pkcs5.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426
  1. /**
  2. * \file pkcs5.c
  3. *
  4. * \brief PKCS#5 functions
  5. *
  6. * \author Mathias Olsson <mathias@kompetensum.com>
  7. *
  8. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  9. * SPDX-License-Identifier: Apache-2.0
  10. *
  11. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  12. * not use this file except in compliance with the License.
  13. * You may obtain a copy of the License at
  14. *
  15. * http://www.apache.org/licenses/LICENSE-2.0
  16. *
  17. * Unless required by applicable law or agreed to in writing, software
  18. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  19. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20. * See the License for the specific language governing permissions and
  21. * limitations under the License.
  22. *
  23. * This file is part of mbed TLS (https://tls.mbed.org)
  24. */
  25. /*
  26. * PKCS#5 includes PBKDF2 and more
  27. *
  28. * http://tools.ietf.org/html/rfc2898 (Specification)
  29. * http://tools.ietf.org/html/rfc6070 (Test vectors)
  30. */
  31. #if !defined(MBEDTLS_CONFIG_FILE)
  32. #include "mbedtls/config.h"
  33. #else
  34. #include MBEDTLS_CONFIG_FILE
  35. #endif
  36. #if defined(MBEDTLS_PKCS5_C)
  37. #include "mbedtls/pkcs5.h"
  38. #if defined(MBEDTLS_ASN1_PARSE_C)
  39. #include "mbedtls/asn1.h"
  40. #include "mbedtls/cipher.h"
  41. #include "mbedtls/oid.h"
  42. #endif /* MBEDTLS_ASN1_PARSE_C */
  43. #include <string.h>
  44. #if defined(MBEDTLS_PLATFORM_C)
  45. #include "mbedtls/platform.h"
  46. #else
  47. #include <stdio.h>
  48. #define mbedtls_printf printf
  49. #endif
  50. #if !defined(MBEDTLS_ASN1_PARSE_C)
  51. int mbedtls_pkcs5_pbes2( const mbedtls_asn1_buf *pbe_params, int mode,
  52. const unsigned char *pwd, size_t pwdlen,
  53. const unsigned char *data, size_t datalen,
  54. unsigned char *output )
  55. {
  56. ((void) pbe_params);
  57. ((void) mode);
  58. ((void) pwd);
  59. ((void) pwdlen);
  60. ((void) data);
  61. ((void) datalen);
  62. ((void) output);
  63. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  64. }
  65. #else
  66. static int pkcs5_parse_pbkdf2_params( const mbedtls_asn1_buf *params,
  67. mbedtls_asn1_buf *salt, int *iterations,
  68. int *keylen, mbedtls_md_type_t *md_type )
  69. {
  70. int ret;
  71. mbedtls_asn1_buf prf_alg_oid;
  72. unsigned char *p = params->p;
  73. const unsigned char *end = params->p + params->len;
  74. if( params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
  75. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT +
  76. MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
  77. /*
  78. * PBKDF2-params ::= SEQUENCE {
  79. * salt OCTET STRING,
  80. * iterationCount INTEGER,
  81. * keyLength INTEGER OPTIONAL
  82. * prf AlgorithmIdentifier DEFAULT algid-hmacWithSHA1
  83. * }
  84. *
  85. */
  86. if( ( ret = mbedtls_asn1_get_tag( &p, end, &salt->len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
  87. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  88. salt->p = p;
  89. p += salt->len;
  90. if( ( ret = mbedtls_asn1_get_int( &p, end, iterations ) ) != 0 )
