You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by dr...@apache.org on 2015/01/12 14:06:27 UTC
[19/50] [abbrv] directory-kerberos git commit: Renaming packages in
haox-kerb projects, using "apache"
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Md4.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Md4.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Md4.java
new file mode 100644
index 0000000..7f72058
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Md4.java
@@ -0,0 +1,269 @@
+package org.apache.kerberos.kerb.crypto;
+
+//http://www.java2s.com/Code/Java/Security/ImplementstheMD4messagedigestalgorithminJava.htm
+
+/*
+ * Copyright (c) 1997 Systemics Ltd
+ * on behalf of the Cryptix Development Team. All rights reserved.
+ */
+
+import java.security.MessageDigest;
+
+/**
+ * Implements the MD4 message digest algorithm in Java.
+ * <p>
+ * <b>References:</b>
+ * <ol>
+ * <li> Ronald L. Rivest,
+ * "<a href="http://www.roxen.com/rfc/rfc1320.html">
+ * The MD4 Message-Digest Algorithm</a>",
+ * IETF RFC-1320 (informational).
+ * </ol>
+ *
+ * <p><b>$Revision: 1.2 $</b>
+ * @author Raif S. Naffah
+ */
+public class Md4 extends MessageDigest implements Cloneable
+{
+ /**
+ * The size in bytes of the input block to the tranformation algorithm.
+ */
+ private static final int BLOCK_LENGTH = 64; // = 512 / 8;
+
+ /**
+ * 4 32-bit words (interim result)
+ */
+ private int[] context = new int[4];
+
+ /**
+ * Number of bytes processed so far mod. 2 power of 64.
+ */
+ private long count;
+
+ /**
+ * 512 bits input buffer = 16 x 32-bit words holds until reaches 512 bits.
+ */
+ private byte[] buffer = new byte[BLOCK_LENGTH];
+
+ /**
+ * 512 bits work buffer = 16 x 32-bit words
+ */
+ private int[] X = new int[16];
+
+ public Md4() {
+ super("MD4");
+ engineReset();
+ }
+
+ /**
+ * This constructor is here to implement cloneability of this class.
+ */
+ private Md4(Md4 md) {
+ this();
+ context = (int[])md.context.clone();
+ buffer = (byte[])md.buffer.clone();
+ count = md.count;
+ }
+
+ /**
+ * Returns a copy of this MD object.
+ */
+ public Object clone() { return new Md4(this); }
+
+ /**
+ * Resets this object disregarding any temporary data present at the
+ * time of the invocation of this call.
+ */
+ public void engineReset () {
+ // initial values of MD4 i.e. A, B, C, D
+ // as per rfc-1320; they are low-order byte first
+ context[0] = 0x67452301;
+ context[1] = 0xEFCDAB89;
+ context[2] = 0x98BADCFE;
+ context[3] = 0x10325476;
+ count = 0L;
+ for (int i = 0; i < BLOCK_LENGTH; i++)
+ buffer[i] = 0;
+ }
+
+ /**
+ * Continues an MD4 message digest using the input byte.
+ */
+ public void engineUpdate (byte b) {
+ // compute number of bytes still unhashed; ie. present in buffer
+ int i = (int)(count % BLOCK_LENGTH);
+ count++; // update number of bytes
+ buffer[i] = b;
+ if (i == BLOCK_LENGTH - 1)
+ transform(buffer, 0);
+ }
+
+ /**
+ * MD4 block update operation.
+ * <p>
+ * Continues an MD4 message digest operation, by filling the buffer,
+ * transform(ing) data in 512-bit message block(s), updating the variables
+ * context and count, and leaving (buffering) the remaining bytes in buffer
+ * for the next update or finish.
+ *
+ * @param input input block
+ * @param offset start of meaningful bytes in input
+ * @param len count of bytes in input block to consider
+ */
+ public void engineUpdate (byte[] input, int offset, int len) {
+ // make sure we don't exceed input's allocated size/length
+ if (offset < 0 || len < 0 || (long)offset + len > input.length)
+ throw new ArrayIndexOutOfBoundsException();
+
+ // compute number of bytes still unhashed; ie. present in buffer
+ int bufferNdx = (int)(count % BLOCK_LENGTH);
+ count += len; // update number of bytes
+ int partLen = BLOCK_LENGTH - bufferNdx;
+ int i = 0;
+ if (len >= partLen) {
+ System.arraycopy(input, offset, buffer, bufferNdx, partLen);
+
+
+ transform(buffer, 0);
+
+ for (i = partLen; i + BLOCK_LENGTH - 1 < len; i+= BLOCK_LENGTH)
+ transform(input, offset + i);
+ bufferNdx = 0;
+ }
+ // buffer remaining input
+ if (i < len)
+ System.arraycopy(input, offset + i, buffer, bufferNdx, len - i);
+ }
+
+ /**
+ * Completes the hash computation by performing final operations such
+ * as padding. At the return of this engineDigest, the MD engine is
+ * reset.
+ *
+ * @return the array of bytes for the resulting hash value.
+ */
+ public byte[] engineDigest () {
+ // pad output to 56 mod 64; as RFC1320 puts it: congruent to 448 mod 512
+ int bufferNdx = (int)(count % BLOCK_LENGTH);
+ int padLen = (bufferNdx < 56) ? (56 - bufferNdx) : (120 - bufferNdx);
+
+ // padding is alwas binary 1 followed by binary 0s
+ byte[] tail = new byte[padLen + 8];
+ tail[0] = (byte)0x80;
+
+ // append length before final transform:
+ // save number of bits, casting the long to an array of 8 bytes
+ // save low-order byte first.
+ for (int i = 0; i < 8; i++)
+ tail[padLen + i] = (byte)((count * 8) >>> (8 * i));
+
+ engineUpdate(tail, 0, tail.length);
+
+ byte[] result = new byte[16];
+ // cast this MD4's context (array of 4 ints) into an array of 16 bytes.
+ for (int i = 0; i < 4; i++)
+ for (int j = 0; j < 4; j++)
+ result[i * 4 + j] = (byte)(context[i] >>> (8 * j));
+
+ // reset the engine
+ engineReset();
+ return result;
+ }
+
+ /**
+ * MD4 basic transformation.
+ * <p>
+ * Transforms context based on 512 bits from input block starting
+ * from the offset'th byte.
+ *
+ * @param block input sub-array.
+ * @param offset starting position of sub-array.
+ */
+ private void transform (byte[] block, int offset) {
+
+ // encodes 64 bytes from input block into an array of 16 32-bit
+ // entities. Use A as a temp var.
