2 * Copyright 1999-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include "internal/cryptlib.h"
13 # include <openssl/x509.h>
14 # include <openssl/evp.h>
15 # include <openssl/hmac.h>
16 # include "evp_locl.h"
18 /* set this to print out info about the keygen algorithm */
19 /* #define OPENSSL_DEBUG_PKCS5V2 */
21 # ifdef OPENSSL_DEBUG_PKCS5V2
22 static void h__dump(const unsigned char *p
, int len
);
26 * This is an implementation of PKCS#5 v2.0 password based encryption key
27 * derivation function PBKDF2. SHA1 version verified against test vectors
28 * posted by Peter Gutmann to the PKCS-TNG mailing list.
31 int PKCS5_PBKDF2_HMAC(const char *pass
, int passlen
,
32 const unsigned char *salt
, int saltlen
, int iter
,
33 const EVP_MD
*digest
, int keylen
, unsigned char *out
)
35 const char *empty
= "";
36 unsigned char digtmp
[EVP_MAX_MD_SIZE
], *p
, itmp
[4];
37 int cplen
, j
, k
, tkeylen
, mdlen
;
39 HMAC_CTX
*hctx_tpl
= NULL
, *hctx
= NULL
;
41 mdlen
= EVP_MD_size(digest
);
45 hctx_tpl
= HMAC_CTX_new();
53 } else if (passlen
== -1) {
54 passlen
= strlen(pass
);
56 if (!HMAC_Init_ex(hctx_tpl
, pass
, passlen
, digest
, NULL
)) {
57 HMAC_CTX_free(hctx_tpl
);
60 hctx
= HMAC_CTX_new();
62 HMAC_CTX_free(hctx_tpl
);
71 * We are unlikely to ever use more than 256 blocks (5120 bits!) but
74 itmp
[0] = (unsigned char)((i
>> 24) & 0xff);
75 itmp
[1] = (unsigned char)((i
>> 16) & 0xff);
76 itmp
[2] = (unsigned char)((i
>> 8) & 0xff);
77 itmp
[3] = (unsigned char)(i
& 0xff);
78 if (!HMAC_CTX_copy(hctx
, hctx_tpl
)) {
80 HMAC_CTX_free(hctx_tpl
);
83 if (!HMAC_Update(hctx
, salt
, saltlen
)
84 || !HMAC_Update(hctx
, itmp
, 4)
85 || !HMAC_Final(hctx
, digtmp
, NULL
)) {
87 HMAC_CTX_free(hctx_tpl
);
90 memcpy(p
, digtmp
, cplen
);
91 for (j
= 1; j
< iter
; j
++) {
92 if (!HMAC_CTX_copy(hctx
, hctx_tpl
)) {
94 HMAC_CTX_free(hctx_tpl
);
97 if (!HMAC_Update(hctx
, digtmp
, mdlen
)
98 || !HMAC_Final(hctx
, digtmp
, NULL
)) {
100 HMAC_CTX_free(hctx_tpl
);
103 for (k
= 0; k
< cplen
; k
++)
111 HMAC_CTX_free(hctx_tpl
);
112 # ifdef OPENSSL_DEBUG_PKCS5V2
113 fprintf(stderr
, "Password:\n");
114 h__dump(pass
, passlen
);
115 fprintf(stderr
, "Salt:\n");
116 h__dump(salt
, saltlen
);
117 fprintf(stderr
, "Iteration count %d\n", iter
);
118 fprintf(stderr
, "Key:\n");
119 h__dump(out
, keylen
);
124 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass
, int passlen
,
125 const unsigned char *salt
, int saltlen
, int iter
,
126 int keylen
, unsigned char *out
)
128 return PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, EVP_sha1(),
133 * Now the key derivation function itself. This is a bit evil because it has
134 * to check the ASN1 parameters are valid: and there are quite a few of
138 int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
, int passlen
,
139 ASN1_TYPE
*param
, const EVP_CIPHER
*c
,
140 const EVP_MD
*md
, int en_de
)
142 PBE2PARAM
*pbe2
= NULL
;
143 const EVP_CIPHER
*cipher
;
148 pbe2
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBE2PARAM
), param
);
150 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_DECODE_ERROR
);
154 /* See if we recognise the key derivation function */
155 if (!EVP_PBE_find(EVP_PBE_TYPE_KDF
, OBJ_obj2nid(pbe2
->keyfunc
->algorithm
),
157 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
,
158 EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION
);
163 * lets see if we recognise the encryption algorithm.
