{"slug": "generate-kerberos-aes-keys-from-a-known-password", "title": "Generate Kerberos AES keys from a known password", "summary": "The article describes a PowerShell function called `Get-KerberosAESKey` that generates Kerberos AES 128/256 encryption keys from a known password, salt (comprising the Kerberos realm and username/hostname), and iteration count. The function uses PBKDF2 to derive keys and has been verified against test values from RFC3962 and MS-KILE. It was authored by Kevin Robertson and is licensed under BSD 3-Clause.", "body_md": "Get-KerberosAESKey.ps1\n\n      This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.\n      \nLearn more about bidirectional Unicode characters\n\n \n    Show hidden characters\n\nfunction Get-KerberosAESKey\n\n{\n\n    <#\n\n    .SYNOPSIS\n\n    Generate Kerberos AES 128/256 keys from a known username/hostname, password, and kerberos realm. The\n\n    results have been verified against the test values in RFC3962, MS-KILE, and my own test lab.\n\n \n\n    https://tools.ietf.org/html/rfc3962\n\n    https://msdn.microsoft.com/library/cc233855.aspx\n\n    Author: Kevin Robertson (@kevin_robertson)  \n\n    License: BSD 3-Clause   \n\n    .PARAMETER Password\n\n    [String] Valid password.\n\n    .PARAMETER Salt\n\n    [String] Concatenated string containing the realm and username/hostname.\n\n    AD username format = uppercase realm + case sensitive username (e.g., TEST.LOCALusername, TEST.LOCALAdministrator)\n\n    AD hostname format = uppercase realm + the word host + lowercase hostname without the trailing '$' + . + lowercase\n\n    realm (e.g., TEST.LOCALhostwks1.test.local)\n\n    .PARAMETER Iteration\n\n    [Integer] Default = 4096: Int value representing how many iterations of PBKDF2 will be performed. AD uses the\n\n    default of 4096.\n\n \n\n    .PARAMETER OutputType\n\n    [String] Default = AES: (AES,AES128,AES256,AES128ByteArray,AES256ByteArray) AES, AES128, and AES256 will output strings.\n\n    AES128Byte and AES256Byte will output byte arrays.\n\n    .EXAMPLE\n\n    Verify results against first RFC3962 sample test vectors in section B.\n\n    Get-KerberosAESKey -Password password -Salt ATHENA.MIT.EDUraeburn -Iteration 1\n\n \n\n    .EXAMPLE\n\n    Generate keys for a valid AD user.\n\n    Get-KerberosAESKey -Salt TEST.LOCALuser\n\n    .LINK\n\n    https://gist.github.com/kevin-robertson/\n\n    #>\n\n    [CmdletBinding()]\n\n    param\n\n    ( \n\n        [parameter(Mandatory=$false)][String]$Password,\n\n        [parameter(Mandatory=$true)][String]$Salt,\n\n        [parameter(Mandatory=$false)][ValidateSet(\"AES\",\"AES128\",\"AES256\",\"AES128ByteArray\",\"AES256ByteArray\")][String]$OutputType = \"AES\",\n\n        [parameter(Mandatory=$false)][Int]$Iteration=4096\n\n    )\n\n \n\n    if(!$Password)\n\n    {\n\n        $secure_password = Read-Host -Prompt \"Enter password\" -AsSecureString\n\n        $password_memory = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure_password)\n\n        $password = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($password_memory)\n\n    }\n\n \n\n    [Byte[]]$password_bytes = [System.Text.Encoding]::UTF8.GetBytes($Password)\n\n    [Byte[]]$salt_bytes = [System.Text.Encoding]::UTF8.GetBytes($Salt)\n\n    $AES256_constant = 