2 * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include "internal/cryptlib.h"
13 #include <openssl/x509.h>
14 #include <openssl/evp.h>
15 #include <openssl/kdf.h>
16 #include <openssl/hmac.h>
17 #include <openssl/trace.h>
18 #include <openssl/core_names.h>
19 #include "crypto/evp.h"
20 #include "evp_local.h"
22 int pkcs5_pbkdf2_hmac_ex(const char *pass
, int passlen
,
23 const unsigned char *salt
, int saltlen
, int iter
,
24 const EVP_MD
*digest
, int keylen
, unsigned char *out
,
25 OSSL_LIB_CTX
*libctx
, const char *propq
)
27 const char *empty
= "";
31 const char *mdname
= EVP_MD_name(digest
);
32 OSSL_PARAM params
[6], *p
= params
;
34 /* Keep documented behaviour. */
38 } else if (passlen
== -1) {
39 passlen
= strlen(pass
);
41 if (salt
== NULL
&& saltlen
== 0)
42 salt
= (unsigned char *)empty
;
44 kdf
= EVP_KDF_fetch(libctx
, OSSL_KDF_NAME_PBKDF2
, propq
);
45 kctx
= EVP_KDF_CTX_new(kdf
);
49 *p
++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD
,
50 (char *)pass
, (size_t)passlen
);
51 *p
++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5
, &mode
);
52 *p
++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT
,
53 (unsigned char *)salt
, saltlen
);
54 *p
++ = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_ITER
, &iter
);
55 *p
++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST
,
57 *p
= OSSL_PARAM_construct_end();
58 if (EVP_KDF_derive(kctx
, out
, keylen
, params
) != 1)
61 EVP_KDF_CTX_free(kctx
);
63 OSSL_TRACE_BEGIN(PKCS5V2
) {
64 BIO_printf(trc_out
, "Password:\n");
65 BIO_hex_string(trc_out
,
66 0, passlen
, pass
, passlen
);
67 BIO_printf(trc_out
, "\n");
68 BIO_printf(trc_out
, "Salt:\n");
69 BIO_hex_string(trc_out
,
70 0, saltlen
, salt
, saltlen
);
71 BIO_printf(trc_out
, "\n");
72 BIO_printf(trc_out
, "Iteration count %d\n", iter
);
73 BIO_printf(trc_out
, "Key:\n");
74 BIO_hex_string(trc_out
,
75 0, keylen
, out
, keylen
);
76 BIO_printf(trc_out
, "\n");
77 } OSSL_TRACE_END(PKCS5V2
);
81 int PKCS5_PBKDF2_HMAC(const char *pass
, int passlen
, const unsigned char *salt
,
82 int saltlen
, int iter
, const EVP_MD
*digest
, int keylen
,
85 return pkcs5_pbkdf2_hmac_ex(pass
, passlen
, salt
, saltlen
, iter
, digest
,
86 keylen
, out
, NULL
, NULL
);
90 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass
, int passlen
,
91 const unsigned char *salt
, int saltlen
, int iter
,
92 int keylen
, unsigned char *out
)
94 return PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, EVP_sha1(),
99 * Now the key derivation function itself. This is a bit evil because it has
100 * to check the ASN1 parameters are valid: and there are quite a few of
104 int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
, int passlen
,
105 ASN1_TYPE
*param
, const EVP_CIPHER
*c
,
106 const EVP_MD
*md
, int en_de
)
108 PBE2PARAM
*pbe2
= NULL
;
109 const EVP_CIPHER
*cipher
;
114 pbe2
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBE2PARAM
), param
);
116 ERR_raise(ERR_LIB_EVP
, EVP_R_DECODE_ERROR
);
120 /* See if we recognise the key derivation function */
121 if (!EVP_PBE_find(EVP_PBE_TYPE_KDF
, OBJ_obj2nid(pbe2
->keyfunc
->algorithm
),
123 ERR_raise(ERR_LIB_EVP
, EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION
);
128 * lets see if we recognise the encryption algorithm.
131 cipher
= EVP_get_cipherbyobj(pbe2
->encryption
->algorithm
);
134 ERR_raise(ERR_LIB_EVP
, EVP_R_UNSUPPORTED_CIPHER
);
138 /* Fixup cipher based on AlgorithmIdentifier */
139 if (!EVP_CipherInit_ex(ctx
, cipher
, NULL
, NULL
, NULL
, en_de
))
141 if (EVP_CIPHER_asn1_to_param(ctx
, pbe2
->encryption
->parameter
) < 0) {
142 ERR_raise(ERR_LIB_EVP
, EVP_R_CIPHER_PARAMETER_ERROR
);
145 rv
= kdf(ctx
, pass
, passlen
, pbe2
->keyfunc
->parameter
, NULL
, NULL
, en_de
);
147 PBE2PARAM_free(pbe2
);
151 int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
,
152 int passlen
, ASN1_TYPE
*param
,
153 const EVP_CIPHER
*c
, const EVP_MD
*md
, int en_de
)
155 unsigned char *salt
, key
[EVP_MAX_KEY_LENGTH
];
156 int saltlen
, iter
, t
;
158 unsigned int keylen
= 0;
159 int prf_nid
, hmac_md_nid
;
160 PBKDF2PARAM
*kdf
= NULL
;
163 if (EVP_CIPHER_CTX_cipher(ctx
) == NULL
) {
164 ERR_raise(ERR_LIB_EVP
, EVP_R_NO_CIPHER_SET
);
167 keylen
= EVP_CIPHER_CTX_key_length(ctx
);
168 OPENSSL_assert(keylen
<= sizeof(key
));
170 /* Decode parameter */
172 kdf
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM
), param
);
175 ERR_raise(ERR_LIB_EVP
, EVP_R_DECODE_ERROR
);
179 t
= EVP_CIPHER_CTX_key_length(ctx
);
181 ERR_raise(ERR_LIB_EVP
, EVP_R_INVALID_KEY_LENGTH
);
186 /* Now check the parameters of the kdf */
188 if (kdf
->keylength
&& (ASN1_INTEGER_get(kdf
->keylength
) != (int)keylen
)) {
189 ERR_raise(ERR_LIB_EVP
, EVP_R_UNSUPPORTED_KEYLENGTH
);
194 prf_nid
= OBJ_obj2nid(kdf
->prf
->algorithm
);
196 prf_nid
= NID_hmacWithSHA1
;
198 if (!EVP_PBE_find(EVP_PBE_TYPE_PRF
, prf_nid
, NULL
, &hmac_md_nid
, 0)) {
199 ERR_raise(ERR_LIB_EVP
, EVP_R_UNSUPPORTED_PRF
);
203 prfmd
= EVP_get_digestbynid(hmac_md_nid
);
205 ERR_raise(ERR_LIB_EVP
, EVP_R_UNSUPPORTED_PRF
);
209 if (kdf
->salt
->type
!= V_ASN1_OCTET_STRING
) {
210 ERR_raise(ERR_LIB_EVP
, EVP_R_UNSUPPORTED_SALT_TYPE
);
214 /* it seems that its all OK */
215 salt
= kdf
->salt
->value
.octet_string
->data
;
216 saltlen
= kdf
->salt
->value
.octet_string
->length
;
217 iter
= ASN1_INTEGER_get(kdf
->iter
);
218 if (!PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, prfmd
,
221 rv
= EVP_CipherInit_ex(ctx
, NULL
, NULL
, key
, NULL
, en_de
);
223 OPENSSL_cleanse(key
, keylen
);
224 PBKDF2PARAM_free(kdf
);