2 * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include "internal/cryptlib.h"
13 # include <openssl/x509.h>
14 # include <openssl/evp.h>
15 # include <openssl/hmac.h>
16 # include "evp_locl.h"
18 /* set this to print out info about the keygen algorithm */
19 /* #define OPENSSL_DEBUG_PKCS5V2 */
21 # ifdef OPENSSL_DEBUG_PKCS5V2
22 static void h__dump(const unsigned char *p, int len);
26 * This is an implementation of PKCS#5 v2.0 password based encryption key
27 * derivation function PBKDF2. SHA1 version verified against test vectors
28 * posted by Peter Gutmann <pgut001@cs.auckland.ac.nz> to the PKCS-TNG
29 * <pkcs-tng@rsa.com> mailing list.
32 int PKCS5_PBKDF2_HMAC(const char *pass, int passlen,
33 const unsigned char *salt, int saltlen, int iter,
34 const EVP_MD *digest, int keylen, unsigned char *out)
36 unsigned char digtmp[EVP_MAX_MD_SIZE], *p, itmp[4];
37 int cplen, j, k, tkeylen, mdlen;
39 HMAC_CTX *hctx_tpl = NULL, *hctx = NULL;
41 mdlen = EVP_MD_size(digest);
45 hctx_tpl = HMAC_CTX_new();
52 else if (passlen == -1)
53 passlen = strlen(pass);
54 if (!HMAC_Init_ex(hctx_tpl, pass, passlen, digest, NULL)) {
55 HMAC_CTX_free(hctx_tpl);
58 hctx = HMAC_CTX_new();
60 HMAC_CTX_free(hctx_tpl);
69 * We are unlikely to ever use more than 256 blocks (5120 bits!) but
72 itmp[0] = (unsigned char)((i >> 24) & 0xff);
73 itmp[1] = (unsigned char)((i >> 16) & 0xff);
74 itmp[2] = (unsigned char)((i >> 8) & 0xff);
75 itmp[3] = (unsigned char)(i & 0xff);
76 if (!HMAC_CTX_copy(hctx, hctx_tpl)) {
78 HMAC_CTX_free(hctx_tpl);
81 if (!HMAC_Update(hctx, salt, saltlen)
82 || !HMAC_Update(hctx, itmp, 4)
83 || !HMAC_Final(hctx, digtmp, NULL)) {
85 HMAC_CTX_free(hctx_tpl);
89 memcpy(p, digtmp, cplen);
90 for (j = 1; j < iter; j++) {
91 if (!HMAC_CTX_copy(hctx, hctx_tpl)) {
93 HMAC_CTX_free(hctx_tpl);
96 if (!HMAC_Update(hctx, digtmp, mdlen)
97 || !HMAC_Final(hctx, digtmp, NULL)) {
99 HMAC_CTX_free(hctx_tpl);
102 HMAC_CTX_reset(hctx);
103 for (k = 0; k < cplen; k++)
111 HMAC_CTX_free(hctx_tpl);
112 # ifdef OPENSSL_DEBUG_PKCS5V2
113 fprintf(stderr, "Password:\n");
114 h__dump(pass, passlen);
115 fprintf(stderr, "Salt:\n");
116 h__dump(salt, saltlen);
117 fprintf(stderr, "Iteration count %d\n", iter);
118 fprintf(stderr, "Key:\n");
119 h__dump(out, keylen);
124 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
125 const unsigned char *salt, int saltlen, int iter,
126 int keylen, unsigned char *out)
128 return PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter, EVP_sha1(),
135 unsigned char out[4];
136 unsigned char salt[] = { 0x12, 0x34, 0x56, 0x78 };
137 PKCS5_PBKDF2_HMAC_SHA1("password", -1, salt, 4, 5, 4, out);
138 fprintf(stderr, "Out %02X %02X %02X %02X\n",
139 out[0], out[1], out[2], out[3]);
145 * Now the key derivation function itself. This is a bit evil because it has
146 * to check the ASN1 parameters are valid: and there are quite a few of
150 int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
151 ASN1_TYPE *param, const EVP_CIPHER *c,
152 const EVP_MD *md, int en_de)
154 PBE2PARAM *pbe2 = NULL;
155 const EVP_CIPHER *cipher;
160 pbe2 = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBE2PARAM), param);
162 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN, EVP_R_DECODE_ERROR);
166 /* See if we recognise the key derivation function */
167 if (!EVP_PBE_find(EVP_PBE_TYPE_KDF, OBJ_obj2nid(pbe2->keyfunc->algorithm),
169 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,
170 EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION);
175 * lets see if we recognise the encryption algorithm.
178 cipher = EVP_get_cipherbyobj(pbe2->encryption->algorithm);
181 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN, EVP_R_UNSUPPORTED_CIPHER);
185 /* Fixup cipher based on AlgorithmIdentifier */
186 if (!EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, en_de))
188 if (EVP_CIPHER_asn1_to_param(ctx, pbe2->encryption->parameter) < 0) {
189 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN, EVP_R_CIPHER_PARAMETER_ERROR);
192 rv = kdf(ctx, pass, passlen, pbe2->keyfunc->parameter, NULL, NULL, en_de);
194 PBE2PARAM_free(pbe2);
198 int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,
199 int passlen, ASN1_TYPE *param,
200 const EVP_CIPHER *c, const EVP_MD *md, int en_de)
202 unsigned char *salt, key[EVP_MAX_KEY_LENGTH];
205 unsigned int keylen = 0;
206 int prf_nid, hmac_md_nid;
207 PBKDF2PARAM *kdf = NULL;
210 if (EVP_CIPHER_CTX_cipher(ctx) == NULL) {
211 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_NO_CIPHER_SET);
214 keylen = EVP_CIPHER_CTX_key_length(ctx);
215 OPENSSL_assert(keylen <= sizeof key);
217 /* Decode parameter */
219 kdf = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM), param);
222 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_DECODE_ERROR);
226 keylen = EVP_CIPHER_CTX_key_length(ctx);
228 /* Now check the parameters of the kdf */
230 if (kdf->keylength && (ASN1_INTEGER_get(kdf->keylength) != (int)keylen)) {
231 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_KEYLENGTH);
236 prf_nid = OBJ_obj2nid(kdf->prf->algorithm);
238 prf_nid = NID_hmacWithSHA1;
240 if (!EVP_PBE_find(EVP_PBE_TYPE_PRF, prf_nid, NULL, &hmac_md_nid, 0)) {
241 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
245 prfmd = EVP_get_digestbynid(hmac_md_nid);
247 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_PRF);
251 if (kdf->salt->type != V_ASN1_OCTET_STRING) {
252 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN, EVP_R_UNSUPPORTED_SALT_TYPE);
256 /* it seems that its all OK */
257 salt = kdf->salt->value.octet_string->data;
258 saltlen = kdf->salt->value.octet_string->length;
259 iter = ASN1_INTEGER_get(kdf->iter);
260 if (!PKCS5_PBKDF2_HMAC(pass, passlen, salt, saltlen, iter, prfmd,
263 rv = EVP_CipherInit_ex(ctx, NULL, NULL, key, NULL, en_de);
265 OPENSSL_cleanse(key, keylen);
266 PBKDF2PARAM_free(kdf);
270 # ifdef OPENSSL_DEBUG_PKCS5V2
271 static void h__dump(const unsigned char *p, int len)
274 fprintf(stderr, "%02X ", *p);
275 fprintf(stderr, "\n");