helpers_hmac.go

package ipmi

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/hmac"
	"crypto/md5"
	"crypto/rc4"
	"crypto/sha1"
	"crypto/sha256"
	"fmt"
)

// generate_hmac generates message authentication code.
// Currently supported algorithms are: "md5", "sha1", "sha256"
//
// 	hmac, hash-based message authentication code
// 	mac, message authentication code
// 	md, message digest
func generate_hmac(alg string, data []byte, key []byte) ([]byte, error) {
	switch alg {
	case "md5":
		h := hmac.New(md5.New, key)
		_, err := h.Write(data)
		if err != nil {
			return nil, fmt.Errorf("hmac md5 failed, err: %s", err)
		}
		return h.Sum(nil), nil

	case "sha1":
		h := hmac.New(sha1.New, key)
		_, err := h.Write(data)
		if err != nil {
			return nil, fmt.Errorf("hmac sha1 failed, err: %s", err)
		}
		return h.Sum(nil), nil

	case "sha256":
		h := hmac.New(sha256.New, key)
		_, err := h.Write(data)
		if err != nil {
			return nil, fmt.Errorf("hmac sha256 failed, err: %s", err)
		}
		return h.Sum(nil), nil

	default:
		return nil, fmt.Errorf("not support for hmac algorithm %s", alg)
	}
}

func generate_auth_hmac(authAlg AuthAlg, data []byte, key []byte) ([]byte, error) {
	switch authAlg {
	case AuthAlgRAKP_None:
		return []byte{}, nil

	case AuthAlgRAKP_HMAC_MD5:
		return generate_hmac("md5", data, key)

	case AuthAlgRAKP_HMAC_SHA1:
		return generate_hmac("sha1", data, key)

	case AuthAlgRAKP_HMAC_SHA256:
		return generate_hmac("sha256", data, key)

	default:
		return nil, fmt.Errorf("not support for authentication algorithm %x", authAlg)
	}
}

// The plainText must be already padded.
// The cipherKey length is either 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256.
func encryptAES(plainText []byte, cipherKey []byte, iv []byte) ([]byte, error) {
	if len(plainText)%aes.BlockSize != 0 {
		return nil, fmt.Errorf("input plainText must be mutiple of aes block size (16)")
	}

	l := len(cipherKey)
	if l != 16 && l != 24 && l != 32 {
		return nil, fmt.Errorf("cipherKey length must be either 16, 24, 32")
	}

	cipherBlock, err := aes.NewCipher(cipherKey)
	if err != nil {
		return nil, fmt.Errorf("NewCipher failed, err: %s", err)
	}

	cipherText := make([]byte, len(plainText))

	mode := cipher.NewCBCEncrypter(cipherBlock, iv)
	mode.CryptBlocks(cipherText, plainText)

	return cipherText, nil
}

func decryptAES(cipherText []byte, cipherKey []byte, iv []byte) ([]byte, error) {
	l := len(cipherKey)
	if l != 16 && l != 24 && l != 32 {
		return nil, fmt.Errorf("cipherKey length must be either 16, 24, 32")
	}

	cipherBlock, err := aes.NewCipher(cipherKey)
	if err != nil {
		return nil, fmt.Errorf("NewCipher failed, err: %s", err)
	}

	plainText := make([]byte, len(cipherText))
	mode := cipher.NewCBCDecrypter(cipherBlock, iv)
	mode.CryptBlocks(plainText, cipherText)

	return plainText, nil
}

func encryptRC4(plainText []byte, cipherKey []byte, iv []byte) ([]byte, error) {
	rc4Cipher, err := rc4.NewCipher(cipherKey)
	if err != nil {
		return nil, fmt.Errorf("NewCipher failed, err: %s", err)
	}

	cipherText := make([]byte, len(plainText))
	rc4Cipher.XORKeyStream(cipherText, plainText)
	return cipherText, nil
}

func decryptRC4(cipherText []byte, cipherKey []byte, iv []byte) ([]byte, error) {
	rc4Cipher, err := rc4.NewCipher(cipherKey)
	if err != nil {
		return nil, fmt.Errorf("NewCipher failed, err: %s", err)
	}

	plainText := make([]byte, len(cipherText))
	rc4Cipher.XORKeyStream(plainText, cipherText)
	return plainText, nil
}