Xuyi Wang / wolfSSL

Important changes to repositories hosted on mbed.com

Mbed hosted mercurial repositories are deprecated and are due to be permanently deleted in July 2026.

To keep a copy of this software download the repository Zip archive or clone locally using Mercurial.

It is also possible to export all your personal repositories from the account settings page.

Dependents:   OS

wolfcrypt/src/pwdbased.c@16:048e5e270a58, 2019-11-19 (annotated)

Committer:
sPymbed
Date:
Tue Nov 19 14:32:16 2019 +0000
Revision:
16:048e5e270a58
Parent:
15:117db924cf7c 
working ssl

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 15:117db924cf7c 1 /* pwdbased.c
wolfSSL 15:117db924cf7c 2 *
wolfSSL 15:117db924cf7c 3 * Copyright (C) 2006-2017 wolfSSL Inc.
wolfSSL 15:117db924cf7c 4 *
wolfSSL 15:117db924cf7c 5 * This file is part of wolfSSL.
wolfSSL 15:117db924cf7c 6 *
wolfSSL 15:117db924cf7c 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 15:117db924cf7c 8 * it under the terms of the GNU General Public License as published by
wolfSSL 15:117db924cf7c 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 15:117db924cf7c 10 * (at your option) any later version.
wolfSSL 15:117db924cf7c 11 *
wolfSSL 15:117db924cf7c 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 15:117db924cf7c 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 15:117db924cf7c 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 15:117db924cf7c 15 * GNU General Public License for more details.
wolfSSL 15:117db924cf7c 16 *
wolfSSL 15:117db924cf7c 17 * You should have received a copy of the GNU General Public License
wolfSSL 15:117db924cf7c 18 * along with this program; if not, write to the Free Software
wolfSSL 15:117db924cf7c 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 15:117db924cf7c 20 */
wolfSSL 15:117db924cf7c 21
wolfSSL 15:117db924cf7c 22
wolfSSL 15:117db924cf7c 23 #ifdef HAVE_CONFIG_H
wolfSSL 15:117db924cf7c 24 #include <config.h>
wolfSSL 15:117db924cf7c 25 #endif
wolfSSL 15:117db924cf7c 26
wolfSSL 15:117db924cf7c 27 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 15:117db924cf7c 28
wolfSSL 15:117db924cf7c 29 #ifndef NO_PWDBASED
wolfSSL 15:117db924cf7c 30
wolfSSL 15:117db924cf7c 31 #include <wolfssl/wolfcrypt/pwdbased.h>
wolfSSL 15:117db924cf7c 32 #include <wolfssl/wolfcrypt/hmac.h>
wolfSSL 15:117db924cf7c 33 #include <wolfssl/wolfcrypt/hash.h>
wolfSSL 15:117db924cf7c 34 #include <wolfssl/wolfcrypt/integer.h>
wolfSSL 15:117db924cf7c 35 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 15:117db924cf7c 36
wolfSSL 15:117db924cf7c 37 #ifdef NO_INLINE
wolfSSL 15:117db924cf7c 38 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 15:117db924cf7c 39 #else
wolfSSL 15:117db924cf7c 40 #define WOLFSSL_MISC_INCLUDED
wolfSSL 15:117db924cf7c 41 #include <wolfcrypt/src/misc.c>
wolfSSL 15:117db924cf7c 42 #endif
wolfSSL 15:117db924cf7c 43
wolfSSL 15:117db924cf7c 44
wolfSSL 15:117db924cf7c 45 /* PKCS#5 v1.5 with non standard extension to optionally derive the extra data (IV) */
wolfSSL 15:117db924cf7c 46 int wc_PBKDF1_ex(byte* key, int keyLen, byte* iv, int ivLen,
wolfSSL 15:117db924cf7c 47 const byte* passwd, int passwdLen, const byte* salt, int saltLen,
wolfSSL 15:117db924cf7c 48 int iterations, int hashType, void* heap)
wolfSSL 15:117db924cf7c 49 {
wolfSSL 15:117db924cf7c 50 int err;
wolfSSL 15:117db924cf7c 51 int keyLeft, ivLeft, i;
wolfSSL 15:117db924cf7c 52 int digestLeft, store;
wolfSSL 15:117db924cf7c 53 int keyOutput = 0;
wolfSSL 15:117db924cf7c 54 int diestLen;
wolfSSL 15:117db924cf7c 55 byte digest[WC_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 56 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 57 wc_HashAlg* hash = NULL;
wolfSSL 15:117db924cf7c 58 #else
wolfSSL 15:117db924cf7c 59 wc_HashAlg hash[1];
wolfSSL 15:117db924cf7c 60 #endif
wolfSSL 15:117db924cf7c 61 enum wc_HashType hashT;
wolfSSL 15:117db924cf7c 62
wolfSSL 15:117db924cf7c 63 (void)heap;
wolfSSL 15:117db924cf7c 64
wolfSSL 15:117db924cf7c 65 if (key == NULL || keyLen < 0 || passwdLen < 0 || saltLen < 0 || ivLen < 0){
wolfSSL 15:117db924cf7c 66 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 67 }
