pkcs5.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406
  1. /**
  2. * \file pkcs5.c
  3. *
  4. * \brief PKCS#5 functions
  5. *
  6. * \author Mathias Olsson <mathias@kompetensum.com>
  7. *
  8. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  9. * SPDX-License-Identifier: Apache-2.0
  10. *
  11. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  12. * not use this file except in compliance with the License.
  13. * You may obtain a copy of the License at
  14. *
  15. * http://www.apache.org/licenses/LICENSE-2.0
  16. *
  17. * Unless required by applicable law or agreed to in writing, software
  18. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  19. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20. * See the License for the specific language governing permissions and
  21. * limitations under the License.
  22. *
  23. * This file is part of mbed TLS (https://tls.mbed.org)
  24. */
  25. /*
  26. * PKCS#5 includes PBKDF2 and more
  27. *
  28. * http://tools.ietf.org/html/rfc2898 (Specification)
  29. * http://tools.ietf.org/html/rfc6070 (Test vectors)
  30. */
  31. #if !defined(MBEDTLS_CONFIG_FILE)
  32. #include "mbedtls/config.h"
  33. #else
  34. #include MBEDTLS_CONFIG_FILE
  35. #endif
  36. #if defined(MBEDTLS_PKCS5_C)
  37. #include "mbedtls/pkcs5.h"
  38. #include "mbedtls/asn1.h"
  39. #include "mbedtls/cipher.h"
  40. #include "mbedtls/oid.h"
  41. #include <string.h>
  42. #if defined(MBEDTLS_PLATFORM_C)
  43. #include "mbedtls/platform.h"
  44. #else
  45. #include <stdio.h>
  46. #define mbedtls_printf printf
  47. #endif
  48. static int pkcs5_parse_pbkdf2_params( const mbedtls_asn1_buf *params,
  49. mbedtls_asn1_buf *salt, int *iterations,
  50. int *keylen, mbedtls_md_type_t *md_type )
  51. {
  52. int ret;
  53. mbedtls_asn1_buf prf_alg_oid;
  54. unsigned char *p = params->p;
  55. const unsigned char *end = params->p + params->len;
  56. if( params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
  57. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT +
  58. MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
  59. /*
  60. * PBKDF2-params ::= SEQUENCE {
  61. * salt OCTET STRING,
  62. * iterationCount INTEGER,
  63. * keyLength INTEGER OPTIONAL
  64. * prf AlgorithmIdentifier DEFAULT algid-hmacWithSHA1
  65. * }
  66. *
  67. */
  68. if( ( ret = mbedtls_asn1_get_tag( &p, end, &salt->len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
  69. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  70. salt->p = p;
  71. p += salt->len;
  72. if( ( ret = mbedtls_asn1_get_int( &p, end, iterations ) ) != 0 )
  73. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  74. if( p == end )
  75. return( 0 );
  76. if( ( ret = mbedtls_asn1_get_int( &p, end, keylen ) ) != 0 )
  77. {
  78. if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
  79. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  80. }
  81. if( p == end )
  82. return( 0 );
  83. if( ( ret = mbedtls_asn1_get_alg_null( &p, end, &prf_alg_oid ) ) != 0 )
  84. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  85. if( MBEDTLS_OID_CMP( MBEDTLS_OID_HMAC_SHA1, &prf_alg_oid ) != 0 )
  86. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  87. *md_type = MBEDTLS_MD_SHA1;
  88. if( p != end )
  89. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT +
  90. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  91. return( 0 );
  92. }
  93. int mbedtls_pkcs5_pbes2( const mbedtls_asn1_buf *pbe_params, int mode,
  94. const unsigned char *pwd, size_t pwdlen,
  95. const unsigned char *data, size_t datalen,
  96. unsigned char *output )
  97. {
  98. int ret, iterations = 0, keylen = 0;
  99. unsigned char *p, *end;
  100. mbedtls_asn1_buf kdf_alg_oid, enc_scheme_oid, kdf_alg_params, enc_scheme_params;
  101. mbedtls_asn1_buf salt;
  102. mbedtls_md_type_t md_type = MBEDTLS_MD_SHA1;
  103. unsigned char key[32], iv[32];
  104. size_t olen = 0;
  105. const mbedtls_md_info_t *md_info;
  106. const mbedtls_cipher_info_t *cipher_info;
