Add key lookup for PAC signatures too

Author: SteveSyfuhs

Kerberos.NET/Crypto/KeyTable.cs

@@ -76,16 +76,21 @@ public void Write(BinaryWriter writer)
 
         public ICollection<KeyEntry> Entries => this.entries ??= new List<KeyEntry>();
 
-        public KerberosKey GetKey(ChecksumType type, KrbPrincipalName sname)
-        {
-            var etype = type switch
+        private static EncryptionType EncryptionTypeForChecksumType(ChecksumType type)
+            => type switch
             {
                 ChecksumType.HMAC_SHA1_96_AES128 => EncryptionType.AES128_CTS_HMAC_SHA1_96,
                 ChecksumType.HMAC_SHA1_96_AES256 => EncryptionType.AES256_CTS_HMAC_SHA1_96,
+                ChecksumType.HMAC_SHA256_128_AES128 => EncryptionType.AES128_CTS_HMAC_SHA256_128,
+                ChecksumType.HMAC_SHA384_192_AES256 => EncryptionType.AES256_CTS_HMAC_SHA384_192,
                 _ => EncryptionType.RC4_HMAC_NT,
             };
-            return this.GetKey(etype, sname);
-        }
+
+        public IEnumerable<KerberosKey> GetKeys(ChecksumType type, KrbPrincipalName sname)
+           => this.GetKeys(EncryptionTypeForChecksumType(type), sname);
+
+        public KerberosKey GetKey(ChecksumType type, KrbPrincipalName sname)
+            => this.GetKey(EncryptionTypeForChecksumType(type), sname);
 
         public IEnumerable<KerberosKey> GetKeys(EncryptionType type, KrbPrincipalName sname)
         {

Kerberos.NET/Entities/Pac/PacSignature.cs

@@ -4,7 +4,10 @@
 // -----------------------------------------------------------------------
 
 using System;
+using System.Linq;
 using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Security;
 using Kerberos.NET.Crypto;
 using Kerberos.NET.Ndr;
 
@@ -113,9 +116,38 @@ public void Validate(KerberosKey key)
 
         internal void Validate(KeyTable keytab, KrbPrincipalName sname)
         {
-            var key = keytab.GetKey(this.Type, sname);
+            var keys = keytab.GetKeys(this.Type, sname);
 
-            this.Validate(key);
+            if (!keys.Any())
+            {
+                throw new InvalidOperationException($"Could not find a key for {this.Type} and {sname.FullyQualifiedName}");
+            }
+
+            Exception ex = null;
+
+            foreach (var key in keys)
+            {
+                try
+                {
+                    this.Validate(key);
+                    return;
+                }
+                catch (CryptographicException cex)
+                {
+                    ex = cex;
+                    continue;
+                }
+                catch (SecurityException secx)
+                {
+                    ex = secx;
+                    continue;
+                }
+            }
+
+            if (ex != null)
+            {
+                throw ex;
+            }
         }
 
         internal void Sign(Memory<byte> pacUnsigned, KerberosKey key)