update comments for golint

crypto/aes128-cts-hmac-sha1-96.go

@@ -61,86 +61,107 @@ import (
 type Aes128CtsHmacSha96 struct {
 }
 
+// GetETypeID returns the EType ID number.
 func (e Aes128CtsHmacSha96) GetETypeID() int {
 	return etypeID.AES128_CTS_HMAC_SHA1_96
 }
 
+// GetHashID returns the checksum type ID number.
 func (e Aes128CtsHmacSha96) GetHashID() int {
 	return chksumtype.HMAC_SHA1_96_AES128
 }
 
+// GetKeyByteSize returns the number of bytes for key of this etype.
 func (e Aes128CtsHmacSha96) GetKeyByteSize() int {
 	return 128 / 8
 }
 
+// GetKeySeedBitLength returns the number of bits for the seed for key generation.
 func (e Aes128CtsHmacSha96) GetKeySeedBitLength() int {
 	return e.GetKeyByteSize() * 8
 }
 
+// GetHashFunc returns the hash function for this etype.
 func (e Aes128CtsHmacSha96) GetHashFunc() func() hash.Hash {
 	return sha1.New
 }
 
+// GetMessageBlockByteSize returns the block size for the etype's messages.
 func (e Aes128CtsHmacSha96) GetMessageBlockByteSize() int {
 	return 1
 }
 
+// GetDefaultStringToKeyParams returns the default key derivation parameters in string form.
 func (e Aes128CtsHmacSha96) GetDefaultStringToKeyParams() string {
 	return "00001000"
 }
 
+// GetConfounderByteSize returns the byte count for confounder to be used during cryptographic operations.
 func (e Aes128CtsHmacSha96) GetConfounderByteSize() int {
 	return aes.BlockSize
 }
 
+// GetHMACBitLength returns the bit count size of the integrity hash.
 func (e Aes128CtsHmacSha96) GetHMACBitLength() int {
 	return 96
 }
 
+// GetCypherBlockBitLength returns the bit count size of the cypher block.
 func (e Aes128CtsHmacSha96) GetCypherBlockBitLength() int {
 	return aes.BlockSize * 8
 }
 
+// StringToKey returns a key derived from the string provided.
 func (e Aes128CtsHmacSha96) StringToKey(secret string, salt string, s2kparams string) ([]byte, error) {
-	return rfc3961.StringToKey(secret, salt, s2kparams, e)
+	return rfc3962.StringToKey(secret, salt, s2kparams, e)
 }
 
+// RandomToKey returns a key from the bytes provided.
 func (e Aes128CtsHmacSha96) RandomToKey(b []byte) []byte {
 	return rfc3961.RandomToKey(b)
 }
 
+// EncryptData encrypts the data provided.
 func (e Aes128CtsHmacSha96) EncryptData(key, data []byte) ([]byte, []byte, error) {
 	return rfc3962.EncryptData(key, data, e)
 }
 
+// EncryptMessage encrypts the message provided and concatenates it with the integrity hash to create an encrypted message.
 func (e Aes128CtsHmacSha96) EncryptMessage(key, message []byte, usage uint32) ([]byte, []byte, error) {
 	return rfc3962.EncryptMessage(key, message, usage, e)
 }
 
+// DecryptData decrypts the data provided.
 func (e Aes128CtsHmacSha96) DecryptData(key, data []byte) ([]byte, error) {
 	return rfc3962.DecryptData(key, data, e)
 }
 
+// DecryptMessage decrypts the message provided and verifies the integrity of the message.
 func (e Aes128CtsHmacSha96) DecryptMessage(key, ciphertext []byte, usage uint32) ([]byte, error) {
 	return rfc3962.DecryptMessage(key, ciphertext, usage, e)
 }
 
+// DeriveKey derives a key from the protocol key based on the usage value.
 func (e Aes128CtsHmacSha96) DeriveKey(protocolKey, usage []byte) ([]byte, error) {
 	return rfc3961.DeriveKey(protocolKey, usage, e)
 }
 
+// DeriveRandom generates data needed for key generation.
 func (e Aes128CtsHmacSha96) DeriveRandom(protocolKey, usage []byte) ([]byte, error) {
 	return rfc3961.DeriveRandom(protocolKey, usage, e)
 }
 
+// VerifyIntegrity checks the integrity of the plaintext message.
 func (e Aes128CtsHmacSha96) VerifyIntegrity(protocolKey, ct, pt []byte, usage uint32) bool {
 	return rfc3961.VerifyIntegrity(protocolKey, ct, pt, usage, e)
 }
 
+// GetChecksumHash returns a keyed checksum hash of the bytes provided.
 func (e Aes128CtsHmacSha96) GetChecksumHash(protocolKey, data []byte, usage uint32) ([]byte, error) {
 	return common.GetHash(data, protocolKey, common.GetUsageKc(usage), e)
 }
 
+// VerifyChecksum compares the checksum of the message bytes is the same as the checksum provided.
 func (e Aes128CtsHmacSha96) VerifyChecksum(protocolKey, data, chksum []byte, usage uint32) bool {
 	c, err := e.GetChecksumHash(protocolKey, data, usage)
 	if err != nil {

crypto/aes128-cts-hmac-sha1-96_test.go

@@ -3,7 +3,7 @@ package crypto
 import (
 	"encoding/hex"
 	"github.com/jcmturner/gokrb5/crypto/common"
-	"github.com/jcmturner/gokrb5/crypto/rfc3961"
+	"github.com/jcmturner/gokrb5/crypto/rfc3962"
 	"github.com/stretchr/testify/assert"
 	"testing"
 )
@@ -32,7 +32,7 @@ func TestAes128CtsHmacSha196_StringToKey(t *testing.T) {
 	var e Aes128CtsHmacSha96
 	for i, test := range tests {
 
-		assert.Equal(t, test.pbkdf2, hex.EncodeToString(rfc3961.StringToPBKDF2(test.phrase, test.salt, test.iterations, e)), "PBKDF2 not as expected")
+		assert.Equal(t, test.pbkdf2, hex.EncodeToString(rfc3962.StringToPBKDF2(test.phrase, test.salt, test.iterations, e)), "PBKDF2 not as expected")
 		k, err := e.StringToKey(test.phrase, test.salt, common.IterationsToS2kparams(test.iterations))
 		if err != nil {
 			t.Errorf("Error in processing string to key for test %d: %v", i, err)

crypto/aes128-cts-hmac-sha256-128.go

@@ -16,79 +16,98 @@ import (
 type Aes128CtsHmacSha256128 struct {
 }
 
+// GetETypeID returns the EType ID number.
 func (e Aes128CtsHmacSha256128) GetETypeID() int {
 	return etypeID.AES128_CTS_HMAC_SHA256_128
 }
 
+// GetHashID returns the checksum type ID number.
 func (e Aes128CtsHmacSha256128) GetHashID() int {
 	return chksumtype.HMAC_SHA256_128_AES128
 }
 
+// GetKeyByteSize returns the number of bytes for key of this etype.
 func (e Aes128CtsHmacSha256128) GetKeyByteSize() int {
 	return 128 / 8
 }
 
+// GetKeySeedBitLength returns the number of bits for the seed for key generation.
 func (e Aes128CtsHmacSha256128) GetKeySeedBitLength() int {
 	return e.GetKeyByteSize() * 8
 }
 
+// GetHashFunc returns the hash function for this etype.
 func (e Aes128CtsHmacSha256128) GetHashFunc() func() hash.Hash {
 	return sha256.New
 }
 
+// GetMessageBlockByteSize returns the block size for the etype's messages.
 func (e Aes128CtsHmacSha256128) GetMessageBlockByteSize() int {
 	return 1
 }
 
+// GetDefaultStringToKeyParams returns the default key derivation parameters in string form.
 func (e Aes128CtsHmacSha256128) GetDefaultStringToKeyParams() string {
 	return "00008000"
 }
 
+// GetConfounderByteSize returns the byte count for confounder to be used during cryptographic operations.
 func (e Aes128CtsHmacSha256128) GetConfounderByteSize() int {
 	return aes.BlockSize
 }
 
+// GetHMACBitLength returns the bit count size of the integrity hash.
 func (e Aes128CtsHmacSha256128) GetHMACBitLength() int {
 	return 128
 }
 
+// GetCypherBlockBitLength returns the bit count size of the cypher block.
 func (e Aes128CtsHmacSha256128) GetCypherBlockBitLength() int {
 	return aes.BlockSize * 8
 }
 
+// StringToKey returns a key derived from the string provided.
 func (e Aes128CtsHmacSha256128) StringToKey(secret string, salt string, s2kparams string) ([]byte, error) {
 	saltp := rfc8009.GetSaltP(salt, "aes128-cts-hmac-sha256-128")
 	return rfc8009.StringToKey(secret, saltp, s2kparams, e)
 }
 
+// RandomToKey returns a key from the bytes provided.
 func (e Aes128CtsHmacSha256128) RandomToKey(b []byte) []byte {
 	return rfc8009.RandomToKey(b)
 }
 
+// EncryptData encrypts the data provided.
 func (e Aes128CtsHmacSha256128) EncryptData(key, data []byte) ([]byte, []byte, error) {
 	return rfc8009.EncryptData(key, data, e)
 }
 
+// EncryptMessage encrypts the message provided and concatenates it with the integrity hash to create an encrypted message.
 func (e Aes128CtsHmacSha256128) EncryptMessage(key, message []byte, usage uint32) ([]byte, []byte, error) {
 	return rfc8009.EncryptMessage(key, message, usage, e)
 }
 
+// DecryptData decrypts the data provided.
 func (e Aes128CtsHmacSha256128) DecryptData(key, data []byte) ([]byte, error) {
 	return rfc8009.DecryptData(key, data, e)
 }
 
+// DecryptMessage decrypts the message provided and verifies the integrity of the message.
 func (e Aes128CtsHmacSha256128) DecryptMessage(key, ciphertext []byte, usage uint32) ([]byte, error) {
 	return rfc8009.DecryptMessage(key, ciphertext, usage, e)
 }
 
+// DeriveKey derives a key from the protocol key based on the usage value.
 func (e Aes128CtsHmacSha256128) DeriveKey(protocolKey, usage []byte) ([]byte, error) {
 	return rfc8009.DeriveKey(protocolKey, usage, e), nil
 }
 
+// DeriveRandom generates data needed for key generation.
 func (e Aes128CtsHmacSha256128) DeriveRandom(protocolKey, usage []byte) ([]byte, error) {
 	return rfc8009.DeriveRandom(protocolKey, usage, e)
 }
 
+// VerifyIntegrity checks the integrity of the ciphertext message.
 // The HMAC is calculated over the cipher state concatenated with the
 // AES output, instead of being calculated over the confounder and
 // plaintext.  This allows the message receiver to verify the
@@ -99,10 +118,12 @@ func (e Aes128CtsHmacSha256128) VerifyIntegrity(protocolKey, ct, pt []byte, usag
 	return rfc8009.VerifyIntegrity(protocolKey, ct, usage, e)
 }
 
+// GetChecksumHash returns a keyed checksum hash of the bytes provided.
 func (e Aes128CtsHmacSha256128) GetChecksumHash(protocolKey, data []byte, usage uint32) ([]byte, error) {
 	return common.GetHash(data, protocolKey, common.GetUsageKc(usage), e)
 }
 
+// VerifyChecksum compares the checksum of the message bytes is the same as the checksum provided.
 func (e Aes128CtsHmacSha256128) VerifyChecksum(protocolKey, data, chksum []byte, usage uint32) bool {
 	c, err := e.GetChecksumHash(protocolKey, data, usage)
 	if err != nil {

crypto/aes256-cts-hmac-sha1-96.go

@@ -61,86 +61,107 @@ import (
 type Aes256CtsHmacSha96 struct {
 }
 
+// GetETypeID returns the EType ID number.
 func (e Aes256CtsHmacSha96) GetETypeID() int {
 	return etypeID.AES256_CTS_HMAC_SHA1_96
 }
 
+// GetHashID returns the checksum type ID number.
 func (e Aes256CtsHmacSha96) GetHashID() int {
 	return chksumtype.HMAC_SHA1_96_AES256
 }
 
+// GetKeyByteSize returns the number of bytes for key of this etype.
 func (e Aes256CtsHmacSha96) GetKeyByteSize() int {
 	return 256 / 8
 }
 
+// GetKeySeedBitLength returns the number of bits for the seed for key generation.
 func (e Aes256CtsHmacSha96) GetKeySeedBitLength() int {
 	return e.GetKeyByteSize() * 8
 }
 
+// GetHashFunc returns the hash function for this etype.
 func (e Aes256CtsHmacSha96) GetHashFunc() func() hash.Hash {
 	return sha1.New
 }
 
+// GetMessageBlockByteSize returns the block size for the etype's messages.
 func (e Aes256CtsHmacSha96) GetMessageBlockByteSize() int {
 	return 1
 }
 
+// GetDefaultStringToKeyParams returns the default key derivation parameters in string form.
 func (e Aes256CtsHmacSha96) GetDefaultStringToKeyParams() string {
 	return "00001000"
 }
 
+// GetConfounderByteSize returns the byte count for confounder to be used during cryptographic operations.
 func (e Aes256CtsHmacSha96) GetConfounderByteSize() int {
 	return aes.BlockSize
 }
 