  107. mbedtls_md_context_t md_ctx;
  108. mbedtls_cipher_type_t cipher_alg;
  109. mbedtls_cipher_context_t cipher_ctx;
  110. p = pbe_params->p;
  111. end = p + pbe_params->len;
  112. /*
  113. * PBES2-params ::= SEQUENCE {
  114. * keyDerivationFunc AlgorithmIdentifier {{PBES2-KDFs}},
  115. * encryptionScheme AlgorithmIdentifier {{PBES2-Encs}}
  116. * }
  117. */
  118. if( pbe_params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
  119. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT +
  120. MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
  121. if( ( ret = mbedtls_asn1_get_alg( &p, end, &kdf_alg_oid, &kdf_alg_params ) ) != 0 )
  122. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  123. // Only PBKDF2 supported at the moment
  124. //
  125. if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS5_PBKDF2, &kdf_alg_oid ) != 0 )
  126. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  127. if( ( ret = pkcs5_parse_pbkdf2_params( &kdf_alg_params,
  128. &salt, &iterations, &keylen,
  129. &md_type ) ) != 0 )
  130. {
  131. return( ret );
  132. }
  133. md_info = mbedtls_md_info_from_type( md_type );
  134. if( md_info == NULL )
  135. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  136. if( ( ret = mbedtls_asn1_get_alg( &p, end, &enc_scheme_oid,
  137. &enc_scheme_params ) ) != 0 )
  138. {
  139. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  140. }
  141. if( mbedtls_oid_get_cipher_alg( &enc_scheme_oid, &cipher_alg ) != 0 )
  142. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  143. cipher_info = mbedtls_cipher_info_from_type( cipher_alg );
  144. if( cipher_info == NULL )
  145. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  146. /*
  147. * The value of keylen from pkcs5_parse_pbkdf2_params() is ignored
  148. * since it is optional and we don't know if it was set or not
  149. */
  150. keylen = cipher_info->key_bitlen / 8;
  151. if( enc_scheme_params.tag != MBEDTLS_ASN1_OCTET_STRING ||
  152. enc_scheme_params.len != cipher_info->iv_size )
  153. {
  154. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT );
  155. }
  156. mbedtls_md_init( &md_ctx );
  157. mbedtls_cipher_init( &cipher_ctx );
  158. memcpy( iv, enc_scheme_params.p, enc_scheme_params.len );
  159. if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
  160. goto exit;
  161. if( ( ret = mbedtls_pkcs5_pbkdf2_hmac( &md_ctx, pwd, pwdlen, salt.p, salt.len,
  162. iterations, keylen, key ) ) != 0 )
  163. {
  164. goto exit;
  165. }
  166. if( ( ret = mbedtls_cipher_setup( &cipher_ctx, cipher_info ) ) != 0 )
  167. goto exit;
  168. if( ( ret = mbedtls_cipher_setkey( &cipher_ctx, key, 8 * keylen, (mbedtls_operation_t) mode ) ) != 0 )
  169. goto exit;
  170. if( ( ret = mbedtls_cipher_crypt( &cipher_ctx, iv, enc_scheme_params.len,
  171. data, datalen, output, &olen ) ) != 0 )
  172. ret = MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH;
  173. exit:
  174. mbedtls_md_free( &md_ctx );
  175. mbedtls_cipher_free( &cipher_ctx );
  176. return( ret );
  177. }
  178. int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *password,
  179. size_t plen, const unsigned char *salt, size_t slen,
  180. unsigned int iteration_count,
  181. uint32_t key_length, unsigned char *output )
  182. {
  183. int ret, j;
  184. unsigned int i;
  185. unsigned char md1[MBEDTLS_MD_MAX_SIZE];
  186. unsigned char work[MBEDTLS_MD_MAX_SIZE];
  187. unsigned char md_size = mbedtls_md_get_size( ctx->md_info );
  188. size_t use_len;
  189. unsigned char *out_p = output;
  190. unsigned char counter[4];
  191. memset( counter, 0, 4 );
  192. counter[3] = 1;
  193. if( iteration_count > 0xFFFFFFFF )
  194. return( MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA );
  195. while( key_length )
  196. {
  197. // U1 ends up in work
  198. //
  199. if( ( ret = mbedtls_md_hmac_starts( ctx, password, plen ) ) != 0 )
  200. return( ret );
  201. if( ( ret = mbedtls_md_hmac_update( ctx, salt, slen ) ) != 0 )
  202. return( ret );
