Manticore is the Go library that backs the offensive and defensive security tooling of The Manticore Project. It collects the low-level primitives those tools rely on: wire structures, cryptographic key formats, identifier types, and parsers for the binary blobs that Windows and Active Directory hand you. The goal is that a tool author never has to re-implement a security descriptor parser or a UUID generator from scratch.
In this release, v1.0.6, I focused on two fronts. The first is breadth: new Windows CNG/BCrypt key structures and the remaining members of the UUID family. The second is consistency: a sweep across the codebase to align naming and parsing APIs so that everything behaves the same way.
Windows CNG/BCrypt key structures
The main addition in this release is the windows/cng/bcrypt structures. The Windows Cryptography API: Next Generation (CNG) exports and imports keys as binary blobs prefixed by a fixed-layout header, and parsing those blobs correctly is a recurring need when you handle keys pulled from a Windows host.
This release lays down the base set of BCrypt key structures and adds an explicit implementation of BCRYPT_DSA_KEY. Having these as first-class types in Manticore means tooling can read and write CNG key material without hand-rolling the header layouts each time.
Completing the UUID family
Manticore already had partial UUID support, and this release fills it out. UUID versions 3, 4, 6, and 7 are now implemented, closing several open issues in one pass.
The practical value is being able to pick the right identifier for the job: version 4 for random identifiers, version 3 for deterministic name-based ones, and the newer versions 6 and 7 for time-ordered identifiers that sort well in databases and logs. Having the full family in one place keeps tooling from reaching for an external dependency just to mint an identifier.
API consistency: Unmarshal everywhere
A library is only pleasant to use if its parsing APIs are predictable. This release standardises on Unmarshal() as the name for the operation that turns a byte slice into a populated structure. The old FromBytes() naming was renamed to Unmarshal() across the codebase, and ldap.DNWithBinary.Parse() was likewise renamed to Unmarshal() to match.
Alongside that, (*KeyCredential).Unmarshal was changed so that malformed input returns an error rather than panicking, which matters when feeding it untrusted data from the wire. All structures were also renamed to follow a single naming convention, so related types read the same way regardless of which package they live in.
SID refactor and cleanup
The network/ldap/sid package was refactored to build on the winacl/sid.SID{} structs rather than carrying its own SID representation. Consolidating on a single SID type avoids subtle conversions and keeps SID handling consistent with the rest of the security-descriptor code in the ecosystem.
Finally, the remaining fmt.Print*(...) calls that had been left in the codebase for testing were removed, so the library no longer writes stray output to standard out when used as a dependency.