mac.go 1.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445
  1. // Copyright 2015 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. package pkcs12
  5. import (
  6. "crypto/hmac"
  7. "crypto/sha1"
  8. "crypto/x509/pkix"
  9. "encoding/asn1"
  10. )
  11. type macData struct {
  12. Mac digestInfo
  13. MacSalt []byte
  14. Iterations int `asn1:"optional,default:1"`
  15. }
  16. // from PKCS#7:
  17. type digestInfo struct {
  18. Algorithm pkix.AlgorithmIdentifier
  19. Digest []byte
  20. }
  21. var (
  22. oidSHA1 = asn1.ObjectIdentifier([]int{1, 3, 14, 3, 2, 26})
  23. )
  24. func verifyMac(macData *macData, message, password []byte) error {
  25. if !macData.Mac.Algorithm.Algorithm.Equal(oidSHA1) {
  26. return NotImplementedError("unknown digest algorithm: " + macData.Mac.Algorithm.Algorithm.String())
  27. }
  28. key := pbkdf(sha1Sum, 20, 64, macData.MacSalt, password, macData.Iterations, 3, 20)
  29. mac := hmac.New(sha1.New, key)
  30. mac.Write(message)
  31. expectedMAC := mac.Sum(nil)
  32. if !hmac.Equal(macData.Mac.Digest, expectedMAC) {
  33. return ErrIncorrectPassword
  34. }
  35. return nil
  36. }