wolfSSL 15:117db924cf7c 68
wolfSSL 15:117db924cf7c 69 if (iterations <= 0)
wolfSSL 15:117db924cf7c 70 iterations = 1;
wolfSSL 15:117db924cf7c 71
wolfSSL 15:117db924cf7c 72 hashT = wc_HashTypeConvert(hashType);
wolfSSL 15:117db924cf7c 73 err = wc_HashGetDigestSize(hashT);
wolfSSL 15:117db924cf7c 74 if (err < 0)
wolfSSL 15:117db924cf7c 75 return err;
wolfSSL 15:117db924cf7c 76 diestLen = err;
wolfSSL 15:117db924cf7c 77
wolfSSL 15:117db924cf7c 78 /* initialize hash */
wolfSSL 15:117db924cf7c 79 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 80 hash = (wc_HashAlg*)XMALLOC(sizeof(wc_HashAlg), heap,
wolfSSL 15:117db924cf7c 81 DYNAMIC_TYPE_HASHCTX);
wolfSSL 15:117db924cf7c 82 if (hash == NULL)
wolfSSL 15:117db924cf7c 83 return MEMORY_E;
wolfSSL 15:117db924cf7c 84 #endif
wolfSSL 15:117db924cf7c 85
wolfSSL 15:117db924cf7c 86 err = wc_HashInit(hash, hashT);
wolfSSL 15:117db924cf7c 87 if (err != 0) {
wolfSSL 15:117db924cf7c 88 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 89 XFREE(hash, heap, DYNAMIC_TYPE_HASHCTX);
wolfSSL 15:117db924cf7c 90 #endif
wolfSSL 15:117db924cf7c 91 return err;
wolfSSL 15:117db924cf7c 92 }
wolfSSL 15:117db924cf7c 93
wolfSSL 15:117db924cf7c 94 keyLeft = keyLen;
wolfSSL 15:117db924cf7c 95 ivLeft = ivLen;
wolfSSL 15:117db924cf7c 96 while (keyOutput < (keyLen + ivLen)) {
wolfSSL 15:117db924cf7c 97 digestLeft = diestLen;
wolfSSL 15:117db924cf7c 98 /* D_(i - 1) */
wolfSSL 15:117db924cf7c 99 if (keyOutput) { /* first time D_0 is empty */
wolfSSL 15:117db924cf7c 100 err = wc_HashUpdate(hash, hashT, digest, diestLen);
wolfSSL 15:117db924cf7c 101 if (err != 0) break;
wolfSSL 15:117db924cf7c 102 }
wolfSSL 15:117db924cf7c 103
wolfSSL 15:117db924cf7c 104 /* data */
wolfSSL 15:117db924cf7c 105 err = wc_HashUpdate(hash, hashT, passwd, passwdLen);
wolfSSL 15:117db924cf7c 106 if (err != 0) break;
wolfSSL 15:117db924cf7c 107
wolfSSL 15:117db924cf7c 108 /* salt */
wolfSSL 15:117db924cf7c 109 if (salt) {
wolfSSL 15:117db924cf7c 110 err = wc_HashUpdate(hash, hashT, salt, saltLen);
wolfSSL 15:117db924cf7c 111 if (err != 0) break;
wolfSSL 15:117db924cf7c 112 }
wolfSSL 15:117db924cf7c 113
wolfSSL 15:117db924cf7c 114 err = wc_HashFinal(hash, hashT, digest);
wolfSSL 15:117db924cf7c 115 if (err != 0) break;
wolfSSL 15:117db924cf7c 116
wolfSSL 15:117db924cf7c 117 /* count */
wolfSSL 15:117db924cf7c 118 for (i = 1; i < iterations; i++) {
wolfSSL 15:117db924cf7c 119 err = wc_HashUpdate(hash, hashT, digest, diestLen);
wolfSSL 15:117db924cf7c 120 if (err != 0) break;
wolfSSL 15:117db924cf7c 121
wolfSSL 15:117db924cf7c 122 err = wc_HashFinal(hash, hashT, digest);
wolfSSL 15:117db924cf7c 123 if (err != 0) break;
wolfSSL 15:117db924cf7c 124 }
wolfSSL 15:117db924cf7c 125
wolfSSL 15:117db924cf7c 126 if (keyLeft) {
wolfSSL 15:117db924cf7c 127 store = min(keyLeft, diestLen);
wolfSSL 15:117db924cf7c 128 XMEMCPY(&key[keyLen - keyLeft], digest, store);
wolfSSL 15:117db924cf7c 129
wolfSSL 15:117db924cf7c 130 keyOutput += store;
wolfSSL 15:117db924cf7c 131 keyLeft -= store;
wolfSSL 15:117db924cf7c 132 digestLeft -= store;
wolfSSL 15:117db924cf7c 133 }
wolfSSL 15:117db924cf7c 134
wolfSSL 15:117db924cf7c 135 if (ivLeft && digestLeft) {
wolfSSL 15:117db924cf7c 136 store = min(ivLeft, digestLeft);
wolfSSL 15:117db924cf7c 137 if (iv != NULL)
wolfSSL 15:117db924cf7c 138 XMEMCPY(&iv[ivLen - ivLeft],
wolfSSL 15:117db924cf7c 139 &digest[diestLen - digestLeft], store);
wolfSSL 15:117db924cf7c 140 keyOutput += store;
wolfSSL 15:117db924cf7c 141 ivLeft -= store;
wolfSSL 15:117db924cf7c 142 }
wolfSSL 15:117db924cf7c 143 }
wolfSSL 15:117db924cf7c 144
wolfSSL 15:117db924cf7c 145 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 146 XFREE(hash, heap, DYNAMIC_TYPE_HASHCTX);
wolfSSL 15:117db924cf7c 147 #endif
wolfSSL 15:117db924cf7c 148
wolfSSL 15:117db924cf7c 149 if (err != 0)
wolfSSL 15:117db924cf7c 150 return err;
wolfSSL 15:117db924cf7c 151
wolfSSL 15:117db924cf7c 152 if (keyOutput != (keyLen + ivLen))
wolfSSL 15:117db924cf7c 153 return BUFFER_E;
wolfSSL 15:117db924cf7c 154
wolfSSL 15:117db924cf7c 155 return err;