+ for (int i = 0; i < 16; i++)
+ X[i] = (block[offset++] & 0xFF) |
+ (block[offset++] & 0xFF) << 8 |
+ (block[offset++] & 0xFF) << 16 |
+ (block[offset++] & 0xFF) << 24;
+
+
+ int A = context[0];
+ int B = context[1];
+ int C = context[2];
+ int D = context[3];
+
+ A = FF(A, B, C, D, X[ 0], 3);
+ D = FF(D, A, B, C, X[ 1], 7);
+ C = FF(C, D, A, B, X[ 2], 11);
+ B = FF(B, C, D, A, X[ 3], 19);
+ A = FF(A, B, C, D, X[ 4], 3);
+ D = FF(D, A, B, C, X[ 5], 7);
+ C = FF(C, D, A, B, X[ 6], 11);
+ B = FF(B, C, D, A, X[ 7], 19);
+ A = FF(A, B, C, D, X[ 8], 3);
+ D = FF(D, A, B, C, X[ 9], 7);
+ C = FF(C, D, A, B, X[10], 11);
+ B = FF(B, C, D, A, X[11], 19);
+ A = FF(A, B, C, D, X[12], 3);
+ D = FF(D, A, B, C, X[13], 7);
+ C = FF(C, D, A, B, X[14], 11);
+ B = FF(B, C, D, A, X[15], 19);
+
+ A = GG(A, B, C, D, X[ 0], 3);
+ D = GG(D, A, B, C, X[ 4], 5);
+ C = GG(C, D, A, B, X[ 8], 9);
+ B = GG(B, C, D, A, X[12], 13);
+ A = GG(A, B, C, D, X[ 1], 3);
+ D = GG(D, A, B, C, X[ 5], 5);
+ C = GG(C, D, A, B, X[ 9], 9);
+ B = GG(B, C, D, A, X[13], 13);
+ A = GG(A, B, C, D, X[ 2], 3);
+ D = GG(D, A, B, C, X[ 6], 5);
+ C = GG(C, D, A, B, X[10], 9);
+ B = GG(B, C, D, A, X[14], 13);
+ A = GG(A, B, C, D, X[ 3], 3);
+ D = GG(D, A, B, C, X[ 7], 5);
+ C = GG(C, D, A, B, X[11], 9);
+ B = GG(B, C, D, A, X[15], 13);
+
+ A = HH(A, B, C, D, X[ 0], 3);
+ D = HH(D, A, B, C, X[ 8], 9);
+ C = HH(C, D, A, B, X[ 4], 11);
+ B = HH(B, C, D, A, X[12], 15);
+ A = HH(A, B, C, D, X[ 2], 3);
+ D = HH(D, A, B, C, X[10], 9);
+ C = HH(C, D, A, B, X[ 6], 11);
+ B = HH(B, C, D, A, X[14], 15);
+ A = HH(A, B, C, D, X[ 1], 3);
+ D = HH(D, A, B, C, X[ 9], 9);
+ C = HH(C, D, A, B, X[ 5], 11);
+ B = HH(B, C, D, A, X[13], 15);
+ A = HH(A, B, C, D, X[ 3], 3);
+ D = HH(D, A, B, C, X[11], 9);
+ C = HH(C, D, A, B, X[ 7], 11);
+ B = HH(B, C, D, A, X[15], 15);
+
+ context[0] += A;
+ context[1] += B;
+ context[2] += C;
+ context[3] += D;
+ }
+
+ // The basic MD4 atomic functions.
+
+ private int FF (int a, int b, int c, int d, int x, int s) {
+ int t = a + ((b & c) | (~b & d)) + x;
+ return t << s | t >>> (32 - s);
+ }
+ private int GG (int a, int b, int c, int d, int x, int s) {
+ int t = a + ((b & (c | d)) | (c & d)) + x + 0x5A827999;
+ return t << s | t >>> (32 - s);
+ }
+ private int HH (int a, int b, int c, int d, int x, int s) {
+ int t = a + (b ^ c ^ d) + x + 0x6ED9EBA1;
+ return t << s | t >>> (32 - s);
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nfold.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nfold.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nfold.java
new file mode 100644
index 0000000..46e9bf2
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nfold.java
@@ -0,0 +1,57 @@
+package org.apache.kerberos.kerb.crypto;
+
+import java.util.Arrays;
+
+public class Nfold {
+
+ public static byte[] nfold(byte[] input, int size) {
+
+ int inbits = input.length;
+
+ int a, b, c, lcm;
+ a = size;
+ b = inbits;
+
+ while (b != 0) {
+ c = b;
+ b = a % b;
+ a = c;
+ }
+ lcm = size*inbits/a;
+
+ byte[] out = new byte[size];
+ Arrays.fill(out, (byte)0);
+
+ int thisbyte = 0;
+ int msbit, i, bval, oval;
+
+ for (i = lcm-1; i >= 0; i--) {
+ msbit = (
+ ((inbits<<3)-1)
+ + (((inbits<<3)+13)*(i/inbits))
+ + ((inbits-(i%inbits)) << 3)) % (inbits << 3);
+
+ bval = ((((input[((inbits-1)-(msbit>>>3))%inbits]&0xff)<<8)|
+ (input[((inbits)-(msbit>>>3))%inbits]&0xff))
+ >>>((msbit&7)+1))&0xff;
+
+ thisbyte += bval;
+ oval = (out[i%size]&0xff);
+ thisbyte += oval;
+ out[i%size] = (byte) (thisbyte&0xff);
+
+ thisbyte >>>= 8;
+ }
+
+ if (thisbyte != 0) {
+ for (i = size-1; i >= 0; i--) {
+ thisbyte += (out[i]&0xff);
+ out[i] = (byte) (thisbyte&0xff);
+
+ thisbyte >>>= 8;
+ }
+ }
+
+ return out;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nonce.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nonce.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nonce.java
new file mode 100644
index 0000000..4dad9e6
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Nonce.java
@@ -0,0 +1,13 @@
+package org.apache.kerberos.kerb.crypto;
+
+import java.security.SecureRandom;
+
+public class Nonce {
+
+ private static SecureRandom srand = new SecureRandom();
+
+ public static synchronized int value() {
+ int value = srand.nextInt();
+ return value & 0x7fffffff;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Pbkdf.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Pbkdf.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Pbkdf.java
new file mode 100644
index 0000000..4869951
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Pbkdf.java
@@ -0,0 +1,21 @@
+package org.apache.kerberos.kerb.crypto;
+
+import javax.crypto.SecretKey;
+import javax.crypto.SecretKeyFactory;
+import javax.crypto.spec.PBEKeySpec;
+import java.security.GeneralSecurityException;
+
+public class Pbkdf {
+
+ public static byte[] PBKDF2(char[] secret, byte[] salt,
+ int count, int keySize) throws GeneralSecurityException {
+
+ PBEKeySpec ks = new PBEKeySpec(secret, salt, count, keySize * 8);
+ SecretKeyFactory skf =
+ SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
+ SecretKey key = skf.generateSecret(ks);
+ byte[] result = key.getEncoded();
+
+ return result;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Random.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Random.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Random.java
new file mode 100644
index 0000000..096a9b0
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Random.java
@@ -0,0 +1,14 @@
+package org.apache.kerberos.kerb.crypto;
+
+import java.security.SecureRandom;
+
+public final class Random {
+
+ private static SecureRandom srand = new SecureRandom();
+
+ public static byte[] makeBytes(int size) {
+ byte[] data = new byte[size];
+ srand.nextBytes(data);
+ return data;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Rc4.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Rc4.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Rc4.java
new file mode 100644
index 0000000..43613b9
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Rc4.java
@@ -0,0 +1,31 @@
+package org.apache.kerberos.kerb.crypto;
+
+public class Rc4 {
+
+ private static byte[] L40 = "fortybits".getBytes();
+
+ public static byte[] getSalt(int usage, boolean exportable) {
+ int msUsage = convertUsage(usage);
+ byte[] salt;
+
+ if (exportable) {
+ salt = new byte[14];
+ System.arraycopy(L40, 0, salt, 0, 9);
+ BytesUtil.int2bytes(msUsage, salt, 10, false);
+ } else {
+ salt = new byte[4];
+ BytesUtil.int2bytes(msUsage, salt, 0, false);
+ }
+
+ return salt;
+ }
+
+ public static int convertUsage(int usage) {
+ switch (usage) {
+ case 3: return 8;
+ case 9: return 8;
+ case 23: return 13;
+ default: return usage;
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Util.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Util.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Util.java
new file mode 100644
index 0000000..58117b9
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/Util.java
@@ -0,0 +1,24 @@
+package org.apache.kerberos.kerb.crypto;
+
+public class Util {
+
+ public static void xor(byte[] input, int offset, byte[] output) {
+ int a, b;
+ for (int i = 0; i < output.length / 4; ++i) {
+ a = BytesUtil.bytes2int(input, offset + i * 4, true);
+ b = BytesUtil.bytes2int(output, i * 4, true);
+ b = a ^ b;
+ BytesUtil.int2bytes(b, output, i * 4, true);
+ }
+ }
+
+ public static void xor(byte[] a, byte[] b, byte[] output) {
+ int av, bv, v;
+ for (int i = 0; i < a.length / 4; ++i) {
+ av = BytesUtil.bytes2int(a, i * 4, true);
+ bv = BytesUtil.bytes2int(b, i * 4, true);
+ v = av ^ bv;
+ BytesUtil.int2bytes(v, output, i * 4, true);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractCheckSumTypeHandler.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractCheckSumTypeHandler.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractCheckSumTypeHandler.java
new file mode 100644
index 0000000..cdf0b70
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractCheckSumTypeHandler.java
@@ -0,0 +1,93 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.AbstractCryptoTypeHandler;
+import org.apache.kerberos.kerb.crypto.CheckSumTypeHandler;
+import org.apache.kerberos.kerb.crypto.enc.EncryptProvider;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class AbstractCheckSumTypeHandler
+ extends AbstractCryptoTypeHandler implements CheckSumTypeHandler {
+
