Class KRB_PKAuthenticator

scapy/layers/kerberos.py:1369–1406

class KRB_PKAuthenticator(ASN1_Packet):
    ASN1_codec = ASN1_Codecs.BER
    ASN1_root = ASN1F_SEQUENCE(
        Microseconds("cusec", 0, explicit_tag=0xA0),
        KerberosTime("ctime", GeneralizedTime(), explicit_tag=0xA1),
        UInt32("nonce", 0, explicit_tag=0xA2),
        ASN1F_optional(
            ASN1F_STRING("paChecksum", "", explicit_tag=0xA3),
        ),
        # RFC8070 extension
        ASN1F_optional(
            ASN1F_STRING("freshnessToken", None, explicit_tag=0xA4),
        ),
        # [MS-PKCA] sect 2.2.3
        ASN1F_optional(
            ASN1F_PACKET("paChecksum2", PAChecksum2(), PAChecksum2, explicit_tag=0xA5),
        ),
    )

    def make_checksum(self, text, h="sha256"):
        """
        Populate paChecksum and paChecksum2
        """
        # paChecksum (always sha-1)
        self.paChecksum = ASN1_STRING(Hash_SHA().digest(text))

        # paChecksum2
        self.paChecksum2 = PAChecksum2()
        self.paChecksum2.make(text, h=h)

    def verify_checksum(self, text):
        """
        Verify paChecksum and paChecksum2
        """
        if self.paChecksum.val != Hash_SHA().digest(text):
            raise ValueError("Bad paChecksum checksum !")

        self.paChecksum2.verify(text)


# RFC8636 sect 6