  91. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  92. if( p == end )
  93. return( 0 );
  94. if( ( ret = mbedtls_asn1_get_int( &p, end, keylen ) ) != 0 )
  95. {
  96. if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
  97. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  98. }
  99. if( p == end )
  100. return( 0 );
  101. if( ( ret = mbedtls_asn1_get_alg_null( &p, end, &prf_alg_oid ) ) != 0 )
  102. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  103. if( mbedtls_oid_get_md_hmac( &prf_alg_oid, md_type ) != 0 )
  104. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  105. if( p != end )
  106. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT +
  107. MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
  108. return( 0 );
  109. }
  110. int mbedtls_pkcs5_pbes2( const mbedtls_asn1_buf *pbe_params, int mode,
  111. const unsigned char *pwd, size_t pwdlen,
  112. const unsigned char *data, size_t datalen,
  113. unsigned char *output )
  114. {
  115. int ret, iterations = 0, keylen = 0;
  116. unsigned char *p, *end;
  117. mbedtls_asn1_buf kdf_alg_oid, enc_scheme_oid, kdf_alg_params, enc_scheme_params;
  118. mbedtls_asn1_buf salt;
  119. mbedtls_md_type_t md_type = MBEDTLS_MD_SHA1;
  120. unsigned char key[32], iv[32];
  121. size_t olen = 0;
  122. const mbedtls_md_info_t *md_info;
  123. const mbedtls_cipher_info_t *cipher_info;
  124. mbedtls_md_context_t md_ctx;
  125. mbedtls_cipher_type_t cipher_alg;
  126. mbedtls_cipher_context_t cipher_ctx;
  127. p = pbe_params->p;
  128. end = p + pbe_params->len;
  129. /*
  130. * PBES2-params ::= SEQUENCE {
  131. * keyDerivationFunc AlgorithmIdentifier {{PBES2-KDFs}},
  132. * encryptionScheme AlgorithmIdentifier {{PBES2-Encs}}
  133. * }
  134. */
  135. if( pbe_params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
  136. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT +
  137. MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
  138. if( ( ret = mbedtls_asn1_get_alg( &p, end, &kdf_alg_oid, &kdf_alg_params ) ) != 0 )
  139. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  140. // Only PBKDF2 supported at the moment
  141. //
  142. if( MBEDTLS_OID_CMP( MBEDTLS_OID_PKCS5_PBKDF2, &kdf_alg_oid ) != 0 )
  143. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  144. if( ( ret = pkcs5_parse_pbkdf2_params( &kdf_alg_params,
  145. &salt, &iterations, &keylen,
  146. &md_type ) ) != 0 )
  147. {
  148. return( ret );
  149. }
  150. md_info = mbedtls_md_info_from_type( md_type );
  151. if( md_info == NULL )
  152. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  153. if( ( ret = mbedtls_asn1_get_alg( &p, end, &enc_scheme_oid,
  154. &enc_scheme_params ) ) != 0 )
  155. {
  156. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT + ret );
  157. }
  158. if( mbedtls_oid_get_cipher_alg( &enc_scheme_oid, &cipher_alg ) != 0 )
  159. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  160. cipher_info = mbedtls_cipher_info_from_type( cipher_alg );
  161. if( cipher_info == NULL )
  162. return( MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE );
  163. /*
  164. * The value of keylen from pkcs5_parse_pbkdf2_params() is ignored