+ private int computeSize;
+ private int outputSize;
+
+ public AbstractCheckSumTypeHandler(EncryptProvider encProvider, HashProvider hashProvider,
+ int computeSize, int outputSize) {
+ super(encProvider, hashProvider);
+ this.computeSize = computeSize;
+ this.outputSize = outputSize;
+ }
+
+ @Override
+ public String name() {
+ return cksumType().getName();
+ }
+
+ @Override
+ public String displayName() {
+ return cksumType().getDisplayName();
+ }
+
+ @Override
+ public int computeSize() {
+ return computeSize;
+ }
+
+ @Override
+ public int outputSize() {
+ return outputSize;
+ }
+
+ public boolean isSafe() {
+ return false;
+ }
+
+ public int cksumSize() {
+ return 4;
+ }
+
+ public int keySize() {
+ return 0;
+ }
+
+ public int confounderSize() {
+ return 0;
+ }
+
+ @Override
+ public byte[] checksum(byte[] data) throws KrbException {
+ return checksum(data, 0, data.length);
+ }
+
+ @Override
+ public byte[] checksum(byte[] data, int start, int size) throws KrbException {
+ throw new UnsupportedOperationException();
+ }
+
+ @Override
+ public boolean verify(byte[] data, byte[] checksum) throws KrbException {
+ return verify(data, 0, data.length, checksum);
+ }
+
+ @Override
+ public boolean verify(byte[] data, int start, int size, byte[] checksum) throws KrbException {
+ throw new UnsupportedOperationException();
+ }
+
+ @Override
+ public byte[] checksumWithKey(byte[] data,
+ byte[] key, int usage) throws KrbException {
+ return checksumWithKey(data, 0, data.length, key, usage);
+ }
+
+ @Override
+ public byte[] checksumWithKey(byte[] data, int start, int size,
+ byte[] key, int usage) throws KrbException {
+ throw new UnsupportedOperationException();
+ }
+ @Override
+ public boolean verifyWithKey(byte[] data,
+ byte[] key, int usage, byte[] checksum) throws KrbException {
+ throw new UnsupportedOperationException();
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractKeyedCheckSumTypeHandler.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractKeyedCheckSumTypeHandler.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractKeyedCheckSumTypeHandler.java
new file mode 100644
index 0000000..3755b63
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/AbstractKeyedCheckSumTypeHandler.java
@@ -0,0 +1,56 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.enc.EncryptProvider;
+import org.apache.kerberos.kerb.crypto.key.KeyMaker;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class AbstractKeyedCheckSumTypeHandler extends AbstractCheckSumTypeHandler {
+
+ private KeyMaker keyMaker;
+
+ public AbstractKeyedCheckSumTypeHandler(EncryptProvider encProvider, HashProvider hashProvider,
+ int computeSize, int outputSize) {
+ super(encProvider, hashProvider, computeSize, outputSize);
+ }
+
+ protected void keyMaker(KeyMaker keyMaker) {
+ this.keyMaker = keyMaker;
+ }
+
+ protected KeyMaker keyMaker() {
+ return keyMaker;
+ }
+
+ @Override
+ public byte[] checksumWithKey(byte[] data,
+ byte[] key, int usage) throws KrbException {
+ return checksumWithKey(data, 0, data.length, key, usage);
+ }
+
+ @Override
+ public byte[] checksumWithKey(byte[] data, int start, int len,
+ byte[] key, int usage) throws KrbException {
+ int outputSize = outputSize();
+
+ byte[] tmp = doChecksumWithKey(data, start, len, key, usage);
+ if (outputSize < tmp.length) {
+ byte[] output = new byte[outputSize];
+ System.arraycopy(tmp, 0, output, 0, outputSize);
+ return output;
+ } else {
+ return tmp;
+ }
+ }
+
+ protected byte[] doChecksumWithKey(byte[] data, int start, int len,
+ byte[] key, int usage) throws KrbException {
+ return new byte[0];
+ }
+
+ @Override
+ public boolean verifyWithKey(byte[] data, byte[] key,
+ int usage, byte[] checksum) throws KrbException {
+ byte[] newCksum = checksumWithKey(data, key, usage);
+ return checksumEqual(checksum, newCksum);
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia128CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia128CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia128CheckSum.java
new file mode 100644
index 0000000..1d62ae2
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia128CheckSum.java
@@ -0,0 +1,34 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.enc.provider.Camellia128Provider;
+import org.apache.kerberos.kerb.crypto.key.CamelliaKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class CmacCamellia128CheckSum extends CmacKcCheckSum {
+
+ public CmacCamellia128CheckSum() {
+ super(new Camellia128Provider(), 16, 16);
+
+ keyMaker(new CamelliaKeyMaker((Camellia128Provider) encProvider()));
+ }
+
+ public int confounderSize() {
+ return 16;
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.CMAC_CAMELLIA128;
+ }
+
+ public boolean isSafe() {
+ return true;
+ }
+
+ public int cksumSize() {
+ return 16; // bytes
+ }
+
+ public int keySize() {
+ return 16; // bytes
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia256CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia256CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia256CheckSum.java
new file mode 100644
index 0000000..5380813
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacCamellia256CheckSum.java
@@ -0,0 +1,34 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.enc.provider.Camellia256Provider;
+import org.apache.kerberos.kerb.crypto.key.CamelliaKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class CmacCamellia256CheckSum extends CmacKcCheckSum {
+
+ public CmacCamellia256CheckSum() {
+ super(new Camellia256Provider(), 16, 16);
+
+ keyMaker(new CamelliaKeyMaker((Camellia256Provider) encProvider()));
+ }
+
+ public int confounderSize() {
+ return 16;
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.CMAC_CAMELLIA256;
+ }
+
+ public boolean isSafe() {
+ return true;
+ }
+
+ public int cksumSize() {
+ return 16; // bytes
+ }
+
+ public int keySize() {
+ return 16; // bytes
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacKcCheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacKcCheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacKcCheckSum.java
new file mode 100644
index 0000000..796d260
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/CmacKcCheckSum.java
@@ -0,0 +1,17 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.Cmac;
+import org.apache.kerberos.kerb.crypto.enc.EncryptProvider;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class CmacKcCheckSum extends KcCheckSum {
+
+ public CmacKcCheckSum(EncryptProvider encProvider, int computeSize, int outputSize) {
+ super(encProvider, null, computeSize, outputSize);
+ }
+
+ protected byte[] mac(byte[] Kc, byte[] data, int start, int len) throws KrbException {
+ byte[] mac = Cmac.cmac(encProvider(), Kc, data, start, len);
+ return mac;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/ConfounderedDesCheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/ConfounderedDesCheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/ConfounderedDesCheckSum.java
new file mode 100644
index 0000000..0b6d5a3
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/ConfounderedDesCheckSum.java
@@ -0,0 +1,101 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.Confounder;
+import org.apache.kerberos.kerb.crypto.enc.provider.DesProvider;
+import org.apache.kerberos.kerb.KrbException;
+
+import javax.crypto.spec.DESKeySpec;
+import java.security.InvalidKeyException;
+
+public abstract class ConfounderedDesCheckSum extends AbstractKeyedCheckSumTypeHandler {
+
+ public ConfounderedDesCheckSum(HashProvider hashProvider,
+ int computeSize, int outputSize) {
+ super(new DesProvider(), hashProvider, computeSize, outputSize);
+ }
+
+ @Override
+ protected byte[] doChecksumWithKey(byte[] data, int start, int len,
+ byte[] key, int usage) throws KrbException {
+ int computeSize = computeSize();
+ int blockSize = encProvider().blockSize();
+ int hashSize = hashProvider().hashSize();
+
+ byte[] workBuffer = new byte[computeSize];
+
+ // confounder
+ byte[] conf = Confounder.makeBytes(blockSize);
+
+ // confounder | data
+ byte[] toHash = new byte[blockSize + len];
+ System.arraycopy(conf, 0, toHash, 0, blockSize);
+ System.arraycopy(data, start, toHash, blockSize, len);
+
+ HashProvider hashProvider = hashProvider();
+ hashProvider.hash(toHash);
+ byte[] hash = hashProvider.output();
+
+ // confounder | hash
+ System.arraycopy(conf, 0, workBuffer, 0, blockSize);
+ System.arraycopy(hash, 0, workBuffer, blockSize, hashSize);
+
+ // key
