{"record":{"id":"2cad2c8529bedf07","repo":"sqlmapproject/sqlmap","slug":"unsupported-encryption-type-d-only-aes-cts-hmac","errorCode":null,"errorMessage":"unsupported encryption type %d (only AES-CTS-HMAC-SHA1 is implemented)","messagePattern":"unsupported encryption type (.+?) \\(only AES-CTS-HMAC-SHA1 is implemented\\)","errorType":"exception","errorClass":"KerberosError","httpStatus":null,"severity":"error","filePath":"extra/kerberos/client.py","lineNumber":63,"sourceCode":"USAGE_TGS_REP_ENCPART = 8\nUSAGE_AP_REQ_AUTH = 11\n\nPVNO = 5\nDEFAULT_ETYPES = (18, 17, 23)                               # aes256-cts, aes128-cts, rc4-hmac (best first)\nKDC_TIMEOUT = 10                                            # seconds for the KDC TCP exchange\nMAX_KDC_RESPONSE = 8 * 1024 * 1024                          # cap on a KDC reply (guards a hostile length prefix)\nKERBEROS_TIME_FORMAT = \"%Y%m%d%H%M%SZ\"                      # RFC 4120 KerberosTime (always UTC)\n\n# Bounds on the string-to-key work factor a KDC may ask for. The PA-ETYPE-INFO2 hint carrying it\n# arrives on an *unauthenticated* KRB-ERROR, and the field is a full 32 bits, so an absurd value would\n# either weaken the derived key against offline guessing or burn hours of CPU (RFC 3962 warns about\n# both and recommends configurable bounds). A count of 0 nominally means 2**32, which we cannot honour.\nMIN_PBKDF2_ITERATIONS = 4096                                # the RFC 3962 default; nothing legitimate is lower\nMAX_PBKDF2_ITERATIONS = 1000000\n\ndef _enctype(etype):\n    if etype not in ENCTYPES:\n        raise KerberosError(-1, \"unsupported encryption type %d (only AES-CTS-HMAC-SHA1 is implemented)\" % etype)\n    return ENCTYPES[etype]\n\nclass KerberosError(Exception):\n    def __init__(self, code, text=None):\n        Exception.__init__(self, \"KDC error %d%s\" % (code, \": %s\" % text if text else \"\"))\n        self.code = code\n\n# ---- EXPLICIT-tag unwrap helpers ------------------------------------------------------------------\n# Kerberos uses EXPLICIT tagging: an [n] field's content is a complete inner TLV, so it must be\n# peeled before the value can be read. _fields() maps a SEQUENCE's [n] children to that inner TLV.\ndef _fields(sequenceContent):\n    out = {}\n    for tag, inner in der.children(sequenceContent):\n        if 0xA0 <= tag <= 0xBE:                             # context-specific, constructed [0]..[30]\n            out[tag - 0xA0] = inner\n    return out\n\ndef _expInteger(field):","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/extra/kerberos/client.py#L45-L81","documentation":"Error \"unsupported encryption type %d (only AES-CTS-HMAC-SHA1 is implemented)\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at extra/kerberos/client.py:63 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}