+// GetHMACBitLength returns the bit count size of the integrity hash.
 func (e Aes256CtsHmacSha96) GetHMACBitLength() int {
 	return 96
 }
 
+// GetCypherBlockBitLength returns the bit count size of the cypher block.
 func (e Aes256CtsHmacSha96) GetCypherBlockBitLength() int {
 	return aes.BlockSize * 8
 }
 
+// StringToKey returns a key derived from the string provided.
 func (e Aes256CtsHmacSha96) StringToKey(secret string, salt string, s2kparams string) ([]byte, error) {
-	return rfc3961.StringToKey(secret, salt, s2kparams, e)
+	return rfc3962.StringToKey(secret, salt, s2kparams, e)
 }
 
+// RandomToKey returns a key from the bytes provided.
 func (e Aes256CtsHmacSha96) RandomToKey(b []byte) []byte {
 	return rfc3961.RandomToKey(b)
 }
 
+// EncryptData encrypts the data provided.
 func (e Aes256CtsHmacSha96) EncryptData(key, data []byte) ([]byte, []byte, error) {
 	return rfc3962.EncryptData(key, data, e)
 }
 
+// EncryptMessage encrypts the message provided and concatenates it with the integrity hash to create an encrypted message.
 func (e Aes256CtsHmacSha96) EncryptMessage(key, message []byte, usage uint32) ([]byte, []byte, error) {
 	return rfc3962.EncryptMessage(key, message, usage, e)
 }
 
+// DecryptData decrypts the data provided.
 func (e Aes256CtsHmacSha96) DecryptData(key, data []byte) ([]byte, error) {
 	return rfc3962.DecryptData(key, data, e)
 }
 
+// DecryptMessage decrypts the message provided and verifies the integrity of the message.
 func (e Aes256CtsHmacSha96) DecryptMessage(key, ciphertext []byte, usage uint32) ([]byte, error) {
 	return rfc3962.DecryptMessage(key, ciphertext, usage, e)
 }
 
+// DeriveKey derives a key from the protocol key based on the usage value.
 func (e Aes256CtsHmacSha96) DeriveKey(protocolKey, usage []byte) ([]byte, error) {
 	return rfc3961.DeriveKey(protocolKey, usage, e)
 }
 
+// DeriveRandom generates data needed for key generation.
 func (e Aes256CtsHmacSha96) DeriveRandom(protocolKey, usage []byte) ([]byte, error) {
 	return rfc3961.DeriveRandom(protocolKey, usage, e)
 }
 
+// VerifyIntegrity checks the integrity of the plaintext message.
 func (e Aes256CtsHmacSha96) VerifyIntegrity(protocolKey, ct, pt []byte, usage uint32) bool {
 	return rfc3961.VerifyIntegrity(protocolKey, ct, pt, usage, e)
 }
 
+// GetChecksumHash returns a keyed checksum hash of the bytes provided.
 func (e Aes256CtsHmacSha96) GetChecksumHash(protocolKey, data []byte, usage uint32) ([]byte, error) {
 	return common.GetHash(data, protocolKey, common.GetUsageKc(usage), e)
 }
 
+// VerifyChecksum compares the checksum of the message bytes is the same as the checksum provided.
 func (e Aes256CtsHmacSha96) VerifyChecksum(protocolKey, data, chksum []byte, usage uint32) bool {
 	c, err := e.GetChecksumHash(protocolKey, data, usage)
 	if err != nil {

crypto/aes256-cts-hmac-sha1-96_test.go

@@ -3,7 +3,7 @@ package crypto
 import (
 	"encoding/hex"
 	"github.com/jcmturner/gokrb5/crypto/common"
-	"github.com/jcmturner/gokrb5/crypto/rfc3961"
+	"github.com/jcmturner/gokrb5/crypto/rfc3962"
 	"github.com/stretchr/testify/assert"
 	"testing"
 )
@@ -32,7 +32,7 @@ func TestAes256CtsHmacSha196_StringToKey(t *testing.T) {
 	var e Aes256CtsHmacSha96
 	for i, test := range tests {
 
-		assert.Equal(t, test.pbkdf2, hex.EncodeToString(rfc3961.StringToPBKDF2(test.phrase, test.salt, test.iterations, e)), "PBKDF2 not as expected")
+		assert.Equal(t, test.pbkdf2, hex.EncodeToString(rfc3962.StringToPBKDF2(test.phrase, test.salt, test.iterations, e)), "PBKDF2 not as expected")
 		k, err := e.StringToKey(test.phrase, test.salt, common.IterationsToS2kparams(test.iterations))
 		if err != nil {
 			t.Errorf("Error in processing string to key for test %d: %v", i, err)

crypto/aes256-cts-hmac-sha384-192.go

@@ -16,79 +16,98 @@ import (
 type Aes256CtsHmacSha384192 struct {
 }
 
+// GetETypeID returns the EType ID number.
 func (e Aes256CtsHmacSha384192) GetETypeID() int {
 	return etypeID.AES256_CTS_HMAC_SHA384_192
 }
 
+// GetHashID returns the checksum type ID number.
 func (e Aes256CtsHmacSha384192) GetHashID() int {
 	return chksumtype.HMAC_SHA384_192_AES256
 }
 
+// GetKeyByteSize returns the number of bytes for key of this etype.
 func (e Aes256CtsHmacSha384192) GetKeyByteSize() int {
 	return 192 / 8
 }
 
+// GetKeySeedBitLength returns the number of bits for the seed for key generation.
 func (e Aes256CtsHmacSha384192) GetKeySeedBitLength() int {
 	return e.GetKeyByteSize() * 8
 }
 
+// GetHashFunc returns the hash function for this etype.
 func (e Aes256CtsHmacSha384192) GetHashFunc() func() hash.Hash {
 	return sha512.New384
 }
 
+// GetMessageBlockByteSize returns the block size for the etype's messages.
 func (e Aes256CtsHmacSha384192) GetMessageBlockByteSize() int {
 	return 1
 }
 
+// GetDefaultStringToKeyParams returns the default key derivation parameters in string form.
 func (e Aes256CtsHmacSha384192) GetDefaultStringToKeyParams() string {
 	return "00008000"
 }
 
+// GetConfounderByteSize returns the byte count for confounder to be used during cryptographic operations.
 func (e Aes256CtsHmacSha384192) GetConfounderByteSize() int {
 	return aes.BlockSize
 }
 
+// GetHMACBitLength returns the bit count size of the integrity hash.
 func (e Aes256CtsHmacSha384192) GetHMACBitLength() int {
 	return 192
 }
 
+// GetCypherBlockBitLength returns the bit count size of the cypher block.
 func (e Aes256CtsHmacSha384192) GetCypherBlockBitLength() int {
 	return aes.BlockSize * 8
 }
 
+// StringToKey returns a key derived from the string provided.
 func (e Aes256CtsHmacSha384192) StringToKey(secret string, salt string, s2kparams string) ([]byte, error) {
 	saltp := rfc8009.GetSaltP(salt, "aes256-cts-hmac-sha384-192")
 	return rfc8009.StringToKey(secret, saltp, s2kparams, e)
 }
 
+// RandomToKey returns a key from the bytes provided.
 func (e Aes256CtsHmacSha384192) RandomToKey(b []byte) []byte {
 	return rfc8009.RandomToKey(b)
 }
 
+// EncryptData encrypts the data provided.
 func (e Aes256CtsHmacSha384192) EncryptData(key, data []byte) ([]byte, []byte, error) {
 	return rfc8009.EncryptData(key, data, e)
 }
 
+// EncryptMessage encrypts the message provided and concatenates it with the integrity hash to create an encrypted message.
 func (e Aes256CtsHmacSha384192) EncryptMessage(key, message []byte, usage uint32) ([]byte, []byte, error) {
 	return rfc8009.EncryptMessage(key, message, usage, e)
 }
 
+// DecryptData decrypts the data provided.
 func (e Aes256CtsHmacSha384192) DecryptData(key, data []byte) ([]byte, error) {
 	return rfc8009.DecryptData(key, data, e)
 }
 
+// DecryptMessage decrypts the message provided and verifies the integrity of the message.
 func (e Aes256CtsHmacSha384192) DecryptMessage(key, ciphertext []byte, usage uint32) ([]byte, error) {
 	return rfc8009.DecryptMessage(key, ciphertext, usage, e)
 }
 
+// DeriveKey derives a key from the protocol key based on the usage value.
 func (e Aes256CtsHmacSha384192) DeriveKey(protocolKey, usage []byte) ([]byte, error) {
 	return rfc8009.DeriveKey(protocolKey, usage, e), nil
 }
 
+// DeriveRandom generates data needed for key generation.
 func (e Aes256CtsHmacSha384192) DeriveRandom(protocolKey, usage []byte) ([]byte, error) {
 	return rfc8009.DeriveRandom(protocolKey, usage, e)
 }
 
+// VerifyIntegrity checks the integrity of the ciphertext message.
 // The HMAC is calculated over the cipher state concatenated with the
 // AES output, instead of being calculated over the confounder and
 // plaintext.  This allows the message receiver to verify the
@@ -99,10 +118,12 @@ func (e Aes256CtsHmacSha384192) VerifyIntegrity(protocolKey, ct, pt []byte, usag
 	return rfc8009.VerifyIntegrity(protocolKey, ct, usage, e)
 }
 
+// GetChecksumHash returns a keyed checksum hash of the bytes provided.
 func (e Aes256CtsHmacSha384192) GetChecksumHash(protocolKey, data []byte, usage uint32) ([]byte, error) {
 	return common.GetHash(data, protocolKey, common.GetUsageKc(usage), e)
 }
 
+// VerifyChecksum compares the checksum of the message bytes is the same as the checksum provided.
 func (e Aes256CtsHmacSha384192) VerifyChecksum(protocolKey, data, chksum []byte, usage uint32) bool {
 	c, err := e.GetChecksumHash(protocolKey, data, usage)
 	if err != nil {

crypto/aescts/aescts.go

@@ -1,4 +1,4 @@
-// AES CipherText Stealing encryption and decryption methods
+// Package aescts provides AES CipherText Stealing encryption and decryption methods
 package aescts
 
 import (
@@ -9,6 +9,7 @@ import (
 	"github.com/jcmturner/gokrb5/crypto/common"
 )
 
+// Encrypt the message with the key and the initial vector.
 func Encrypt(key, iv, message []byte) ([]byte, []byte, error) {
 	l := len(message)
 
@@ -61,6 +62,7 @@ func Encrypt(key, iv, message []byte) ([]byte, []byte, error) {
 	return lb, ct[:l], nil
 }
 
+// Decrypt the ciphertext with the key and the initial vector.
 func Decrypt(key, iv, ciphertext []byte) ([]byte, error) {
 	// Copy the cipher text as golang slices even when passed by value to this method can result in the backing arrays of the calling code value being updated.
 	ct := make([]byte, len(ciphertext))

crypto/common/common.go

@@ -1,4 +1,4 @@
-// Encryption methods common across encryption types
+// Package common provides encryption methods common across encryption types
 package common
 
 import (
@@ -11,7 +11,11 @@ import (
 	"github.com/jcmturner/gokrb5/crypto/etype"
 )
 
-// Pad bytes b with zeros to nearest multiple of message size m.
+const (
+	s2kParamsZero = 4294967296
+)
+
+// ZeroPad pads bytes with zeros to nearest multiple of message size m.
 func ZeroPad(b []byte, m int) ([]byte, error) {
 	if m <= 0 {
 		return nil, errors.New("Invalid message block size when padding")
@@ -27,7 +31,7 @@ func ZeroPad(b []byte, m int) ([]byte, error) {
 	return b, nil
 }
 
-// Pad bytes b according to RFC 2315 to nearest multiple of message size m.
+// PKCS7Pad pads bytes according to RFC 2315 to nearest multiple of message size m.
 func PKCS7Pad(b []byte, m int) ([]byte, error) {
 	if m <= 0 {
 		return nil, errors.New("Invalid message block size when padding")
@@ -42,7 +46,7 @@ func PKCS7Pad(b []byte, m int) ([]byte, error) {
 	return pb, nil
 }
 
-// Remove RFC 2315 padding from byes b where message size is m.
+// PKCS7Unpad removes RFC 2315 padding from byes where message size is m.
 func PKCS7Unpad(b []byte, m int) ([]byte, error) {
 	if m <= 0 {
 		return nil, errors.New("Invalid message block size when unpadding")
@@ -66,6 +70,7 @@ func PKCS7Unpad(b []byte, m int) ([]byte, error) {
 	return b[:len(b)-n], nil
 }
 
+// GetHash generates the keyed hash value according to the etype's hash function.
 func GetHash(pt, key []byte, usage []byte, etype etype.EType) ([]byte, error) {
 	k, err := etype.DeriveKey(key, usage)
 	if err != nil {
@@ -78,17 +83,17 @@ func GetHash(pt, key []byte, usage []byte, etype etype.EType) ([]byte, error) {
 	return mac.Sum(nil)[:etype.GetHMACBitLength()/8], nil
 }
 
-// Get a keyed checksum hash of bytes b.
+// GetChecksumHash returns a keyed checksum hash of the bytes provided.
 func GetChecksumHash(b, key []byte, usage uint32, etype etype.EType) ([]byte, error) {
 	return GetHash(b, key, GetUsageKc(usage), etype)
 }
 
