Comment Re: Ah, microsoft... (Score 1) 61
"the problem is not that the algorithm exists. The problem is how the algorithm is chosen, and the rules governing that spanned 20 years of code changes."
LOL, the algorithm was chosen because it made moving people off NT4 domains to AD back 25 years ago "easy"
They're talking about the algorithm that decides what cipher to use for key exchange, and AES has been supported for a while already. I know efforts to migrate from RC4 have been ongoing for a long time. It's a little late and pointless to be salty about cipher choices back in the early 2000s.. the web was barely even using https back then, asymmetric encryption was still "expensive".
For example, user accounts in windows will use AES by default, but if you create a service account you have to manually set the msDS-SupportedEncryptionTypes attribute to allow AES, else the key exchange falls back to RC4. I'm sure this was done because changing the default for service accounts broke some partners integrations somewhere sometime.
So you can have an AES keytab for your service, do everything right as far as you know, and the session key the app gets will be RC4, if you didn't set that attribute to let the KDC know your app supports AES session encryption. That's one of the main problems I can think of that they could fix by making RC4 opt-in instead of AES.
I barely get Kerberos, it's pretty backwards at first glance because PKI made it obsolete, but I can say if anyone doesn't understand Kerberos, you'd probably want to slowly back away from this conversation. It's not worth the lost brain cells to learn how this old symmetric key exchange system works. All you need to know if when someone says "hey let's use Kerberos instead of ssl", punch them right in the dick or vag. Also, big fuck you to the Kafka devs.