crypto

Documentation

Overview

Package crypto defines Kerberos encryption-type and checksum interfaces.

Index

• Constants
• Variables
• func CF2(etype EType, key1, key2, pepper1, pepper2 []byte) ([]byte, error)
• func DecryptWithIV(etype EType, key []byte, usage uint32, ciphertext, iv []byte) ([]byte, []byte, error)
• func EncryptWithIV(etype EType, key []byte, usage uint32, plaintext, iv []byte) ([]byte, []byte, error)
• func PRF(etype EType, key, input []byte) ([]byte, error)
• func SetRandomSource(source types.RandomSource) func()
• type EType
• type Registry
  • func NewRegistry() *Registry
  • func (r *Registry) Get(id int32) (EType, error)
• type StatefulEType

Constants

const (
	EnctypeAES128SHA1   int32 = 17
	EnctypeAES256SHA1   int32 = 18
	EnctypeAES128SHA256 int32 = 19
	EnctypeAES256SHA384 int32 = 20

	ChecksumHMACSHA196AES128    int32 = 15
	ChecksumHMACSHA196AES256    int32 = 16
	ChecksumHMACSHA256128AES128 int32 = 19
	ChecksumHMACSHA384192AES256 int32 = 20
)

Variables

var RandomSource types.RandomSource = cryptorand.Reader

RandomSource supplies confounders for encryption. Tests may replace it with a deterministic reader; production code leaves it as rand.Reader.

Functions

func CF2

func CF2(etype EType, key1, key2, pepper1, pepper2 []byte) ([]byte, error)

CF2 combines two keys using the RFC 6113 KRB-FX-CF2 construction.

func DecryptWithIV

func DecryptWithIV(etype EType, key []byte, usage uint32, ciphertext, iv []byte) ([]byte, []byte, error)

DecryptWithIV performs authenticated decryption with an explicit CBC-CTS IV and returns the next MIT auth-context state.

func EncryptWithIV

func EncryptWithIV(etype EType, key []byte, usage uint32, plaintext, iv []byte) ([]byte, []byte, error)

EncryptWithIV performs authenticated encryption with an explicit CBC-CTS IV and returns the next MIT auth-context state.

func PRF

func PRF(etype EType, key, input []byte) ([]byte, error)

PRF computes the enctype-specific Kerberos pseudorandom function.

func SetRandomSource

func SetRandomSource(source types.RandomSource) func()

SetRandomSource replaces the confounder source and returns a restore hook.

Types

type EType

type EType interface {
	ID() int32
	KeySize() int
	StringToKey(password, salt, params []byte) ([]byte, error)
	Encrypt(key []byte, usage uint32, plaintext []byte) ([]byte, error)
	Decrypt(key []byte, usage uint32, ciphertext []byte) ([]byte, error)
	Checksum(key []byte, usage uint32, data []byte) ([]byte, error)
	ChecksumSize() int
	VerifyChecksum(key []byte, usage uint32, data, checksum []byte) error
}

EType is the common Kerberos encryption-type and checksum contract.

type Registry

type Registry struct{}

Registry selects one of the supported AES enctypes.

func NewRegistry

func NewRegistry() *Registry

func (*Registry) Get

func (r *Registry) Get(id int32) (EType, error)

type StatefulEType

type StatefulEType interface {
	EType
	EncryptWithIV(key []byte, usage uint32, plaintext, iv []byte) (ciphertext, nextIV []byte, err error)
	DecryptWithIV(key []byte, usage uint32, ciphertext, iv []byte) (plaintext, nextIV []byte, err error)
}

StatefulEType is implemented by block enctypes which support the MIT auth-context cipher state used by KRB-PRIV streams.