wolfSSL 15:117db924cf7c 156 }
wolfSSL 15:117db924cf7c 157
wolfSSL 15:117db924cf7c 158 /* PKCS#5 v1.5 */
wolfSSL 15:117db924cf7c 159 int wc_PBKDF1(byte* output, const byte* passwd, int pLen, const byte* salt,
wolfSSL 15:117db924cf7c 160 int sLen, int iterations, int kLen, int hashType)
wolfSSL 15:117db924cf7c 161 {
wolfSSL 15:117db924cf7c 162 return wc_PBKDF1_ex(output, kLen, NULL, 0,
wolfSSL 15:117db924cf7c 163 passwd, pLen, salt, sLen, iterations, hashType, NULL);
wolfSSL 15:117db924cf7c 164 }
wolfSSL 15:117db924cf7c 165
wolfSSL 15:117db924cf7c 166
wolfSSL 15:117db924cf7c 167 int wc_PBKDF2(byte* output, const byte* passwd, int pLen, const byte* salt,
wolfSSL 15:117db924cf7c 168 int sLen, int iterations, int kLen, int hashType)
wolfSSL 15:117db924cf7c 169 {
wolfSSL 15:117db924cf7c 170 word32 i = 1;
wolfSSL 15:117db924cf7c 171 int hLen;
wolfSSL 15:117db924cf7c 172 int j, ret;
wolfSSL 15:117db924cf7c 173 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 174 byte* buffer;
wolfSSL 15:117db924cf7c 175 Hmac* hmac;
wolfSSL 15:117db924cf7c 176 #else
wolfSSL 15:117db924cf7c 177 byte buffer[WC_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 178 Hmac hmac[1];
wolfSSL 15:117db924cf7c 179 #endif
wolfSSL 15:117db924cf7c 180 enum wc_HashType hashT;
wolfSSL 15:117db924cf7c 181
wolfSSL 15:117db924cf7c 182 if (output == NULL || pLen < 0 || sLen < 0 || kLen < 0) {
wolfSSL 15:117db924cf7c 183 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 184 }
wolfSSL 15:117db924cf7c 185
wolfSSL 15:117db924cf7c 186 if (iterations <= 0)
wolfSSL 15:117db924cf7c 187 iterations = 1;
wolfSSL 15:117db924cf7c 188
wolfSSL 15:117db924cf7c 189 hashT = wc_HashTypeConvert(hashType);
wolfSSL 15:117db924cf7c 190 hLen = wc_HashGetDigestSize(hashT);
wolfSSL 15:117db924cf7c 191 if (hLen < 0)
wolfSSL 15:117db924cf7c 192 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 193
wolfSSL 15:117db924cf7c 194 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 195 buffer = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 196 if (buffer == NULL)
wolfSSL 15:117db924cf7c 197 return MEMORY_E;
wolfSSL 15:117db924cf7c 198 hmac = (Hmac*)XMALLOC(sizeof(Hmac), NULL, DYNAMIC_TYPE_HMAC);
wolfSSL 15:117db924cf7c 199 if (buffer == NULL)
wolfSSL 15:117db924cf7c 200 return MEMORY_E;
wolfSSL 15:117db924cf7c 201 #endif
wolfSSL 15:117db924cf7c 202
wolfSSL 15:117db924cf7c 203 ret = wc_HmacInit(hmac, NULL, INVALID_DEVID);
wolfSSL 15:117db924cf7c 204 if (ret == 0) {
wolfSSL 15:117db924cf7c 205 /* use int hashType here, since HMAC FIPS uses the old unique value */
wolfSSL 15:117db924cf7c 206 ret = wc_HmacSetKey(hmac, hashType, passwd, pLen);
wolfSSL 15:117db924cf7c 207
wolfSSL 15:117db924cf7c 208 while (ret == 0 && kLen) {
wolfSSL 15:117db924cf7c 209 int currentLen;
wolfSSL 15:117db924cf7c 210
wolfSSL 15:117db924cf7c 211 ret = wc_HmacUpdate(hmac, salt, sLen);
wolfSSL 15:117db924cf7c 212 if (ret != 0)
wolfSSL 15:117db924cf7c 213 break;
wolfSSL 15:117db924cf7c 214
wolfSSL 15:117db924cf7c 215 /* encode i */
wolfSSL 15:117db924cf7c 216 for (j = 0; j < 4; j++) {
wolfSSL 15:117db924cf7c 217 byte b = (byte)(i >> ((3-j) * 8));
wolfSSL 15:117db924cf7c 218
wolfSSL 15:117db924cf7c 219 ret = wc_HmacUpdate(hmac, &b, 1);
wolfSSL 15:117db924cf7c 220 if (ret != 0)
wolfSSL 15:117db924cf7c 221 break;
wolfSSL 15:117db924cf7c 222 }
wolfSSL 15:117db924cf7c 223
wolfSSL 15:117db924cf7c 224 /* check ret from inside for loop */
wolfSSL 15:117db924cf7c 225 if (ret != 0)
wolfSSL 15:117db924cf7c 226 break;
wolfSSL 15:117db924cf7c 227
wolfSSL 15:117db924cf7c 228 ret = wc_HmacFinal(hmac, buffer);
wolfSSL 15:117db924cf7c 229 if (ret != 0)
wolfSSL 15:117db924cf7c 230 break;
wolfSSL 15:117db924cf7c 231
wolfSSL 15:117db924cf7c 232 currentLen = min(kLen, hLen);
wolfSSL 15:117db924cf7c 233 XMEMCPY(output, buffer, currentLen);
wolfSSL 15:117db924cf7c 234
wolfSSL 15:117db924cf7c 235 for (j = 1; j < iterations; j++) {
wolfSSL 15:117db924cf7c 236 ret = wc_HmacUpdate(hmac, buffer, hLen);
wolfSSL 15:117db924cf7c 237 if (ret != 0)
wolfSSL 15:117db924cf7c 238 break;
wolfSSL 15:117db924cf7c 239 ret = wc_HmacFinal(hmac, buffer);
