Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In Kerberos, the answer is effectively no. To generate the NT hash, the password is hashed using a single round of MD4. This is what is used to encrypt (and sign) tickets.

The attack is, guess a password, hash it, and attempt to decrypt.

With AES Kerberos keys there is a salt... but not a good one. It is just the domain (realm) and the username.



Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: