kadmin (and presumably other utilities) should report enctypes in a format that it takes them as an argument to -e, because it's difficult for someone who cares only rarely to remember that "Triple DES cbc mode with HMAC/sha1" is pronounced "des3-cbc-sha1"... or something like that. kcr