-// Get a keyed integrity hash of bytes b.
+// GetIntegrityHash returns a keyed integrity hash of the bytes provided.
 func GetIntegrityHash(b, key []byte, usage uint32, etype etype.EType) ([]byte, error) {
 	return GetHash(b, key, GetUsageKi(usage), etype)
 }
 
-// Verify the checksum of the msg bytes is the same as the checksum provided.
+// VerifyChecksum compares the checksum of the msg bytes is the same as the checksum provided.
 func VerifyChecksum(key, chksum, msg []byte, usage uint32, etype etype.EType) bool {
 	//The ciphertext output is the concatenation of the output of the basic
 	//encryption function E and a (possibly truncated) HMAC using the
@@ -100,7 +105,7 @@ func VerifyChecksum(key, chksum, msg []byte, usage uint32, etype etype.EType) bo
 	return hmac.Equal(chksum, expectedMAC)
 }
 
-// Get the checksum key usage value for the usage number un.
+// GetUsageKc returns the checksum key usage value for the usage number un.
 //
 // RFC 3961: The "well-known constant" used for the DK function is the key usage number, expressed as four octets in big-endian order, followed by one octet indicated below.
 //
@@ -109,7 +114,7 @@ func GetUsageKc(un uint32) []byte {
 	return getUsage(un, 0x99)
 }
 
-// Get the encryption key usage value for the usage number un
+// GetUsageKe returns the encryption key usage value for the usage number un
 //
 // RFC 3961: The "well-known constant" used for the DK function is the key usage number, expressed as four octets in big-endian order, followed by one octet indicated below.
 //
@@ -118,7 +123,7 @@ func GetUsageKe(un uint32) []byte {
 	return getUsage(un, 0xAA)
 }
 
-// Get the integrity key usage value for the usage number un
+// GetUsageKi returns the integrity key usage value for the usage number un
 //
 // RFC 3961: The "well-known constant" used for the DK function is the key usage number, expressed as four octets in big-endian order, followed by one octet indicated below.
 //
@@ -133,8 +138,33 @@ func getUsage(un uint32, o byte) []byte {
 	return append(buf.Bytes(), o)
 }
 
+// IterationsToS2Kparams converts the number of iterations as an integer to a string representation.
 func IterationsToS2kparams(i int) string {
 	b := make([]byte, 4, 4)
 	binary.BigEndian.PutUint32(b, uint32(i))
 	return hex.EncodeToString(b)
 }
+
+// S2KparamsToItertions converts the string representation of iterations to an integer
+func S2KparamsToItertions(s2kparams string) (int, error) {
+	//process s2kparams string
+	//The parameter string is four octets indicating an unsigned
+	//number in big-endian order.  This is the number of iterations to be
+	//performed.  If the value is 00 00 00 00, the number of iterations to
+	//be performed is 4,294,967,296 (2**32).
+	var i uint32
+	if len(s2kparams) != 8 {
+		return s2kParamsZero, errors.New("Invalid s2kparams length")
+	}
+	b, err := hex.DecodeString(s2kparams)
+	if err != nil {
+		return s2kParamsZero, errors.New("Invalid s2kparams, cannot decode string to bytes")
+	}
+	i = binary.BigEndian.Uint32(b)
+	//buf := bytes.NewBuffer(b)
+	//err = binary.Read(buf, binary.BigEndian, &i)
+	if err != nil {
+		return s2kParamsZero, errors.New("Invalid s2kparams, cannot convert to big endian int32")
+	}
+	return int(i), nil
+}

crypto/des3-cbc-sha1-kd.go

@@ -52,48 +52,59 @@ import (
 type Des3CbcSha1Kd struct {
 }
 
+// GetETypeID returns the EType ID number.
 func (e Des3CbcSha1Kd) GetETypeID() int {
 	return etypeID.DES3_CBC_SHA1_KD
 }
 
+// GetHashID returns the checksum type ID number.
 func (e Des3CbcSha1Kd) GetHashID() int {
 	return chksumtype.HMAC_SHA1_DES3_KD
 }
 
+// GetKeyByteSize returns the number of bytes for key of this etype.
 func (e Des3CbcSha1Kd) GetKeyByteSize() int {
 	return 24
 }
 
+// GetKeySeedBitLength returns the number of bits for the seed for key generation.
 func (e Des3CbcSha1Kd) GetKeySeedBitLength() int {
 	return 21 * 8
 }
 
+// GetHashFunc returns the hash function for this etype.
 func (e Des3CbcSha1Kd) GetHashFunc() func() hash.Hash {
 	return sha1.New
 }
 
+// GetMessageBlockByteSize returns the block size for the etype's messages.
 func (e Des3CbcSha1Kd) GetMessageBlockByteSize() int {
 	//For traditional CBC mode with padding, it would be the underlying cipher's block size
 	return des.BlockSize
 }
 
+// GetDefaultStringToKeyParams returns the default key derivation parameters in string form.
 func (e Des3CbcSha1Kd) GetDefaultStringToKeyParams() string {
 	var s string
 	return s
 }
 
+// GetConfounderByteSize returns the byte count for confounder to be used during cryptographic operations.
 func (e Des3CbcSha1Kd) GetConfounderByteSize() int {
 	return des.BlockSize
 }
 
+// GetHMACBitLength returns the bit count size of the integrity hash.
 func (e Des3CbcSha1Kd) GetHMACBitLength() int {
 	return e.GetHashFunc()().Size() * 8
 }
 
+// GetCypherBlockBitLength returns the bit count size of the cypher block.
 func (e Des3CbcSha1Kd) GetCypherBlockBitLength() int {
 	return des.BlockSize * 8
 }
 
+// StringToKey returns a key derived from the string provided.
 func (e Des3CbcSha1Kd) StringToKey(secret string, salt string, s2kparams string) ([]byte, error) {
 	if s2kparams != "" {
 		return []byte{}, errors.New("s2kparams must be an empty string")
@@ -101,15 +112,18 @@ func (e Des3CbcSha1Kd) StringToKey(secret string, salt string, s2kparams string)
 	return rfc3961.DES3StringToKey(secret, salt, e)
 }
 
+// RandomToKey returns a key from the bytes provided.
 func (e Des3CbcSha1Kd) RandomToKey(b []byte) []byte {
 	return rfc3961.DES3RandomToKey(b)
 }
 
+// DeriveRandom generates data needed for key generation.
 func (e Des3CbcSha1Kd) DeriveRandom(protocolKey, usage []byte) ([]byte, error) {
 	r, err := rfc3961.DeriveRandom(protocolKey, usage, e)
 	return r, err
 }
 
+// DeriveKey derives a key from the protocol key based on the usage value.
 func (e Des3CbcSha1Kd) DeriveKey(protocolKey, usage []byte) ([]byte, error) {
 	r, err := e.DeriveRandom(protocolKey, usage)
 	if err != nil {
@@ -118,30 +132,37 @@ func (e Des3CbcSha1Kd) DeriveKey(protocolKey, usage []byte) ([]byte, error) {
 	return e.RandomToKey(r), nil
 }
 
+// EncryptData encrypts the data provided.
 func (e Des3CbcSha1Kd) EncryptData(key, data []byte) ([]byte, []byte, error) {
 	return rfc3961.DES3EncryptData(key, data, e)
 }
 
+// EncryptMessage encrypts the message provided and concatenates it with the integrity hash to create an encrypted message.
 func (e Des3CbcSha1Kd) EncryptMessage(key, message []byte, usage uint32) ([]byte, []byte, error) {
 	return rfc3961.DES3EncryptMessage(key, message, usage, e)
 }
 
+// DecryptData decrypts the data provided.
 func (e Des3CbcSha1Kd) DecryptData(key, data []byte) ([]byte, error) {
 	return rfc3961.DES3DecryptData(key, data, e)
 }
 
+// DecryptMessage decrypts the message provided and verifies the integrity of the message.
 func (e Des3CbcSha1Kd) DecryptMessage(key, ciphertext []byte, usage uint32) (message []byte, err error) {
 	return rfc3961.DES3DecryptMessage(key, ciphertext, usage, e)
 }
 
+// VerifyIntegrity checks the integrity of the plaintext message.
 func (e Des3CbcSha1Kd) VerifyIntegrity(protocolKey, ct, pt []byte, usage uint32) bool {
 	return rfc3961.VerifyIntegrity(protocolKey, ct, pt, usage, e)
 }
 
+// GetChecksumHash returns a keyed checksum hash of the bytes provided.
 func (e Des3CbcSha1Kd) GetChecksumHash(protocolKey, data []byte, usage uint32) ([]byte, error) {
 	return common.GetHash(data, protocolKey, common.GetUsageKc(usage), e)
 }
 
+// VerifyChecksum compares the checksum of the message bytes is the same as the checksum provided.
 func (e Des3CbcSha1Kd) VerifyChecksum(protocolKey, data, chksum []byte, usage uint32) bool {
 	c, err := e.GetChecksumHash(protocolKey, data, usage)
 	if err != nil {

crypto/etype/etype.go

@@ -1,4 +1,4 @@
-// The Kerberos Encryption Type interface
+// Package etype provides the Kerberos Encryption Type interface
 package etype
 
 import "hash"

crypto/rfc3961/encryption.go

@@ -1,4 +1,4 @@
-// Encryption and checksum methods as specified in RFC 3961
+// Package rfc3961 provides encryption and checksum methods as specified in RFC 3961
 package rfc3961
 
 import (
@@ -12,6 +12,7 @@ import (
 	"github.com/jcmturner/gokrb5/crypto/etype"
 )
 
+// DES3EncryptData encrypts the data provided using DES3 and methods specific to the etype provided.
 func DES3EncryptData(key, data []byte, e etype.EType) ([]byte, []byte, error) {
 	if len(key) != e.GetKeyByteSize() {
 		return nil, nil, fmt.Errorf("Incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
@@ -33,6 +34,8 @@ func DES3EncryptData(key, data []byte, e etype.EType) ([]byte, []byte, error) {
 	return ivz, ct, nil
 }
 
+// DES3EncryptMessage encrypts the message provided using DES3 and methods specific to the etype provided.
+// The encrypted data is concatenated with its integrity hash to create an encrypted message.
 func DES3EncryptMessage(key, message []byte, usage uint32, e etype.EType) ([]byte, []byte, error) {
 	//confounder
 	c := make([]byte, e.GetConfounderByteSize())
@@ -65,6 +68,7 @@ func DES3EncryptMessage(key, message []byte, usage uint32, e etype.EType) ([]byt
 	return iv, b, nil
 }
 
+// DES3DecryptData decrypts the data provided using DES3 and methods specific to the etype provided.
 func DES3DecryptData(key, data []byte, e etype.EType) ([]byte, error) {
 	if len(key) != e.GetKeyByteSize() {
 		return []byte{}, fmt.Errorf("Incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
@@ -84,6 +88,8 @@ func DES3DecryptData(key, data []byte, e etype.EType) ([]byte, error) {
 	return pt, nil
 }
 
+// DES3DecryptMessage decrypts the message provided using DES3 and methods specific to the etype provided.
+// The integrity of the message is also verified.
 func DES3DecryptMessage(key, ciphertext []byte, usage uint32, e etype.EType) ([]byte, error) {
 	//Derive the key
 	k, err := e.DeriveKey(key, common.GetUsageKe(usage))
@@ -103,7 +109,7 @@ func DES3DecryptMessage(key, ciphertext []byte, usage uint32, e etype.EType) ([]
 	return b[e.GetConfounderByteSize():], nil
 }
 
-// Verify the integrity of cipertext bytes ct.
+// VerifyIntegrity verifies the integrity of cipertext bytes ct.
 func VerifyIntegrity(key, ct, pt []byte, usage uint32, etype etype.EType) bool {
 	//The ciphertext output is the concatenation of the output of the basic
 	//encryption function E and a (possibly truncated) HMAC using the

crypto/rfc3961/keyDerivation.go

@@ -1,11 +1,7 @@
 package rfc3961
 
 import (
-	"encoding/binary"
-	"encoding/hex"
-	"errors"
 	"github.com/jcmturner/gokrb5/crypto/etype"
-	"golang.org/x/crypto/pbkdf2"
 )
 
 const (
@@ -13,7 +9,7 @@ const (
 	s2kParamsZero = 4294967296
 )
 
-// RFC 3961: DR(Key, Constant) = k-truncate(E(Key, Constant, initial-cipher-state)).
+// DeriveRandom implements the RFC 3961 defined function: DR(Key, Constant) = k-truncate(E(Key, Constant, initial-cipher-state)).
 //
 // key: base key or protocol key. Likely to be a key from a keytab file.
 //
@@ -52,6 +48,7 @@ func DeriveRandom(key, usage []byte, e etype.EType) ([]byte, error) {
 	return out, nil
 }
 
+// DeriveKey derives a key from the protocol key based on the usage and the etype's specific methods.
 func DeriveKey(protocolKey, usage []byte, e etype.EType) ([]byte, error) {
 	r, err := e.DeriveRandom(protocolKey, usage)
 	if err != nil {
@@ -60,10 +57,12 @@ func DeriveKey(protocolKey, usage []byte, e etype.EType) ([]byte, error) {
 	return e.RandomToKey(r), nil
 }
 
