# PKINIT Protocol Types
All PKINIT classes in `synta.krb5` are frozen (immutable after construction). Each provides
a `from_der(data: bytes)` static method for parsing. Fields that are OPTIONAL in the ASN.1
schema are exposed as `... | None`.
```python
import synta.krb5 as krb5
```
## EncryptionKey
RFC 3961 §2 encryption key structure.
```python
class EncryptionKey:
@staticmethod
def from_der(data: bytes) -> EncryptionKey: ...
keytype: int # Kerberos etype number
keyvalue: bytes # raw key material
```
## Checksum
RFC 3961 §4 checksum structure.
```python
class Checksum:
@staticmethod
def from_der(data: bytes) -> Checksum: ...
cksumtype: int # checksum type
checksum: bytes # raw checksum bytes
```
## KDFAlgorithmId
RFC 8636 §3.1 KDF algorithm identifier.
```python
class KDFAlgorithmId:
@staticmethod
def from_der(data: bytes) -> KDFAlgorithmId: ...
kdf_id: ObjectIdentifier # KDF algorithm OID
```
## IssuerAndSerialNumber
RFC 4556 §3.2.2 — identifies a certificate by issuer name and serial number.
```python
class IssuerAndSerialNumber:
@staticmethod
def from_der(data: bytes) -> IssuerAndSerialNumber: ...
issuer: bytes # DER-encoded Name SEQUENCE
serial_number: int # certificate serial number
```
## ExternalPrincipalIdentifier
RFC 4556 §3.2.2 — identifies a client certificate by one of three optional methods.
```python
class ExternalPrincipalIdentifier:
@staticmethod
def from_der(data: bytes) -> ExternalPrincipalIdentifier: ...
subject_name: bytes | None # DER of subject Name
issuer_and_serial_number: IssuerAndSerialNumber | None
subject_key_identifier: bytes | None # raw SKI bytes
```
## PKAuthenticator
RFC 4556 §3.2.1 — client proof of liveness in AS-REQ.
```python
class PKAuthenticator:
@staticmethod
def from_der(data: bytes) -> PKAuthenticator: ...
cusec: int # microseconds component (0–999999)
ctime: str # client time as "YYYYMMDDHHMMSSz"
nonce: int
pa_checksum: bytes | None # SHA-1 checksum of AS-REQ
freshness_token: bytes | None # RFC 8070 freshness token
```
## AuthPack
RFC 4556 §3.2.1 — content signed by the client.
```python
class AuthPack:
@staticmethod
def from_der(data: bytes) -> AuthPack: ...
pk_authenticator: PKAuthenticator
client_public_value: bytes | None # DER SubjectPublicKeyInfo
supported_cmstypes: bytes | None # DER AlgorithmIdentifiers
client_dhnonce: bytes | None
supported_kdfs: list[KDFAlgorithmId] | None # RFC 8636 KDF list
```
## PaPkAsReq
RFC 4556 §3.2.2 — PKINIT pre-authentication request.
```python
class PaPkAsReq:
@staticmethod
def from_der(data: bytes) -> PaPkAsReq: ...
signed_auth_pack: bytes # CMS SignedData wrapping AuthPack
trusted_certifiers: list[ExternalPrincipalIdentifier] | None
kdc_pk_id: bytes | None # raw SKI bytes for KDC certificate
```
## DHRepInfo
RFC 4556 §3.2.4 — KDC Diffie-Hellman reply data.
```python
class DHRepInfo:
@staticmethod
def from_der(data: bytes) -> DHRepInfo: ...
dh_signed_data: bytes # CMS SignedData wrapping KDCDHKeyInfo
server_dhnonce: bytes | None
```
## KDCDHKeyInfo
RFC 4556 §3.2.4 — KDC DH public key and nonce.
```python
class KDCDHKeyInfo:
@staticmethod
def from_der(data: bytes) -> KDCDHKeyInfo: ...
subject_public_key: bytes # BIT STRING payload bytes (KDC DH public key)
nonce: int
dh_key_expiration: str | None # "YYYYMMDDHHMMSSz"
```
## ReplyKeyPack
RFC 4556 §3.2.3 — session key and checksum from KDC (Diffie-Hellman-less path).
```python
class ReplyKeyPack:
@staticmethod
def from_der(data: bytes) -> ReplyKeyPack: ...
reply_key: EncryptionKey # the session key
as_checksum: Checksum # checksum over the AS-REQ
```
## PaPkAsRep
RFC 4556 §3.2.4 — PKINIT pre-authentication reply (CHOICE type).
```python
class PaPkAsRep:
@staticmethod
def from_der(data: bytes) -> PaPkAsRep: ...
variant: str # "DhInfo" or "EncKeyPack"
dh_info: DHRepInfo | None
enc_key_pack: bytes | None # CMS EnvelopedData bytes
```
See also [Kerberos V5 Types](krb5.md) for constants and [Krb5PrincipalName](krb5-principal.md)
for principal name encoding.