2 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include <openssl/hmac.h>
13 #include <openssl/kdf.h>
14 #include <openssl/evp.h>
15 #include "internal/cryptlib.h"
16 #include "internal/evp_int.h"
18 #define HKDF_MAXBUF 1024
20 static unsigned char *HKDF(const EVP_MD
*evp_md
,
21 const unsigned char *salt
, size_t salt_len
,
22 const unsigned char *key
, size_t key_len
,
23 const unsigned char *info
, size_t info_len
,
24 unsigned char *okm
, size_t okm_len
);
26 static unsigned char *HKDF_Extract(const EVP_MD
*evp_md
,
27 const unsigned char *salt
, size_t salt_len
,
28 const unsigned char *key
, size_t key_len
,
29 unsigned char *prk
, size_t *prk_len
);
31 static unsigned char *HKDF_Expand(const EVP_MD
*evp_md
,
32 const unsigned char *prk
, size_t prk_len
,
33 const unsigned char *info
, size_t info_len
,
34 unsigned char *okm
, size_t okm_len
);
42 unsigned char info
[HKDF_MAXBUF
];
46 static int pkey_hkdf_init(EVP_PKEY_CTX
*ctx
)
50 kctx
= OPENSSL_zalloc(sizeof(*kctx
));
59 static void pkey_hkdf_cleanup(EVP_PKEY_CTX
*ctx
)
61 HKDF_PKEY_CTX
*kctx
= ctx
->data
;
62 OPENSSL_clear_free(kctx
->salt
, kctx
->salt_len
);
63 OPENSSL_clear_free(kctx
->key
, kctx
->key_len
);
64 OPENSSL_cleanse(kctx
->info
, kctx
->info_len
);
68 static int pkey_hkdf_ctrl(EVP_PKEY_CTX
*ctx
, int type
, int p1
, void *p2
)
70 HKDF_PKEY_CTX
*kctx
= ctx
->data
;
73 case EVP_PKEY_CTRL_HKDF_MD
:
80 case EVP_PKEY_CTRL_HKDF_SALT
:
81 if (p1
== 0 || p2
== NULL
)
87 if (kctx
->salt
!= NULL
)
88 OPENSSL_clear_free(kctx
->salt
, kctx
->salt_len
);
90 kctx
->salt
= OPENSSL_memdup(p2
, p1
);
91 if (kctx
->salt
== NULL
)
97 case EVP_PKEY_CTRL_HKDF_KEY
:
101 if (kctx
->key
!= NULL
)
102 OPENSSL_clear_free(kctx
->key
, kctx
->key_len
);
104 kctx
->key
= OPENSSL_memdup(p2
, p1
);
105 if (kctx
->key
== NULL
)
111 case EVP_PKEY_CTRL_HKDF_INFO
:
112 if (p1
== 0 || p2
== NULL
)
115 if (p1
< 0 || p1
> (int)(HKDF_MAXBUF
- kctx
->info_len
))
118 memcpy(kctx
->info
+ kctx
->info_len
, p2
, p1
);
119 kctx
->info_len
+= p1
;
128 static int pkey_hkdf_ctrl_str(EVP_PKEY_CTX
*ctx
, const char *type
,
131 if (strcmp(type
, "md") == 0)
132 return EVP_PKEY_CTX_set_hkdf_md(ctx
, EVP_get_digestbyname(value
));
134 if (strcmp(type
, "salt") == 0)
135 return EVP_PKEY_CTX_str2ctrl(ctx
, EVP_PKEY_CTRL_HKDF_SALT
, value
);
137 if (strcmp(type
, "hexsalt") == 0)
138 return EVP_PKEY_CTX_hex2ctrl(ctx
, EVP_PKEY_CTRL_HKDF_SALT
, value
);
140 if (strcmp(type
, "key") == 0)
141 return EVP_PKEY_CTX_str2ctrl(ctx
, EVP_PKEY_CTRL_HKDF_KEY
, value
);
143 if (strcmp(type
, "hexkey") == 0)
144 return EVP_PKEY_CTX_hex2ctrl(ctx
, EVP_PKEY_CTRL_HKDF_KEY
, value
);
146 if (strcmp(type
, "info") == 0)
147 return EVP_PKEY_CTX_str2ctrl(ctx
, EVP_PKEY_CTRL_HKDF_INFO
, value
);
149 if (strcmp(type
, "hexinfo") == 0)
150 return EVP_PKEY_CTX_hex2ctrl(ctx
, EVP_PKEY_CTRL_HKDF_INFO
, value
);
155 static int pkey_hkdf_derive(EVP_PKEY_CTX
*ctx
, unsigned char *key
,
158 HKDF_PKEY_CTX
*kctx
= ctx
->data
;
160 if (kctx
->md
== NULL
|| kctx
->key
== NULL
)
163 if (HKDF(kctx
->md
, kctx
->salt
, kctx
->salt_len
, kctx
->key
, kctx
->key_len
,
164 kctx
->info
, kctx
->info_len
, key
, *keylen
) == NULL
)
172 const EVP_PKEY_METHOD hkdf_pkey_meth
= {
202 static unsigned char *HKDF(const EVP_MD
*evp_md
,
203 const unsigned char *salt
, size_t salt_len
,
204 const unsigned char *key
, size_t key_len
,
205 const unsigned char *info
, size_t info_len
,
206 unsigned char *okm
, size_t okm_len
)
208 unsigned char prk
[EVP_MAX_MD_SIZE
];
211 if (!HKDF_Extract(evp_md
, salt
, salt_len
, key
, key_len
, prk
, &prk_len
))
214 return HKDF_Expand(evp_md
, prk
, prk_len
, info
, info_len
, okm
, okm_len
);
217 static unsigned char *HKDF_Extract(const EVP_MD
*evp_md
,
218 const unsigned char *salt
, size_t salt_len
,
219 const unsigned char *key
, size_t key_len
,
220 unsigned char *prk
, size_t *prk_len
)
222 unsigned int tmp_len
;
224 if (!HMAC(evp_md
, salt
, salt_len
, key
, key_len
, prk
, &tmp_len
))
231 static unsigned char *HKDF_Expand(const EVP_MD
*evp_md
,
232 const unsigned char *prk
, size_t prk_len
,
233 const unsigned char *info
, size_t info_len
,
234 unsigned char *okm
, size_t okm_len
)
240 unsigned char prev
[EVP_MAX_MD_SIZE
];
242 size_t done_len
= 0, dig_len
= EVP_MD_size(evp_md
);
244 size_t n
= okm_len
/ dig_len
;
245 if (okm_len
% dig_len
)
251 if ((hmac
= HMAC_CTX_new()) == NULL
)
254 if (!HMAC_Init_ex(hmac
, prk
, prk_len
, evp_md
, NULL
))
257 for (i
= 1; i
<= n
; i
++) {
259 const unsigned char ctr
= i
;
262 if (!HMAC_Init_ex(hmac
, NULL
, 0, NULL
, NULL
))
265 if (!HMAC_Update(hmac
, prev
, dig_len
))
269 if (!HMAC_Update(hmac
, info
, info_len
))
272 if (!HMAC_Update(hmac
, &ctr
, 1))
275 if (!HMAC_Final(hmac
, prev
, NULL
))
278 copy_len
= (done_len
+ dig_len
> okm_len
) ?
282 memcpy(okm
+ done_len
, prev
, copy_len
);
284 done_len
+= copy_len
;