wolfSSL 15:117db924cf7c 240 if (ret != 0)
wolfSSL 15:117db924cf7c 241 break;
wolfSSL 15:117db924cf7c 242 xorbuf(output, buffer, currentLen);
wolfSSL 15:117db924cf7c 243 }
wolfSSL 15:117db924cf7c 244
wolfSSL 15:117db924cf7c 245 /* check ret from inside for loop */
wolfSSL 15:117db924cf7c 246 if (ret != 0)
wolfSSL 15:117db924cf7c 247 break;
wolfSSL 15:117db924cf7c 248
wolfSSL 15:117db924cf7c 249 output += currentLen;
wolfSSL 15:117db924cf7c 250 kLen -= currentLen;
wolfSSL 15:117db924cf7c 251 i++;
wolfSSL 15:117db924cf7c 252 }
wolfSSL 15:117db924cf7c 253 wc_HmacFree(hmac);
wolfSSL 15:117db924cf7c 254 }
wolfSSL 15:117db924cf7c 255
wolfSSL 15:117db924cf7c 256 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 257 XFREE(buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 258 XFREE(hmac, NULL, DYNAMIC_TYPE_HMAC);
wolfSSL 15:117db924cf7c 259 #endif
wolfSSL 15:117db924cf7c 260
wolfSSL 15:117db924cf7c 261 return ret;
wolfSSL 15:117db924cf7c 262 }
wolfSSL 15:117db924cf7c 263
wolfSSL 15:117db924cf7c 264 /* helper for PKCS12_PBKDF(), does hash operation */
wolfSSL 15:117db924cf7c 265 static int DoPKCS12Hash(int hashType, byte* buffer, word32 totalLen,
wolfSSL 15:117db924cf7c 266 byte* Ai, word32 u, int iterations)
wolfSSL 15:117db924cf7c 267 {
wolfSSL 15:117db924cf7c 268 int i;
wolfSSL 15:117db924cf7c 269 int ret = 0;
wolfSSL 15:117db924cf7c 270 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 271 wc_HashAlg* hash = NULL;
wolfSSL 15:117db924cf7c 272 #else
wolfSSL 15:117db924cf7c 273 wc_HashAlg hash[1];
wolfSSL 15:117db924cf7c 274 #endif
wolfSSL 15:117db924cf7c 275 enum wc_HashType hashT;
wolfSSL 15:117db924cf7c 276
wolfSSL 15:117db924cf7c 277 if (buffer == NULL || Ai == NULL) {
wolfSSL 15:117db924cf7c 278 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 279 }
wolfSSL 15:117db924cf7c 280
wolfSSL 15:117db924cf7c 281 hashT = wc_HashTypeConvert(hashType);
wolfSSL 15:117db924cf7c 282
wolfSSL 15:117db924cf7c 283 /* initialize hash */
wolfSSL 15:117db924cf7c 284 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 285 hash = (wc_HashAlg*)XMALLOC(sizeof(wc_HashAlg), NULL,
wolfSSL 15:117db924cf7c 286 DYNAMIC_TYPE_HASHCTX);
wolfSSL 15:117db924cf7c 287 if (hash == NULL)
wolfSSL 15:117db924cf7c 288 return MEMORY_E;
wolfSSL 15:117db924cf7c 289 #endif
wolfSSL 15:117db924cf7c 290
wolfSSL 15:117db924cf7c 291 ret = wc_HashInit(hash, hashT);
wolfSSL 15:117db924cf7c 292 if (ret != 0) {
wolfSSL 15:117db924cf7c 293 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 294 XFREE(hash, NULL, DYNAMIC_TYPE_HASHCTX);
wolfSSL 15:117db924cf7c 295 #endif
wolfSSL 15:117db924cf7c 296 return ret;
wolfSSL 15:117db924cf7c 297 }
wolfSSL 15:117db924cf7c 298
wolfSSL 15:117db924cf7c 299 ret = wc_HashUpdate(hash, hashT, buffer, totalLen);
wolfSSL 15:117db924cf7c 300
wolfSSL 15:117db924cf7c 301 if (ret == 0)
wolfSSL 15:117db924cf7c 302 ret = wc_HashFinal(hash, hashT, Ai);
wolfSSL 15:117db924cf7c 303
wolfSSL 15:117db924cf7c 304 for (i = 1; i < iterations; i++) {
wolfSSL 15:117db924cf7c 305 if (ret == 0)
wolfSSL 15:117db924cf7c 306 ret = wc_HashUpdate(hash, hashT, Ai, u);
wolfSSL 15:117db924cf7c 307 if (ret == 0)
wolfSSL 15:117db924cf7c 308 ret = wc_HashFinal(hash, hashT, Ai);
wolfSSL 15:117db924cf7c 309 }
wolfSSL 15:117db924cf7c 310
wolfSSL 15:117db924cf7c 311 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 312 XFREE(hash, NULL, DYNAMIC_TYPE_HASHCTX);
wolfSSL 15:117db924cf7c 313 #endif
wolfSSL 15:117db924cf7c 314
wolfSSL 15:117db924cf7c 315 return ret;
wolfSSL 15:117db924cf7c 316 }
wolfSSL 15:117db924cf7c 317
wolfSSL 15:117db924cf7c 318
wolfSSL 15:117db924cf7c 319 int wc_PKCS12_PBKDF(byte* output, const byte* passwd, int passLen,
wolfSSL 15:117db924cf7c 320 const byte* salt, int saltLen, int iterations, int kLen, int hashType,
wolfSSL 15:117db924cf7c 321 int id)
wolfSSL 15:117db924cf7c 322 {
wolfSSL 15:117db924cf7c 323 return wc_PKCS12_PBKDF_ex(output, passwd, passLen, salt, saltLen,
wolfSSL 15:117db924cf7c 324 iterations, kLen, hashType, id, NULL);
wolfSSL 15:117db924cf7c 325 }
wolfSSL 15:117db924cf7c 326
wolfSSL 15:117db924cf7c 327
