2 * Copyright 1999-2019 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include "internal/cryptlib.h"
13 #include <openssl/x509.h>
14 #include <openssl/evp.h>
15 #include <openssl/kdf.h>
16 #include <openssl/hmac.h>
17 #include <openssl/trace.h>
18 #include <openssl/core_names.h>
19 #include "crypto/evp.h"
20 #include "evp_local.h"
22 int PKCS5_PBKDF2_HMAC(const char *pass
, int passlen
,
23 const unsigned char *salt
, int saltlen
, int iter
,
24 const EVP_MD
*digest
, int keylen
, unsigned char *out
)
26 const char *empty
= "";
30 const char *mdname
= EVP_MD_name(digest
);
31 OSSL_PARAM params
[6], *p
= params
;
33 /* Keep documented behaviour. */
37 } else if (passlen
== -1) {
38 passlen
= strlen(pass
);
40 if (salt
== NULL
&& saltlen
== 0)
41 salt
= (unsigned char *)empty
;
43 kdf
= EVP_KDF_fetch(NULL
, OSSL_KDF_NAME_PBKDF2
, NULL
);
44 kctx
= EVP_KDF_CTX_new(kdf
);
48 *p
++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD
,
49 (char *)pass
, (size_t)passlen
);
50 *p
++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5
, &mode
);
51 *p
++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT
,
52 (unsigned char *)salt
, saltlen
);
53 *p
++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_ITER
, &iter
);
54 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST
,
56 *p
= OSSL_PARAM_construct_end();
57 if (EVP_KDF_CTX_set_params(kctx
, params
) != 1
58 || EVP_KDF_derive(kctx
, out
, keylen
) != 1)
61 EVP_KDF_CTX_free(kctx
);
63 OSSL_TRACE_BEGIN(PKCS5V2
) {
64 BIO_printf(trc_out
, "Password:\n");
65 BIO_hex_string(trc_out
,
66 0, passlen
, pass
, passlen
);
67 BIO_printf(trc_out
, "\n");
68 BIO_printf(trc_out
, "Salt:\n");
69 BIO_hex_string(trc_out
,
70 0, saltlen
, salt
, saltlen
);
71 BIO_printf(trc_out
, "\n");
72 BIO_printf(trc_out
, "Iteration count %d\n", iter
);
73 BIO_printf(trc_out
, "Key:\n");
74 BIO_hex_string(trc_out
,
75 0, keylen
, out
, keylen
);
76 BIO_printf(trc_out
, "\n");
77 } OSSL_TRACE_END(PKCS5V2
);
81 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass
, int passlen
,
82 const unsigned char *salt
, int saltlen
, int iter
,
83 int keylen
, unsigned char *out
)
85 return PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, EVP_sha1(),
90 * Now the key derivation function itself. This is a bit evil because it has
91 * to check the ASN1 parameters are valid: and there are quite a few of
95 int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
, int passlen
,
96 ASN1_TYPE
*param
, const EVP_CIPHER
*c
,
97 const EVP_MD
*md
, int en_de
)
99 PBE2PARAM
*pbe2
= NULL
;
100 const EVP_CIPHER
*cipher
;
105 pbe2
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBE2PARAM
), param
);
107 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_DECODE_ERROR
);
111 /* See if we recognise the key derivation function */
112 if (!EVP_PBE_find(EVP_PBE_TYPE_KDF
, OBJ_obj2nid(pbe2
->keyfunc
->algorithm
),
114 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
,
115 EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION
);
120 * lets see if we recognise the encryption algorithm.
123 cipher
= EVP_get_cipherbyobj(pbe2
->encryption
->algorithm
);
126 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_UNSUPPORTED_CIPHER
);
130 /* Fixup cipher based on AlgorithmIdentifier */
131 if (!EVP_CipherInit_ex(ctx
, cipher
, NULL
, NULL
, NULL
, en_de
))
133 if (EVP_CIPHER_asn1_to_param(ctx
, pbe2
->encryption
->parameter
) < 0) {
134 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_CIPHER_PARAMETER_ERROR
);
137 rv
= kdf(ctx
, pass
, passlen
, pbe2
->keyfunc
->parameter
, NULL
, NULL
, en_de
);
139 PBE2PARAM_free(pbe2
);
143 int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
,
144 int passlen
, ASN1_TYPE
*param
,
145 const EVP_CIPHER
*c
, const EVP_MD
*md
, int en_de
)
147 unsigned char *salt
, key
[EVP_MAX_KEY_LENGTH
];
148 int saltlen
, iter
, t
;
150 unsigned int keylen
= 0;
151 int prf_nid
, hmac_md_nid
;
152 PBKDF2PARAM
*kdf
= NULL
;
155 if (EVP_CIPHER_CTX_cipher(ctx
) == NULL
) {
156 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_NO_CIPHER_SET
);
159 keylen
= EVP_CIPHER_CTX_key_length(ctx
);
160 OPENSSL_assert(keylen
<= sizeof(key
));
162 /* Decode parameter */
164 kdf
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM
), param
);
167 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_DECODE_ERROR
);
171 t
= EVP_CIPHER_CTX_key_length(ctx
);
173 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_INVALID_KEY_LENGTH
);
178 /* Now check the parameters of the kdf */
180 if (kdf
->keylength
&& (ASN1_INTEGER_get(kdf
->keylength
) != (int)keylen
)) {
181 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_KEYLENGTH
);
186 prf_nid
= OBJ_obj2nid(kdf
->prf
->algorithm
);
188 prf_nid
= NID_hmacWithSHA1
;
190 if (!EVP_PBE_find(EVP_PBE_TYPE_PRF
, prf_nid
, NULL
, &hmac_md_nid
, 0)) {
191 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_PRF
);
195 prfmd
= EVP_get_digestbynid(hmac_md_nid
);
197 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_PRF
);
201 if (kdf
->salt
->type
!= V_ASN1_OCTET_STRING
) {
202 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_SALT_TYPE
);
206 /* it seems that its all OK */
207 salt
= kdf
->salt
->value
.octet_string
->data
;
208 saltlen
= kdf
->salt
->value
.octet_string
->length
;
209 iter
= ASN1_INTEGER_get(kdf
->iter
);
210 if (!PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, prfmd
,
213 rv
= EVP_CipherInit_ex(ctx
, NULL
, NULL
, key
, NULL
, en_de
);
215 OPENSSL_cleanse(key
, keylen
);
216 PBKDF2PARAM_free(kdf
);