carlos256 10mo agoNope. AES is not trivial to implement securely, so most implementations simply rely on hardware support. ChaCha20 and XChaCha20 are more secure ciphers.
- bmenrigh 11mo agoThere are so many problems with this article and the previous one it references (How weak passwords and other failings led to catastrophic breach of Ascension). Specifically, RC4 is a stream cipher. Yet, much of the discussion is around the weakness of NTLM, and NTLM password hashes which use MD4, a hash algorithm. The discussion around offline cracking of NTLM hashes being very fast is correct. More importantly though, the weakness of NTLM comes from a design of the protocol, not a weakness with MD4. Yes MD4 is weak, but the flaws in NTLM don't stem specifically from MD4. Dan Goodin's reporting is usually of high quality but he didn't understand the cryptography or the protocols here, and clearly the people he spoke to didn't help him to understand. EDIT: let me be more clear here. MS is removing RC4 from Kerberos, which is a good thing. But the article seems to confuse various NTLM authentication weaknesses and past hacks with RC4 in Kerberos.
- matthewdgreen 10mo agoObviously RC4 itself isn't the problem. The problem is that Microsoft ships a "ciphersuite" that includes a bad password-based key derivation algorithm that also happens to be tied to a whole pile of bad cryptography. And the real, real problem is that Microsoft still ships a design in which low-entropy passwords can be misconfigured for use in encrypting credentials, which is a nightmare out of the 1990s and should have been completely disallowed in 2010. But I'm not going to get particularly picky if people identify the bad ciphersuite by the shorthand "RC4", because even Microsoft does this: https://www.microsoft.com/en-us/windows-server/blog/2025/12/03/beyond-rc4-for-windows-authentication https://www.microsoft.com/en-us/windows-server/blog/2025/12/...
- hnmullany 10mo agoWhat are the bets that the NSA has been encouraging Microsoft to keep shipping this?
- Someone1234 10mo agoLow. While the NSA would, absolutely, use it to elevate existing internal access - it is such low-hanging fruit that they have enough alternative tools in their arsenal that it isn't a particularly big loss. Most of their competent adversaries disabled it years ago (as has been best-practice since 2010~). More likely, it is Microsoft's obsession with backwards compatibility. Which while a great philosophy in general has given them a black eye several times before vis-a-vis security posture.
- ChrisArchitect 11mo agoSource: https://www.microsoft.com/en-us/windows-server/blog/2025/12/03/beyond-rc4-for-windows-authentication https://www.microsoft.com/en-us/windows-server/blog/2025/12/...
- Someone1234 10mo agoWhich, in this case, is higher quality as the article has a bunch of mistakes and misinformation in it.
- duvetworld 11mo agoMicrosoft does not have the power to stop me from using this cipher.
- Filligree 10mo agoYou do. You have the power. Please stop using it.
- ok123456 10mo agoHow did RC4 become so widespread when it came from a leak? Additionally, why was it the de facto standard stream cipher in the 90s, even though it was known to be flawed? Just the speed?
- dchest 10mo agoIt's fast, easy to implement, has very concise code, takes any key length up to 256 bytes, comes from a famous cryptographer, and there weren't a lot of alternatives.
- ivanr 10mo agoBecause "everybody uses RC4" (the sibling comment from dchest is correct). There was a lot of bad cryptography in that period and not a lot of desire to improve. The cleanup only really started in 2010 or thereabouts. For RC4 specifically, its was this research paper: https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_alfardan.pdf https://www.usenix.org/system/files/conference/usenixsecurit... released in 2013.
- WorldMaker 10mo agoRSA was still selling RC4 into the mid-2000s as a product. While open source variants of RC4, often trying to avoid the RSA trademark by calling it things like ARCFOUR, started trading in the 1990s, there was still a sense that RC4 was backed by a security company. Also, even though flaws were discovered as early as the open source variants had reverse engineered the RC4 algorithm, it was one of those "flaws exist but need things to exploit them that are out of our current threat models" problems, with it being a multi-stage, multi-year effort from the earliest flaw discoveries in the 90s to the most devastating exploits being developed around 2013-2015 taking advantage of those flaws in reproducible ways. I also remember in the 90s it felt like the reverse engineered, open source efforts were once shining beacons of hope like PGP of releasing "enterprise grade" security algorithms from trade secret-protected corporate and governmental interests to "the common people". RC4 was simple to implement and easy to reason about, but gave "good enough" security for a lot of uses, certainly far better than "no security unless you pay a company like RSA and only if you don't plan to export your software outside of the US". That's why RC4 was the basis of a 90s idea called CipherSaber [1] about the idea of being able to implement your own security suite that you controlled and companies couldn't take from you. Of course, things have shifted so much since the 90s when security suites were trade-protected and export-controlled. The security through obscurity of the algorithms involved behind trade secrets laws is no longer seen as an advantage and the algorithm being public knowledge has started to be a part of security suite threat models. Today's advice is never write your own security suite because there are several well regarded open source suites that have many eyes on them (and subsequently vulnerability plans/mitigations). Governments in the internet age have had to greatly relax their import/export controls on cryptography. We live in a very different world from the world RC4 was originally intended to secure. [1] https://en.wikipedia.org/wiki/CipherSaber https://en.wikipedia.org/wiki/CipherSaber
