github.com/jcmturner/gokrb5/v8@v8.4.4/crypto/des3-cbc-sha1-kd.go (about)

     1  package crypto
     2  
     3  import (
     4  	"crypto/des"
     5  	"crypto/hmac"
     6  	"crypto/sha1"
     7  	"errors"
     8  	"hash"
     9  
    10  	"github.com/jcmturner/gokrb5/v8/crypto/common"
    11  	"github.com/jcmturner/gokrb5/v8/crypto/rfc3961"
    12  	"github.com/jcmturner/gokrb5/v8/iana/chksumtype"
    13  	"github.com/jcmturner/gokrb5/v8/iana/etypeID"
    14  )
    15  
    16  //RFC: 3961 Section 6.3
    17  
    18  // Des3CbcSha1Kd implements Kerberos encryption type des3-cbc-hmac-sha1-kd
    19  type Des3CbcSha1Kd struct {
    20  }
    21  
    22  // GetETypeID returns the EType ID number.
    23  func (e Des3CbcSha1Kd) GetETypeID() int32 {
    24  	return etypeID.DES3_CBC_SHA1_KD
    25  }
    26  
    27  // GetHashID returns the checksum type ID number.
    28  func (e Des3CbcSha1Kd) GetHashID() int32 {
    29  	return chksumtype.HMAC_SHA1_DES3_KD
    30  }
    31  
    32  // GetKeyByteSize returns the number of bytes for key of this etype.
    33  func (e Des3CbcSha1Kd) GetKeyByteSize() int {
    34  	return 24
    35  }
    36  
    37  // GetKeySeedBitLength returns the number of bits for the seed for key generation.
    38  func (e Des3CbcSha1Kd) GetKeySeedBitLength() int {
    39  	return 21 * 8
    40  }
    41  
    42  // GetHashFunc returns the hash function for this etype.
    43  func (e Des3CbcSha1Kd) GetHashFunc() func() hash.Hash {
    44  	return sha1.New
    45  }
    46  
    47  // GetMessageBlockByteSize returns the block size for the etype's messages.
    48  func (e Des3CbcSha1Kd) GetMessageBlockByteSize() int {
    49  	//For traditional CBC mode with padding, it would be the underlying cipher's block size
    50  	return des.BlockSize
    51  }
    52  
    53  // GetDefaultStringToKeyParams returns the default key derivation parameters in string form.
    54  func (e Des3CbcSha1Kd) GetDefaultStringToKeyParams() string {
    55  	var s string
    56  	return s
    57  }
    58  
    59  // GetConfounderByteSize returns the byte count for confounder to be used during cryptographic operations.
    60  func (e Des3CbcSha1Kd) GetConfounderByteSize() int {
    61  	return des.BlockSize
    62  }
    63  
    64  // GetHMACBitLength returns the bit count size of the integrity hash.
    65  func (e Des3CbcSha1Kd) GetHMACBitLength() int {
    66  	return e.GetHashFunc()().Size() * 8
    67  }
    68  
    69  // GetCypherBlockBitLength returns the bit count size of the cypher block.
    70  func (e Des3CbcSha1Kd) GetCypherBlockBitLength() int {
    71  	return des.BlockSize * 8
    72  }
    73  
    74  // StringToKey returns a key derived from the string provided.
    75  func (e Des3CbcSha1Kd) StringToKey(secret string, salt string, s2kparams string) ([]byte, error) {
    76  	if s2kparams != "" {
    77  		return []byte{}, errors.New("s2kparams must be an empty string")
    78  	}
    79  	return rfc3961.DES3StringToKey(secret, salt, e)
    80  }
    81  
    82  // RandomToKey returns a key from the bytes provided.
    83  func (e Des3CbcSha1Kd) RandomToKey(b []byte) []byte {
    84  	return rfc3961.DES3RandomToKey(b)
    85  }
    86  
    87  // DeriveRandom generates data needed for key generation.
    88  func (e Des3CbcSha1Kd) DeriveRandom(protocolKey, usage []byte) ([]byte, error) {
    89  	r, err := rfc3961.DeriveRandom(protocolKey, usage, e)
    90  	return r, err
    91  }
    92  
    93  // DeriveKey derives a key from the protocol key based on the usage value.
    94  func (e Des3CbcSha1Kd) DeriveKey(protocolKey, usage []byte) ([]byte, error) {
    95  	r, err := e.DeriveRandom(protocolKey, usage)
    96  	if err != nil {
    97  		return nil, err
    98  	}
    99  	return e.RandomToKey(r), nil
   100  }
   101  
   102  // EncryptData encrypts the data provided.
   103  func (e Des3CbcSha1Kd) EncryptData(key, data []byte) ([]byte, []byte, error) {
   104  	return rfc3961.DES3EncryptData(key, data, e)
   105  }
   106  
   107  // EncryptMessage encrypts the message provided and concatenates it with the integrity hash to create an encrypted message.
   108  func (e Des3CbcSha1Kd) EncryptMessage(key, message []byte, usage uint32) ([]byte, []byte, error) {
   109  	return rfc3961.DES3EncryptMessage(key, message, usage, e)
   110  }
   111  
   112  // DecryptData decrypts the data provided.
   113  func (e Des3CbcSha1Kd) DecryptData(key, data []byte) ([]byte, error) {
   114  	return rfc3961.DES3DecryptData(key, data, e)
   115  }
   116  
   117  // DecryptMessage decrypts the message provided and verifies the integrity of the message.
   118  func (e Des3CbcSha1Kd) DecryptMessage(key, ciphertext []byte, usage uint32) ([]byte, error) {
   119  	return rfc3961.DES3DecryptMessage(key, ciphertext, usage, e)
   120  }
   121  
   122  // VerifyIntegrity checks the integrity of the plaintext message.
   123  func (e Des3CbcSha1Kd) VerifyIntegrity(protocolKey, ct, pt []byte, usage uint32) bool {
   124  	return rfc3961.VerifyIntegrity(protocolKey, ct, pt, usage, e)
   125  }
   126  
   127  // GetChecksumHash returns a keyed checksum hash of the bytes provided.
   128  func (e Des3CbcSha1Kd) GetChecksumHash(protocolKey, data []byte, usage uint32) ([]byte, error) {
   129  	return common.GetHash(data, protocolKey, common.GetUsageKc(usage), e)
   130  }
   131  
   132  // VerifyChecksum compares the checksum of the message bytes is the same as the checksum provided.
   133  func (e Des3CbcSha1Kd) VerifyChecksum(protocolKey, data, chksum []byte, usage uint32) bool {
   134  	c, err := e.GetChecksumHash(protocolKey, data, usage)
   135  	if err != nil {
   136  		return false
   137  	}
   138  	return hmac.Equal(chksum, c)
   139  }