kerbcrypto

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5/crypto"

Package kerbcrypto provides Kerberos cryptographic operations including string-to-key derivation, encryption, and decryption for RC4-HMAC and AES-CTS-HMAC-SHA1-96 encryption types.

Import path: github.com/TheManticoreProject/Manticore/network/kerberos/v5/crypto

Index

Constants
Variables
func Decrypt(etype int, key []byte, usage int, ciphertext []byte) ([]byte, error)
func Encrypt(etype int, key []byte, usage int, plaintext []byte) ([]byte, error)
func KeyLen(etype int) int
func StringToKey(etype int, password, salt string, params []byte) ([]byte, error)

Constants

Key usage constants per RFC 4120 Section 7.5.1.

const (
    // KeyUsageASReqPAEncTimestamp is the key usage for PA-ENC-TIMESTAMP.
    KeyUsageASReqPAEncTimestamp = 1
    // KeyUsageKDCRepTicket is the key usage for KDC-REP ticket encryption.
    KeyUsageKDCRepTicket = 2
    // KeyUsageASRepEncPart is the key usage for AS-REP encrypted part.
    KeyUsageASRepEncPart = 3
    // KeyUsageTGSReqPAAPReqAuthen is the key usage for TGS-REQ AP-REQ authenticator.
    KeyUsageTGSReqPAAPReqAuthen = 7
    // KeyUsageTGSRepEncSessionKey is the key usage for TGS-REP enc-part with session key.
    KeyUsageTGSRepEncSessionKey = 8
    // KeyUsageTGSRepEncSubSessionKey is the key usage for TGS-REP enc-part with sub-session key.
    KeyUsageTGSRepEncSubSessionKey = 9
    // KeyUsageAPReqAuthen is the key usage for AP-REQ authenticator.
    KeyUsageAPReqAuthen = 11
)

Variables

Sentinel errors for cryptographic operations.

var (
    // ErrCiphertextTooShort is returned when the ciphertext is too short to be valid.
    ErrCiphertextTooShort = errors.New("kerbcrypto: ciphertext too short")
    // ErrIntegrityCheckFailed is returned when the MAC verification fails.
    ErrIntegrityCheckFailed = errors.New("kerbcrypto: integrity check failed")
    // ErrUnsupportedEType is returned when an encryption type is not supported.
    ErrUnsupportedEType = errors.New("kerbcrypto: unsupported encryption type")
)

func Decrypt

func Decrypt(etype int, key []byte, usage int, ciphertext []byte) ([]byte, error)

Decrypt decrypts ciphertext with the given key, etype, and key usage number. Returns the plaintext (confounder is stripped).

func Encrypt

func Encrypt(etype int, key []byte, usage int, plaintext []byte) ([]byte, error)

Encrypt encrypts plaintext with the given key, etype, and key usage number. Returns the ciphertext including confounder and MAC.

func KeyLen

func KeyLen(etype int) int

KeyLen returns the key length in bytes for the given etype.

func StringToKey

func StringToKey(etype int, password, salt string, params []byte) ([]byte, error)

StringToKey derives an encryption key from a password and salt for the given etype. For RC4-HMAC (etype 23), the salt is ignored. For AES (etype 17/18), the salt is used with PBKDF2-HMAC-SHA1. The params argument carries S2KParams from PA-ETYPE-INFO2 (currently only iteration count for AES is supported; pass nil for defaults).