2.2.1.3.3 NL_AUTH_SHA2_SIGNATURE
The NL_AUTH_SHA2_SIGNATURE structure is a security token that defines the SHA2 authentication signature that SHOULD<18> be used by Netlogon to execute Netlogon methods over a secure channel. It follows the security trailer that a security provider MUST associate with a signed or encrypted message. A security trailer or sec_trailer structure ([MS-RPCE] section 2.2.2.11) has syntax equivalent to the auth_verifier_co_t structure, as specified in [C706] section 13.2.6.1. When Netlogon is functioning as its own SSP for the RPC connection, this structure contains the signature, a sequence number, and (if encryption is requested) a confounder. See section 3.3.4.2.
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
SignatureAlgorithm |
SealAlgorithm |
||||||||||||||||||||||||||||||
|
Pad |
Flags |
||||||||||||||||||||||||||||||
|
SequenceNumber |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Checksum (8 bytes) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Confounder |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
Reserved (24 bytes) |
|||||||||||||||||||||||||||||||
|
… |
|||||||||||||||||||||||||||||||
SignatureAlgorithm (2 bytes): A 16-bit little-endian integer that identifies the algorithm that is used for signature computation. The only supported signature algorithm is HMAC-SHA256 [RFC4634]. The SignatureAlgorithm field MUST contain the following value.
-
Value
Meaning
0x0013
The packet is signed using HMAC-SHA256.
SealAlgorithm (2 bytes): A 16-bit little-endian integer that identifies the algorithm used for encryption. The only supported encryption algorithm is AES-128 [FIPS197]. The SealAlgorithm field MUST contain one of the following values.
-
Value
Meaning
0xFFFF
The packet is not encrypted.
0x001A
The packet is encrypted using AES-128.
Pad (2 bytes): A 2-byte padding field. Both bytes MUST be set to 0xFF.
Flags (2 bytes): Specifies properties of the structure. No Flags are currently defined. Both bytes MUST be set to zero and MUST be ignored on receipt.
SequenceNumber (8 bytes): A 64-bit little-endian integer containing the sequence number of the RPC message. For more details about how to calculate the SequenceNumber, see section 3.3.4.2.1.
Checksum (8 bytes): A 64-bit value containing the final Checksum of the signature and the RPC message. For more details about how to calculate the Checksum, see section 3.3.4.2.1.
Confounder (8 bytes): A buffer that is employed when the structure is used for encryption, in addition to signing. The bytes are filled with random data that is used by the encryption algorithm. If the structure is used only for signing, the Confounder is not included. For details about the Confounder and encrypting the data, see section 3.3.4.2.1.
Reserved (24 bytes): The sender SHOULD<19> set these bytes to zero, and the receiver MUST ignore them.