  165. * since it is optional and we don't know if it was set or not
  166. */
  167. keylen = cipher_info->key_bitlen / 8;
  168. if( enc_scheme_params.tag != MBEDTLS_ASN1_OCTET_STRING ||
  169. enc_scheme_params.len != cipher_info->iv_size )
  170. {
  171. return( MBEDTLS_ERR_PKCS5_INVALID_FORMAT );
  172. }
  173. mbedtls_md_init( &md_ctx );
  174. mbedtls_cipher_init( &cipher_ctx );
  175. memcpy( iv, enc_scheme_params.p, enc_scheme_params.len );
  176. if( ( ret = mbedtls_md_setup( &md_ctx, md_info, 1 ) ) != 0 )
  177. goto exit;
  178. if( ( ret = mbedtls_pkcs5_pbkdf2_hmac( &md_ctx, pwd, pwdlen, salt.p, salt.len,
  179. iterations, keylen, key ) ) != 0 )
  180. {
  181. goto exit;
  182. }
  183. if( ( ret = mbedtls_cipher_setup( &cipher_ctx, cipher_info ) ) != 0 )
  184. goto exit;
  185. if( ( ret = mbedtls_cipher_setkey( &cipher_ctx, key, 8 * keylen, (mbedtls_operation_t) mode ) ) != 0 )
  186. goto exit;
  187. if( ( ret = mbedtls_cipher_crypt( &cipher_ctx, iv, enc_scheme_params.len,
  188. data, datalen, output, &olen ) ) != 0 )
  189. ret = MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH;
  190. exit:
  191. mbedtls_md_free( &md_ctx );
  192. mbedtls_cipher_free( &cipher_ctx );
  193. return( ret );
  194. }
  195. #endif /* MBEDTLS_ASN1_PARSE_C */
  196. int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *password,
  197. size_t plen, const unsigned char *salt, size_t slen,
  198. unsigned int iteration_count,
  199. uint32_t key_length, unsigned char *output )
  200. {
  201. int ret, j;
  202. unsigned int i;
  203. unsigned char md1[MBEDTLS_MD_MAX_SIZE];
  204. unsigned char work[MBEDTLS_MD_MAX_SIZE];
  205. unsigned char md_size = mbedtls_md_get_size( ctx->md_info );
  206. size_t use_len;
  207. unsigned char *out_p = output;
  208. unsigned char counter[4];
  209. memset( counter, 0, 4 );
  210. counter[3] = 1;
  211. #if UINT_MAX > 0xFFFFFFFF
  212. if( iteration_count > 0xFFFFFFFF )
  213. return( MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA );
  214. #endif
  215. while( key_length )
  216. {
  217. // U1 ends up in work
  218. //
  219. if( ( ret = mbedtls_md_hmac_starts( ctx, password, plen ) ) != 0 )
  220. return( ret );
  221. if( ( ret = mbedtls_md_hmac_update( ctx, salt, slen ) ) != 0 )
  222. return( ret );
  223. if( ( ret = mbedtls_md_hmac_update( ctx, counter, 4 ) ) != 0 )
  224. return( ret );
  225. if( ( ret = mbedtls_md_hmac_finish( ctx, work ) ) != 0 )
  226. return( ret );
  227. memcpy( md1, work, md_size );
  228. for( i = 1; i < iteration_count; i++ )
  229. {
  230. // U2 ends up in md1
  231. //
  232. if( ( ret = mbedtls_md_hmac_starts( ctx, password, plen ) ) != 0 )
  233. return( ret );
  234. if( ( ret = mbedtls_md_hmac_update( ctx, md1, md_size ) ) != 0 )
  235. return( ret );
  236. if( ( ret = mbedtls_md_hmac_finish( ctx, md1 ) ) != 0 )
  237. return( ret );
  238. // U1 xor U2
  239. //
  240. for( j = 0; j < md_size; j++ )
  241. work[j] ^= md1[j];
  242. }
  243. use_len = ( key_length < md_size ) ? key_length : md_size;
  244. memcpy( out_p, work, use_len );
  245. key_length -= (uint32_t) use_len;
