sspi/kerberos/
encryption_params.rs

1use picky_krb::constants::key_usages::{ACCEPTOR_SEAL, INITIATOR_SEAL};
2use picky_krb::crypto::CipherSuite;
3use picky_krb::crypto::aes::AesSize;
4
5use crate::Secret;
6
7#[derive(Debug, Clone)]
8pub struct EncryptionParams {
9    pub encryption_type: Option<CipherSuite>,
10    pub session_key: Option<Secret<Vec<u8>>>,
11    pub sub_session_key: Option<Secret<Vec<u8>>>,
12    pub sspi_encrypt_key_usage: i32,
13    pub sspi_decrypt_key_usage: i32,
14    /// EC field of the Kerberos Wrap token.
15    ///
16    /// Related documentation:
17    /// * [RFC 4121: EC Field](https://www.rfc-editor.org/rfc/rfc4121#section-4.2.3).
18    /// * [3.4.5.4.1 Kerberos Binding of GSS_WrapEx()](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/e94b3acd-8415-4d0d-9786-749d0c39d550).
19    ///
20    /// This value is different during RDP and RPC authentication.
21    /// We negotiate it during the authentication process.
22    pub ec: u16,
23}
24
25impl EncryptionParams {
26    pub fn default_for_client() -> Self {
27        Self {
28            encryption_type: None,
29            session_key: None,
30            sub_session_key: None,
31            sspi_encrypt_key_usage: INITIATOR_SEAL,
32            sspi_decrypt_key_usage: ACCEPTOR_SEAL,
33            ec: 0,
34        }
35    }
36
37    pub fn default_for_server() -> Self {
38        Self {
39            encryption_type: None,
40            session_key: None,
41            sub_session_key: None,
42            sspi_encrypt_key_usage: ACCEPTOR_SEAL,
43            sspi_decrypt_key_usage: INITIATOR_SEAL,
44            ec: 0,
45        }
46    }
47
48    pub fn aes_size(&self) -> Option<AesSize> {
49        self.encryption_type.as_ref().and_then(|e_type| match e_type {
50            CipherSuite::Aes256CtsHmacSha196 => Some(AesSize::Aes256),
51            CipherSuite::Aes128CtsHmacSha196 => Some(AesSize::Aes128),
52            CipherSuite::Des3CbcSha1Kd => None,
53        })
54    }
55}
sspi/kerberos/encryption_params.rs

sspi/kerberos/
encryption_params.rs