+// RandomToKey returns a key from the bytes provided according to the definition in RFC 3961.
 func RandomToKey(b []byte) []byte {
 	return b
 }
 
+// DES3RandomToKey returns a key from the bytes provided according to the definition in RFC 3961 for DES3 etypes.
 func DES3RandomToKey(b []byte) []byte {
 	r := stretch56Bits(b[:7])
 	r2 := stretch56Bits(b[7:14])
@@ -73,29 +72,14 @@ func DES3RandomToKey(b []byte) []byte {
 	return r
 }
 
+// DES3StringToKey returns a key derived from the string provided according to the definition in RFC 3961 for DES3 etypes.
 func DES3StringToKey(secret, salt string, e etype.EType) ([]byte, error) {
 	s := secret + salt
 	tkey := e.RandomToKey(Nfold([]byte(s), e.GetKeySeedBitLength()))
 	return e.DeriveKey(tkey, []byte("kerberos"))
 }
 
-func StringToKey(secret, salt, s2kparams string, e etype.EType) ([]byte, error) {
-	i, err := S2KparamsToItertions(s2kparams)
-	if err != nil {
-		return nil, err
-	}
-	return StringToKeyIter(secret, salt, int(i), e)
-}
-
-func StringToPBKDF2(secret, salt string, iterations int, e etype.EType) []byte {
-	return pbkdf2.Key([]byte(secret), []byte(salt), iterations, e.GetKeyByteSize(), e.GetHashFunc())
-}
-
-func StringToKeyIter(secret, salt string, iterations int, e etype.EType) ([]byte, error) {
-	tkey := e.RandomToKey(StringToPBKDF2(secret, salt, iterations, e))
-	return e.DeriveKey(tkey, []byte("kerberos"))
-}
-
+// PseudoRandom function as defined in RFC 3961
 func PseudoRandom(key, b []byte, e etype.EType) ([]byte, error) {
 	h := e.GetHashFunc()()
 	h.Write(b)
@@ -111,29 +95,6 @@ func PseudoRandom(key, b []byte, e etype.EType) ([]byte, error) {
 	return prf, nil
 }
 
-func S2KparamsToItertions(s2kparams string) (int, error) {
-	//process s2kparams string
-	//The parameter string is four octets indicating an unsigned
-	//number in big-endian order.  This is the number of iterations to be
-	//performed.  If the value is 00 00 00 00, the number of iterations to
-	//be performed is 4,294,967,296 (2**32).
-	var i uint32
-	if len(s2kparams) != 8 {
-		return s2kParamsZero, errors.New("Invalid s2kparams length")
-	}
-	b, err := hex.DecodeString(s2kparams)
-	if err != nil {
-		return s2kParamsZero, errors.New("Invalid s2kparams, cannot decode string to bytes")
-	}
-	i = binary.BigEndian.Uint32(b)
-	//buf := bytes.NewBuffer(b)
-	//err = binary.Read(buf, binary.BigEndian, &i)
-	if err != nil {
-		return s2kParamsZero, errors.New("Invalid s2kparams, cannot convert to big endian int32")
-	}
-	return int(i), nil
-}
-
 func stretch56Bits(b []byte) []byte {
 	d := make([]byte, len(b), len(b))
 	copy(d, b)

crypto/rfc3961/nfold.go

@@ -34,7 +34,8 @@ https://svn.apache.org/repos/asf/directory/apacheds/tags/1.5.1/kerberos-shared/s
 License: http://www.apache.org/licenses/LICENSE-2.0
 */
 
-// RFC 3961: n-fold algorithm.
+// Nfold expands the key to ensure it is not smaller than one cipher block.
+// Defined in RFC 3961.
 //
 // m input bytes that will be "stretched" to the least common multiple of n bits and the bit length of m.
 func Nfold(m []byte, n int) []byte {

crypto/rfc3962/encryption.go

@@ -1,4 +1,4 @@
-// Encryption and checksum methods as specified in RFC 3962
+// Package rfc3962 provides encryption and checksum methods as specified in RFC 3962
 package rfc3962
 
 import (
@@ -10,6 +10,7 @@ import (
 	"github.com/jcmturner/gokrb5/crypto/etype"
 )
 
+// EncryptData encrypts the data provided using methods specific to the etype provided as defined in RFC 3962.
 func EncryptData(key, data []byte, e etype.EType) ([]byte, []byte, error) {
 	if len(key) != e.GetKeyByteSize() {
 		return []byte{}, []byte{}, fmt.Errorf("Incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
@@ -18,6 +19,8 @@ func EncryptData(key, data []byte, e etype.EType) ([]byte, []byte, error) {
 	return aescts.Encrypt(key, ivz, data)
 }
 
+// EncryptMessage encrypts the message provided using the methods specific to the etype provided as defined in RFC 3962.
+// The encrypted data is concatenated with its integrity hash to create an encrypted message.
 func EncryptMessage(key, message []byte, usage uint32, e etype.EType) ([]byte, []byte, error) {
 	if len(key) != e.GetKeyByteSize() {
 		return []byte{}, []byte{}, fmt.Errorf("Incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
@@ -54,6 +57,7 @@ func EncryptMessage(key, message []byte, usage uint32, e etype.EType) ([]byte, [
 	return iv, b, nil
 }
 
+// DecryptData decrypts the data provided using the methods specific to the etype provided as defined in RFC 3962.
 func DecryptData(key, data []byte, e etype.EType) ([]byte, error) {
 	if len(key) != e.GetKeyByteSize() {
 		return []byte{}, fmt.Errorf("Incorrect keysize: expected: %v actual: %v", e.GetKeyByteSize(), len(key))
@@ -62,6 +66,8 @@ func DecryptData(key, data []byte, e etype.EType) ([]byte, error) {
 	return aescts.Decrypt(key, ivz, data)
 }
 
+// DecryptMessage decrypts the message provided using the methods specific to the etype provided as defined in RFC 3962.
+// The integrity of the message is also verified.
 func DecryptMessage(key, ciphertext []byte, usage uint32, e etype.EType) ([]byte, error) {
 	//Derive the key
 	k, err := e.DeriveKey(key, common.GetUsageKe(usage))

crypto/rfc3962/keyDerivation.go

@@ -0,0 +1,27 @@
+package rfc3962
+
+import (
+	"github.com/jcmturner/gokrb5/crypto/common"
+	"github.com/jcmturner/gokrb5/crypto/etype"
+	"golang.org/x/crypto/pbkdf2"
+)
+
+// StringToKey returns a key derived from the string provided according to the definition in RFC 3961.
+func StringToKey(secret, salt, s2kparams string, e etype.EType) ([]byte, error) {
+	i, err := common.S2KparamsToItertions(s2kparams)
+	if err != nil {
+		return nil, err
+	}
+	return StringToKeyIter(secret, salt, int(i), e)
+}
+
+// StringToPBKDF2 generates an encryption key from a pass phrase and salt string using the PBKDF2 function from PKCS #5 v2.0
+func StringToPBKDF2(secret, salt string, iterations int, e etype.EType) []byte {
+	return pbkdf2.Key([]byte(secret), []byte(salt), iterations, e.GetKeyByteSize(), e.GetHashFunc())
+}
+
+// StringToKeyIter returns a key derived from the string provided according to the definition in RFC 3961.
+func StringToKeyIter(secret, salt string, iterations int, e etype.EType) ([]byte, error) {
+	tkey := e.RandomToKey(StringToPBKDF2(secret, salt, iterations, e))
+	return e.DeriveKey(tkey, []byte("kerberos"))
+}

crypto/rfc8009/encryption.go

@@ -1,4 +1,4 @@
-// Encryption and checksum methods as specified in RFC 8009
+// Package rfc8009 provides encryption and checksum methods as specified in RFC 8009
 package rfc8009
 
 import (
@@ -13,6 +13,7 @@ import (
 	"github.com/jcmturner/gokrb5/iana/etypeID"
 )
 
+// EncryptData encrypts the data provided using methods specific to the etype provided as defined in RFC 8009.
 func EncryptData(key, data []byte, e etype.EType) ([]byte, []byte, error) {
 	kl := e.GetKeyByteSize()
 	if e.GetETypeID() == etypeID.AES256_CTS_HMAC_SHA384_192 {
@@ -25,28 +26,8 @@ func EncryptData(key, data []byte, e etype.EType) ([]byte, []byte, error) {
 	return aescts.Encrypt(key, ivz, data)
 }
 
-//encryption function: as follows, where E() is AES encryption in
-//CBC-CS3 mode, and h is the size of truncated HMAC (128 bits or 192
-//bits as described above).
-//
-//N = random value of length 128 bits (the AES block size)
-//IV = cipher state
-//C = E(Ke, N | plaintext, IV)
-//H = HMAC(Ki, IV | C)
-//ciphertext = C | H[1..h]
-//
-//Steps to compute the 128-bit cipher state:
-//L = length of C in bits
-//portion C into 128-bit blocks, placing any remainder of less
-//than 128 bits into a final block
-//if L == 128: cipher state = C
-//else if L mod 128 > 0: cipher state = last full (128-bit) block
-//of C (the next-to-last
-//block)
-//else if L mod 128 == 0: cipher state = next-to-last block of C
-//
-//(Note that L will never be less than 128 because of the
-//presence of N in the encryption input.)
+// EncryptMessage encrypts the message provided using the methods specific to the etype provided as defined in RFC 8009.
+// The encrypted data is concatenated with its integrity hash to create an encrypted message.
 func EncryptMessage(key, message []byte, usage uint32, e etype.EType) ([]byte, []byte, error) {
 	kl := e.GetKeyByteSize()
 	if e.GetETypeID() == etypeID.AES256_CTS_HMAC_SHA384_192 {
@@ -89,6 +70,7 @@ func EncryptMessage(key, message []byte, usage uint32, e etype.EType) ([]byte, [
 	return iv, b, nil
 }
 
+// DecryptData decrypts the data provided using the methods specific to the etype provided as defined in RFC 8009.
 func DecryptData(key, data []byte, e etype.EType) ([]byte, error) {
 	kl := e.GetKeyByteSize()
 	if e.GetETypeID() == etypeID.AES256_CTS_HMAC_SHA384_192 {
@@ -101,6 +83,8 @@ func DecryptData(key, data []byte, e etype.EType) ([]byte, error) {
 	return aescts.Decrypt(key, ivz, data)
 }
 
+// DecryptMessage decrypts the message provided using the methods specific to the etype provided as defined in RFC 8009.
+// The integrity of the message is also verified.
 func DecryptMessage(key, ciphertext []byte, usage uint32, e etype.EType) ([]byte, error) {
 	//Derive the key
 	k, err := e.DeriveKey(key, common.GetUsageKe(usage))
@@ -120,6 +104,7 @@ func DecryptMessage(key, ciphertext []byte, usage uint32, e etype.EType) ([]byte
 	return b[e.GetConfounderByteSize():], nil
 }
 
+// GetIntegityHash returns a keyed integrity hash of the bytes provided as defined in RFC 8009
 func GetIntegityHash(iv, c, key []byte, usage uint32, e etype.EType) ([]byte, error) {
 	// Generate and append integrity hash
 	// The HMAC is calculated over the cipher state concatenated with the
@@ -131,7 +116,7 @@ func GetIntegityHash(iv, c, key []byte, usage uint32, e etype.EType) ([]byte, er
 	return common.GetIntegrityHash(ib, key, usage, e)
 }
 
-// Verify the integrity of cipertext bytes ct.
+// VerifyIntegrity verifies the integrity of cipertext bytes ct.
 func VerifyIntegrity(key, ct []byte, usage uint32, etype etype.EType) bool {
 	h := make([]byte, etype.GetHMACBitLength()/8)
 	copy(h, ct[len(ct)-etype.GetHMACBitLength()/8:])

gssapi/ContextFlags.go

@@ -26,6 +26,7 @@ const (
 
 type ContextFlags asn1.BitString
 
+// NewContextFlags creates a new ContextFlags instance.
 func NewContextFlags() ContextFlags {
 	var c ContextFlags
 	c.BitLength = 32

gssapi/NegotiationToken.go

@@ -61,7 +61,7 @@ type NegTokenResp struct {
 
 type NegTokenTarg NegTokenResp
 
-// Unmarshal and return either a NegTokenInit or a NegTokenResp.
+// UnmarshalNegToken umarshals and returns either a NegTokenInit or a NegTokenResp.
 //
 // The boolean indicates if the response is a NegTokenInit.
 // If error is nil and the boolean is false the response is a NegTokenResp.
@@ -130,7 +130,7 @@ func (n *NegTokenResp) Marshal() ([]byte, error) {
 	return nb, nil
 }
 
-// Create new Init negotiation token for Kerberos 5
+// NewNegTokenInitKrb5 creates new Init negotiation token for Kerberos 5
 func NewNegTokenInitKrb5(creds credentials.Credentials, tkt messages.Ticket, sessionKey types.EncryptionKey) (NegTokenInit, error) {
 	mt, err := NewKRB5APREQMechToken(creds, tkt, sessionKey)
 	if err != nil {

gssapi/gssapi.go

@@ -1,4 +1,4 @@
-// Generic Security Services Application Program Interface implementation required for SPNEGO kerberos authentication.
+// Package gssapi implements Generic Security Services Application Program Interface required for SPNEGO kerberos authentication.
 package gssapi
 
 import (
@@ -86,6 +86,7 @@ func (s *SPNEGO) Marshal() ([]byte, error) {
 	return b, errors.New("SPNEGO cannot be marshalled. It contains neither a NegTokenInit or NegTokenResp")
 }
 
