kerbcrypto

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5/crypto"

Package kerbcrypto provides Kerberos cryptographic operations including string-to-key derivation, encryption, and decryption for RC4-HMAC and AES-CTS-HMAC-SHA1-96 encryption types.

Import path: github.com/TheManticoreProject/Manticore/network/kerberos/v5/crypto

Index

• Constants
• Variables
• func ChecksumTypeForEType(etype int) (int, bool)
• func Decrypt(etype int, key []byte, usage int, ciphertext []byte) ([]byte, error)
• func Encrypt(etype int, key []byte, usage int, plaintext []byte) ([]byte, error)
• func GetChecksum(cksumType int, key []byte, usage int, data []byte) ([]byte, error)
• func KRBFXCF2(k1 []byte, k1Etype int, k2 []byte, k2Etype int, pepper1, pepper2 string) ([]byte, int, error)
• func KeyLen(etype int) int
• func PRF(etype int, key, input []byte) ([]byte, error)
• func StringToKey(etype int, password, salt string, params []byte) ([]byte, error)
• func VerifyChecksum(cksumType int, key []byte, usage int, data, want []byte) bool

Constants

Key usage constants per RFC 4120 Section 7.5.1, re-exported from the iana leaf package so callers can keep using kerbcrypto.KeyUsage* while iana remains the single source of truth.

const (
    KeyUsageASReqPAEncTimestamp    = iana.KeyUsageASReqPAEncTimestamp
    KeyUsageKDCRepTicket           = iana.KeyUsageKDCRepTicket
    KeyUsageASRepEncPart           = iana.KeyUsageASRepEncPart
    KeyUsageTGSReqPAAPReqAuthen    = iana.KeyUsageTGSReqPAAPReqAuthen
    KeyUsageTGSRepEncSessionKey    = iana.KeyUsageTGSRepEncSessionKey
    KeyUsageTGSRepEncSubSessionKey = iana.KeyUsageTGSRepEncSubSessionKey
    KeyUsageAPReqAuthen            = iana.KeyUsageAPReqAuthen
    KeyUsageAPRepEncPart           = iana.KeyUsageAPRepEncPart
    KeyUsageKRBCredEncPart         = iana.KeyUsageKRBCredEncPart
    KeyUsageKerbNonKerbSalt        = iana.KeyUsageKerbNonKerbSalt
)

Key-usage numbers introduced by RFC 6113 (Kerberos FAST). They live here alongside the FAST cryptographic primitives so callers pass them to Encrypt / GetChecksum without re-declaring the magic numbers.

const (
    // KeyUsageFASTReqChksum keys the req-checksum in KrbFastArmoredReq
    // (RFC 6113 §5.4.2, KEY_USAGE_FAST_REQ_CHKSUM = 50).
    KeyUsageFASTReqChksum = 50
    // KeyUsageFASTEnc keys the enc-fast-req EncryptedData in KrbFastArmoredReq
    // (RFC 6113 §5.4.2, KEY_USAGE_FAST_ENC = 51).
    KeyUsageFASTEnc = 51
    // KeyUsageFASTRep keys the enc-fast-rep EncryptedData in KrbFastArmoredRep
    // (RFC 6113 §5.4.3, KEY_USAGE_FAST_REP = 52).
    KeyUsageFASTRep = 52
    // KeyUsageFASTFinished keys the ticket-checksum in KrbFastFinished
    // (RFC 6113 §5.4.3, KEY_USAGE_FAST_FINISHED = 53).
    KeyUsageFASTFinished = 53
    // KeyUsageEncChallengeClient keys the client's PA-ENCRYPTED-CHALLENGE
    // (RFC 6113 §5.4.6, KEY_USAGE_ENC_CHALLENGE_CLIENT = 54).
    KeyUsageEncChallengeClient = 54
    // KeyUsageEncChallengeKDC keys the KDC's PA-ENCRYPTED-CHALLENGE reply
    // (RFC 6113 §5.4.6, KEY_USAGE_ENC_CHALLENGE_KDC = 55).
    KeyUsageEncChallengeKDC = 55
)

Variables

Sentinel errors for cryptographic operations.

var (
    // ErrCiphertextTooShort is returned when the ciphertext is too short to be valid.
    ErrCiphertextTooShort = errors.New("kerbcrypto: ciphertext too short")
    // ErrIntegrityCheckFailed is returned when the MAC verification fails.
    ErrIntegrityCheckFailed = errors.New("kerbcrypto: integrity check failed")
    // ErrUnsupportedEType is returned when an encryption type is not supported.
    ErrUnsupportedEType = errors.New("kerbcrypto: unsupported encryption type")
)

