sqlmapproject/sqlmap · error · KerberosError

unsupported encryption type %d (only AES-CTS-HMAC-SHA1 is im

Error message

unsupported encryption type %d (only AES-CTS-HMAC-SHA1 is implemented)

What it means

Error "unsupported encryption type %d (only AES-CTS-HMAC-SHA1 is implemented)" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/kerberos/client.py:63

USAGE_TGS_REP_ENCPART = 8
USAGE_AP_REQ_AUTH = 11

PVNO = 5
DEFAULT_ETYPES = (18, 17, 23)                               # aes256-cts, aes128-cts, rc4-hmac (best first)
KDC_TIMEOUT = 10                                            # seconds for the KDC TCP exchange
MAX_KDC_RESPONSE = 8 * 1024 * 1024                          # cap on a KDC reply (guards a hostile length prefix)
KERBEROS_TIME_FORMAT = "%Y%m%d%H%M%SZ"                      # RFC 4120 KerberosTime (always UTC)

# Bounds on the string-to-key work factor a KDC may ask for. The PA-ETYPE-INFO2 hint carrying it
# arrives on an *unauthenticated* KRB-ERROR, and the field is a full 32 bits, so an absurd value would
# either weaken the derived key against offline guessing or burn hours of CPU (RFC 3962 warns about
# both and recommends configurable bounds). A count of 0 nominally means 2**32, which we cannot honour.
MIN_PBKDF2_ITERATIONS = 4096                                # the RFC 3962 default; nothing legitimate is lower
MAX_PBKDF2_ITERATIONS = 1000000

def _enctype(etype):
    if etype not in ENCTYPES:
        raise KerberosError(-1, "unsupported encryption type %d (only AES-CTS-HMAC-SHA1 is implemented)" % etype)
    return ENCTYPES[etype]

class KerberosError(Exception):
    def __init__(self, code, text=None):
        Exception.__init__(self, "KDC error %d%s" % (code, ": %s" % text if text else ""))
        self.code = code

# ---- EXPLICIT-tag unwrap helpers ------------------------------------------------------------------
# Kerberos uses EXPLICIT tagging: an [n] field's content is a complete inner TLV, so it must be
# peeled before the value can be read. _fields() maps a SEQUENCE's [n] children to that inner TLV.
def _fields(sequenceContent):
    out = {}
    for tag, inner in der.children(sequenceContent):
        if 0xA0 <= tag <= 0xBE:                             # context-specific, constructed [0]..[30]
            out[tag - 0xA0] = inner
    return out

def _expInteger(field):

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/kerberos/client.py:63 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/2cad2c8529bedf07. Report an issue: GitHub.