+// GetSPNEGOKrbNegTokenInit returns an SPNEGO struct containing a NegTokenInit.
 func GetSPNEGOKrbNegTokenInit(creds credentials.Credentials, tkt messages.Ticket, sessionKey types.EncryptionKey) (SPNEGO, error) {
 	negTokenInit, err := NewNegTokenInitKrb5(creds, tkt, sessionKey)
 	if err != nil {

gssapi/krb5Token.go

@@ -34,6 +34,7 @@ type MechToken struct {
 	KRBError messages.KRBError
 }
 
+// Unmarshal a MechToken
 func (m *MechToken) Unmarshal(b []byte) error {
 	var oid asn1.ObjectIdentifier
 	r, err := asn1.UnmarshalWithParams(b, &oid, fmt.Sprintf("application,explicit,tag:%v", 0))
@@ -68,6 +69,7 @@ func (m *MechToken) Unmarshal(b []byte) error {
 	return nil
 }
 
+// IsAPReq tests if the MechToken contains an AP_REQ
 func (m *MechToken) IsAPReq() bool {
 	if hex.EncodeToString(m.TokID) == TOK_ID_KRB_AP_REQ {
 		return true
@@ -75,6 +77,7 @@ func (m *MechToken) IsAPReq() bool {
 	return false
 }
 
+// IsAPRep tests if the MechToken contains an AP_REP
 func (m *MechToken) IsAPRep() bool {
 	if hex.EncodeToString(m.TokID) == TOK_ID_KRB_AP_REP {
 		return true
@@ -82,6 +85,7 @@ func (m *MechToken) IsAPRep() bool {
 	return false
 }
 
+// IsKRBError tests if the MechToken contains an KRB_ERROR
 func (m *MechToken) IsKRBError() bool {
 	if hex.EncodeToString(m.TokID) == TOK_ID_KRB_ERROR {
 		return true
@@ -89,7 +93,7 @@ func (m *MechToken) IsKRBError() bool {
 	return false
 }
 
-// Create new kerberos AP_REQ MechToken
+// NewKRB5APREQMechToken creates new kerberos AP_REQ MechToken
 func NewKRB5APREQMechToken(creds credentials.Credentials, tkt messages.Ticket, sessionKey types.EncryptionKey) ([]byte, error) {
 	// Create the header
 	b, _ := asn1.Marshal(MechTypeOID_Krb5)

iana/adtype/constants.go

@@ -1,4 +1,4 @@
-// Authenticator type assigned numbers.
+// Package adtype provides Authenticator type assigned numbers.
 package adtype
 
 const (

iana/asnAppTag/constants.go

@@ -1,4 +1,4 @@
-// ASN1 application tag numbers.
+// Package asnAppTag provides ASN1 application tag numbers.
 package asnAppTag
 
 const (

iana/chksumtype/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 checksum type assigned numbers.
+// Package chksumtype provides Kerberos 5 checksum type assigned numbers.
 package chksumtype
 
 const (

iana/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 assigned numbers.
+// Package iana provides Kerberos 5 assigned numbers.
 package iana
 
 const (

iana/errorcode/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 assigned error codes.
+// Package errorcode provides Kerberos 5 assigned error codes.
 package errorcode
 
 import "fmt"

iana/etypeID/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 encryption type assigned numbers.
+// Package etypeID provides Kerberos 5 encryption type assigned numbers.
 package etypeID
 
 const (

iana/flags/constants.go

@@ -1,4 +1,4 @@
-//Kerberos 5 flag values.
+// Package flags provides Kerberos 5 flag assigned numbers.
 package flags
 
 const (

iana/keyusage/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 key usage assigned numbers.
+// Package keyusage provides Kerberos 5 key usage assigned numbers.
 package keyusage
 
 const (

iana/msgtype/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 message type assigned numbers.
+// Package msgtype provides Kerberos 5 message type assigned numbers.
 package msgtype
 
 const (

iana/nametype/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 principal name type numbers.
+// Package nametype provides Kerberos 5 principal name type numbers.
 package nametype
 
 const (

iana/patype/constants.go

@@ -1,4 +1,4 @@
-// Kerberos 5 pre-authentication type assigned numbers.
+// Package patype provides Kerberos 5 pre-authentication type assigned numbers.
 package patype
 
 const (

keytab/keytab.go

@@ -1,4 +1,4 @@
-// Implementation of Kerberos keytabs: https://web.mit.edu/kerberos/krb5-devel/doc/formats/keytab_file_format.html.
+// Package keytab implements Kerberos keytabs: https://web.mit.edu/kerberos/krb5-devel/doc/formats/keytab_file_format.html.
 package keytab
 
 import (
@@ -35,7 +35,7 @@ type Principal struct {
 	NameType      int32
 }
 
-//Create new, empty Keytab type.
+// NewKeytab creates new, empty Keytab type.
 func NewKeytab() Keytab {
 	var e []Entry
 	return Keytab{
@@ -44,7 +44,7 @@ func NewKeytab() Keytab {
 	}
 }
 
-// Get the EncryptionKey from the Keytab for the newest entry with the required kvno, etype and matching principal.
+// GetEncryptionKey returns the EncryptionKey from the Keytab for the newest entry with the required kvno, etype and matching principal.
 func (kt *Keytab) GetEncryptionKey(nameString []string, realm string, kvno, etype int) (types.EncryptionKey, error) {
 	var key types.EncryptionKey
 	var t time.Time

krberror/error.go

@@ -21,14 +21,17 @@ type Krberror struct {
 	EText     []string
 }
 
+// Error function to implement the error interface.
 func (e Krberror) Error() string {
 	return fmt.Sprintf("[Root cause: %s] ", e.RootCause) + strings.Join(e.EText, SEPARATOR)
 }
 
-func (e *Krberror) Add2(et string, s string) {
+// Add another error statement to the error.
+func (e *Krberror) Add(et string, s string) {
 	e.EText = append([]string{fmt.Sprintf("%s: %s", et, s)}, e.EText...)
 }
 
+// NewKrberror creates a new instance of Krberror.
 func NewKrberror(et, s string) Krberror {
 	return Krberror{
 		RootCause: et,
@@ -36,6 +39,7 @@ func NewKrberror(et, s string) Krberror {
 	}
 }
 
+// Errorf appends to or creates a new Krberror.
 func Errorf(err error, et, format string, a ...interface{}) Krberror {
 	if e, ok := err.(Krberror); ok {
 		e.EText = append([]string{fmt.Sprintf("%s: "+format, et, a)}, e.EText...)
@@ -44,6 +48,7 @@ func Errorf(err error, et, format string, a ...interface{}) Krberror {
 	return NewErrorf(et, format+": %v", a, err)
 }
 
+// NewErrorf creates a new Krberror from a formatted string.
 func NewErrorf(et, format string, a ...interface{}) Krberror {
 	return Krberror{
 		RootCause: et,

messages/APReq.go

@@ -45,7 +45,7 @@ type APReq struct {
 	Authenticator types.EncryptedData `asn1:"explicit,tag:4"`
 }
 
-// Generate a new KRB_AP_REQ struct.
+// NewAPReq generates a new KRB_AP_REQ struct.
 func NewAPReq(tkt Ticket, sessionKey types.EncryptionKey, auth types.Authenticator) (APReq, error) {
 	var a APReq
 	ed, err := encryptAuthenticator(auth, sessionKey, tkt)
@@ -104,7 +104,7 @@ func (a *APReq) Unmarshal(b []byte) error {
 	return nil
 }
 
-// ASN1 marshal APReq struct.
+// Marshal APReq struct.
 func (a *APReq) Marshal() ([]byte, error) {
 	m := marshalAPReq{
 		PVNO:          a.PVNO,

messages/KDCRep.go

@@ -148,7 +148,7 @@ func (e *EncKDCRepPart) Unmarshal(b []byte) error {
 	return nil
 }
 
-// Decrypt the encrypted part of an AS_REP.
+// DecryptEncPart decrypts the encrypted part of an AS_REP.
 func (k *ASRep) DecryptEncPart(c *credentials.Credentials) (types.EncryptionKey, error) {
 	var key types.EncryptionKey
 	var err error
@@ -180,7 +180,7 @@ func (k *ASRep) DecryptEncPart(c *credentials.Credentials) (types.EncryptionKey,
 	return key, nil
 }
 
-// Check validity of AS_REP message.
+// IsValid checks the validity of AS_REP message.
 func (k *ASRep) IsValid(cfg *config.Config, creds *credentials.Credentials, asReq ASReq) (bool, error) {
 	//Ref RFC 4120 Section 3.1.5
 	if k.CName.NameType != asReq.ReqBody.CName.NameType || k.CName.NameString == nil {
@@ -247,7 +247,7 @@ func (k *ASRep) IsValid(cfg *config.Config, creds *credentials.Credentials, asRe
 	return true, nil
 }
 
-// Decrypt the encrypted part of an TGS_REP.
+// DecryptEncPart decrypts the encrypted part of an TGS_REP.
 func (k *TGSRep) DecryptEncPart(key types.EncryptionKey) error {
 	b, err := crypto.DecryptEncPart(k.EncPart, key, keyusage.TGS_REP_ENCPART_SESSION_KEY)
 	if err != nil {
@@ -262,7 +262,7 @@ func (k *TGSRep) DecryptEncPart(key types.EncryptionKey) error {
 	return nil
 }
 
-// Check validity of TGS_REP message.
+// IsValid checks the validity of the TGS_REP message.
 func (k *TGSRep) IsValid(cfg *config.Config, tgsReq TGSReq) (bool, error) {
 	if k.CName.NameType != tgsReq.ReqBody.CName.NameType || k.CName.NameString == nil {
 		return false, krberror.NewErrorf(krberror.KRBMSG_ERROR, "CName in response does not match what was requested. Requested: %+v; Reply: %+v", tgsReq.ReqBody.CName, k.CName)

messages/KDCReq.go

@@ -80,7 +80,7 @@ type KDCReqBody struct {
 	AdditionalTickets []Ticket            `asn1:"explicit,optional,tag:11"`
 }
 
-// Generate a new KRB_AS_REQ struct.
+// NewASReq generates a new KRB_AS_REQ struct.
 func NewASReq(c *config.Config, cname types.PrincipalName) ASReq {
 	nonce := int(rand.Int31())
 	t := time.Now().UTC()
@@ -123,7 +123,7 @@ func NewASReq(c *config.Config, cname types.PrincipalName) ASReq {
 	return a
 }
 
-// Generate a new KRB_TGS_REQ struct.
+// NewTGSReq generates a new KRB_TGS_REQ struct.
 func NewTGSReq(cname types.PrincipalName, c *config.Config, tkt Ticket, sessionKey types.EncryptionKey, spn types.PrincipalName, renewal bool) (TGSReq, error) {
 	nonce := int(rand.Int31())
 	t := time.Now().UTC()
@@ -268,7 +268,7 @@ func (k *KDCReqBody) Unmarshal(b []byte) error {
 	return nil
 }
 
-// ASN1 marshal ASReq struct.
+// Marshal ASReq struct.
 func (k *ASReq) Marshal() ([]byte, error) {
 	m := marshalKDCReq{
 		PVNO:    k.PVNO,
@@ -294,7 +294,7 @@ func (k *ASReq) Marshal() ([]byte, error) {
 	return mk, nil
 }
 
-// ASN1 marshal TGSReq struct.
+// Marshal TGSReq struct.
 func (k *TGSReq) Marshal() ([]byte, error) {
 	m := marshalKDCReq{
 		PVNO:    k.PVNO,
@@ -320,7 +320,7 @@ func (k *TGSReq) Marshal() ([]byte, error) {
 	return mk, nil
 }
 
-// ASN1 marshal KRB_KDC_REQ body struct.
+// Marshal KRB_KDC_REQ body struct.
 func (k *KDCReqBody) Marshal() ([]byte, error) {
 	var b []byte
 	m := marshalKDCReqBody{

messages/KRBCred.go

@@ -76,7 +76,7 @@ func (k *KRBCred) Unmarshal(b []byte) error {
 	return nil
 }
 
-// Decrypt the encrypted part of a KRB_CRED.
+// DecryptEncPart decrypts the encrypted part of a KRB_CRED.
 func (k *KRBCred) DecryptEncPart(key types.EncryptionKey) error {
 	b, err := crypto.DecryptEncPart(k.EncPart, key, keyusage.KRB_CRED_ENCPART)
 	if err != nil {

messages/KRBError.go

@@ -1,4 +1,4 @@
-// Kerberos 5 message types and methods.
+// Package message implements Kerberos 5 message types and methods.
 package messages
 
 import (
@@ -30,6 +30,7 @@ type KRBError struct {
 	EData     []byte              `asn1:"optional,explicit,tag:12"`
 }
 