wolfSSL 15:117db924cf7c 328 /* extended API that allows a heap hint to be used */
wolfSSL 15:117db924cf7c 329 int wc_PKCS12_PBKDF_ex(byte* output, const byte* passwd, int passLen,
wolfSSL 15:117db924cf7c 330 const byte* salt, int saltLen, int iterations, int kLen,
wolfSSL 15:117db924cf7c 331 int hashType, int id, void* heap)
wolfSSL 15:117db924cf7c 332 {
wolfSSL 15:117db924cf7c 333 /* all in bytes instead of bits */
wolfSSL 15:117db924cf7c 334 word32 u, v, dLen, pLen, iLen, sLen, totalLen;
wolfSSL 15:117db924cf7c 335 int dynamic = 0;
wolfSSL 15:117db924cf7c 336 int ret = 0;
wolfSSL 15:117db924cf7c 337 int i;
wolfSSL 15:117db924cf7c 338 byte *D, *S, *P, *I;
wolfSSL 15:117db924cf7c 339 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 340 byte staticBuffer[1]; /* force dynamic usage */
wolfSSL 15:117db924cf7c 341 #else
wolfSSL 15:117db924cf7c 342 byte staticBuffer[1024];
wolfSSL 15:117db924cf7c 343 #endif
wolfSSL 15:117db924cf7c 344 byte* buffer = staticBuffer;
wolfSSL 15:117db924cf7c 345
wolfSSL 15:117db924cf7c 346 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 347 byte* Ai;
wolfSSL 15:117db924cf7c 348 byte* B;
wolfSSL 15:117db924cf7c 349 #else
wolfSSL 15:117db924cf7c 350 byte Ai[WC_MAX_DIGEST_SIZE];
wolfSSL 15:117db924cf7c 351 byte B[WC_MAX_BLOCK_SIZE];
wolfSSL 15:117db924cf7c 352 #endif
wolfSSL 15:117db924cf7c 353 enum wc_HashType hashT;
wolfSSL 15:117db924cf7c 354
wolfSSL 15:117db924cf7c 355 (void)heap;
wolfSSL 15:117db924cf7c 356
wolfSSL 15:117db924cf7c 357 if (output == NULL || passLen < 0 || saltLen < 0 || kLen < 0) {
wolfSSL 15:117db924cf7c 358 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 359 }
wolfSSL 15:117db924cf7c 360
wolfSSL 15:117db924cf7c 361 if (iterations <= 0)
wolfSSL 15:117db924cf7c 362 iterations = 1;
wolfSSL 15:117db924cf7c 363
wolfSSL 15:117db924cf7c 364 hashT = wc_HashTypeConvert(hashType);
wolfSSL 15:117db924cf7c 365 ret = wc_HashGetDigestSize(hashT);
wolfSSL 15:117db924cf7c 366 if (ret < 0)
wolfSSL 15:117db924cf7c 367 return ret;
wolfSSL 15:117db924cf7c 368 u = ret;
wolfSSL 15:117db924cf7c 369
wolfSSL 15:117db924cf7c 370 ret = wc_HashGetBlockSize(hashT);
wolfSSL 15:117db924cf7c 371 if (ret < 0)
wolfSSL 15:117db924cf7c 372 return ret;
wolfSSL 15:117db924cf7c 373 v = ret;
wolfSSL 15:117db924cf7c 374
wolfSSL 15:117db924cf7c 375 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 376 Ai = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 377 if (Ai == NULL)
wolfSSL 15:117db924cf7c 378 return MEMORY_E;
wolfSSL 15:117db924cf7c 379
wolfSSL 15:117db924cf7c 380 B = (byte*)XMALLOC(WC_MAX_BLOCK_SIZE, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 381 if (B == NULL) {
wolfSSL 15:117db924cf7c 382 XFREE(Ai, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 383 return MEMORY_E;
wolfSSL 15:117db924cf7c 384 }
wolfSSL 15:117db924cf7c 385 #endif
wolfSSL 15:117db924cf7c 386
wolfSSL 15:117db924cf7c 387 XMEMSET(Ai, 0, WC_MAX_DIGEST_SIZE);
wolfSSL 15:117db924cf7c 388 XMEMSET(B, 0, WC_MAX_BLOCK_SIZE);
wolfSSL 15:117db924cf7c 389
wolfSSL 15:117db924cf7c 390 dLen = v;
wolfSSL 15:117db924cf7c 391 sLen = v * ((saltLen + v - 1) / v);
wolfSSL 15:117db924cf7c 392 if (passLen)
wolfSSL 15:117db924cf7c 393 pLen = v * ((passLen + v - 1) / v);
wolfSSL 15:117db924cf7c 394 else
wolfSSL 15:117db924cf7c 395 pLen = 0;
wolfSSL 15:117db924cf7c 396 iLen = sLen + pLen;
wolfSSL 15:117db924cf7c 397
wolfSSL 15:117db924cf7c 398 totalLen = dLen + sLen + pLen;
wolfSSL 15:117db924cf7c 399
wolfSSL 15:117db924cf7c 400 if (totalLen > sizeof(staticBuffer)) {
wolfSSL 15:117db924cf7c 401 buffer = (byte*)XMALLOC(totalLen, heap, DYNAMIC_TYPE_KEY);
wolfSSL 15:117db924cf7c 402 if (buffer == NULL) {
wolfSSL 15:117db924cf7c 403 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 404 XFREE(Ai, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 405 XFREE(B, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 406 #endif
wolfSSL 15:117db924cf7c 407 return MEMORY_E;
wolfSSL 15:117db924cf7c 408 }
wolfSSL 15:117db924cf7c 409 dynamic = 1;
wolfSSL 15:117db924cf7c 410 }
wolfSSL 15:117db924cf7c 411
wolfSSL 15:117db924cf7c 412 D = buffer;
wolfSSL 15:117db924cf7c 413 S = D + dLen;
