Compute the SigningKey and EncryptionKey (for SMB 3+)
(self, IsClient=None)
| 4829 | |
| 4830 | @crypto_validator |
| 4831 | def computeSMBSessionKeys(self, IsClient=None): |
| 4832 | """ |
| 4833 | Compute the SigningKey and EncryptionKey (for SMB 3+) |
| 4834 | """ |
| 4835 | if not getattr(self.sspcontext, "SessionKey", None): |
| 4836 | # no signing key, no session key |
| 4837 | return |
| 4838 | # [MS-SMB2] sect 3.3.5.5.3 |
| 4839 | # SigningKey |
| 4840 | if self.Dialect >= 0x0300: |
| 4841 | if self.Dialect == 0x0311: |
| 4842 | label = b"SMBSigningKey\x00" |
| 4843 | context = self.SessionPreauthIntegrityHashValue |
| 4844 | else: |
| 4845 | label = b"SMB2AESCMAC\x00" |
| 4846 | context = b"SmbSign\x00" |
| 4847 | # [MS-SMB2] sect 3.1.4.2 |
| 4848 | if "256" in self.CipherId: |
| 4849 | L = 256 |
| 4850 | elif "128" in self.CipherId: |
| 4851 | L = 128 |
| 4852 | else: |
| 4853 | raise ValueError |
| 4854 | self.SigningKey = SP800108_KDFCTR( |
| 4855 | self.sspcontext.SessionKey[:16], |
| 4856 | label, |
| 4857 | context, |
| 4858 | L, |
| 4859 | ) |
| 4860 | # EncryptionKey / DecryptionKey |
| 4861 | if self.Dialect == 0x0311: |
| 4862 | if IsClient: |
| 4863 | label_out = b"SMBC2SCipherKey\x00" |
| 4864 | label_in = b"SMBS2CCipherKey\x00" |
| 4865 | else: |
| 4866 | label_out = b"SMBS2CCipherKey\x00" |
| 4867 | label_in = b"SMBC2SCipherKey\x00" |
| 4868 | context_out = context_in = self.SessionPreauthIntegrityHashValue |
| 4869 | else: |
| 4870 | label_out = label_in = b"SMB2AESCCM\x00" |
| 4871 | if IsClient: |
| 4872 | context_out = b"ServerIn \x00" # extra space per spec |
| 4873 | context_in = b"ServerOut\x00" |
| 4874 | else: |
| 4875 | context_out = b"ServerOut\x00" |
| 4876 | context_in = b"ServerIn \x00" |
| 4877 | self.EncryptionKey = SP800108_KDFCTR( |
| 4878 | self.sspcontext.SessionKey[: L // 8], |
| 4879 | label_out, |
| 4880 | context_out, |
| 4881 | L, |
| 4882 | ) |
| 4883 | self.DecryptionKey = SP800108_KDFCTR( |
| 4884 | self.sspcontext.SessionKey[: L // 8], |
| 4885 | label_in, |
| 4886 | context_in, |
| 4887 | L, |
| 4888 | ) |
no test coverage detected