+// NewKRBError creates a new KRBError.
 func NewKRBError(sname types.PrincipalName, realm string, code int, etext string) KRBError {
 	t := time.Now().UTC()
 	return KRBError{

messages/KRBPriv.go

@@ -40,7 +40,7 @@ func (k *KRBPriv) Unmarshal(b []byte) error {
 	return nil
 }
 
-// Decrypt the encrypted part of a KRB_PRIV.
+// Unmarshal bytes b into the EncKrbPrivPart struct.
 func (k *EncKrbPrivPart) Unmarshal(b []byte) error {
 	_, err := asn1.UnmarshalWithParams(b, k, fmt.Sprintf("application,explicit,tag:%v", asnAppTag.EncKrbPrivPart))
 	if err != nil {

messages/Ticket.go

@@ -48,6 +48,7 @@ type TransitedEncoding struct {
 	Contents []byte `asn1:"explicit,tag:1"`
 }
 
+// NewTicket creates a new Ticket instance.
 func NewTicket(cname types.PrincipalName, crealm string, sname types.PrincipalName, srealm string, flags asn1.BitString, sktab keytab.Keytab, eTypeID, kvno int, authTime, startTime, endTime, renewTill time.Time) (Ticket, types.EncryptionKey, error) {
 	etype, err := crypto.GetEtype(eTypeID)
 	if err != nil {
@@ -87,11 +88,13 @@ func NewTicket(cname types.PrincipalName, crealm string, sname types.PrincipalNa
 	return tkt, sessionKey, nil
 }
 
+// Unmarshal bytes b into a Ticket struct.
 func (t *Ticket) Unmarshal(b []byte) error {
 	_, err := asn1.UnmarshalWithParams(b, t, fmt.Sprintf("application,explicit,tag:%d", asnAppTag.Ticket))
 	return err
 }
 
+// Marshal the Ticket.
 func (t *Ticket) Marshal() ([]byte, error) {
 	b, err := asn1.Marshal(*t)
 	if err != nil {
@@ -101,16 +104,19 @@ func (t *Ticket) Marshal() ([]byte, error) {
 	return b, nil
 }
 
+// Unmarshal bytes b into the EncTicketPart struct.
 func (t *EncTicketPart) Unmarshal(b []byte) error {
 	_, err := asn1.UnmarshalWithParams(b, t, fmt.Sprintf("application,explicit,tag:%d", asnAppTag.EncTicketPart))
 	return err
 }
 
+// UnmarshalTicket returns a ticket from the bytes provided.
 func UnmarshalTicket(b []byte) (t Ticket, err error) {
 	_, err = asn1.UnmarshalWithParams(b, &t, fmt.Sprintf("application,explicit,tag:%d", asnAppTag.Ticket))
 	return
 }
 
+// UnmarshalTicketsSequence returns a slice of Tickets from a raw ASN1 value.
 func UnmarshalTicketsSequence(in asn1.RawValue) ([]Ticket, error) {
 	//This is a workaround to a asn1 decoding issue in golang - https://github.com/golang/go/issues/17321. It's not pretty I'm afraid
 	//We pull out raw values from the larger raw value (that is actually the data of the sequence of raw values) and track our position moving along the data.
@@ -135,6 +141,7 @@ func UnmarshalTicketsSequence(in asn1.RawValue) ([]Ticket, error) {
 	return tkts, nil
 }
 
+// MarshalTicketSequence marshals a slice of Tickets returning an ASN1 raw value containing the ticket sequence.
 func MarshalTicketSequence(tkts []Ticket) (asn1.RawValue, error) {
 	raw := asn1.RawValue{
 		Class:      2,
@@ -167,6 +174,7 @@ func MarshalTicketSequence(tkts []Ticket) (asn1.RawValue, error) {
 	return raw, nil
 }
 
+// DecryptEncPart decrypts the encrypted part of the ticket.
 func (t *Ticket) DecryptEncPart(keytab keytab.Keytab, sa string) error {
 	var upn []string
 	if sa != "" {
@@ -191,6 +199,7 @@ func (t *Ticket) DecryptEncPart(keytab keytab.Keytab, sa string) error {
 	return nil
 }
 
+// GetPACType returns a Microsoft PAC that has been extracted from the ticket and processed.
 func (t *Ticket) GetPACType(keytab keytab.Keytab, sa string) (bool, pac.PACType, error) {
 	var isPAC bool
 	for _, ad := range t.DecryptedEncPart.AuthorizationData {

mstypes/claims_set_metadata.go

@@ -23,6 +23,7 @@ const (
 	COMPRESSION_FORMAT_XPRESS_HUFF = 4
 )
 
+// Read_ClaimsSetMetadata reads a ClaimsSetMetadata from the bytes slice.
 func Read_ClaimsSetMetadata(b *[]byte, p *int, e *binary.ByteOrder) ClaimsSetMetadata {
 	var c ClaimsSetMetadata
 	c.ULClaimsSetSize = ndr.Read_uint32(b, p, e)

mstypes/filetime.go

@@ -1,4 +1,4 @@
-// Representations of Microsoft types for PAC processing.
+// Package mstypes implements representations of Microsoft types for PAC processing.
 package mstypes
 
 import (
@@ -24,7 +24,7 @@ type FileTime struct {
 	HighDateTime uint32
 }
 
-// Return a golang Time type from the FileTime
+// Time return a golang Time type from the FileTime
 func (ft FileTime) Time() time.Time {
 	ns := (ft.MSEpoch() - UNIX_EPOCH_DIFF) * 100
 	return time.Unix(0, int64(ns)).UTC()
@@ -40,7 +40,7 @@ func (ft FileTime) Unix() int64 {
 	return (ft.MSEpoch() - UNIX_EPOCH_DIFF) / 10000000
 }
 
-// Get a FileTime type from the provided Golang Time type.
+// GetFileTime returns a FileTime type from the provided Golang Time type.
 func GetFileTime(t time.Time) FileTime {
 	ns := t.UnixNano()
 	fp := (ns / 100) + UNIX_EPOCH_DIFF
@@ -52,6 +52,7 @@ func GetFileTime(t time.Time) FileTime {
 	}
 }
 
+// Read_FileTime reads a FileTime from the bytes slice.
 func Read_FileTime(b *[]byte, p *int, e *binary.ByteOrder) FileTime {
 	l := ndr.Read_uint32(b, p, e)
 	h := ndr.Read_uint32(b, p, e)

mstypes/group_membership.go

@@ -13,6 +13,7 @@ type GroupMembership struct {
 	Attributes uint32
 }
 
+// Read_GroupMembership reads a GroupMembership from the bytes slice.
 func Read_GroupMembership(b *[]byte, p *int, e *binary.ByteOrder) GroupMembership {
 	r := ndr.Read_uint32(b, p, e)
 	a := ndr.Read_uint32(b, p, e)
@@ -32,6 +33,7 @@ type DomainGroupMembership struct {
 	GroupIDs   []GroupMembership // Size is value of GroupCount
 }
 
+// Read_DomainGroupMembership reads a DomainGroupMembership from the bytes slice.
 func Read_DomainGroupMembership(b *[]byte, p *int, e *binary.ByteOrder) (DomainGroupMembership, error) {
 	d, err := Read_RPC_SID(b, p, e)
 	if err != nil {

mstypes/kerb_sid_and_attributes.go

@@ -20,6 +20,7 @@ type KerbSidAndAttributes struct {
 	Attributes uint32
 }
 
+// Read_KerbSidAndAttributes reads a KerbSidAndAttribute from the bytes slice.
 func Read_KerbSidAndAttributes(b *[]byte, p *int, e *binary.ByteOrder) (KerbSidAndAttributes, error) {
 	s, err := Read_RPC_SID(b, p, e)
 	if err != nil {
@@ -32,6 +33,7 @@ func Read_KerbSidAndAttributes(b *[]byte, p *int, e *binary.ByteOrder) (KerbSidA
 	}, nil
 }
 
+// SetFlag sets a flag in a uint32 attribute value.
 func SetFlag(a *uint32, i uint) {
 	*a = *a | (1 << (31 - i))
 }

mstypes/rpc_unicode_string.go

@@ -13,6 +13,7 @@ type RPC_UnicodeString struct {
 	Value         string
 }
 
+// Read_RPC_UnicodeString reads a RPC_UnicodeString from the bytes slice.
 func Read_RPC_UnicodeString(b *[]byte, p *int, e *binary.ByteOrder) (RPC_UnicodeString, error) {
 	l := ndr.Read_uint16(b, p, e)
 	ml := ndr.Read_uint16(b, p, e)
@@ -27,6 +28,7 @@ func Read_RPC_UnicodeString(b *[]byte, p *int, e *binary.ByteOrder) (RPC_Unicode
 	}, nil
 }
 
+// UnmarshalString populates a golang string into the RPC_UnicodeString struct.
 func (s *RPC_UnicodeString) UnmarshalString(b *[]byte, p *int, e *binary.ByteOrder) (err error) {
 	s.Value, err = ndr.Read_ConformantVaryingString(b, p, e)
 	return

mstypes/sid.go

@@ -20,6 +20,7 @@ type RPC_SIDIdentifierAuthority struct {
 	Value []byte // 6 bytes
 }
 
+// Read_RPC_SID reads a RPC_SID from the bytes slice.
 func Read_RPC_SID(b *[]byte, p *int, e *binary.ByteOrder) (RPC_SID, error) {
 	size := int(ndr.Read_uint32(b, p, e)) // This is part of the NDR encoding rather than the data type.
 	r := ndr.Read_uint8(b, p)
@@ -43,30 +44,14 @@ func Read_RPC_SID(b *[]byte, p *int, e *binary.ByteOrder) (RPC_SID, error) {
 	}, nil
 }
 
+// Read_RPC_SIDIdentifierAuthority reads a RPC_SIDIdentifierAuthority from the bytes slice.
 func Read_RPC_SIDIdentifierAuthority(b *[]byte, p *int, e *binary.ByteOrder) RPC_SIDIdentifierAuthority {
 	return RPC_SIDIdentifierAuthority{
 		Value: ndr.Read_bytes(b, p, 6, e),
 	}
 }
 
-//SID= "S-1-" IdentifierAuthority 1*SubAuthority
-//IdentifierAuthority= IdentifierAuthorityDec / IdentifierAuthorityHex
-//; If the identifier authority is < 2^32, the
-//; identifier authority is represented as a decimal ; number
-//; If the identifier authority is >= 2^32,
-//; the identifier authority is represented in
-//; hexadecimal
-//IdentifierAuthorityDec = 1*10DIGIT
-//; IdentifierAuthorityDec, top level authority of a
-//; security identifier is represented as a decimal number
-//IdentifierAuthorityHex = "0x" 12HEXDIG
-//; IdentifierAuthorityHex, the top-level authority of a
-//; security identifier is represented as a hexadecimal number
-//SubAuthority= "-" 1*10DIGIT
-//; Sub-Authority is always represented as a decimal number
-//; No leading "0" characters are allowed when IdentifierAuthority ; or SubAuthority is represented as a decimal number
-//; All hexadecimal digits must be output in string format,
-//; pre-pended by "0x"
+// ToString returns the string representation of the RPC_SID.
 func (s *RPC_SID) ToString() string {
 	var str string
 	b := append(make([]byte, 2, 2), s.IdentifierAuthority.Value...)

mstypes/user_session_key.go

@@ -13,6 +13,7 @@ type UserSessionKey struct {
 	Data []CypherBlock // size = 2
 }
 
+// Read_UserSessionKey reads a UserSessionKey from the bytes slice.
 func Read_UserSessionKey(b *[]byte, p *int, e *binary.ByteOrder) UserSessionKey {
 	cb1 := CypherBlock{
 		Data: ndr.Read_bytes(b, p, 8, e),

ndr/error.go

@@ -6,6 +6,7 @@ type Malformed struct {
 	EText string
 }
 
+// Error implements the error interface on the Malformed struct.
 func (e Malformed) Error() string {
 	return fmt.Sprintf("Malformed NDR steam: %s", e.EText)
 }

ndr/ndr.go

@@ -1,4 +1,4 @@
-// Partial implementation of NDR encoding: http://pubs.opengroup.org/onlinepubs/9629399/chap14.htm
+// Package ndr is a partial implementation of NDR encoding: http://pubs.opengroup.org/onlinepubs/9629399/chap14.htm
 package ndr
 
 import (
@@ -54,6 +54,7 @@ type PrivateHeader struct {
 	Filler             []byte
 }
 
+// ReadHeaders processes the bytes to return the NDR Common and Private headers.
 func ReadHeaders(b *[]byte) (CommonHeader, PrivateHeader, int, error) {
 	ch, p, err := GetCommonHeader(b)
 	if err != nil {
@@ -66,6 +67,7 @@ func ReadHeaders(b *[]byte) (CommonHeader, PrivateHeader, int, error) {
 	return ch, ph, p, err
 }
 
+// GetCommonHeader processes the bytes to return the NDR Common header.
 func GetCommonHeader(b *[]byte) (CommonHeader, int, error) {
 	//The first 8 bytes comprise the Common RPC Header for type marshalling.
 	if len(*b) < COMMON_HEADER_BYTES {
@@ -104,6 +106,7 @@ func GetCommonHeader(b *[]byte) (CommonHeader, int, error) {
 	}, 8, nil
 }
 
