Struct Key 

pub struct Key { /* private fields */ }

A Kerberos key. Not Debug, not Display, not Serialize: the bytes leave this type only as a ciphertext, a checksum, or the EncryptionKey inside an encrypted part.

Implementations

impl Key

pub fn from_password(etype: i32, password: &str, salt: &str) -> Result<Self>

Derive a key from a password with PBKDF2-HMAC-SHA1, 4096 iterations (RFC 3962 §4’s default, and what both MIT and Heimdal use when no s2kparams are sent).

pub fn random(etype: i32) -> Result<Self>

A fresh random key from the operating system’s generator.

pub fn from_wire(etype: i32, bytes: Vec<u8>) -> Result<Self>

A key a peer delivered inside an encrypted part (a session key or a subkey).

pub fn etype(&self) -> i32

pub fn to_asn1(&self) -> EncryptionKey

The EncryptionKey structure carrying this key, for an encrypted part only.

pub fn from_asn1(key: &EncryptionKey) -> Result<Self>

Read an EncryptionKey out of a decrypted part.

pub fn bytes_for_ccache(&self) -> &[u8]

The raw key bytes, for the client’s credential cache file only.

pub fn encrypt(&self, usage: i32, plaintext: &[u8]) -> Result<Vec<u8>>

Encrypt plaintext under usage with a fresh random confounder.

pub fn encrypted_data( &self, usage: i32, plaintext: &[u8], kvno: Option<i64>, ) -> Result<EncryptedData>

Encrypt into an EncryptedData with this key’s enctype.

pub fn decrypt( &self, usage: i32, ciphertext: &[u8], ) -> Result<Vec<u8>, CryptoError>

Decrypt and verify. The HMAC-SHA1-96 over confounder and plaintext is recomputed here and compared in constant time; nothing is returned unless it matches.

pub fn decrypt_data( &self, usage: i32, data: &EncryptedData, ) -> Result<Vec<u8>, CryptoError>

Decrypt an EncryptedData, refusing one whose enctype is not this key’s.

pub fn checksum_type(&self) -> i32

The keyed checksum type that goes with this key’s enctype.

pub fn checksum(&self, usage: i32, data: &[u8]) -> Result<Vec<u8>>

The keyed checksum of data under usage: HMAC-SHA1-96 with the checksum key Kc = DK(key, usage | 0x99) (RFC 3961 §5.3, RFC 3962). Not the encryption integrity key Ki (usage | 0x55): the two differ, and only Heimdal’s TGS-REQ showed it, since NetGet’s client and KDC agreed with each other on the wrong one.

pub fn verify_checksum( &self, cksumtype: i32, usage: i32, data: &[u8], expected: &[u8], ) -> bool

Verify a keyed checksum. Only this key’s own checksum type is accepted: an unkeyed or foreign checksum type would let a peer that does not hold the key forge one.

Trait Implementations

impl Clone for Key

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.