wolfSSL 15:117db924cf7c 414 P = S + sLen;
wolfSSL 15:117db924cf7c 415 I = S;
wolfSSL 15:117db924cf7c 416
wolfSSL 15:117db924cf7c 417 XMEMSET(D, id, dLen);
wolfSSL 15:117db924cf7c 418
wolfSSL 15:117db924cf7c 419 for (i = 0; i < (int)sLen; i++)
wolfSSL 15:117db924cf7c 420 S[i] = salt[i % saltLen];
wolfSSL 15:117db924cf7c 421 for (i = 0; i < (int)pLen; i++)
wolfSSL 15:117db924cf7c 422 P[i] = passwd[i % passLen];
wolfSSL 15:117db924cf7c 423
wolfSSL 15:117db924cf7c 424 while (kLen > 0) {
wolfSSL 15:117db924cf7c 425 word32 currentLen;
wolfSSL 15:117db924cf7c 426 mp_int B1;
wolfSSL 15:117db924cf7c 427
wolfSSL 15:117db924cf7c 428 ret = DoPKCS12Hash(hashType, buffer, totalLen, Ai, u, iterations);
wolfSSL 15:117db924cf7c 429 if (ret < 0)
wolfSSL 15:117db924cf7c 430 break;
wolfSSL 15:117db924cf7c 431
wolfSSL 15:117db924cf7c 432 for (i = 0; i < (int)v; i++)
wolfSSL 15:117db924cf7c 433 B[i] = Ai[i % u];
wolfSSL 15:117db924cf7c 434
wolfSSL 15:117db924cf7c 435 if (mp_init(&B1) != MP_OKAY)
wolfSSL 15:117db924cf7c 436 ret = MP_INIT_E;
wolfSSL 15:117db924cf7c 437 else if (mp_read_unsigned_bin(&B1, B, v) != MP_OKAY)
wolfSSL 15:117db924cf7c 438 ret = MP_READ_E;
wolfSSL 15:117db924cf7c 439 else if (mp_add_d(&B1, (mp_digit)1, &B1) != MP_OKAY)
wolfSSL 15:117db924cf7c 440 ret = MP_ADD_E;
wolfSSL 15:117db924cf7c 441
wolfSSL 15:117db924cf7c 442 if (ret != 0) {
wolfSSL 15:117db924cf7c 443 mp_clear(&B1);
wolfSSL 15:117db924cf7c 444 break;
wolfSSL 15:117db924cf7c 445 }
wolfSSL 15:117db924cf7c 446
wolfSSL 15:117db924cf7c 447 for (i = 0; i < (int)iLen; i += v) {
wolfSSL 15:117db924cf7c 448 int outSz;
wolfSSL 15:117db924cf7c 449 mp_int i1;
wolfSSL 15:117db924cf7c 450 mp_int res;
wolfSSL 15:117db924cf7c 451
wolfSSL 15:117db924cf7c 452 if (mp_init_multi(&i1, &res, NULL, NULL, NULL, NULL) != MP_OKAY) {
wolfSSL 15:117db924cf7c 453 ret = MP_INIT_E;
wolfSSL 15:117db924cf7c 454 break;
wolfSSL 15:117db924cf7c 455 }
wolfSSL 15:117db924cf7c 456 if (mp_read_unsigned_bin(&i1, I + i, v) != MP_OKAY)
wolfSSL 15:117db924cf7c 457 ret = MP_READ_E;
wolfSSL 15:117db924cf7c 458 else if (mp_add(&i1, &B1, &res) != MP_OKAY)
wolfSSL 15:117db924cf7c 459 ret = MP_ADD_E;
wolfSSL 15:117db924cf7c 460 else if ( (outSz = mp_unsigned_bin_size(&res)) < 0)
wolfSSL 15:117db924cf7c 461 ret = MP_TO_E;
wolfSSL 15:117db924cf7c 462 else {
wolfSSL 15:117db924cf7c 463 if (outSz > (int)v) {
wolfSSL 15:117db924cf7c 464 /* take off MSB */
wolfSSL 15:117db924cf7c 465 byte tmp[129];
wolfSSL 15:117db924cf7c 466 ret = mp_to_unsigned_bin(&res, tmp);
wolfSSL 15:117db924cf7c 467 XMEMCPY(I + i, tmp + 1, v);
wolfSSL 15:117db924cf7c 468 }
wolfSSL 15:117db924cf7c 469 else if (outSz < (int)v) {
wolfSSL 15:117db924cf7c 470 XMEMSET(I + i, 0, v - outSz);
wolfSSL 15:117db924cf7c 471 ret = mp_to_unsigned_bin(&res, I + i + v - outSz);
wolfSSL 15:117db924cf7c 472 }
wolfSSL 15:117db924cf7c 473 else
wolfSSL 15:117db924cf7c 474 ret = mp_to_unsigned_bin(&res, I + i);
wolfSSL 15:117db924cf7c 475 }
wolfSSL 15:117db924cf7c 476
wolfSSL 15:117db924cf7c 477 mp_clear(&i1);
wolfSSL 15:117db924cf7c 478 mp_clear(&res);
wolfSSL 15:117db924cf7c 479 if (ret < 0) break;
wolfSSL 15:117db924cf7c 480 }
wolfSSL 15:117db924cf7c 481
wolfSSL 15:117db924cf7c 482 currentLen = min(kLen, (int)u);
wolfSSL 15:117db924cf7c 483 XMEMCPY(output, Ai, currentLen);
wolfSSL 15:117db924cf7c 484 output += currentLen;
wolfSSL 15:117db924cf7c 485 kLen -= currentLen;
wolfSSL 15:117db924cf7c 486 mp_clear(&B1);
wolfSSL 15:117db924cf7c 487 }
wolfSSL 15:117db924cf7c 488
wolfSSL 15:117db924cf7c 489 if (dynamic) XFREE(buffer, heap, DYNAMIC_TYPE_KEY);
wolfSSL 15:117db924cf7c 490
wolfSSL 15:117db924cf7c 491 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 15:117db924cf7c 492 XFREE(Ai, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 493 XFREE(B, heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 494 #endif
wolfSSL 15:117db924cf7c 495
wolfSSL 15:117db924cf7c 496 return ret;
wolfSSL 15:117db924cf7c 497 }
wolfSSL 15:117db924cf7c 498
wolfSSL 15:117db924cf7c 499 #ifdef HAVE_SCRYPT
wolfSSL 15:117db924cf7c 500 /* Rotate the 32-bit value a by b bits to the left.
