Windows Credential Guard Insufficient Checks On Kerberos Encryption Type Use

Windows CG APIs, which take encrypted keys, do not limit what encryption or checksum types can be used with those keys. This can result in using weak encryption algorithms which could be abused to either generate keystreams or brute force encryption keys.

credential encryption guard kerberos windows