- notepad0x90 10mo agoThe common asrep roast kerberos etype I see now is aes/18 (https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml https://www.iana.org/assignments/kerberos-parameters/kerbero...). I was looking at this guy's benchmark here: https://gist.github.com/Chick3nman/32e662a5bb63bc4f51b847bb422222fd https://gist.github.com/Chick3nman/32e662a5bb63bc4f51b847bb4... Etype 23 (rc4-hmac) gets ~3500 kH/s, 18 (aes256-cts-hmac-sha1-96) gets roughly 2500 kH/s. Big difference, but somehow I thought it would be much bigger? 2.5M guesses/second is still not so bad. I've done kerberoasting and aseproasting a handful of times only, but from what I recall, RC4 can be cracked within reasonable time regardless of your password complexity. But with AES if you have a long and complex service account password, it will take decades/centuries to crack. But (!!) it is still quite common to use relatively weak passwords for service accounts, a lot of times the purpose of the service is included in the password so it makes guessing a bit easier. My criticism is that Kerberos (as far as I'm aware) does not provide modern PBKDFs (keyed argon2?) that have memory-hardness in place. That might be asking too much, so why doesn't Microsoft alert directory administrators (and security teams) when someone is dumping tickets for kerberoasting by default? It's not common for any user or service to request for tickets for literally all your service accounts. Lastly, Microsoft has azure-keyvault in the cloud, but they're so focused on cloud, they don't have an on-prem keyvault solution. If a service account is compromised, you still have to find everything that uses it and change the password one by one. Where if there was a keyvault-like setup, you could more easily change passwords without causing outages. Rotating the KDC/krbtgt credential is also still a nightmare. From what bits I've heard, Microsoft expects its users to be using EntraId instead of on-prem domains (computers joined directly to entra-id instead of domain controllers). That's a nice dream, but in reality 20 years from know there will still be domain controllers on enterprise networks.
- mr_mitm 10mo ago> I've done kerberoasting and aseproasting a handful of times only, but from what I recall, RC4 can be cracked within reasonable time regardless of your password complexity That's not quite right. If the password is sufficiently strong, you won't crack it even when RC4 is used. The password space is infinite. You might be thinking of the LM hash, where you are guaranteed to find the password within minutes, because the password space is limited to 7 character passwords. > Rotating the KDC/krbtgt credential is also still a nightmare. I also disagree there. Just change it exactly once every two weeks or so. Just don't do it more than once within 10 hours. See: https://adsecurity.org/?p=4597 https://adsecurity.org/?p=4597 What I wonder is why Windows isn't changing it itself every 30 days or so, just like every computer account password. > why doesn't Microsoft alert directory administrators (and security teams) when someone is dumping tickets for kerberoasting by default? Good question. Probably because they want you to license some Defender product which does this.
- tracker1 10mo agoGiven the time it's been since deprecated, I'm assuming most older versions of Windows since 2000 and Samba have long since supported more secure options... though from some comments even the more secure options are relatively weak by today's standards as well. Aside: still hate working in orgs where you have a password reset multiple times a year... I tend to use some relatively long passphrases, if not the strongest possible... (ex: "ThisHasMyNewPassphrase%#23") I just need to be able to remember it through the first weekend each time I change without forgetting the phrase I used.
- christkv 10mo agoI mean this is what I use 1password for.
- SahAssar 10mo agoIf it's the IT managed computer login then you couldn't use a password manager for it, right? I think this is more the realm of using windows hello or apple touchid (AFAIK no good, simple, standard built-in way exists for linux distros) to get the first OS login and then you can use your password manager when you are logged into the OS.
- infogulch 10mo agook fine, two passwords then
- slashdave 10mo agoHardware MFA is available for logins, including Linux.
- SahAssar 10mo agoWhat method/program are you talking about? Does it support FDE? Is it reasonably supported with the methods expected by end users (fingerprint, face, smartcard, etc.)? Everytime I've tried its been finicky and had to use non-standard tools to get it working.
- ln809 10mo agoAuthor D.Goodin... ok,we know it's wrong. Just how badly wrong takes effort to discover.
- marcellus23 10mo agoDo you have context on this? Is Goodin generally known to be make mistakes?
- billpg 10mo agoWhat's the use case of a stream cipher when AES can be turned into a stream with a little XOR-ing?
- tptacek 10mo agoWhat's the use case of a block cipher when you can encrypt arbitrary-sized blocks with a stream cipher construction?
- djaouen 10mo agoNf n cebhq Nzrevpna, gur bayl pvcure V rire hfr vf EBG13!
- zamadatix 10mo agolbhghor.pbz/jngpu?i=JujdOHPLDB0&g=6f
- deleted 10mo ago[deleted]
- bastard_op 10mo agoNever underestimate the propensity for lazy windoze admins everywhere to ride with defaults for decades. They could fix it, but they typically don't know any better. There's still medical, hospitality, government, and industrial that probably runs off a nt4/2000 dc's somewhere, or at least xp era things they've said to kill but see above. Microsoft technically supported xp until 2019 in "iot" versions probably mostly for oracle pos systems that would never die after they acquired micros 20 years ago, probably still in your fav restaurant until around then. The joys of a windoze world, thanks microsoft for the advent of the lazy admin.