wolfSSL 15:117db924cf7c 501 *
wolfSSL 15:117db924cf7c 502 * a 32-bit value.
wolfSSL 15:117db924cf7c 503 * b Number of bits to rotate.
wolfSSL 15:117db924cf7c 504 * returns rotated value.
wolfSSL 15:117db924cf7c 505 */
wolfSSL 15:117db924cf7c 506 #define R(a, b) rotlFixed(a, b)
wolfSSL 15:117db924cf7c 507
wolfSSL 15:117db924cf7c 508 /* One round of Salsa20/8.
wolfSSL 15:117db924cf7c 509 * Code taken from RFC 7914: scrypt PBKDF.
wolfSSL 15:117db924cf7c 510 *
wolfSSL 15:117db924cf7c 511 * out Output buffer.
wolfSSL 15:117db924cf7c 512 * in Input data to hash.
wolfSSL 15:117db924cf7c 513 */
wolfSSL 15:117db924cf7c 514 static void scryptSalsa(word32* out, word32* in)
wolfSSL 15:117db924cf7c 515 {
wolfSSL 15:117db924cf7c 516 int i;
wolfSSL 15:117db924cf7c 517 word32 x[16];
wolfSSL 15:117db924cf7c 518
wolfSSL 15:117db924cf7c 519 #ifdef LITTLE_ENDIAN_ORDER
wolfSSL 15:117db924cf7c 520 for (i = 0; i < 16; ++i)
wolfSSL 15:117db924cf7c 521 x[i] = in[i];
wolfSSL 15:117db924cf7c 522 #else
wolfSSL 15:117db924cf7c 523 for (i = 0; i < 16; i++)
wolfSSL 15:117db924cf7c 524 x[i] = ByteReverseWord32(in[i]);
wolfSSL 15:117db924cf7c 525 #endif
wolfSSL 15:117db924cf7c 526 for (i = 8; i > 0; i -= 2) {
wolfSSL 15:117db924cf7c 527 x[ 4] ^= R(x[ 0] + x[12], 7); x[ 8] ^= R(x[ 4] + x[ 0], 9);
wolfSSL 15:117db924cf7c 528 x[12] ^= R(x[ 8] + x[ 4], 13); x[ 0] ^= R(x[12] + x[ 8], 18);
wolfSSL 15:117db924cf7c 529 x[ 9] ^= R(x[ 5] + x[ 1], 7); x[13] ^= R(x[ 9] + x[ 5], 9);
wolfSSL 15:117db924cf7c 530 x[ 1] ^= R(x[13] + x[ 9], 13); x[ 5] ^= R(x[ 1] + x[13], 18);
wolfSSL 15:117db924cf7c 531 x[14] ^= R(x[10] + x[ 6], 7); x[ 2] ^= R(x[14] + x[10], 9);
wolfSSL 15:117db924cf7c 532 x[ 6] ^= R(x[ 2] + x[14], 13); x[10] ^= R(x[ 6] + x[ 2], 18);
wolfSSL 15:117db924cf7c 533 x[ 3] ^= R(x[15] + x[11], 7); x[ 7] ^= R(x[ 3] + x[15], 9);
wolfSSL 15:117db924cf7c 534 x[11] ^= R(x[ 7] + x[ 3], 13); x[15] ^= R(x[11] + x[ 7], 18);
wolfSSL 15:117db924cf7c 535 x[ 1] ^= R(x[ 0] + x[ 3], 7); x[ 2] ^= R(x[ 1] + x[ 0], 9);
wolfSSL 15:117db924cf7c 536 x[ 3] ^= R(x[ 2] + x[ 1], 13); x[ 0] ^= R(x[ 3] + x[ 2], 18);
wolfSSL 15:117db924cf7c 537 x[ 6] ^= R(x[ 5] + x[ 4], 7); x[ 7] ^= R(x[ 6] + x[ 5], 9);
wolfSSL 15:117db924cf7c 538 x[ 4] ^= R(x[ 7] + x[ 6], 13); x[ 5] ^= R(x[ 4] + x[ 7], 18);
wolfSSL 15:117db924cf7c 539 x[11] ^= R(x[10] + x[ 9], 7); x[ 8] ^= R(x[11] + x[10], 9);
wolfSSL 15:117db924cf7c 540 x[ 9] ^= R(x[ 8] + x[11], 13); x[10] ^= R(x[ 9] + x[ 8], 18);
wolfSSL 15:117db924cf7c 541 x[12] ^= R(x[15] + x[14], 7); x[13] ^= R(x[12] + x[15], 9);
wolfSSL 15:117db924cf7c 542 x[14] ^= R(x[13] + x[12], 13); x[15] ^= R(x[14] + x[13], 18);
wolfSSL 15:117db924cf7c 543 }
wolfSSL 15:117db924cf7c 544 #ifdef LITTLE_ENDIAN_ORDER
wolfSSL 15:117db924cf7c 545 for (i = 0; i < 16; ++i)
wolfSSL 15:117db924cf7c 546 out[i] = in[i] + x[i];
wolfSSL 15:117db924cf7c 547 #else
wolfSSL 15:117db924cf7c 548 for (i = 0; i < 16; i++)
wolfSSL 15:117db924cf7c 549 out[i] = ByteReverseWord32(ByteReverseWord32(in[i]) + x[i]);
wolfSSL 15:117db924cf7c 550 #endif
wolfSSL 15:117db924cf7c 551 }
wolfSSL 15:117db924cf7c 552
wolfSSL 15:117db924cf7c 553 /* Mix a block using Salsa20/8.