ErrUnsupportedCksumType is returned when a checksum type is not supported.

var ErrUnsupportedCksumType = fmt.Errorf("kerbcrypto: unsupported checksum type")

func ChecksumTypeForEType

func ChecksumTypeForEType(etype int) (int, bool)

ChecksumTypeForEType returns the checksum type paired with an encryption type (RFC 3961/3962/8009/4757), i.e. the checksum an authenticator or PA-FOR-USER should use when keyed with a key of that etype. Reports false for unsupported etypes.

func Decrypt

func Decrypt(etype int, key []byte, usage int, ciphertext []byte) ([]byte, error)

Decrypt decrypts ciphertext with the given key, etype, and key usage number. Returns the plaintext (confounder is stripped).

func Encrypt

func Encrypt(etype int, key []byte, usage int, plaintext []byte) ([]byte, error)

Encrypt encrypts plaintext with the given key, etype, and key usage number. Returns the ciphertext including confounder and MAC.

func GetChecksum

func GetChecksum(cksumType int, key []byte, usage int, data []byte) ([]byte, error)

GetChecksum computes a keyed Kerberos checksum of data for the given checksum type, protocol key, and key usage. The supported types are the ones paired with the enctypes this package implements:

15  hmac-sha1-96-aes128     (RFC 3961/3962, etype 17) — 12-byte output
16  hmac-sha1-96-aes256     (RFC 3961/3962, etype 18) — 12-byte output
19  hmac-sha256-128-aes128  (RFC 8009, etype 19)      — 16-byte output
20  hmac-sha384-192-aes256  (RFC 8009, etype 20)      — 24-byte output
-138 hmac-md5 (KERB_CHECKSUM_HMAC_MD5, RFC 4757, RC4) — 16-byte output

func KRBFXCF2

func KRBFXCF2(k1 []byte, k1Etype int, k2 []byte, k2Etype int, pepper1, pepper2 string) ([]byte, int, error)

KRBFXCF2 implements the RFC 6113 §5.1 KRB-FX-CF2 key-combination function:

KRB-FX-CF2(K1, K2, pepper1, pepper2) =
    random-to-key( PRF+(K1, pepper1) ^ PRF+(K2, pepper2) )

The two input keys may have different enctypes; the result adopts K1’s enctype (its key length drives the PRF+ output length and random-to-key). For every enctype implemented here random-to-key is the identity function, so the XOR of the two PRF+ streams is the combined key. The returned int is the result enctype (= k1Etype).

func KeyLen

func KeyLen(etype int) int

KeyLen returns the key length in bytes for the given etype.

func PRF

func PRF(etype int, key, input []byte) ([]byte, error)

PRF implements the RFC 3961 pseudo-random function for the given encryption type, as required by the KRB-FX-CF2 key combination of RFC 6113. Each enctype binds a specific construction:

• AES-CTS-HMAC-SHA1-96 (17/18), RFC 3962 §6: prf(key, s) = E(DK(key, “prf”), truncate-128(SHA-1(s))) i.e. AES-encrypt the first 16 bytes of SHA-1(s) under the “prf”-derived key.
• AES-CTS-HMAC-SHA2 (19/20), RFC 8009 §5: PRF(key, s) = KDF-HMAC-SHA2(key, “prf” | s, k) with k = 256 (SHA-256) or 384 (SHA-384).
• RC4-HMAC (23): HMAC-SHA1(key, s), matching the widely deployed arcfour-hmac PRF.

The output length is fixed by the enctype (16 bytes for AES-SHA1 and RC4, the full SHA-2 output for the RFC 8009 types).

func StringToKey

func StringToKey(etype int, password, salt string, params []byte) ([]byte, error)

StringToKey derives an encryption key from a password and salt for the given etype. For RC4-HMAC (etype 23), the salt is ignored. For AES (etype 17/18), the salt is used with PBKDF2-HMAC-SHA1. The params argument carries S2KParams from PA-ETYPE-INFO2 (currently only iteration count for AES is supported; pass nil for defaults).

func VerifyChecksum

func VerifyChecksum(cksumType int, key []byte, usage int, data, want []byte) bool

VerifyChecksum recomputes the checksum of data and compares it, in constant time, against want. It returns false (never an error) for unsupported types.