Module jcifs

Package org.codelibs.jcifs.smb.pac

Class PacMac

java.lang.Object

org.codelibs.jcifs.smb.pac.PacMac

public class PacMac
extends Object

Utility class for calculating and verifying PAC (Privilege Attribute Certificate) message authentication codes. This class provides methods for computing MACs using various Kerberos encryption types including ARCFOUR-HMAC-MD5 and AES-based HMAC algorithms.

Method Summary

Modifier and Type	Method	Description
static byte[]	calculateMac(int type, Map<Integer,KerberosKey> keys, byte[] data)	Calculates a MAC (Message Authentication Code) for PAC data validation.
static byte[]	calculateMacArcfourHMACMD5(int keyusage, Key key, byte[] data)	Calculates a MAC using the ARCFOUR-HMAC-MD5 algorithm.
static byte[]	calculateMacHMACAES(int usage, KerberosKey baseKey, byte[] input)	Calculates a MAC using HMAC-SHA1 with AES key derivation.
static byte[]	deriveKeyAES(KerberosKey key, byte[] constant)	Derives an AES key using the Kerberos key derivation function.
static byte[]	expandNFold(byte[] data, int outlen)	Performs n-fold expansion of data as specified in RFC 3961.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

calculateMacArcfourHMACMD5

public static byte[] calculateMacArcfourHMACMD5(int keyusage,
 Key key,
 byte[] data)
                                         throws GeneralSecurityException

Calculates a MAC using the ARCFOUR-HMAC-MD5 algorithm. This method implements the Microsoft variant of the Kerberos ARCFOUR-HMAC-MD5 checksum.

Parameters:

keyusage - the Kerberos key usage number for this operation

key - the encryption key to use for MAC calculation

data - the data to calculate the MAC for

Returns:

the calculated MAC bytes

Throws:

GeneralSecurityException - if cryptographic operations fail

calculateMacHMACAES

public static byte[] calculateMacHMACAES(int usage,
 KerberosKey baseKey,
 byte[] input)
                                  throws GeneralSecurityException

Calculates a MAC using HMAC-SHA1 with AES key derivation. This method supports both AES-128 and AES-256 encryption types.

Parameters:

usage - the Kerberos key usage number for this operation

baseKey - the base Kerberos key for key derivation

input - the data to calculate the MAC for

Returns:

the calculated MAC bytes (truncated to 12 bytes)

Throws:

GeneralSecurityException - if cryptographic operations fail

deriveKeyAES

public static byte[] deriveKeyAES(KerberosKey key,
 byte[] constant)
                           throws GeneralSecurityException

Derives an AES key using the Kerberos key derivation function. This method implements the simplified key derivation for AES encryption types.

Parameters:

key - the base Kerberos key

constant - the key derivation constant

Returns:

the derived key bytes

Throws:

GeneralSecurityException - if cryptographic operations fail

expandNFold

public static byte[] expandNFold(byte[] data,
 int outlen)

Performs n-fold expansion of data as specified in RFC 3961. This operation is used in Kerberos key derivation to expand or compress input data to a specific output length.

Parameters:

data - the input data to expand

outlen - the desired output length in bytes

Returns:

the n-folded data of the specified length

calculateMac

public static byte[] calculateMac(int type,
 Map<Integer,KerberosKey> keys,
 byte[] data)
                           throws PACDecodingException

Calculates a MAC (Message Authentication Code) for PAC data validation.

Parameters:

type - the checksum type to use

keys - map of available Kerberos keys indexed by encryption type

data - the data to calculate the MAC for

Returns:

the calculated mac bytes

Throws:

PACDecodingException - if the MAC calculation fails or required keys are missing