msDS-SupportedEncryptionTypes + etypes: How to calculate Kerberos Encryption Types

Once again, I'm publishing content related to the imminent Kerberos hardening that Microsoft is carrying out due to the CVE-2026-20833 vulnerability. In this article, I'll explain how to calculate the value of msDS-SupportedEncryptionTypes (msDS-SET from now on), and avoid confusing this value with what are known as etypes.

Kerberos supported encryption types calculator

Later in this article, we'll explore three sections (msDS-SET, DefaultDomainSupportedEncTypes, and SupportedEncryptionTypes) where we define Kerberos encryption types using the same values. Microsoft uses a bitmap to apply one value or another, but initially, I prefer to use the simplest values first and then explain this table in detail.

• BInary - Hex. - Decimal - Result

• 0000 0001 - 0x01 - 1 - Enables DES-CBC-CRC only.

• 0000 0010 - 0x02 - 2 - Enables DES-CBC-MD5 only.

• 0000 0100 - 0x04 - 4 - Enables RC4-HMAC only.

• 0000 1000 - 0x08 - 8 - Enables AES128-CTS-HMAC-SHA1-96 only.

• 0001 0000 - 0x10 - 16 - Enables AES256-CTS-HMAC-SHA1-96 only.

• 0010 0000 - 0x20 - 32 - Enables AES256-CTS-HMAC-SHA1-96-SK only.

Initially, using decimal values is very simple: for example, if we have the value 4, we enable RC4, while if we use 16, we would have AES256. And if we want to add another encryption method? We add them together:

• 0001 1000- 0x18 - 24 - AES256-CTS-HMAC-SHA1-96 + AES128-CTS-HMAC-SHA1-96.

• 0001 1100 - 0x1C - 28 - AES256-CTS-HMAC-SHA1-96 + AES128-CTS-HMAC-SHA1-96 + RC4-HMAC.

• 0001 1111 - 0x1F - 31 - AES256-CTS-HMAC-SHA1-96 + AES128-CTS-HMAC-SHA1-96 + RC4-HMAC + DES-CBC-MD5 + DES-CBC-CRC.

• 0010 0100 - 0x24 - 36 - AES256-CTS-HMAC-SHA1-96-SK + RC4-HMAC.

Among the mentioned ciphers, I want to emphasize AES256-CTS-HMAC-SHA1-96-SK. This cipher is used to add AES256-encrypted session keys to tickets that may already be encrypted with another cipher. By this way, Microsoft managed to increase the security of Active Directory domains back in November 2022.

In addition to the ciphers mentioned, there are other values that improve Kerberos authentication by supporting technologies such as FAST, Compound Identity, and Claims. These technologies are used in federated environments and/or with authentication policies. This article will not detail them, but it's important to know that there are other values that may affect us later.

Why we use binary and hexadecimal values?

We need binary because there are more values, and converting from decimal to binary will help us determine which encryption types are enabled. For example, when all ciphers are enabled, the decimal value is 2,147,483,647. How do we know if RC4 is enabled? By using a calculator and looking at the third-to-last bit. Since it's 1, we know it's enabled. On Windows Server, we'll often see values displayed in both hexadecimal and decimal, which can be a bit more confusing.

msDS-SupportedEncryptionTypes

The msDS-SET attribute is an Active Directory attribute that appears in three types of accounts:

• Users

• Computers

• Services (MSA accounts)

For computers, the default value when joining them to a domain is 28 (RC4, AES128, and AES256). This value is updated according to the value in the computer's SupportedEncryptionTypes registry key, although it only uses the last 5 bits (DES, RC4, and AES encryptions), and it takes some minutes for the change to take effect.

User and service accounts, on the other hand, will only have a value if we manually set it up.

SupportedEncryptionTypes

• Path: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\

• Key: SupportedEncryptionTypes

• Type: DWORD

By default, this key does not exist, but it is treated as if it did with a decimal value of 28 (RC4+AES128+AES256). This registry key can be created on any domain-joined computer. It is usually done through a policy (either local or group, although group policies are generally recommended):

• Path: Computer / Windows Settings / Security Settings / Local Policies / Security Options

• Policy: Network Security: Configure encryption types allowed for Kerberos

In addition to the five traditional encryption types, this policy allows us to select "Future encryption types," which are the additional Kerberos features we discussed earlier. When we select this option, we'll see that the registry key becomes very large, up to 2,147,483,647 if we've also enabled the other encryption types.

DefaultDomainSupportedEncTypes

• Path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\KDC\

• Key: DefaultDomainSupportedEncTypes

• Type: DWORD

This registry key applies only to Domain Controllers. It is used to define the encryption types for service accounts that do not have the msDS-SET attribute defined. By default, this registry key does not exist, but there is a default behavior:

• Windows Server 2025: 0x24 (36) - RC4 + AES256 for session key

• Windows Server 2022 and earlier: 0x27 (39): - DES-CBC_CRC, DES-CBC-MD5, RC4 + AES256 for session key.

If we don't create the registration key, hardening will arrive in April, changing the default value to 0x18 (24). By default, only AES128 and AES256 ciphers will be supported.

etypes

Additionally, there's a unique way of naming the encryption types used in Kerberos tickets: etypes. We'll see this typology in Windows Server security events. In etypes, each encryption is represented by a distinct number; there are no sums or combinations of different encryption types. Because these numbers are similar, they can be confusing, but they are completely unrelated to the numbers we discussed at the beginning of this article for registry keys and attributes. Furthermore, using the binary system in these cases is not appropriate. These are the most common etypes:

• Cipher- Hex - Decimal

• DES-CBC-CRC - 0x1 - 1

• DES-CBC-MD5 - 0x3 - 3

• RC4-HMAC-MD5 - 0x17 - 23

• AES128-CTS-HMAC-SHA1-96 - 0x11 - 17

• AES256-CTS-HMAC-SHA1-96 - 0x12 - 18