0x6B,0x65,0x72,0x62,0x65,0x72,0x6F,0x73,0x7B,0x9B,0x5B,0x2B,0x93,0x13,0x2B,0x93,0x5C,0x9B,0xDC,0xDA,0xD9,0x5C,0x98,0x99,0xC4,0xCA,0xE4,0xDE,0xE6,0xD6,0xCA,0xE4\n\n    $AES128_constant = 0x6B,0x65,0x72,0x62,0x65,0x72,0x6F,0x73,0x7B,0x9B,0x5B,0x2B,0x93,0x13,0x2B,0x93\n\n    $IV = 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 \n\n    $PBKDF2 = New-Object Security.Cryptography.Rfc2898DeriveBytes($password_bytes,$salt_bytes,$iteration)\n\n    $PBKDF2_AES256_key = $PBKDF2.GetBytes(32)\n\n    $PBKDF2_AES128_key = $PBKDF2_AES256_key[0..15]\n\n    $PBKDF2_AES256_key_string = ([System.BitConverter]::ToString($PBKDF2_AES256_key)) -replace \"-\",\"\"\n\n    $PBKDF2_AES128_key_string = ([System.BitConverter]::ToString($PBKDF2_AES128_key)) -replace \"-\",\"\"\n\n    Write-Verbose \"PBKDF2 AES128 Key: $PBKDF2_AES128_key_string\"\n\n    Write-Verbose \"PBKDF2 AES256 Key: $PBKDF2_AES256_key_string\"\n\n    $AES = New-Object \"System.Security.Cryptography.AesManaged\"\n\n    $AES.Mode = [System.Security.Cryptography.CipherMode]::CBC\n\n    $AES.Padding = [System.Security.Cryptography.PaddingMode]::None\n\n    $AES.IV = $IV\n\n    # AES 256\n\n    $AES.KeySize = 256\n\n    $AES.Key = $PBKDF2_AES256_key\n\n    $AES_encryptor = $AES.CreateEncryptor()\n\n    $AES256_key_part_1 = $AES_encryptor.TransformFinalBlock($AES256_constant,0,$AES256_constant.Length)\n\n    $AES256_key_part_2 = $AES_encryptor.TransformFinalBlock($AES256_key_part_1,0,$AES256_key_part_1.Length)\n\n    $AES256_key = $AES256_key_part_1[0..15] + $AES256_key_part_2[0..15]\n\n    $AES256_key_string = ([System.BitConverter]::ToString($AES256_key)) -replace \"-\",\"\"    \n\n    # AES 128\n\n    $AES.KeySize = 128\n\n    $AES.Key = $PBKDF2_AES128_key\n\n    $AES_encryptor = $AES.CreateEncryptor()\n\n    $AES128_key = $AES_encryptor.TransformFinalBlock($AES128_constant,0,$AES128_constant.Length)\n\n    $AES128_key_string = ([System.BitConverter]::ToString($AES128_key)) -replace \"-\",\"\"\n\n \n\n    switch($OutputType)\n\n    {\n\n \n\n        'AES'\n\n        {\n\n            Write-Output \"AES128 Key: $AES128_key_string\"\n\n            Write-Output \"AES256 Key: $AES256_key_string\"\n\n        }\n\n \n\n        'AES128'\n\n        {\n\n            Write-Output \"$AES128_key_string\"\n\n        }\n\n \n\n        'AES256'\n\n        {\n\n            Write-Output \"$AES256_key_string\"\n\n        }\n\n \n\n        'AES128ByteArray'\n\n        {\n\n            Write-Output $AES128_key\n\n        }\n\n \n\n        'AES256ByteArray'\n\n        {\n\n            Write-Output $AES256_key\n\n        }\n\n \n\n    }\n\n \n\n}", "url": "https://wpnews.pro/news/generate-kerberos-aes-keys-from-a-known-password", "canonical_source": "https://gist.github.com/Kevin-Robertson/9e0f8bfdbf4c1e694e6ff4197f0a4372", "published_at": "2017-08-08 15:55:34+00:00", "updated_at": "2026-05-22 14:44:56.729578+00:00", "lang": "en", "topics": ["cybersecurity"], "entities": ["Kevin Robertson", "RFC3962", "MS-KILE", "Microsoft"], "alternates": {"html": "https://wpnews.pro/news/generate-kerberos-aes-keys-from-a-known-password", "markdown": "https://wpnews.pro/news/generate-kerberos-aes-keys-from-a-known-password.md", "text": "https://wpnews.pro/news/generate-kerberos-aes-keys-from-a-known-password.txt", "jsonld": "https://wpnews.pro/news/generate-kerberos-aes-keys-from-a-known-password.jsonld"}}