  203. if( ( ret = mbedtls_md_hmac_update( ctx, counter, 4 ) ) != 0 )
  204. return( ret );
  205. if( ( ret = mbedtls_md_hmac_finish( ctx, work ) ) != 0 )
  206. return( ret );
  207. memcpy( md1, work, md_size );
  208. for( i = 1; i < iteration_count; i++ )
  209. {
  210. // U2 ends up in md1
  211. //
  212. if( ( ret = mbedtls_md_hmac_starts( ctx, password, plen ) ) != 0 )
  213. return( ret );
  214. if( ( ret = mbedtls_md_hmac_update( ctx, md1, md_size ) ) != 0 )
  215. return( ret );
  216. if( ( ret = mbedtls_md_hmac_finish( ctx, md1 ) ) != 0 )
  217. return( ret );
  218. // U1 xor U2
  219. //
  220. for( j = 0; j < md_size; j++ )
  221. work[j] ^= md1[j];
  222. }
  223. use_len = ( key_length < md_size ) ? key_length : md_size;
  224. memcpy( out_p, work, use_len );
  225. key_length -= (uint32_t) use_len;
  226. out_p += use_len;
  227. for( i = 4; i > 0; i-- )
  228. if( ++counter[i - 1] != 0 )
  229. break;
  230. }
  231. return( 0 );
  232. }
  233. #if defined(MBEDTLS_SELF_TEST)
  234. #if !defined(MBEDTLS_SHA1_C)
  235. int mbedtls_pkcs5_self_test( int verbose )
  236. {
  237. if( verbose != 0 )
  238. mbedtls_printf( " PBKDF2 (SHA1): skipped\n\n" );
  239. return( 0 );
  240. }
  241. #else
  242. #define MAX_TESTS 6
  243. static const size_t plen[MAX_TESTS] =
  244. { 8, 8, 8, 24, 9 };
  245. static const unsigned char password[MAX_TESTS][32] =
  246. {
  247. "password",
  248. "password",
  249. "password",
  250. "passwordPASSWORDpassword",
  251. "pass\0word",
  252. };
  253. static const size_t slen[MAX_TESTS] =
  254. { 4, 4, 4, 36, 5 };
  255. static const unsigned char salt[MAX_TESTS][40] =
  256. {
  257. "salt",
  258. "salt",
  259. "salt",
  260. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  261. "sa\0lt",
  262. };
  263. static const uint32_t it_cnt[MAX_TESTS] =
  264. { 1, 2, 4096, 4096, 4096 };
  265. static const uint32_t key_len[MAX_TESTS] =
  266. { 20, 20, 20, 25, 16 };
  267. static const unsigned char result_key[MAX_TESTS][32] =
  268. {
  269. { 0x0c, 0x60, 0xc8, 0x0f, 0x96, 0x1f, 0x0e, 0x71,
  270. 0xf3, 0xa9, 0xb5, 0x24, 0xaf, 0x60, 0x12, 0x06,
  271. 0x2f, 0xe0, 0x37, 0xa6 },
  272. { 0xea, 0x6c, 0x01, 0x4d, 0xc7, 0x2d, 0x6f, 0x8c,
  273. 0xcd, 0x1e, 0xd9, 0x2a, 0xce, 0x1d, 0x41, 0xf0,
  274. 0xd8, 0xde, 0x89, 0x57 },
  275. { 0x4b, 0x00, 0x79, 0x01, 0xb7, 0x65, 0x48, 0x9a,
  276. 0xbe, 0xad, 0x49, 0xd9, 0x26, 0xf7, 0x21, 0xd0,
  277. 0x65, 0xa4, 0x29, 0xc1 },
  278. { 0x3d, 0x2e, 0xec, 0x4f, 0xe4, 0x1c, 0x84, 0x9b,
  279. 0x80, 0xc8, 0xd8, 0x36, 0x62, 0xc0, 0xe4, 0x4a,
  280. 0x8b, 0x29, 0x1a, 0x96, 0x4c, 0xf2, 0xf0, 0x70,
  281. 0x38 },
  282. { 0x56, 0xfa, 0x6a, 0xa7, 0x55, 0x48, 0x09, 0x9d,
  283. 0xcc, 0x37, 0xd7, 0xf0, 0x34, 0x25, 0xe0, 0xc3 },
  284. };
  285. int mbedtls_pkcs5_self_test( int verbose )
  286. {
  287. mbedtls_md_context_t sha1_ctx;
  288. const mbedtls_md_info_t *info_sha1;
  289. int ret, i;
  290. unsigned char key[64];
  291. mbedtls_md_init( &sha1_ctx );
  292. info_sha1 = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 );
  293. if( info_sha1 == NULL )
  294. {
  295. ret = 1;
  296. goto exit;
  297. }
  298. if( ( ret = mbedtls_md_setup( &sha1_ctx, info_sha1, 1 ) ) != 0 )
  299. {
  300. ret = 1;
  301. goto exit;
  302. }
  303. for( i = 0; i < MAX_TESTS; i++ )
  304. {
  305. if( verbose != 0 )
  306. mbedtls_printf( " PBKDF2 (SHA1) #%d: ", i );
  307. ret = mbedtls_pkcs5_pbkdf2_hmac( &sha1_ctx, password[i], plen[i], salt[i],
  308. slen[i], it_cnt[i], key_len[i], key );
  309. if( ret != 0 ||
  310. memcmp( result_key[i], key, key_len[i] ) != 0 )
  311. {
  312. if( verbose != 0 )
  313. mbedtls_printf( "failed\n" );
  314. ret = 1;
  315. goto exit;
  316. }
  317. if( verbose != 0 )
  318. mbedtls_printf( "passed\n" );
  319. }
  320. if( verbose != 0 )
  321. mbedtls_printf( "\n" );
  322. exit:
  323. mbedtls_md_free( &sha1_ctx );
  324. return( ret );
  325. }
  326. #endif /* MBEDTLS_SHA1_C */
  327. #endif /* MBEDTLS_SELF_TEST */
  328. #endif /* MBEDTLS_PKCS5_C */