admin/RedTeamPentesting-adauth
1
0
Fork 0
mirror of https://github.com/RedTeamPentesting/adauth synced 2026-06-08 12:20:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

pkinit: Replace OID literals by their names

Browse Source
This commit is contained in:
Erik Geiser
2025-08-13 13:06:41 +02:00
parent e406594fd6
commit ea51cc58ea
4 changed files with 21 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkinit/asn1.go
+11
View File
@@ -11,6 +11,17 @@ import (
"github.com/jcmturner/gokrb5/v8/types"
)
var (
signedDataOID = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 2}
idPKINITAuthDataOID = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 2, 3, 1}
idPKINITDHKeyDataOID = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 2, 3, 2}
sha1HashOID = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 26}
sha1WithRSAEncryptionOID = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5}
contentTypeOID = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 3}
ephemeralStaticDiffieHellmanKeyAgreementAlgorithmOID = asn1.ObjectIdentifier{1, 2, 840, 10046, 2, 1}
messageDigestOID = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 4}
)
type SignerInfo struct {
Version int `asn1:"default:1"`
IssuerAndSerialNumber IssuerAndSerial
pkinit/asrep.go
+2 -2
View File
@@ -63,7 +63,7 @@ func ExtractNegotiatedKey(
return ekey, fmt.Errorf("unmarshal signed data: %w", err)
}
if !contentInfo.ContentType.Equal(asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 2}) {
if !contentInfo.ContentType.Equal(signedDataOID) {
return ekey, fmt.Errorf("unexpected outer content type: %s", contentInfo.ContentType)
}
@@ -74,7 +74,7 @@ func ExtractNegotiatedKey(
return ekey, fmt.Errorf("unmarshal signed data: %w", err)
}
if !signedData.ContentInfo.ContentType.Equal(asn1.ObjectIdentifier{1, 3, 6, 1, 5, 2, 3, 2}) {
if !signedData.ContentInfo.ContentType.Equal(idPKINITDHKeyDataOID) {
return ekey, fmt.Errorf("unexpected inner content type: %s", signedData.ContentInfo.ContentType)
}
pkinit/asreq.go
+1 -1
View File
@@ -58,7 +58,7 @@ func ConfigureASReq(
},
ClientPublicValue: SubjectPublicKeyInfo{
Algorithm: AlgorithmIdentifier{
Algorithm: asn1.ObjectIdentifier{1, 2, 840, 10046, 2, 1},
Algorithm: ephemeralStaticDiffieHellmanKeyAgreementAlgorithmOID,
Parameters: DomainParameters{
P: DiffieHellmanPrime,
G: 2,
pkinit/pkcs7.go
+7 -7
View File
@@ -29,29 +29,29 @@ func PKCS7Sign(data []byte, key *rsa.PrivateKey, cert *x509.Certificate) ([]byte
return nil, fmt.Errorf("marshal digest: %w", err)
}
serializedPKInitOID, err := asn1.Marshal(asn1.ObjectIdentifier{1, 3, 6, 1, 5, 2, 3, 1})
serializedPKInitOID, err := asn1.Marshal(idPKINITAuthDataOID)
if err != nil {
return nil, fmt.Errorf("marshal PKInit OID: %w", err)
}
sha1AlgorithmIdentifier := pkix.AlgorithmIdentifier{
Algorithm: asn1.ObjectIdentifier{1, 3, 14, 3, 2, 26},
Algorithm: sha1HashOID,
}
rsaWithSHA1AlgorithmIdentifier := pkix.AlgorithmIdentifier{
Algorithm: asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5},
Algorithm: sha1WithRSAEncryptionOID,
}
authenticatedAttributes := []Attribute{
{
// ContentType
Type: asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 3},
Type: contentTypeOID,
// id-pkinit-authData
Value: asn1.RawValue{Tag: 17, IsCompound: true, Bytes: serializedPKInitOID},
},
{
// MessageDigest
Type: asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 9, 4},
Type: messageDigestOID,
Value: asn1.RawValue{Tag: 17, IsCompound: true, Bytes: serializedDigest},
},
}
@@ -66,7 +66,7 @@ func PKCS7Sign(data []byte, key *rsa.PrivateKey, cert *x509.Certificate) ([]byte
DigestAlgorithmIdentifiers: []pkix.AlgorithmIdentifier{sha1AlgorithmIdentifier},
ContentInfo: ContentInfo{
// id-pkinit-authData
ContentType: asn1.ObjectIdentifier{1, 3, 6, 1, 5, 2, 3, 1},
ContentType: idPKINITAuthDataOID,
Content: asn1.RawValue{Class: 2, Tag: 0, Bytes: serializedData, IsCompound: true},
},
Certificates: rawCert,
@@ -90,7 +90,7 @@ func PKCS7Sign(data []byte, key *rsa.PrivateKey, cert *x509.Certificate) ([]byte
contentInfo := ContentInfo{
// signed data
ContentType: asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 7, 2},
ContentType: signedDataOID,
Content: asn1.RawValue{Class: 2, Tag: 0, Bytes: signedDataBytes, IsCompound: true},
}