+ byte[] newKey = deriveKey(key);
+
+ encProvider().encrypt(newKey, workBuffer);
+ return workBuffer;
+ }
+
+ protected byte[] deriveKey(byte[] key) {
+ return fixKey(xorKey(key));
+ }
+
+ protected byte[] xorKey(byte[] key) {
+ byte[] xorKey = new byte[encProvider().keySize()];
+ System.arraycopy(key, 0, xorKey, 0, key.length);
+ for (int i = 0; i < xorKey.length; i++) {
+ xorKey[i] = (byte) (xorKey[i] ^ 0xf0);
+ }
+
+ return xorKey;
+ }
+
+ private byte[] fixKey(byte[] key) {
+ boolean isWeak = true;
+ try {
+ isWeak = DESKeySpec.isWeak(key, 0);
+ } catch (InvalidKeyException e) {
+ e.printStackTrace();
+ }
+ if (isWeak) {
+ key[7] = (byte)(key[7] ^ 0xF0);
+ }
+
+ return key;
+ }
+
+ @Override
+ public boolean verifyWithKey(byte[] data,byte[] key,
+ int usage, byte[] checksum) throws KrbException {
+ int computeSize = computeSize();
+ int blockSize = encProvider().blockSize();
+ int hashSize = hashProvider().hashSize();
+
+ // key
+ byte[] newKey = deriveKey(key);
+
+ encProvider().decrypt(newKey, checksum);
+ byte[] decrypted = checksum; // confounder | hash
+
+ // confounder | data
+ byte[] toHash = new byte[blockSize + data.length];
+ System.arraycopy(decrypted, 0, toHash, 0, blockSize);
+ System.arraycopy(data, 0, toHash, blockSize, data.length);
+
+ HashProvider hashProvider = hashProvider();
+ hashProvider.hash(toHash);
+ byte[] newHash = hashProvider.output();
+
+ return checksumEqual(newHash, decrypted, blockSize, hashSize);
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Crc32CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Crc32CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Crc32CheckSum.java
new file mode 100644
index 0000000..5fda3bb
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Crc32CheckSum.java
@@ -0,0 +1,16 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.AbstractUnkeyedCheckSumTypeHandler;
+import org.apache.kerberos.kerb.crypto.cksum.provider.Crc32Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class Crc32CheckSum extends AbstractUnkeyedCheckSumTypeHandler {
+
+ public Crc32CheckSum() {
+ super(new Crc32Provider(), 4, 4);
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.CRC32;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/DesCbcCheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/DesCbcCheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/DesCbcCheckSum.java
new file mode 100644
index 0000000..0eaddfb
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/DesCbcCheckSum.java
@@ -0,0 +1,14 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class DesCbcCheckSum extends ConfounderedDesCheckSum {
+
+ public DesCbcCheckSum() {
+ super(null, 8, 8);
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.DES_CBC;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HashProvider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HashProvider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HashProvider.java
new file mode 100644
index 0000000..2028419
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HashProvider.java
@@ -0,0 +1,16 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.KrbException;
+
+/**
+ * krb5_hash_provider
+ */
+public interface HashProvider {
+
+ public int hashSize();
+ public int blockSize();
+
+ public void hash(byte[] data, int start, int size) throws KrbException;
+ public void hash(byte[] data) throws KrbException;
+ public byte[] output();
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacKcCheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacKcCheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacKcCheckSum.java
new file mode 100644
index 0000000..5e55617
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacKcCheckSum.java
@@ -0,0 +1,18 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.Hmac;
+import org.apache.kerberos.kerb.crypto.cksum.provider.Sha1Provider;
+import org.apache.kerberos.kerb.crypto.enc.EncryptProvider;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class HmacKcCheckSum extends KcCheckSum {
+
+ public HmacKcCheckSum(EncryptProvider encProvider, int computeSize, int outputSize) {
+ super(encProvider, new Sha1Provider(), computeSize, outputSize);
+ }
+
+ protected byte[] mac(byte[] Kc, byte[] data, int start, int len) throws KrbException {
+ byte[] hmac = Hmac.hmac(hashProvider(), Kc, data, start, len);
+ return hmac;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacMd5Rc4CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacMd5Rc4CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacMd5Rc4CheckSum.java
new file mode 100644
index 0000000..ec9a6d3
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacMd5Rc4CheckSum.java
@@ -0,0 +1,54 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.Hmac;
+import org.apache.kerberos.kerb.crypto.Rc4;
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md5Provider;
+import org.apache.kerberos.kerb.KrbException;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class HmacMd5Rc4CheckSum extends AbstractKeyedCheckSumTypeHandler {
+
+ public HmacMd5Rc4CheckSum() {
+ super(null, new Md5Provider(), 16, 16);
+ }
+
+ public int confounderSize() {
+ return 8;
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.HMAC_MD5_ARCFOUR;
+ }
+
+ public boolean isSafe() {
+ return true;
+ }
+
+ public int cksumSize() {
+ return 16; // bytes
+ }
+
+ public int keySize() {
+ return 16; // bytes
+ }
+
+ @Override
+ protected byte[] doChecksumWithKey(byte[] data, int start, int len,
+ byte[] key, int usage) throws KrbException {
+
+ byte[] Ksign = null;
+ byte[] signKey = "signaturekey".getBytes();
+ byte[] newSignKey = new byte[signKey.length + 1];
+ System.arraycopy(signKey, 0, newSignKey, 0, signKey.length);
+ Ksign = Hmac.hmac(hashProvider(), key, newSignKey);
+
+ byte[] salt = Rc4.getSalt(usage, false);
+
+ hashProvider().hash(salt);
+ hashProvider().hash(data, start, len);
+ byte[] hashTmp = hashProvider().output();
+
+ byte[] hmac = Hmac.hmac(hashProvider(), Ksign, hashTmp);
+ return hmac;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes128CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes128CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes128CheckSum.java
new file mode 100644
index 0000000..23617c7
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes128CheckSum.java
@@ -0,0 +1,34 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.enc.provider.Aes128Provider;
+import org.apache.kerberos.kerb.crypto.key.AesKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class HmacSha1Aes128CheckSum extends HmacKcCheckSum {
+
+ public HmacSha1Aes128CheckSum() {
+ super(new Aes128Provider(), 20, 12);
+
+ keyMaker(new AesKeyMaker((Aes128Provider) encProvider()));
+ }
+
+ public int confounderSize() {
+ return 16;
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.HMAC_SHA1_96_AES128;
+ }
+
+ public boolean isSafe() {
+ return true;
+ }
+
+ public int cksumSize() {
+ return 12; // bytes
+ }
+
+ public int keySize() {
+ return 16; // bytes
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes256CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes256CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes256CheckSum.java
new file mode 100644
index 0000000..974cfdf
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Aes256CheckSum.java
@@ -0,0 +1,34 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.enc.provider.Aes256Provider;
+import org.apache.kerberos.kerb.crypto.key.AesKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class HmacSha1Aes256CheckSum extends HmacKcCheckSum {
+
+ public HmacSha1Aes256CheckSum() {
+ super(new Aes256Provider(), 20, 12);
+
+ keyMaker(new AesKeyMaker((Aes256Provider) encProvider()));
+ }
+
+ public int confounderSize() {
+ return 16;
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.HMAC_SHA1_96_AES256;
+ }
+
+ public boolean isSafe() {
+ return true;
+ }
+
+ public int cksumSize() {
+ return 12; // bytes
+ }
+
+ public int keySize() {
+ return 32; // bytes
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Des3CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Des3CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Des3CheckSum.java
new file mode 100644
index 0000000..dfb38e9
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/HmacSha1Des3CheckSum.java
@@ -0,0 +1,34 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.enc.provider.Des3Provider;