  246. out_p += use_len;
  247. for( i = 4; i > 0; i-- )
  248. if( ++counter[i - 1] != 0 )
  249. break;
  250. }
  251. return( 0 );
  252. }
  253. #if defined(MBEDTLS_SELF_TEST)
  254. #if !defined(MBEDTLS_SHA1_C)
  255. int mbedtls_pkcs5_self_test( int verbose )
  256. {
  257. if( verbose != 0 )
  258. mbedtls_printf( " PBKDF2 (SHA1): skipped\n\n" );
  259. return( 0 );
  260. }
  261. #else
  262. #define MAX_TESTS 6
  263. static const size_t plen[MAX_TESTS] =
  264. { 8, 8, 8, 24, 9 };
  265. static const unsigned char password[MAX_TESTS][32] =
  266. {
  267. "password",
  268. "password",
  269. "password",
  270. "passwordPASSWORDpassword",
  271. "pass\0word",
  272. };
  273. static const size_t slen[MAX_TESTS] =
  274. { 4, 4, 4, 36, 5 };
  275. static const unsigned char salt[MAX_TESTS][40] =
  276. {
  277. "salt",
  278. "salt",
  279. "salt",
  280. "saltSALTsaltSALTsaltSALTsaltSALTsalt",
  281. "sa\0lt",
  282. };
  283. static const uint32_t it_cnt[MAX_TESTS] =
  284. { 1, 2, 4096, 4096, 4096 };
  285. static const uint32_t key_len[MAX_TESTS] =
  286. { 20, 20, 20, 25, 16 };
  287. static const unsigned char result_key[MAX_TESTS][32] =
  288. {
  289. { 0x0c, 0x60, 0xc8, 0x0f, 0x96, 0x1f, 0x0e, 0x71,
  290. 0xf3, 0xa9, 0xb5, 0x24, 0xaf, 0x60, 0x12, 0x06,
  291. 0x2f, 0xe0, 0x37, 0xa6 },
  292. { 0xea, 0x6c, 0x01, 0x4d, 0xc7, 0x2d, 0x6f, 0x8c,
  293. 0xcd, 0x1e, 0xd9, 0x2a, 0xce, 0x1d, 0x41, 0xf0,
  294. 0xd8, 0xde, 0x89, 0x57 },
  295. { 0x4b, 0x00, 0x79, 0x01, 0xb7, 0x65, 0x48, 0x9a,
  296. 0xbe, 0xad, 0x49, 0xd9, 0x26, 0xf7, 0x21, 0xd0,
  297. 0x65, 0xa4, 0x29, 0xc1 },
  298. { 0x3d, 0x2e, 0xec, 0x4f, 0xe4, 0x1c, 0x84, 0x9b,
  299. 0x80, 0xc8, 0xd8, 0x36, 0x62, 0xc0, 0xe4, 0x4a,
  300. 0x8b, 0x29, 0x1a, 0x96, 0x4c, 0xf2, 0xf0, 0x70,
  301. 0x38 },
  302. { 0x56, 0xfa, 0x6a, 0xa7, 0x55, 0x48, 0x09, 0x9d,
  303. 0xcc, 0x37, 0xd7, 0xf0, 0x34, 0x25, 0xe0, 0xc3 },
  304. };
  305. int mbedtls_pkcs5_self_test( int verbose )
  306. {
  307. mbedtls_md_context_t sha1_ctx;
  308. const mbedtls_md_info_t *info_sha1;
  309. int ret, i;
  310. unsigned char key[64];
  311. mbedtls_md_init( &sha1_ctx );
  312. info_sha1 = mbedtls_md_info_from_type( MBEDTLS_MD_SHA1 );
  313. if( info_sha1 == NULL )
  314. {
  315. ret = 1;
  316. goto exit;
  317. }
  318. if( ( ret = mbedtls_md_setup( &sha1_ctx, info_sha1, 1 ) ) != 0 )
  319. {
  320. ret = 1;
  321. goto exit;
  322. }
  323. for( i = 0; i < MAX_TESTS; i++ )
  324. {
  325. if( verbose != 0 )
  326. mbedtls_printf( " PBKDF2 (SHA1) #%d: ", i );
  327. ret = mbedtls_pkcs5_pbkdf2_hmac( &sha1_ctx, password[i], plen[i], salt[i],
  328. slen[i], it_cnt[i], key_len[i], key );
  329. if( ret != 0 ||
  330. memcmp( result_key[i], key, key_len[i] ) != 0 )
  331. {
  332. if( verbose != 0 )
  333. mbedtls_printf( "failed\n" );
  334. ret = 1;
  335. goto exit;
  336. }
  337. if( verbose != 0 )
  338. mbedtls_printf( "passed\n" );
  339. }
  340. if( verbose != 0 )
  341. mbedtls_printf( "\n" );
  342. exit:
  343. mbedtls_md_free( &sha1_ctx );
  344. return( ret );
  345. }
  346. #endif /* MBEDTLS_SHA1_C */
  347. #endif /* MBEDTLS_SELF_TEST */
  348. #endif /* MBEDTLS_PKCS5_C */