2 * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include "internal/cryptlib.h"
13 #include <openssl/x509.h>
14 #include <openssl/evp.h>
15 #include <openssl/kdf.h>
16 #include <openssl/hmac.h>
17 #include <openssl/trace.h>
18 #include <openssl/core_names.h>
19 #include "crypto/evp.h"
20 #include "evp_local.h"
22 int pkcs5_pbkdf2_hmac_with_libctx(const char *pass
, int passlen
,
23 const unsigned char *salt
, int saltlen
,
24 int iter
, const EVP_MD
*digest
, int keylen
,
26 OPENSSL_CTX
*libctx
, const char *propq
)
28 const char *empty
= "";
32 const char *mdname
= EVP_MD_name(digest
);
33 OSSL_PARAM params
[6], *p
= params
;
35 /* Keep documented behaviour. */
39 } else if (passlen
== -1) {
40 passlen
= strlen(pass
);
42 if (salt
== NULL
&& saltlen
== 0)
43 salt
= (unsigned char *)empty
;
45 kdf
= EVP_KDF_fetch(libctx
, OSSL_KDF_NAME_PBKDF2
, propq
);
46 kctx
= EVP_KDF_CTX_new(kdf
);
50 *p
++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD
,
51 (char *)pass
, (size_t)passlen
);
52 *p
++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5
, &mode
);
53 *p
++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT
,
54 (unsigned char *)salt
, saltlen
);
55 *p
++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_ITER
, &iter
);
56 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST
,
58 *p
= OSSL_PARAM_construct_end();
59 if (EVP_KDF_CTX_set_params(kctx
, params
) != 1
60 || EVP_KDF_derive(kctx
, out
, keylen
) != 1)
63 EVP_KDF_CTX_free(kctx
);
65 OSSL_TRACE_BEGIN(PKCS5V2
) {
66 BIO_printf(trc_out
, "Password:\n");
67 BIO_hex_string(trc_out
,
68 0, passlen
, pass
, passlen
);
69 BIO_printf(trc_out
, "\n");
70 BIO_printf(trc_out
, "Salt:\n");
71 BIO_hex_string(trc_out
,
72 0, saltlen
, salt
, saltlen
);
73 BIO_printf(trc_out
, "\n");
74 BIO_printf(trc_out
, "Iteration count %d\n", iter
);
75 BIO_printf(trc_out
, "Key:\n");
76 BIO_hex_string(trc_out
,
77 0, keylen
, out
, keylen
);
78 BIO_printf(trc_out
, "\n");
79 } OSSL_TRACE_END(PKCS5V2
);
83 int PKCS5_PBKDF2_HMAC(const char *pass
, int passlen
, const unsigned char *salt
,
84 int saltlen
, int iter
, const EVP_MD
*digest
, int keylen
,
87 return pkcs5_pbkdf2_hmac_with_libctx(pass
, passlen
, salt
, saltlen
, iter
,
88 digest
, keylen
, out
, NULL
, NULL
);
92 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass
, int passlen
,
93 const unsigned char *salt
, int saltlen
, int iter
,
94 int keylen
, unsigned char *out
)
96 return PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, EVP_sha1(),
101 * Now the key derivation function itself. This is a bit evil because it has
102 * to check the ASN1 parameters are valid: and there are quite a few of
106 int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
, int passlen
,
107 ASN1_TYPE
*param
, const EVP_CIPHER
*c
,
108 const EVP_MD
*md
, int en_de
)
110 PBE2PARAM
*pbe2
= NULL
;
111 const EVP_CIPHER
*cipher
;
116 pbe2
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBE2PARAM
), param
);
118 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_DECODE_ERROR
);
122 /* See if we recognise the key derivation function */
123 if (!EVP_PBE_find(EVP_PBE_TYPE_KDF
, OBJ_obj2nid(pbe2
->keyfunc
->algorithm
),
125 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
,
126 EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION
);
131 * lets see if we recognise the encryption algorithm.
134 cipher
= EVP_get_cipherbyobj(pbe2
->encryption
->algorithm
);
137 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_UNSUPPORTED_CIPHER
);
141 /* Fixup cipher based on AlgorithmIdentifier */
142 if (!EVP_CipherInit_ex(ctx
, cipher
, NULL
, NULL
, NULL
, en_de
))
144 if (EVP_CIPHER_asn1_to_param(ctx
, pbe2
->encryption
->parameter
) < 0) {
145 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_CIPHER_PARAMETER_ERROR
);
148 rv
= kdf(ctx
, pass
, passlen
, pbe2
->keyfunc
->parameter
, NULL
, NULL
, en_de
);
150 PBE2PARAM_free(pbe2
);
154 int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
,
155 int passlen
, ASN1_TYPE
*param
,
156 const EVP_CIPHER
*c
, const EVP_MD
*md
, int en_de
)
158 unsigned char *salt
, key
[EVP_MAX_KEY_LENGTH
];
159 int saltlen
, iter
, t
;
161 unsigned int keylen
= 0;
162 int prf_nid
, hmac_md_nid
;
163 PBKDF2PARAM
*kdf
= NULL
;
166 if (EVP_CIPHER_CTX_cipher(ctx
) == NULL
) {
167 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_NO_CIPHER_SET
);
170 keylen
= EVP_CIPHER_CTX_key_length(ctx
);
171 OPENSSL_assert(keylen
<= sizeof(key
));
173 /* Decode parameter */
175 kdf
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM
), param
);
178 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_DECODE_ERROR
);
182 t
= EVP_CIPHER_CTX_key_length(ctx
);
184 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_INVALID_KEY_LENGTH
);
189 /* Now check the parameters of the kdf */
191 if (kdf
->keylength
&& (ASN1_INTEGER_get(kdf
->keylength
) != (int)keylen
)) {
192 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_KEYLENGTH
);
197 prf_nid
= OBJ_obj2nid(kdf
->prf
->algorithm
);
199 prf_nid
= NID_hmacWithSHA1
;
201 if (!EVP_PBE_find(EVP_PBE_TYPE_PRF
, prf_nid
, NULL
, &hmac_md_nid
, 0)) {
202 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_PRF
);
206 prfmd
= EVP_get_digestbynid(hmac_md_nid
);
208 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_PRF
);
212 if (kdf
->salt
->type
!= V_ASN1_OCTET_STRING
) {
213 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_SALT_TYPE
);
217 /* it seems that its all OK */
218 salt
= kdf
->salt
->value
.octet_string
->data
;
219 saltlen
= kdf
->salt
->value
.octet_string
->length
;
220 iter
= ASN1_INTEGER_get(kdf
->iter
);
221 if (!PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, prfmd
,
224 rv
= EVP_CipherInit_ex(ctx
, NULL
, NULL
, key
, NULL
, en_de
);
226 OPENSSL_cleanse(key
, keylen
);
227 PBKDF2PARAM_free(kdf
);