+import org.apache.kerberos.kerb.crypto.key.Des3KeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class HmacSha1Des3CheckSum extends HmacKcCheckSum {
+
+ public HmacSha1Des3CheckSum() {
+ super(new Des3Provider(), 20, 20);
+
+ keyMaker(new Des3KeyMaker(encProvider()));
+ }
+
+ public int confounderSize() {
+ return 8;
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.HMAC_SHA1_DES3;
+ }
+
+ public boolean isSafe() {
+ return true;
+ }
+
+ public int cksumSize() {
+ return 20; // bytes
+ }
+
+ public int keySize() {
+ return 24; // bytes
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/KcCheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/KcCheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/KcCheckSum.java
new file mode 100644
index 0000000..ac58ecd
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/KcCheckSum.java
@@ -0,0 +1,29 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.BytesUtil;
+import org.apache.kerberos.kerb.crypto.enc.EncryptProvider;
+import org.apache.kerberos.kerb.crypto.key.DkKeyMaker;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class KcCheckSum extends AbstractKeyedCheckSumTypeHandler {
+
+ public KcCheckSum(EncryptProvider encProvider, HashProvider hashProvider,
+ int computeSize, int outputSize) {
+ super(encProvider, hashProvider, computeSize, outputSize);
+ }
+
+ @Override
+ protected byte[] doChecksumWithKey(byte[] data, int start, int len,
+ byte[] key, int usage) throws KrbException {
+ byte[] Kc;
+ byte[] constant = new byte[5];
+ BytesUtil.int2bytes(usage, constant, 0, true);
+ constant[4] = (byte) 0x99;
+ Kc = ((DkKeyMaker) keyMaker()).dk(key, constant);
+
+ byte[] mac = mac(Kc, data, start, len);
+ return mac;
+ }
+
+ protected abstract byte[] mac(byte[] Kc, byte[] data, int start, int len) throws KrbException;
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Md5HmacRc4CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Md5HmacRc4CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Md5HmacRc4CheckSum.java
new file mode 100644
index 0000000..47b96ab
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Md5HmacRc4CheckSum.java
@@ -0,0 +1,51 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.Hmac;
+import org.apache.kerberos.kerb.crypto.Rc4;
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md5Provider;
+import org.apache.kerberos.kerb.crypto.enc.provider.Rc4Provider;
+import org.apache.kerberos.kerb.KrbException;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class Md5HmacRc4CheckSum extends AbstractKeyedCheckSumTypeHandler {
+
+ public Md5HmacRc4CheckSum() {
+ super(new Rc4Provider(), new Md5Provider(), 16, 16);
+ }
+
+ public int confounderSize() {
+ return 8;
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.MD5_HMAC_ARCFOUR;
+ }
+
+ public boolean isSafe() {
+ return true;
+ }
+
+ public int cksumSize() {
+ return 16; // bytes
+ }
+
+ public int keySize() {
+ return 16; // bytes
+ }
+
+ @Override
+ protected byte[] doChecksumWithKey(byte[] data, int start, int len,
+ byte[] key, int usage) throws KrbException {
+
+ byte[] Ksign = key;
+
+ byte[] salt = Rc4.getSalt(usage, false);
+
+ hashProvider().hash(salt);
+ hashProvider().hash(data, start, len);
+ byte[] hashTmp = hashProvider().output();
+
+ byte[] hmac = Hmac.hmac(hashProvider(), Ksign, hashTmp);
+ return hmac;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4CheckSum.java
new file mode 100644
index 0000000..89679e7
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4CheckSum.java
@@ -0,0 +1,16 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.AbstractUnkeyedCheckSumTypeHandler;
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md4Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class RsaMd4CheckSum extends AbstractUnkeyedCheckSumTypeHandler {
+
+ public RsaMd4CheckSum() {
+ super(new Md4Provider(), 16, 16);
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.RSA_MD4;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4DesCheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4DesCheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4DesCheckSum.java
new file mode 100644
index 0000000..6d023d0
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd4DesCheckSum.java
@@ -0,0 +1,15 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md4Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class RsaMd4DesCheckSum extends ConfounderedDesCheckSum {
+
+ public RsaMd4DesCheckSum() {
+ super(new Md4Provider(), 24, 24);
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.RSA_MD4_DES;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5CheckSum.java
new file mode 100644
index 0000000..346f0e2
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5CheckSum.java
@@ -0,0 +1,16 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.AbstractUnkeyedCheckSumTypeHandler;
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md5Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class RsaMd5CheckSum extends AbstractUnkeyedCheckSumTypeHandler {
+
+ public RsaMd5CheckSum() {
+ super(new Md5Provider(), 16, 16);
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.RSA_MD5;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5DesCheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5DesCheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5DesCheckSum.java
new file mode 100644
index 0000000..47a337b
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/RsaMd5DesCheckSum.java
@@ -0,0 +1,15 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md5Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public final class RsaMd5DesCheckSum extends ConfounderedDesCheckSum {
+
+ public RsaMd5DesCheckSum() {
+ super(new Md5Provider(), 24, 24);
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.RSA_MD5_DES;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Sha1CheckSum.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Sha1CheckSum.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Sha1CheckSum.java
new file mode 100644
index 0000000..fd9d443
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/Sha1CheckSum.java
@@ -0,0 +1,16 @@
+package org.apache.kerberos.kerb.crypto.cksum;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.AbstractUnkeyedCheckSumTypeHandler;
+import org.apache.kerberos.kerb.crypto.cksum.provider.Sha1Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+
+public class Sha1CheckSum extends AbstractUnkeyedCheckSumTypeHandler {
+
+ public Sha1CheckSum() {
+ super(new Sha1Provider(), 20, 20);
+ }
+
+ public CheckSumType cksumType() {
+ return CheckSumType.NIST_SHA;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractHashProvider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractHashProvider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractHashProvider.java
new file mode 100644
index 0000000..f8decee
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractHashProvider.java
@@ -0,0 +1,33 @@
+package org.apache.kerberos.kerb.crypto.cksum.provider;
+
+import org.apache.kerberos.kerb.crypto.cksum.HashProvider;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class AbstractHashProvider implements HashProvider {
+ private int blockSize;
+ private int hashSize;
+
+ public AbstractHashProvider(int hashSize, int blockSize) {
+ this.hashSize = hashSize;
+ this.blockSize = blockSize;
+ }
+
+ protected void init() {
+
+ }
+
+ @Override
+ public int hashSize() {
+ return hashSize;
+ }
+
+ @Override
+ public int blockSize() {
+ return blockSize;
+ }
+
+ @Override
+ public void hash(byte[] data) throws KrbException {
+ hash(data, 0, data.length);
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractUnkeyedCheckSumTypeHandler.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractUnkeyedCheckSumTypeHandler.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractUnkeyedCheckSumTypeHandler.java
new file mode 100644
index 0000000..99af260
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/AbstractUnkeyedCheckSumTypeHandler.java
@@ -0,0 +1,35 @@
+package org.apache.kerberos.kerb.crypto.cksum.provider;
+
+import org.apache.kerberos.kerb.crypto.cksum.AbstractCheckSumTypeHandler;
+import org.apache.kerberos.kerb.crypto.cksum.HashProvider;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class AbstractUnkeyedCheckSumTypeHandler extends AbstractCheckSumTypeHandler {
+
+ public AbstractUnkeyedCheckSumTypeHandler(HashProvider hashProvider,
+ int computeSize, int outputSize) {
+ super(null, hashProvider, computeSize, outputSize);