+// GetPrivateHeader processes the bytes to return the NDR Private header.
 func GetPrivateHeader(b *[]byte, p *int, bo *binary.ByteOrder) (PrivateHeader, error) {
 	//The next 8 bytes comprise the RPC type marshalling private header for constructed types.
 	if len(*b) < (PRIVATE_HEADER_BYTES) {
@@ -122,7 +125,7 @@ func GetPrivateHeader(b *[]byte, p *int, bo *binary.ByteOrder) (PrivateHeader, e
 	}, nil
 }
 
-// Read bytes representing a thirty two bit integer.
+// Read_uint8 reads bytes representing a thirty two bit integer.
 func Read_uint8(b *[]byte, p *int) (i uint8) {
 	if len((*b)[*p:]) < 1 {
 		return
@@ -133,7 +136,7 @@ func Read_uint8(b *[]byte, p *int) (i uint8) {
 	return
 }
 
-// Read bytes representing a thirty two bit integer.
+// Read_uint16 reads bytes representing a thirty two bit integer.
 func Read_uint16(b *[]byte, p *int, e *binary.ByteOrder) (i uint16) {
 	if len((*b)[*p:]) < 2 {
 		return
@@ -144,7 +147,7 @@ func Read_uint16(b *[]byte, p *int, e *binary.ByteOrder) (i uint16) {
 	return
 }
 
-// Read bytes representing a thirty two bit integer.
+// Read_uint32 reads bytes representing a thirty two bit integer.
 func Read_uint32(b *[]byte, p *int, e *binary.ByteOrder) (i uint32) {
 	if len((*b)[*p:]) < 4 {
 		return
@@ -155,7 +158,7 @@ func Read_uint32(b *[]byte, p *int, e *binary.ByteOrder) (i uint32) {
 	return
 }
 
-// Read bytes representing a thirty two bit integer.
+// Read_uint64 reads bytes representing a thirty two bit integer.
 func Read_uint64(b *[]byte, p *int, e *binary.ByteOrder) (i uint64) {
 	if len((*b)[*p:]) < 8 {
 		return
@@ -166,6 +169,7 @@ func Read_uint64(b *[]byte, p *int, e *binary.ByteOrder) (i uint64) {
 	return
 }
 
+// Read_bytes reads the number of bytes specified.
 func Read_bytes(b *[]byte, p *int, s int, e *binary.ByteOrder) (r []byte) {
 	if len((*b)[*p:]) < s {
 		return
@@ -177,6 +181,7 @@ func Read_bytes(b *[]byte, p *int, s int, e *binary.ByteOrder) (r []byte) {
 	return r
 }
 
+// Read_bool reads bytes representing a boolean.
 func Read_bool(b *[]byte, p *int) bool {
 	if len((*b)[*p:]) < 1 {
 		return false
@@ -187,17 +192,19 @@ func Read_bool(b *[]byte, p *int) bool {
 	return false
 }
 
+// Read_IEEEfloat32 reads bytes representing a IEEE formatted 32 bit float.
 func Read_IEEEfloat32(b *[]byte, p *int, e *binary.ByteOrder) float32 {
 	ensureAlignment(p, 4)
 	return math.Float32frombits(Read_uint32(b, p, e))
 }
 
+// Read_IEEEfloat64 reads bytes representing a IEEE formatted 64 bit float.
 func Read_IEEEfloat64(b *[]byte, p *int, e *binary.ByteOrder) float64 {
 	ensureAlignment(p, 8)
 	return math.Float64frombits(Read_uint64(b, p, e))
 }
 
-// Conformant and Varying Strings
+// Read_ConformantVaryingString reads a Conformant and Varying String from the bytes slice.
 // A conformant and varying string is a string in which the maximum number of elements is not known beforehand and therefore is included in the representation of the string.
 // NDR represents a conformant and varying string as an ordered sequence of representations of the string elements, preceded by three unsigned long integers.
 // The first integer gives the maximum number of elements in the string, including the terminator.
@@ -223,6 +230,7 @@ func Read_ConformantVaryingString(b *[]byte, p *int, e *binary.ByteOrder) (strin
 	return string(s), nil
 }
 
+// Read_UniDimensionalConformantArrayHeader reads a UniDimensionalConformantArrayHeader from the bytes slice.
 func Read_UniDimensionalConformantArrayHeader(b *[]byte, p *int, e *binary.ByteOrder) int {
 	return int(Read_uint32(b, p, e))
 }

pac/client_claims.go

@@ -11,6 +11,7 @@ type ClientClaimsInfo struct {
 	Claims mstypes.ClaimsSetMetadata
 }
 
+// Unmarshal bytes into the ClientClaimsInfo struct
 func (k *ClientClaimsInfo) Unmarshal(b []byte) error {
 	ch, _, p, err := ndr.ReadHeaders(&b)
 	if err != nil {

pac/client_info.go

@@ -13,6 +13,7 @@ type ClientInfo struct {
 	Name       string           // An array of 16-bit Unicode characters in little-endian format that contains the client's account name.
 }
 
+// Unmarshal bytes into the ClientInfo struct
 func (k *ClientInfo) Unmarshal(b []byte) error {
 	//The PAC_CLIENT_INFO structure is a simple structure that is not NDR-encoded.
 	var p int

pac/credentials_info.go

@@ -20,6 +20,7 @@ type CredentialsInfo struct {
 	PAC_CredentialData           CredentialData
 }
 
+// Unmarshal bytes into the CredentialsInfo struct
 func (c *CredentialsInfo) Unmarshal(b []byte, k types.EncryptionKey) error {
 	ch, _, p, err := ndr.ReadHeaders(&b)
 	if err != nil {
@@ -41,6 +42,7 @@ func (c *CredentialsInfo) Unmarshal(b []byte, k types.EncryptionKey) error {
 	return nil
 }
 
+// DecryptEncPart decrypts the encrypted part of the CredentialsInfo.
 func (c *CredentialsInfo) DecryptEncPart(k types.EncryptionKey, e *binary.ByteOrder) error {
 	if k.KeyType != int(c.EType) {
 		return fmt.Errorf("Key provided is not the correct type. Type needed: %d, type provided: %d", c.EType, k.KeyType)
@@ -64,6 +66,7 @@ type CredentialData struct {
 	Credentials     []SECPKG_SupplementalCred // Size is the value of CredentialCount
 }
 
+// Read_PAC_CredentialData reads a CredentialData from the byte slice.
 func Read_PAC_CredentialData(b *[]byte, p *int, e *binary.ByteOrder) CredentialData {
 	c := ndr.Read_uint32(b, p, e)
 	cr := make([]SECPKG_SupplementalCred, c, c)
@@ -83,6 +86,7 @@ type SECPKG_SupplementalCred struct {
 	Credentials    []uint8 // Is a ptr. Size is the value of CredentialSize
 }
 
+// Read_SECPKG_SupplementalCred reads a SECPKG_SupplementalCred from the byte slice.
 func Read_SECPKG_SupplementalCred(b *[]byte, p *int, e *binary.ByteOrder) SECPKG_SupplementalCred {
 	n, _ := mstypes.Read_RPC_UnicodeString(b, p, e)
 	cs := ndr.Read_uint32(b, p, e)
@@ -105,6 +109,7 @@ type NTLM_SupplementalCred struct {
 	NTPassword []byte // A 16-element array of unsigned 8-bit integers that define the NT OWF. The LtPassword member MUST be ignored if the N flag is not set in the Flags member.
 }
 
+// Read_NTLM_SupplementalCred reads a NTLM_SupplementalCred from the byte slice.
 func Read_NTLM_SupplementalCred(b *[]byte, p *int, e *binary.ByteOrder) NTLM_SupplementalCred {
 	v := ndr.Read_uint32(b, p, e)
 	f := ndr.Read_uint32(b, p, e)

pac/device_claims.go

@@ -11,6 +11,7 @@ type DeviceClaimsInfo struct {
 	Claims mstypes.ClaimsSetMetadata
 }
 
+// Unmarshal bytes into the DeviceClaimsInfo struct
 func (k *DeviceClaimsInfo) Unmarshal(b []byte) error {
 	ch, _, p, err := ndr.ReadHeaders(&b)
 	if err != nil {

pac/device_info.go

@@ -19,6 +19,7 @@ type DeviceInfo struct {
 	DomainGroup       []mstypes.DomainGroupMembership // A pointer to a list of DOMAIN_GROUP_MEMBERSHIP structures (section 2.2.3) that contains the domains to which the account belongs to a group. The number of sets in this list MUST be equal to DomainCount.
 }
 
+// Unmarshal bytes into the DeviceInfo struct
 func (k *DeviceInfo) Unmarshal(b []byte) error {
 	ch, _, p, err := ndr.ReadHeaders(&b)
 	if err != nil {

pac/kerb_validation_info.go

@@ -72,6 +72,7 @@ type KerbValidationInfo struct {
 	ResourceGroupIDs        []mstypes.GroupMembership
 }
 
+// Unmarshal bytes into the DeviceInfo struct
 func (k *KerbValidationInfo) Unmarshal(b []byte) (err error) {
 	ch, _, p, err := ndr.ReadHeaders(&b)
 	if err != nil {
@@ -221,6 +222,7 @@ func (k *KerbValidationInfo) Unmarshal(b []byte) (err error) {
 	return nil
 }
 
+// GetGroupMembershipSIDs returns a slice of strings containing the group membership SIDs found in the PAC.
 func (k *KerbValidationInfo) GetGroupMembershipSIDs() []string {
 	gSize := len(k.GroupIDs) + len(k.ExtraSIDs)
 	g := make([]string, gSize, gSize)

pac/pac_info_buffer.go

@@ -25,6 +25,7 @@ type InfoBuffer struct {
 	Offset       uint64 // A 64-bit unsigned integer in little-endian format that contains the offset to the beginning of the buffer, in bytes, from the beginning of the PACTYPE structure. The data offset MUST be a multiple of eight. The following sections specify the format of each type of element.
 }
 
+// Read_PACInfoBuffer reads a InfoBuffer from the byte slice.
 func Read_PACInfoBuffer(b *[]byte, p *int, e *binary.ByteOrder) InfoBuffer {
 	u := ndr.Read_uint32(b, p, e)
 	s := ndr.Read_uint32(b, p, e)

pac/pac_type.go

@@ -29,6 +29,7 @@ type PACType struct {
 	ZeroSigData        []byte
 }
 
+// Unmarshal bytes into the PACType struct
 func (pac *PACType) Unmarshal(b []byte) error {
 	var p int
 	var e binary.ByteOrder = binary.LittleEndian
@@ -46,6 +47,7 @@ func (pac *PACType) Unmarshal(b []byte) error {
 	return nil
 }
 
+// ProcessPACInfoBuffers processes the PAC Info Buffers.
 // https://msdn.microsoft.com/en-us/library/cc237954.aspx
 func (pac *PACType) ProcessPACInfoBuffers(key types.EncryptionKey) error {
 	for _, buf := range pac.Buffers {

pac/s4u_delegation_info.go

@@ -13,6 +13,7 @@ type S4U_DelegationInfo struct {
 	S4UTransitedServices []mstypes.RPC_UnicodeString // List of all services that have been delegated through by this client and subsequent services or servers.. Size is value of TransitedListSize
 }
 
+// Unmarshal bytes into the S4U_DelegationInfo struct
 func (k *S4U_DelegationInfo) Unmarshal(b []byte) error {
 	ch, _, p, err := ndr.ReadHeaders(&b)
 	if err != nil {

pac/signature_data.go

@@ -36,6 +36,7 @@ type SignatureData struct {
 	RODCIdentifier uint16 // A 16-bit unsigned integer value in little-endian format that contains the first 16 bits of the key version number ([MS-KILE] section 3.1.5.8) when the KDC is an RODC. When the KDC is not an RODC, this field does not exist.
 }
 
+// Unmarshal bytes into the SignatureData struct
 func (k *SignatureData) Unmarshal(b []byte) ([]byte, error) {
 	var p int
 	var e binary.ByteOrder = binary.LittleEndian

pac/upn_dns_info.go

@@ -21,6 +21,7 @@ const (
 	UPN_NO_UPN_ATTR = 31 // The user account object does not have the userPrincipalName attribute ([MS-ADA3] section 2.349) set. A UPN constructed by concatenating the user name with the DNS domain name of the account domain is provided.
 )
 
+// Unmarshal bytes into the UPN_DNSInfo struct
 func (k *UPN_DNSInfo) Unmarshal(b []byte) error {
 	//The UPN_DNS_INFO structure is a simple structure that is not NDR-encoded.
 	var p int

service/APExchange.go

@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-// Validates an AP_REQ sent to the service. Returns a boolean for if the AP_REQ is valid and the client's principal name and realm.
+// ValidateAPREQ validates an AP_REQ sent to the service. Returns a boolean for if the AP_REQ is valid and the client's principal name and realm.
 func ValidateAPREQ(APReq messages.APReq, kt keytab.Keytab, sa string, cAddr string) (bool, credentials.Credentials, error) {
 	var creds credentials.Credentials
 	err := APReq.Ticket.DecryptEncPart(kt, sa)

service/cache.go

@@ -1,4 +1,4 @@
-// Service integrations for Kerberos authentication.
+// Package service provides server side integrations for Kerberos authentication.
 package service
 
 import (
@@ -50,7 +50,7 @@ type replayCacheEntry struct {
 var replayCache Cache
 var once sync.Once
 