166 cipher
= EVP_get_cipherbyobj(pbe2
->encryption
->algorithm
);
169 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_UNSUPPORTED_CIPHER
);
173 /* Fixup cipher based on AlgorithmIdentifier */
174 if (!EVP_CipherInit_ex(ctx
, cipher
, NULL
, NULL
, NULL
, en_de
))
176 if (EVP_CIPHER_asn1_to_param(ctx
, pbe2
->encryption
->parameter
) < 0) {
177 EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN
, EVP_R_CIPHER_PARAMETER_ERROR
);
180 rv
= kdf(ctx
, pass
, passlen
, pbe2
->keyfunc
->parameter
, NULL
, NULL
, en_de
);
182 PBE2PARAM_free(pbe2
);
186 int PKCS5_v2_PBKDF2_keyivgen(EVP_CIPHER_CTX
*ctx
, const char *pass
,
187 int passlen
, ASN1_TYPE
*param
,
188 const EVP_CIPHER
*c
, const EVP_MD
*md
, int en_de
)
190 unsigned char *salt
, key
[EVP_MAX_KEY_LENGTH
];
193 unsigned int keylen
= 0;
194 int prf_nid
, hmac_md_nid
;
195 PBKDF2PARAM
*kdf
= NULL
;
198 if (EVP_CIPHER_CTX_cipher(ctx
) == NULL
) {
199 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_NO_CIPHER_SET
);
202 keylen
= EVP_CIPHER_CTX_key_length(ctx
);
203 OPENSSL_assert(keylen
<= sizeof(key
));
205 /* Decode parameter */
207 kdf
= ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(PBKDF2PARAM
), param
);
210 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_DECODE_ERROR
);
214 keylen
= EVP_CIPHER_CTX_key_length(ctx
);
216 /* Now check the parameters of the kdf */
218 if (kdf
->keylength
&& (ASN1_INTEGER_get(kdf
->keylength
) != (int)keylen
)) {
219 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_KEYLENGTH
);
224 prf_nid
= OBJ_obj2nid(kdf
->prf
->algorithm
);
226 prf_nid
= NID_hmacWithSHA1
;
228 if (!EVP_PBE_find(EVP_PBE_TYPE_PRF
, prf_nid
, NULL
, &hmac_md_nid
, 0)) {
229 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_PRF
);
233 prfmd
= EVP_get_digestbynid(hmac_md_nid
);
235 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_PRF
);
239 if (kdf
->salt
->type
!= V_ASN1_OCTET_STRING
) {
240 EVPerr(EVP_F_PKCS5_V2_PBKDF2_KEYIVGEN
, EVP_R_UNSUPPORTED_SALT_TYPE
);
244 /* it seems that its all OK */
245 salt
= kdf
->salt
->value
.octet_string
->data
;
246 saltlen
= kdf
->salt
->value
.octet_string
->length
;
247 iter
= ASN1_INTEGER_get(kdf
->iter
);
248 if (!PKCS5_PBKDF2_HMAC(pass
, passlen
, salt
, saltlen
, iter
, prfmd
,
251 rv
= EVP_CipherInit_ex(ctx
, NULL
, NULL
, key
, NULL
, en_de
);
253 OPENSSL_cleanse(key
, keylen
);
254 PBKDF2PARAM_free(kdf
);
258 # ifdef OPENSSL_DEBUG_PKCS5V2
259 static void h__dump(const unsigned char *p
, int len
)
262 fprintf(stderr
, "%02X ", *p
);
263 fprintf(stderr
, "\n");