+ }
+
+ @Override
+ public byte[] checksum(byte[] data, int start, int len) throws KrbException {
+ int outputSize = outputSize();
+
+ HashProvider hp = hashProvider();
+ hp.hash(data, start, len);
+ byte[] workBuffer = hp.output();
+
+ if (outputSize < workBuffer.length) {
+ byte[] output = new byte[outputSize];
+ System.arraycopy(workBuffer, 0, output, 0, outputSize);
+ return output;
+ }
+ return workBuffer;
+ }
+
+ @Override
+ public boolean verify(byte[] data, int start, int len, byte[] checksum) throws KrbException {
+ byte[] newCksum = checksum(data, start, len);
+ return checksumEqual(newCksum, checksum);
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Crc32Provider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Crc32Provider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Crc32Provider.java
new file mode 100644
index 0000000..303c506
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Crc32Provider.java
@@ -0,0 +1,21 @@
+package org.apache.kerberos.kerb.crypto.cksum.provider;
+
+import org.apache.kerberos.kerb.crypto.Crc32;
+
+public class Crc32Provider extends AbstractHashProvider {
+ private byte[] output;
+
+ public Crc32Provider() {
+ super(4, 1);
+ }
+
+ @Override
+ public void hash(byte[] data, int start, int size) {
+ output = Crc32.crc(data, start, size);
+ }
+
+ @Override
+ public byte[] output() {
+ return output;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md4Provider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md4Provider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md4Provider.java
new file mode 100644
index 0000000..f3147c3
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md4Provider.java
@@ -0,0 +1,15 @@
+package org.apache.kerberos.kerb.crypto.cksum.provider;
+
+import org.apache.kerberos.kerb.crypto.Md4;
+
+public class Md4Provider extends MessageDigestHashProvider {
+
+ public Md4Provider() {
+ super(16, 64, "MD4");
+ }
+
+ @Override
+ protected void init() {
+ messageDigest = new Md4();
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md5Provider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md5Provider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md5Provider.java
new file mode 100644
index 0000000..76ce18d
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Md5Provider.java
@@ -0,0 +1,8 @@
+package org.apache.kerberos.kerb.crypto.cksum.provider;
+
+public class Md5Provider extends MessageDigestHashProvider {
+
+ public Md5Provider() {
+ super(16, 64, "MD5");
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/MessageDigestHashProvider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/MessageDigestHashProvider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/MessageDigestHashProvider.java
new file mode 100644
index 0000000..c7903c6
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/MessageDigestHashProvider.java
@@ -0,0 +1,37 @@
+package org.apache.kerberos.kerb.crypto.cksum.provider;
+
+import org.apache.kerberos.kerb.KrbException;
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class MessageDigestHashProvider extends AbstractHashProvider {
+ private String algorithm;
+ protected MessageDigest messageDigest;
+
+ public MessageDigestHashProvider(int hashSize, int blockSize, String algorithm) {
+ super(hashSize, blockSize);
+ this.algorithm = algorithm;
+
+ init();
+ }
+
+ @Override
+ protected void init() {
+ try {
+ messageDigest = MessageDigest.getInstance(algorithm);
+ } catch (NoSuchAlgorithmException e) {
+ throw new RuntimeException("Failed to init JCE provider", e);
+ }
+ }
+
+ @Override
+ public void hash(byte[] data, int start, int len) throws KrbException {
+ messageDigest.update(data, start, len);
+ }
+
+ @Override
+ public byte[] output() {
+ return messageDigest.digest();
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Sha1Provider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Sha1Provider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Sha1Provider.java
new file mode 100644
index 0000000..0fce138
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/cksum/provider/Sha1Provider.java
@@ -0,0 +1,8 @@
+package org.apache.kerberos.kerb.crypto.cksum.provider;
+
+public class Sha1Provider extends MessageDigestHashProvider {
+
+ public Sha1Provider() {
+ super(20, 64, "SHA1");
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/AbstractEncTypeHandler.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/AbstractEncTypeHandler.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/AbstractEncTypeHandler.java
new file mode 100644
index 0000000..0099db2
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/AbstractEncTypeHandler.java
@@ -0,0 +1,141 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.AbstractCryptoTypeHandler;
+import org.apache.kerberos.kerb.crypto.EncTypeHandler;
+import org.apache.kerberos.kerb.crypto.cksum.HashProvider;
+import org.apache.kerberos.kerb.crypto.key.KeyMaker;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class AbstractEncTypeHandler
+ extends AbstractCryptoTypeHandler implements EncTypeHandler {
+
+ private KeyMaker keyMaker;
+
+ public AbstractEncTypeHandler(EncryptProvider encProvider,
+ HashProvider hashProvider) {
+ super(encProvider, hashProvider);
+ }
+
+ protected void keyMaker(KeyMaker keyMaker) {
+ this.keyMaker = keyMaker;
+ }
+
+ protected KeyMaker keyMaker() {
+ return keyMaker;
+ }
+
+ @Override
+ public String name() {
+ return eType().getName();
+ }
+
+ @Override
+ public String displayName() {
+ return eType().getDisplayName();
+ }
+
+ protected int paddingLength(int inputLen) {
+ int payloadLen = confounderSize() + checksumSize() + inputLen;
+ int padding = paddingSize();
+
+ if (padding == 0 || (payloadLen % padding) == 0) {
+ return 0;
+ }
+
+ return padding - (payloadLen % padding);
+ }
+
+ @Override
+ public int keyInputSize() {
+ return encProvider().keyInputSize();
+ }
+
+ @Override
+ public int keySize() {
+ return encProvider().keySize();
+ }
+
+ @Override
+ public int confounderSize() {
+ return encProvider().blockSize();
+ }
+
+ @Override
+ public int checksumSize() {
+ return hashProvider().hashSize();
+ }
+
+ @Override
+ public int paddingSize() {
+ return encProvider().blockSize();
+ }
+
+ @Override
+ public byte[] str2key(String string, String salt, byte[] param) throws KrbException {
+ return keyMaker.str2key(string, salt, param);
+ }
+
+ @Override
+ public byte[] random2Key(byte[] randomBits) throws KrbException {
+ return keyMaker.random2Key(randomBits);
+ }
+
+ @Override
+ public byte[] encrypt(byte[] data, byte[] key, int usage) throws KrbException {
+ byte[] iv = new byte[encProvider().blockSize()];
+ return encrypt(data, key, iv, usage);
+ }
+
+ @Override
+ public byte[] encrypt(byte[] data, byte[] key, byte[] iv, int usage) throws KrbException {
+ int confounderLen = confounderSize();
+ int checksumLen = checksumSize();
+ int headerLen = confounderLen + checksumLen;
+ int inputLen = data.length;
+ int paddingLen = paddingLength(inputLen);
+
+ /**
+ * E(Confounder | Checksum | Plaintext | Padding), or
+ * header | data | padding | trailer, where trailer may be absent
+ */
+
+ int workLength = headerLen + inputLen + paddingLen;
+
+ byte[] workBuffer = new byte[workLength];
+ System.arraycopy(data, 0, workBuffer, headerLen, data.length);
+
+ int [] workLens = new int[] {confounderLen, checksumLen,
+ inputLen, paddingLen};
+
+ encryptWith(workBuffer, workLens, key, iv, usage);
+ return workBuffer;
+ }
+
+ protected void encryptWith(byte[] workBuffer, int[] workLens,
+ byte[] key, byte[] iv, int usage) throws KrbException {
+
+ }
+
+ public byte[] decrypt(byte[] cipher, byte[] key, int usage)
+ throws KrbException {
+ byte[] iv = new byte[encProvider().blockSize()];
+ return decrypt(cipher, key, iv, usage);
+ }
+
+ public byte[] decrypt(byte[] cipher, byte[] key, byte[] iv, int usage)
+ throws KrbException {
+
+ int totalLen = cipher.length;
+ int confounderLen = confounderSize();
+ int checksumLen = checksumSize();
+ int dataLen = totalLen - (confounderLen + checksumLen);
+
+ int[] workLens = new int[] {confounderLen, checksumLen, dataLen};
+ return decryptWith(cipher, workLens, key, iv, usage);
+ }
+
+ protected byte[] decryptWith(byte[] workBuffer, int[] workLens,
+ byte[] key, byte[] iv, int usage) throws KrbException {
+ return null;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes128CtsHmacSha1Enc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes128CtsHmacSha1Enc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes128CtsHmacSha1Enc.java
