2 This file is part of GNUnet.
3 Copyright (C) 2010 GNUnet e.V.
5 GNUnet is free software: you can redistribute it and/or modify it
6 under the terms of the GNU Affero General Public License as published
7 by the Free Software Foundation, either version 3 of the License,
8 or (at your option) any later version.
10 GNUnet is distributed in the hope that it will be useful, but
11 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Affero General Public License for more details.
15 You should have received a copy of the GNU Affero General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 * @file src/util/crypto_kdf.c
21 * @brief Key derivation
23 * @author Jeffrey Burdges <burdges@gnunet.org>
29 #include "gnunet_crypto_lib.h"
31 #define LOG(kind,...) GNUNET_log_from (kind, "util-crypto-kdf", __VA_ARGS__)
35 * @param result buffer for the derived key, allocated by caller
36 * @param out_len desired length of the derived key
38 * @param xts_len length of @a xts
39 * @param skm source key material
40 * @param skm_len length of @a skm
41 * @param argp va_list of void * & size_t pairs for context chunks
42 * @return #GNUNET_YES on success
45 GNUNET_CRYPTO_kdf_v (void *result,
54 * "Finally, we point out to a particularly advantageous instantiation using
55 * HMAC-SHA512 as XTR and HMAC-SHA256 in PRF* (in which case the output from SHA-512 is
56 * truncated to 256 bits). This makes sense in two ways: First, the extraction part is where we need a
57 * stronger hash function due to the unconventional demand from the hash function in the extraction
58 * setting. Second, as shown in Section 6, using HMAC with a truncated output as an extractor
59 * allows to prove the security of HKDF under considerably weaker assumptions on the underlying
62 * http://eprint.iacr.org/2010/264
65 return GNUNET_CRYPTO_hkdf_v (result,
79 * @param result buffer for the derived key, allocated by caller
80 * @param out_len desired length of the derived key
82 * @param xts_len length of @a xts
83 * @param skm source key material
84 * @param skm_len length of @a skm
85 * @param ... void * & size_t pairs for context chunks
86 * @return #GNUNET_YES on success
89 GNUNET_CRYPTO_kdf (void *result,
99 va_start (argp, skm_len);
100 ret = GNUNET_CRYPTO_kdf_v (result,
114 * Deterministically generate a pseudo-random number uniformly from the
115 * integers modulo a libgcrypt mpi.
117 * @param[out] r MPI value set to the FDH
118 * @param n MPI to work modulo
120 * @param xts_len length of @a xts
121 * @param skm source key material
122 * @param skm_len length of @a skm
123 * @param ctx context string
126 GNUNET_CRYPTO_kdf_mod_mpi (gcry_mpi_t *r,
128 const void *xts, size_t xts_len,
129 const void *skm, size_t skm_len,
137 nbits = gcry_mpi_get_nbits (n);
138 /* GNUNET_assert (nbits > 512); */
143 /* Ain't clear if n is always divisible by 8 */
144 uint8_t buf[ (nbits-1)/8 + 1 ];
146 rc = GNUNET_CRYPTO_kdf (buf,
153 GNUNET_assert (GNUNET_YES == rc);
155 rc = gcry_mpi_scan (r,
157 (const unsigned char *) buf,
160 GNUNET_assert (0 == rc); /* Allocation erro? */
162 gcry_mpi_clear_highbit (*r, nbits);
163 GNUNET_assert( 0 == gcry_mpi_test_bit (*r, nbits) );
165 /* We reject this FDH if either *r > n and retry with another ctr */
166 if (0 > gcry_mpi_cmp(*r, n))
168 gcry_mpi_release (*r);
172 /* end of crypto_kdf.c */