1 /* $OpenBSD: pkcs5_pbkdf2.c,v 1.2 2024/09/20 02:00:46 jsg Exp $ */
2
3 /*-
4 * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 #include <sys/param.h>
20
21 #include <lib/libsa/stand.h>
22
23 #include "pkcs5_pbkdf2.h"
24 #include "hmac_sha1.h"
25
26 /*
27 * Password-Based Key Derivation Function 2 (PKCS #5 v2.0).
28 * Code based on IEEE Std 802.11-2007, Annex H.4.2.
29 */
30 int
pkcs5_pbkdf2(const char * pass,size_t pass_len,const char * salt,size_t salt_len,u_int8_t * key,size_t key_len,u_int rounds)31 pkcs5_pbkdf2(const char *pass, size_t pass_len, const char *salt,
32 size_t salt_len, u_int8_t *key, size_t key_len, u_int rounds)
33 {
34 u_int8_t *asalt, obuf[SHA1_DIGEST_LENGTH];
35 u_int8_t d1[SHA1_DIGEST_LENGTH], d2[SHA1_DIGEST_LENGTH];
36 u_int i, j;
37 u_int count;
38 size_t r;
39
40 if (rounds < 1 || key_len == 0)
41 return -1;
42 if (salt_len == 0 || salt_len > SIZE_MAX - 1)
43 return -1;
44 if ((asalt = alloc(salt_len + 4)) == NULL)
45 return -1;
46
47 memcpy(asalt, salt, salt_len);
48
49 for (count = 1; key_len > 0; count++) {
50 asalt[salt_len + 0] = (count >> 24) & 0xff;
51 asalt[salt_len + 1] = (count >> 16) & 0xff;
52 asalt[salt_len + 2] = (count >> 8) & 0xff;
53 asalt[salt_len + 3] = count & 0xff;
54 hmac_sha1(asalt, salt_len + 4, pass, pass_len, d1);
55 memcpy(obuf, d1, sizeof(obuf));
56
57 for (i = 1; i < rounds; i++) {
58 hmac_sha1(d1, sizeof(d1), pass, pass_len, d2);
59 memcpy(d1, d2, sizeof(d1));
60 for (j = 0; j < sizeof(obuf); j++)
61 obuf[j] ^= d1[j];
62 }
63
64 r = MIN(key_len, SHA1_DIGEST_LENGTH);
65 memcpy(key, obuf, r);
66 key += r;
67 key_len -= r;
68 }
69 explicit_bzero(asalt, salt_len + 4);
70 free(asalt, salt_len + 4);
71 explicit_bzero(d1, sizeof(d1));
72 explicit_bzero(d2, sizeof(d2));
73 explicit_bzero(obuf, sizeof(obuf));
74
75 return 0;
76 }
77