new file mode 100644
index 0000000..263864e
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes128CtsHmacSha1Enc.java
@@ -0,0 +1,29 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Sha1Provider;
+import org.apache.kerberos.kerb.crypto.enc.provider.Aes128Provider;
+import org.apache.kerberos.kerb.crypto.enc.provider.AesProvider;
+import org.apache.kerberos.kerb.crypto.key.AesKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class Aes128CtsHmacSha1Enc extends KeKiHmacSha1Enc {
+
+ public Aes128CtsHmacSha1Enc() {
+ super(new Aes128Provider(), new Sha1Provider());
+ keyMaker(new AesKeyMaker((AesProvider) encProvider()));
+ }
+
+ @Override
+ public int checksumSize() {
+ return 96 / 8;
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.AES128_CTS_HMAC_SHA1_96;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.HMAC_SHA1_96_AES128;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes256CtsHmacSha1Enc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes256CtsHmacSha1Enc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes256CtsHmacSha1Enc.java
new file mode 100644
index 0000000..4911113
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Aes256CtsHmacSha1Enc.java
@@ -0,0 +1,29 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Sha1Provider;
+import org.apache.kerberos.kerb.crypto.enc.provider.Aes256Provider;
+import org.apache.kerberos.kerb.crypto.enc.provider.AesProvider;
+import org.apache.kerberos.kerb.crypto.key.AesKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class Aes256CtsHmacSha1Enc extends KeKiHmacSha1Enc {
+
+ public Aes256CtsHmacSha1Enc() {
+ super(new Aes256Provider(), new Sha1Provider());
+ keyMaker(new AesKeyMaker((AesProvider) encProvider()));
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.AES256_CTS_HMAC_SHA1_96;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.HMAC_SHA1_96_AES256;
+ }
+
+ @Override
+ public int checksumSize() {
+ return 96 / 8;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia128CtsCmacEnc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia128CtsCmacEnc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia128CtsCmacEnc.java
new file mode 100644
index 0000000..bbfa63c
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia128CtsCmacEnc.java
@@ -0,0 +1,22 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.enc.provider.Camellia128Provider;
+import org.apache.kerberos.kerb.crypto.key.CamelliaKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class Camellia128CtsCmacEnc extends KeKiCmacEnc {
+
+ public Camellia128CtsCmacEnc() {
+ super(new Camellia128Provider());
+ keyMaker(new CamelliaKeyMaker((Camellia128Provider) encProvider()));
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.CAMELLIA128_CTS_CMAC;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.CMAC_CAMELLIA128;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia256CtsCmacEnc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia256CtsCmacEnc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia256CtsCmacEnc.java
new file mode 100644
index 0000000..ad4b42b
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Camellia256CtsCmacEnc.java
@@ -0,0 +1,22 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.enc.provider.Camellia256Provider;
+import org.apache.kerberos.kerb.crypto.key.CamelliaKeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class Camellia256CtsCmacEnc extends KeKiCmacEnc {
+
+ public Camellia256CtsCmacEnc() {
+ super(new Camellia256Provider());
+ keyMaker(new CamelliaKeyMaker((Camellia256Provider) encProvider()));
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.CAMELLIA256_CTS_CMAC;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.CMAC_CAMELLIA256;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Des3CbcSha1Enc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Des3CbcSha1Enc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Des3CbcSha1Enc.java
new file mode 100644
index 0000000..7ec07c2
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/Des3CbcSha1Enc.java
@@ -0,0 +1,23 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Sha1Provider;
+import org.apache.kerberos.kerb.crypto.enc.provider.Des3Provider;
+import org.apache.kerberos.kerb.crypto.key.Des3KeyMaker;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class Des3CbcSha1Enc extends KeKiHmacSha1Enc {
+
+ public Des3CbcSha1Enc() {
+ super(new Des3Provider(), new Sha1Provider());
+ keyMaker(new Des3KeyMaker(this.encProvider()));
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.DES3_CBC_SHA1;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.HMAC_SHA1_DES3;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcCrcEnc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcCrcEnc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcCrcEnc.java
new file mode 100644
index 0000000..8318eef
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcCrcEnc.java
@@ -0,0 +1,36 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Crc32Provider;
+import org.apache.kerberos.kerb.KrbException;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class DesCbcCrcEnc extends DesCbcEnc {
+
+ public DesCbcCrcEnc() {
+ super(new Crc32Provider());
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.DES_CBC_CRC;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.CRC32;
+ }
+
+ @Override
+ public byte[] encrypt(byte[] data, byte[] key, int usage) throws KrbException {
+ byte[] iv = new byte[encProvider().blockSize()];
+ System.arraycopy(key, 0, iv, 0, key.length);
+ return encrypt(data, key, iv, usage);
+ }
+
+ @Override
+ public byte[] decrypt(byte[] cipher, byte[] key, int usage)
+ throws KrbException {
+ byte[] iv = new byte[encProvider().blockSize()];
+ System.arraycopy(key, 0, iv, 0, key.length);
+ return decrypt(cipher, key, iv, usage);
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcEnc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcEnc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcEnc.java
new file mode 100644
index 0000000..162db4a
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcEnc.java
@@ -0,0 +1,69 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.KrbErrorCode;
+import org.apache.kerberos.kerb.crypto.Confounder;
+import org.apache.kerberos.kerb.crypto.cksum.HashProvider;
+import org.apache.kerberos.kerb.crypto.enc.provider.DesProvider;
+import org.apache.kerberos.kerb.crypto.key.DesKeyMaker;
+import org.apache.kerberos.kerb.KrbException;
+
+abstract class DesCbcEnc extends AbstractEncTypeHandler {
+
+ public DesCbcEnc(HashProvider hashProvider) {
+ super(new DesProvider(), hashProvider);
+ keyMaker(new DesKeyMaker(this.encProvider()));
+ }
+
+ @Override
+ protected void encryptWith(byte[] workBuffer, int[] workLens,
+ byte[] key, byte[] iv, int usage) throws KrbException {
+ int confounderLen = workLens[0];
+ int checksumLen = workLens[1];
+ int dataLen = workLens[2];
+ int paddingLen = workLens[3];
+
+ // confounder
+ byte[] confounder = Confounder.makeBytes(confounderLen);
+ System.arraycopy(confounder, 0, workBuffer, 0, confounderLen);
+
+ // padding
+ for (int i = confounderLen + checksumLen + dataLen; i < paddingLen; ++i) {
+ workBuffer[i] = 0;
+ }
+
+ // checksum
+ hashProvider().hash(workBuffer);
+ byte[] cksum = hashProvider().output();
+ System.arraycopy(cksum, 0, workBuffer, confounderLen, checksumLen);
+
+ encProvider().encrypt(key, iv, workBuffer);
+ }
+
+ @Override
+ protected byte[] decryptWith(byte[] workBuffer, int[] workLens,
+ byte[] key, byte[] iv, int usage) throws KrbException {
+ int confounderLen = workLens[0];
+ int checksumLen = workLens[1];
+ int dataLen = workLens[2];
+
+ encProvider().decrypt(key, iv, workBuffer);
+
+ byte[] checksum = new byte[checksumLen];
+ for (int i = 0; i < checksumLen; i++) {
+ checksum[i] = workBuffer[confounderLen + i];
+ workBuffer[confounderLen + i] = 0;
+ }
+
+ hashProvider().hash(workBuffer);
+ byte[] newChecksum = hashProvider().output();
+ if (! checksumEqual(checksum, newChecksum)) {
+ throw new KrbException(KrbErrorCode.KRB_AP_ERR_BAD_INTEGRITY);
+ }
+
+ byte[] data = new byte[dataLen];
+ System.arraycopy(workBuffer, confounderLen + checksumLen,
+ data, 0, dataLen);
+
+ return data;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd4Enc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd4Enc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd4Enc.java
