<commit_before>package pkcs12

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha1"
	"crypto/x509/pkix"
	"hash"
)

type macData struct {
	Mac        digestInfo
	MacSalt    []byte
	Iterations int `asn1:"optional,default:1"`
}

// from PKCS#7:
type digestInfo struct {
	Algorithm pkix.AlgorithmIdentifier
	Digest    []byte
}

const (
	sha1Algorithm = "SHA-1"
)

var (
	hashNameByID = map[string]string{
		"1.3.14.3.2.26": sha1Algorithm,
	}
	hashByName = map[string]func() hash.Hash{
		sha1Algorithm: sha1.New,
	}
)

func verifyMac(macData *macData, message, password []byte) error {
	name, ok := hashNameByID[macData.Mac.Algorithm.Algorithm.String()]
	if !ok {
		return UnsupportedFormat("Unknown digest algorithm: " + macData.Mac.Algorithm.Algorithm.String())
	}
	k := deriveMacKeyByAlg[name](macData.MacSalt, password, macData.Iterations)
	password = nil

	mac := hmac.New(hashByName[name], k)
	mac.Write(message)
	expectedMAC := mac.Sum(nil)

	if bytes.Compare(macData.Mac.Digest, expectedMAC) != 0 {
		return PasswordIncorrect("Incorrect password, MAC mismatch")
	}
	return nil
}

// Error indicating that the supplied password is incorrect. Usually, P12/PFX data is signed to be able to verify the password.
type PasswordIncorrect string

func (e PasswordIncorrect) Error() string { return string(e) }<commit_msg>Compare hmac values using hmac.Equal<commit_after>package pkcs12

import (
	"crypto/hmac"
	"crypto/sha1"
	"crypto/x509/pkix"
	"hash"
)

type macData struct {
	Mac        digestInfo
	MacSalt    []byte
	Iterations int `asn1:"optional,default:1"`
}

// from PKCS#7:
type digestInfo struct {
	Algorithm pkix.AlgorithmIdentifier
	Digest    []byte
}

const (
	sha1Algorithm = "SHA-1"
)

var (
	hashNameByID = map[string]string{
		"1.3.14.3.2.26": sha1Algorithm,
	}
	hashByName = map[string]func() hash.Hash{
		sha1Algorithm: sha1.New,
	}
)

func verifyMac(macData *macData, message, password []byte) error {
	name, ok := hashNameByID[macData.Mac.Algorithm.Algorithm.String()]
	if !ok {
		return UnsupportedFormat("Unknown digest algorithm: " + macData.Mac.Algorithm.Algorithm.String())
	}
	k := deriveMacKeyByAlg[name](macData.MacSalt, password, macData.Iterations)
	password = <PASSWORD>

	mac := hmac.New(hashByName[name], k)
	mac.Write(message)
	expectedMAC := mac.Sum(nil)

	if !hmac.Equal(macData.Mac.Digest, expectedMAC) {
		return PasswordIncorrect("Incorrect password, MAC mismatch")
	}
	return nil
}

// Error indicating that the supplied password is incorrect. Usually, P12/PFX data is signed to be able to verify the password.
type PasswordIncorrect string

func (e PasswordIncorrect) Error() string { return string(e) }
{'fraction_non_alphanumeric': 0.1236722306525038, 'fraction_numerical': 0.01858877086494689, 'mean_word_length': 4.586864406779661, 'pattern_counts': {'":': 2, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5942598', 'n_tokens_mistral': 954, 'n_tokens_neox': 922, 'n_words': 222}