credentials

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5/credentials"

Package credentials models the long-term secret a Kerberos client authenticates with, abstracting over the three forms Active Directory tooling uses: a cleartext password, an NT hash (the RC4-HMAC key — enabling overpass-the-hash), or a raw AES key (enabling pass-the-key). A Credential turns any of these into the per-etype key material the AS/TGS exchanges need.

type Credential

Credential is an immutable long-term secret bound to a principal.

type Credential struct {
    // contains filtered or unexported fields
}

func NewWithAESKey

func NewWithAESKey(username, realm string, etype int, key []byte) (*Credential, error)

NewWithAESKey creates a pass-the-key credential from a raw AES key. etype must be one of the AES-SHA1 or AES-SHA2 profiles (17-20) and match the profile’s 16- or 32-byte key length. The key is copied.

func NewWithHexAESKey

func NewWithHexAESKey(username, realm, hexKey string) (*Credential, error)

NewWithHexAESKey creates a pass-the-key credential from a hex-encoded AES key. The etype is inferred from the key length (16 bytes -> 17, 32 bytes -> 18).

func NewWithHexAESKeyForEType

func NewWithHexAESKeyForEType(username, realm string, etype int, hexKey string) (*Credential, error)

NewWithHexAESKeyForEType creates a pass-the-key credential for an explicit AES-SHA1 or AES-SHA2 enctype. Unlike NewWithHexAESKey, it does not infer the profile from the key length because the SHA1 and SHA2 variants use identical key sizes.

func NewWithHexNTHash

func NewWithHexNTHash(username, realm, hexHash string) (*Credential, error)

NewWithHexNTHash creates an NT-hash credential from a 32-character hex string (optionally an “LM:NT” pair, in which case the NT half is used).

func NewWithNTHash

func NewWithNTHash(username, realm string, ntHash []byte) (*Credential, error)

NewWithNTHash creates an NT-hash (overpass-the-hash) credential from a 16-byte hash. The hash is copied.

func NewWithPassword

func NewWithPassword(username, realm, password string) *Credential

NewWithPassword creates a password-based credential. The realm is upper-cased.

func (*Credential) DefaultSalt

func (c *Credential) DefaultSalt() string

DefaultSalt returns the Active Directory default string-to-key salt for a user account (UPPERCASE-REALM concatenated with the account name). The KDC may advertise a different salt in PA-ETYPE-INFO2; prefer that when present.

func (*Credential) Destroy

func (c *Credential) Destroy()

Destroy zeroes the secret material held by the credential.

func (*Credential) Key

func (c *Credential) Key(etype int, salt string, s2kparams []byte) ([]byte, error)

Key derives the long-term key for the requested etype.

Password: string-to-key over (salt, s2kparams); any supported etype.
NT hash: only etype 23 (RC4-HMAC); the hash itself is the key.
AES key: only the etype the key was created for.

It returns an error if the credential cannot produce a key of that etype (e.g. an NT hash cannot yield an AES key).

func (*Credential) Kind

func (c *Credential) Kind() SecretKind

Kind returns which form of secret this credential holds.

func (*Credential) Realm

func (c *Credential) Realm() string

Realm returns the upper-cased realm.

func (*Credential) SupportedETypes

func (c *Credential) SupportedETypes() []int

SupportedETypes returns the etypes this credential can produce keys for, in KDC-preference order (strongest first). It is used to build the AS-REQ etype list so the request advertises only etypes the client can actually complete.

func (*Credential) Username

func (c *Credential) Username() string

Username returns the principal’s account name.

type SecretKind

SecretKind identifies which form of long-term secret a Credential holds.

type SecretKind int

const (
    // SecretPassword is a cleartext password; keys of any supported etype can
    // be derived from it via string-to-key.
    SecretPassword SecretKind = iota
    // SecretNTHash is the NT hash (MD4 of the UTF-16LE password), which is
    // exactly the RC4-HMAC (etype 23) key — the basis of overpass-the-hash.
    SecretNTHash
    // SecretAESKey is a precomputed AES key for one specific etype (17-20),
    // the basis of pass-the-key.
    SecretAESKey
)