smb_server_auth/
crypto.rs

1//! Cryptographic primitives used by the NTLM family and SMB signing.
2//!
3//! Thin re-export of the [`smb_server_csp`] crypto service provider. The active
4//! backend is selected at compile time in `smb-server-csp` itself:
5//! * default — RustCrypto crates (`lib` feature),
6//! * `--no-default-features --features handrolled` — bundled implementations.
7
8#[cfg(feature = "lib")]
9pub use smb_server_csp::{aes128ccm_open, aes128ccm_seal, aes128gcm_open, aes128gcm_seal,
10    aes256ccm_open, aes256ccm_seal, aes256gcm_open, aes256gcm_seal,
11    ntlm_mech_list_mic};
12
13/// AES-128-GMAC authentication tag over `msg` with `nonce` ([RFC4543]): the
14/// SMB 3.1.1 AES-GMAC signature ([MS-SMB2] §3.1.4.1). GMAC is AES-GCM with an
15/// empty plaintext and the message supplied as additional authenticated data;
16/// the 16-byte GCM tag is the signature.
17#[cfg(feature = "lib")]
18#[cfg_attr(dylint_lib = "no_magic_numbers", allow(no_magic_numbers))] // AEAD tag length
19pub fn aes128_gmac(key: &[u8; 16], nonce: &[u8; 12], msg: &[u8]) -> [u8; 16] {
20    let out = aes128gcm_seal(key, nonce, msg, &[]);
21    let mut tag = [0u8; 16];
22    tag.copy_from_slice(&out[out.len() - 16..]);
23    tag
24}
25pub use smb_server_csp::{
26    aes128_cmac,
27    aes128_encrypt_block, des_encrypt_key7, hmac_md5, hmac_sha256,
28    kdf_counter_mode_hmac_sha256, md4, md5, ntlmv1_response, nt_hash, rc4, sha256, sha512,
29};
30
31/// SHA-256 module alias for callers importing by path
32/// (`crypto::sha256::sha256`).
33pub mod sha256 {
34    pub use smb_server_csp::sha256;
35}
36
37/// SHA-512 module alias for callers importing by path.
38pub mod sha512 {
39    pub use smb_server_csp::sha512;
40}
smb_server_auth/crypto.rs

smb_server_auth/
crypto.rs