new file mode 100644
index 0000000..5a1520a
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd4Enc.java
@@ -0,0 +1,20 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md4Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class DesCbcMd4Enc extends DesCbcEnc {
+
+ public DesCbcMd4Enc() {
+ super(new Md4Provider());
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.DES_CBC_MD4;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.RSA_MD4_DES;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd5Enc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd5Enc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd5Enc.java
new file mode 100644
index 0000000..ba1c34b
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/DesCbcMd5Enc.java
@@ -0,0 +1,20 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.cksum.provider.Md5Provider;
+import org.apache.kerberos.kerb.spec.common.CheckSumType;
+import org.apache.kerberos.kerb.spec.common.EncryptionType;
+
+public class DesCbcMd5Enc extends DesCbcEnc {
+
+ public DesCbcMd5Enc() {
+ super(new Md5Provider());
+ }
+
+ public EncryptionType eType() {
+ return EncryptionType.DES_CBC_MD5;
+ }
+
+ public CheckSumType checksumType() {
+ return CheckSumType.RSA_MD5_DES;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/EncryptProvider.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/EncryptProvider.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/EncryptProvider.java
new file mode 100644
index 0000000..3533e4b
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/EncryptProvider.java
@@ -0,0 +1,24 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.KrbException;
+
+/**
+ * krb5_enc_provider
+ */
+public interface EncryptProvider {
+
+ public int keyInputSize(); //input size to make key
+ public int keySize(); //output key size
+ public int blockSize(); //crypto block size
+
+ public void encrypt(byte[] key, byte[] cipherState, byte[] data) throws KrbException;
+ public void decrypt(byte[] key, byte[] cipherState, byte[] data) throws KrbException;
+ public void encrypt(byte[] key, byte[] data) throws KrbException;
+ public void decrypt(byte[] key, byte[] data) throws KrbException;
+ public byte[] cbcMac(byte[] key, byte[] iv, byte[] data) throws KrbException;
+ public boolean supportCbcMac();
+
+ public byte[] initState(byte[] key, int keyUsage);
+ public void cleanState();
+ public void cleanKey();
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiCmacEnc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiCmacEnc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiCmacEnc.java
new file mode 100644
index 0000000..2342c82
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiCmacEnc.java
@@ -0,0 +1,34 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.Cmac;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class KeKiCmacEnc extends KeKiEnc {
+
+ public KeKiCmacEnc(EncryptProvider encProvider) {
+ super(encProvider, null);
+ }
+
+ @Override
+ public int paddingSize() {
+ return 0;
+ }
+
+ @Override
+ public int checksumSize() {
+ return encProvider().blockSize();
+ }
+
+ @Override
+ protected byte[] makeChecksum(byte[] key, byte[] data, int hashSize)
+ throws KrbException {
+
+ // generate hash
+ byte[] hash = Cmac.cmac(encProvider(), key, data);
+
+ // truncate hash
+ byte[] output = new byte[hashSize];
+ System.arraycopy(hash, 0, output, 0, hashSize);
+ return output;
+ }
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiEnc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiEnc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiEnc.java
new file mode 100644
index 0000000..5e49a35
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiEnc.java
@@ -0,0 +1,110 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.KrbErrorCode;
+import org.apache.kerberos.kerb.crypto.BytesUtil;
+import org.apache.kerberos.kerb.crypto.Confounder;
+import org.apache.kerberos.kerb.crypto.cksum.HashProvider;
+import org.apache.kerberos.kerb.crypto.key.DkKeyMaker;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class KeKiEnc extends AbstractEncTypeHandler {
+
+ public KeKiEnc(EncryptProvider encProvider,
+ HashProvider hashProvider) {
+ super(encProvider, hashProvider);
+ }
+
+ @Override
+ public int paddingSize() {
+ return 0;
+ }
+
+
+ @Override
+ protected void encryptWith(byte[] workBuffer, int[] workLens,
+ byte[] key, byte[] iv, int usage) throws KrbException {
+ int confounderLen = workLens[0];
+ int checksumLen = workLens[1];
+ int inputLen = workLens[2];
+ int paddingLen = workLens[3];
+
+ byte[] Ke, Ki;
+ byte[] constant = new byte[5];
+ constant[0] = (byte) ((usage>>24)&0xff);
+ constant[1] = (byte) ((usage>>16)&0xff);
+ constant[2] = (byte) ((usage>>8)&0xff);
+ constant[3] = (byte) (usage&0xff);
+ constant[4] = (byte) 0xaa;
+ Ke = ((DkKeyMaker) keyMaker()).dk(key, constant);
+ constant[4] = (byte) 0x55;
+ Ki = ((DkKeyMaker) keyMaker()).dk(key, constant);
+
+ /**
+ * Instead of E(Confounder | Checksum | Plaintext | Padding),
+ * E(Confounder | Plaintext | Padding) | Checksum,
+ * so need to adjust the workBuffer arrangement
+ */
+
+ byte[] tmpEnc = new byte[confounderLen + inputLen + paddingLen];
+ // confounder
+ byte[] confounder = Confounder.makeBytes(confounderLen);
+ System.arraycopy(confounder, 0, tmpEnc, 0, confounderLen);
+
+ // data
+ System.arraycopy(workBuffer, confounderLen + checksumLen,
+ tmpEnc, confounderLen, inputLen);
+
+ // padding
+ for (int i = confounderLen + inputLen; i < paddingLen; ++i) {
+ tmpEnc[i] = 0;
+ }
+
+ // checksum & encrypt
+ byte[] checksum;
+ checksum = makeChecksum(Ki, tmpEnc, checksumLen);
+ encProvider().encrypt(Ke, iv, tmpEnc);
+
+ System.arraycopy(tmpEnc, 0, workBuffer, 0, tmpEnc.length);
+ System.arraycopy(checksum, 0, workBuffer, tmpEnc.length, checksum.length);
+ }
+
+ @Override
+ protected byte[] decryptWith(byte[] workBuffer, int[] workLens,
+ byte[] key, byte[] iv, int usage) throws KrbException {
+ int confounderLen = workLens[0];
+ int checksumLen = workLens[1];
+ int dataLen = workLens[2];
+
+ byte[] Ke, Ki;
+ byte[] constant = new byte[5];
+ BytesUtil.int2bytes(usage, constant, 0, true);
+ constant[4] = (byte) 0xaa;
+ Ke = ((DkKeyMaker) keyMaker()).dk(key, constant);
+ constant[4] = (byte) 0x55;
+ Ki = ((DkKeyMaker) keyMaker()).dk(key, constant);
+
+ // decrypt and verify checksum
+
+ byte[] tmpEnc = new byte[confounderLen + dataLen];
+ System.arraycopy(workBuffer, 0,
+ tmpEnc, 0, confounderLen + dataLen);
+ byte[] checksum = new byte[checksumLen];
+ System.arraycopy(workBuffer, confounderLen + dataLen,
+ checksum, 0, checksumLen);
+
+ byte[] newChecksum;
+ encProvider().decrypt(Ke, iv, tmpEnc);
+ newChecksum = makeChecksum(Ki, tmpEnc, checksumLen);
+
+ if (! checksumEqual(checksum, newChecksum)) {
+ throw new KrbException(KrbErrorCode.KRB_AP_ERR_BAD_INTEGRITY);
+ }
+
+ byte[] data = new byte[dataLen];
+ System.arraycopy(tmpEnc, confounderLen, data, 0, dataLen);
+ return data;
+ }
+
+ protected abstract byte[] makeChecksum(byte[] key, byte[] data, int hashSize)
+ throws KrbException;
+}
http://git-wip-us.apache.org/repos/asf/directory-kerberos/blob/967d7e1c/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiHmacSha1Enc.java
----------------------------------------------------------------------
diff --git a/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiHmacSha1Enc.java b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiHmacSha1Enc.java
new file mode 100644
index 0000000..4d5e268
--- /dev/null
+++ b/haox-kerb/kerb-crypto/src/main/java/org/apache/kerberos/kerb/crypto/enc/KeKiHmacSha1Enc.java
@@ -0,0 +1,31 @@
+package org.apache.kerberos.kerb.crypto.enc;
+
+import org.apache.kerberos.kerb.crypto.Hmac;
+import org.apache.kerberos.kerb.crypto.cksum.HashProvider;
+import org.apache.kerberos.kerb.KrbException;
+
+public abstract class KeKiHmacSha1Enc extends KeKiEnc {
+
+ public KeKiHmacSha1Enc(EncryptProvider encProvider,
+ HashProvider hashProvider) {
+ super(encProvider, hashProvider);
+ }
+
+ @Override
+ public int paddingSize() {
+ return 0;
+ }
+
+ @Override
+ protected byte[] makeChecksum(byte[] key, byte[] data, int hashSize)
+ throws KrbException {
+
+ // generate hash
+ byte[] hash = Hmac.hmac(hashProvider(), key, data);
+
+ // truncate hash
+ byte[] output = new byte[hashSize];
+ System.arraycopy(hash, 0, output, 0, hashSize);
+ return output;
+ }
+}