-// Get a pointer to the ServiceCache singleton.
+// GetReplayCache returns a pointer to the Cache singleton.
 func GetReplayCache(d time.Duration) *Cache {
 	// Create a singleton of the ReplayCache and start a background thread to regularly clean out old entries
 	once.Do(func() {
@@ -66,7 +66,7 @@ func GetReplayCache(d time.Duration) *Cache {
 	return &replayCache
 }
 
-// Add an entry to the ServiceCache.
+// AddEntry adds an entry to the Cache.
 func (c *Cache) AddEntry(sname types.PrincipalName, a types.Authenticator) {
 	ct := a.CTime.Add(time.Duration(a.Cusec) * time.Microsecond)
 	if ce, ok := (*c)[a.CName.GetPrincipalNameString()]; ok {
@@ -92,7 +92,7 @@ func (c *Cache) AddEntry(sname types.PrincipalName, a types.Authenticator) {
 	}
 }
 
-// Clear entries from the ServiceCache that are older than the duration provided.
+// ClearOldEntries clears entries from the Cache that are older than the duration provided.
 func (c *Cache) ClearOldEntries(d time.Duration) {
 	for ck := range *c {
 		for ct, e := range (*c)[ck].ReplayMap {
@@ -106,7 +106,7 @@ func (c *Cache) ClearOldEntries(d time.Duration) {
 	}
 }
 
-// Check if the Authenticator provided is a replay within the duration defined. If this is not a replay add the entry to the cache for tracking.
+// IsReplay tests if the Authenticator provided is a replay within the duration defined. If this is not a replay add the entry to the cache for tracking.
 func (c *Cache) IsReplay(sname types.PrincipalName, a types.Authenticator) bool {
 	if ck, ok := (*c)[a.CName.GetPrincipalNameString()]; ok {
 		ct := a.CTime.Add(time.Duration(a.Cusec) * time.Microsecond)

service/http.go

@@ -22,7 +22,7 @@ const (
 	AUTHENTICATED_CTXKEY       ctxKey = 1
 )
 
-// Kerberos SPNEGO authentication HTTP handler wrapper.
+// SPNEGOKRB5Authenticate is a Kerberos SPNEGO authentication HTTP handler wrapper.
 //
 // kt - keytab for the service user
 //

testdata/test_vectors.go

@@ -1,4 +1,4 @@
-// Kerberos 5 test reference data.
+// Package testdata provides Kerberos 5 test reference data.
 package testdata
 
 const (

types/Authenticator.go

@@ -43,6 +43,7 @@ type Authenticator struct {
 	AuthorizationData AuthorizationData `asn1:"explicit,optional,tag:8"`
 }
 
+// NewAuthenticator creates a new Authenticator.
 func NewAuthenticator(realm string, cname PrincipalName) Authenticator {
 	t := time.Now().UTC()
 	return Authenticator{
@@ -56,6 +57,7 @@ func NewAuthenticator(realm string, cname PrincipalName) Authenticator {
 	}
 }
 
+// GenerateSeqNumberAndSubKey sets the Authenticator's sequence number and subkey.
 func (a *Authenticator) GenerateSeqNumberAndSubKey(keyType, keySize int) {
 	a.SeqNumber = int(rand.Int31())
 	//Generate subkey value
@@ -67,11 +69,13 @@ func (a *Authenticator) GenerateSeqNumberAndSubKey(keyType, keySize int) {
 	}
 }
 
+// Unmarshal bytes into the Authenticator.
 func (a *Authenticator) Unmarshal(b []byte) error {
 	_, err := asn1.UnmarshalWithParams(b, a, fmt.Sprintf("application,explicit,tag:%v", asnAppTag.Authenticator))
 	return err
 }
 
+// Marshal the Authenticator.
 func (a *Authenticator) Marshal() ([]byte, error) {
 	b, err := asn1.Marshal(*a)
 	if err != nil {

types/AuthorizationData.go

@@ -98,16 +98,19 @@ type ADKDCIssued struct {
 
 type ADMandatoryForKDC AuthorizationData
 
+// Unmarshal bytes into the ADKDCIssued.
 func (a *ADKDCIssued) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// Unmarshal bytes into the AuthorizationData.
 func (a *AuthorizationData) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// Unmarshal bytes into the AuthorizationDataEntry.
 func (a *AuthorizationDataEntry) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err

types/Cryptosystem.go

@@ -26,11 +26,13 @@ type Checksum struct {
 	Checksum  []byte `asn1:"explicit,tag:1"`
 }
 
+// Unmarshal bytes into the EncryptedData.
 func (a *EncryptedData) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// Marshal the EncryptedData.
 func (a *EncryptedData) Marshal() ([]byte, error) {
 	edb, err := asn1.Marshal(*a)
 	if err != nil {
@@ -39,11 +41,13 @@ func (a *EncryptedData) Marshal() ([]byte, error) {
 	return edb, nil
 }
 
+// Unmarshal bytes into the EncryptionKey.
 func (a *EncryptionKey) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// Unmarshal bytes into the Checksum.
 func (a *Checksum) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err

types/HostAddress.go

@@ -53,6 +53,7 @@ type HostAddress struct {
 	Address  []byte `asn1:"explicit,tag:1"`
 }
 
+// GetHostAddress returns a HostAddress struct from a string in the format <hostname>:<port>
 func GetHostAddress(s string) (HostAddress, error) {
 	var h HostAddress
 	cAddr, _, err := net.SplitHostPort(s)
@@ -79,12 +80,14 @@ func GetHostAddress(s string) (HostAddress, error) {
 	return h, nil
 }
 
+// GetAddress returns a string representation of the HostAddress.
 func (h *HostAddress) GetAddress() (string, error) {
 	var b []byte
 	_, err := asn1.Unmarshal(h.Address, &b)
 	return string(b), err
 }
 
+// HostAddressesEqual tests if two HostAddress slices are equal.
 func HostAddressesEqual(h, a []HostAddress) bool {
 	if len(h) != len(a) {
 		return false
@@ -105,6 +108,7 @@ func HostAddressesEqual(h, a []HostAddress) bool {
 	return true
 }
 
+// HostAddressesContains tests if a HostAddress is contained in a HostAddress slice.
 func HostAddressesContains(h []HostAddress, a HostAddress) bool {
 	for _, e := range h {
 		if e.Equal(a) {
@@ -114,6 +118,7 @@ func HostAddressesContains(h []HostAddress, a HostAddress) bool {
 	return false
 }
 
+// Equal tests if the HostAddress is equal to another HostAddress provided.
 func (h *HostAddress) Equal(a HostAddress) bool {
 	if h.AddrType != a.AddrType {
 		return false
@@ -121,6 +126,7 @@ func (h *HostAddress) Equal(a HostAddress) bool {
 	return bytes.Equal(h.Address, a.Address)
 }
 
+// Contains tests if a HostAddress is contained within the HostAddresses struct.
 func (h *HostAddresses) Contains(a HostAddress) bool {
 	for _, e := range *h {
 		if e.Equal(a) {
@@ -130,6 +136,7 @@ func (h *HostAddresses) Contains(a HostAddress) bool {
 	return false
 }
 
+// Equal tests if a HostAddress slice is equal to the HostAddresses struct.
 func (h *HostAddresses) Equal(a []HostAddress) bool {
 	if len(*h) != len(a) {
 		return false

types/KerberosFlags.go

@@ -63,6 +63,7 @@ encoding of a bit string that is declared with the "NamedBit"
 notation.
 */
 
+// NewKrbFlags returns an ASN1 BitString struct of the right size for KrbFlags.
 func NewKrbFlags() asn1.BitString {
 	f := asn1.BitString{}
 	f.Bytes = make([]byte, 4)
@@ -70,12 +71,14 @@ func NewKrbFlags() asn1.BitString {
 	return f
 }
 
+// SetFlags sets the flags of an ASN1 BitString.
 func SetFlags(f *asn1.BitString, j []int) {
 	for _, i := range j {
 		SetFlag(f, i)
 	}
 }
 
+// SetFlag sets a flag in an ASN1 BitString.
 func SetFlag(f *asn1.BitString, i int) {
 	for l := len(f.Bytes); l < 4; l++ {
 		(*f).Bytes = append((*f).Bytes, byte(0))
@@ -88,12 +91,14 @@ func SetFlag(f *asn1.BitString, i int) {
 	(*f).Bytes[b] = (*f).Bytes[b] | (1 << p)
 }
 
+// UnsetFlags unsets flags in an ASN1 BitString.
 func UnsetFlags(f *asn1.BitString, j []int) {
 	for _, i := range j {
 		UnsetFlag(f, i)
 	}
 }
 
+// UnsetFlag unsets a flag in an ASN1 BitString.
 func UnsetFlag(f *asn1.BitString, i int) {
 	for l := len(f.Bytes); l < 4; l++ {
 		(*f).Bytes = append((*f).Bytes, byte(0))
@@ -106,6 +111,7 @@ func UnsetFlag(f *asn1.BitString, i int) {
 	(*f).Bytes[b] = (*f).Bytes[b] &^ (1 << p)
 }
 
+// IsFlagSet tests if a flag is set in the ASN1 BitString.
 func IsFlagSet(f *asn1.BitString, i int) bool {
 	//Which byte?
 	b := int(i / 8)

types/PAData.go

@@ -25,6 +25,7 @@ type PAEncTSEnc struct {
 	PAUSec      int       `asn1:"explicit,optional,tag:1"`
 }
 
+// Contains tests if a PADataSequence contains PA Data of a certain type.
 func (pas *PADataSequence) Contains(patype int) bool {
 	for _, pa := range *pas {
 		if pa.PADataType == patype {
@@ -34,6 +35,7 @@ func (pas *PADataSequence) Contains(patype int) bool {
 	return false
 }
 
+// GetPAEncTSEncAsnMarshalled returns the bytes of a PAEncTSEnc.
 func GetPAEncTSEncAsnMarshalled() ([]byte, error) {
 	t := time.Now().UTC()
 	p := PAEncTSEnc{
@@ -67,51 +69,61 @@ type PAReqEncPARep struct {
 	Chksum     []byte `asn1:"explicit,tag:1"`
 }
 
+// Unmarshal bytes into the PAData
 func (pa *PAData) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, pa)
 	return err
 }
 
+// Unmarshal bytes into the PADataSequence
 func (pas *PADataSequence) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, pas)
 	return err
 }
 
+// Unmarshal bytes into the PAReqEncPARep
 func (pa *PAReqEncPARep) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, pa)
 	return err
 }
 
+// Unmarshal bytes into the PAEncTimestamp
 func (pa *PAEncTimestamp) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, pa)
 	return err
 }
 
+// Unmarshal bytes into the PAEncTSEnc
 func (pa *PAEncTSEnc) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, pa)
 	return err
 }
 
+// Unmarshal bytes into the ETypeInfo
 func (a *ETypeInfo) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// Unmarshal bytes into the ETypeInfoEntry
 func (a *ETypeInfoEntry) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// Unmarshal bytes into the ETypeInfo2
 func (a *ETypeInfo2) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// Unmarshal bytes into the ETypeInfo2Entry
 func (a *ETypeInfo2Entry) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err
 }
 
+// GetETypeInfo returns an ETypeInfo from the PAData.
 func (pa *PAData) GetETypeInfo() (d ETypeInfo, err error) {
 	if pa.PADataType != patype.PA_ETYPE_INFO {
 		err = fmt.Errorf("PAData does not contain PA EType Info data. TypeID Expected: %v; Actual: %v", patype.PA_ETYPE_INFO, pa.PADataType)
@@ -121,6 +133,7 @@ func (pa *PAData) GetETypeInfo() (d ETypeInfo, err error) {
 	return
 }
 
+// GetETypeInfo2 returns an ETypeInfo2 from the PAData.
 func (pa *PAData) GetETypeInfo2() (d ETypeInfo2, err error) {
 	if pa.PADataType != patype.PA_ETYPE_INFO2 {
 		err = fmt.Errorf("PAData does not contain PA EType Info 2 data. TypeID Expected: %v; Actual: %v", patype.PA_ETYPE_INFO2, pa.PADataType)

types/PrincipalName.go

@@ -10,6 +10,7 @@ type PrincipalName struct {
 	NameString []string `asn1:"generalstring,explicit,tag:1"`
 }
 
+// GetSalt returns a salt derived from the PrincipalName.
 func (pn *PrincipalName) GetSalt(realm string) string {
 	var sb []byte
 	sb = append(sb, realm...)
@@ -19,6 +20,7 @@ func (pn *PrincipalName) GetSalt(realm string) string {
 	return string(sb)
 }
 
+// Equal tests if the PrincipalName is equal to the one provided.
 func (pn *PrincipalName) Equal(n PrincipalName) bool {
 	if n.NameType != pn.NameType {
 		return false
@@ -31,6 +33,7 @@ func (pn *PrincipalName) Equal(n PrincipalName) bool {
 	return true
 }
 
+// GetPrincipalNameString returns the PrincipalName in string form.
 func (pn *PrincipalName) GetPrincipalNameString() string {
 	return strings.Join(pn.NameString, "/")
 }

types/TypedData.go

@@ -9,6 +9,7 @@ type TypedData struct {
 
 type TypedDataSequence []TypedData
 
+// Unmarshal bytes into the TypedDataSequence.
 func (a *TypedDataSequence) Unmarshal(b []byte) error {
 	_, err := asn1.Unmarshal(b, a)
 	return err