wolfSSL 15:117db924cf7c 554 * Based on RFC 7914: scrypt PBKDF.
wolfSSL 15:117db924cf7c 555 *
wolfSSL 15:117db924cf7c 556 * b Blocks to mix.
wolfSSL 15:117db924cf7c 557 * y Temporary storage.
wolfSSL 15:117db924cf7c 558 * r Size of the block.
wolfSSL 15:117db924cf7c 559 */
wolfSSL 15:117db924cf7c 560 static void scryptBlockMix(byte* b, byte* y, int r)
wolfSSL 15:117db924cf7c 561 {
wolfSSL 15:117db924cf7c 562 byte x[64];
wolfSSL 15:117db924cf7c 563 #ifdef WORD64_AVAILABLE
wolfSSL 15:117db924cf7c 564 word64* b64 = (word64*)b;
wolfSSL 15:117db924cf7c 565 word64* y64 = (word64*)y;
wolfSSL 15:117db924cf7c 566 word64* x64 = (word64*)x;
wolfSSL 15:117db924cf7c 567 #else
wolfSSL 15:117db924cf7c 568 word32* b32 = (word32*)b;
wolfSSL 15:117db924cf7c 569 word32* y32 = (word32*)y;
wolfSSL 15:117db924cf7c 570 word32* x32 = (word32*)x;
wolfSSL 15:117db924cf7c 571 #endif
wolfSSL 15:117db924cf7c 572 int i;
wolfSSL 15:117db924cf7c 573 int j;
wolfSSL 15:117db924cf7c 574
wolfSSL 15:117db924cf7c 575 /* Step 1. */
wolfSSL 15:117db924cf7c 576 XMEMCPY(x, b + (2 * r - 1) * 64, sizeof(x));
wolfSSL 15:117db924cf7c 577 /* Step 2. */
wolfSSL 15:117db924cf7c 578 for (i = 0; i < 2 * r; i++)
wolfSSL 15:117db924cf7c 579 {
wolfSSL 15:117db924cf7c 580 #ifdef WORD64_AVAILABLE
wolfSSL 15:117db924cf7c 581 for (j = 0; j < 8; j++)
wolfSSL 15:117db924cf7c 582 x64[j] ^= b64[i * 8 + j];
wolfSSL 15:117db924cf7c 583 #else
wolfSSL 15:117db924cf7c 584 for (j = 0; j < 16; j++)
wolfSSL 15:117db924cf7c 585 x32[j] ^= b32[i * 16 + j];
wolfSSL 15:117db924cf7c 586 #endif
wolfSSL 15:117db924cf7c 587 scryptSalsa((word32*)x, (word32*)x);
wolfSSL 15:117db924cf7c 588 XMEMCPY(y + i * 64, x, sizeof(x));
wolfSSL 15:117db924cf7c 589 }
wolfSSL 15:117db924cf7c 590 /* Step 3. */
wolfSSL 15:117db924cf7c 591 for (i = 0; i < r; i++) {
wolfSSL 15:117db924cf7c 592 #ifdef WORD64_AVAILABLE
wolfSSL 15:117db924cf7c 593 for (j = 0; j < 8; j++) {
wolfSSL 15:117db924cf7c 594 b64[i * 8 + j] = y64[2 * i * 8 + j];
wolfSSL 15:117db924cf7c 595 b64[(r + i) * 8 + j] = y64[(2 * i + 1) * 8 + j];
wolfSSL 15:117db924cf7c 596 }
wolfSSL 15:117db924cf7c 597 #else
wolfSSL 15:117db924cf7c 598 for (j = 0; j < 16; j++) {
wolfSSL 15:117db924cf7c 599 b32[i * 16 + j] = y32[2 * i * 16 + j];
wolfSSL 15:117db924cf7c 600 b32[(r + i) * 16 + j] = y32[(2 * i + 1) * 16 + j];
wolfSSL 15:117db924cf7c 601 }
wolfSSL 15:117db924cf7c 602 #endif
wolfSSL 15:117db924cf7c 603 }
wolfSSL 15:117db924cf7c 604 }
wolfSSL 15:117db924cf7c 605
wolfSSL 15:117db924cf7c 606 /* Random oracles mix.
wolfSSL 15:117db924cf7c 607 * Based on RFC 7914: scrypt PBKDF.
wolfSSL 15:117db924cf7c 608 *
wolfSSL 15:117db924cf7c 609 * x Data to mix.
wolfSSL 15:117db924cf7c 610 * v Temporary buffer.
wolfSSL 15:117db924cf7c 611 * y Temporary buffer for the block mix.
wolfSSL 15:117db924cf7c 612 * r Block size parameter.
wolfSSL 15:117db924cf7c 613 * n CPU/Memory cost parameter.
wolfSSL 15:117db924cf7c 614 */
wolfSSL 15:117db924cf7c 615 static void scryptROMix(byte* x, byte* v, byte* y, int r, word32 n)
wolfSSL 15:117db924cf7c 616 {
wolfSSL 15:117db924cf7c 617 word32 i;
wolfSSL 15:117db924cf7c 618 word32 j;
wolfSSL 15:117db924cf7c 619 word32 k;
wolfSSL 15:117db924cf7c 620 word32 bSz = 128 * r;
wolfSSL 15:117db924cf7c 621 #ifdef WORD64_AVAILABLE
wolfSSL 15:117db924cf7c 622 word64* x64 = (word64*)x;
wolfSSL 15:117db924cf7c 623 word64* v64 = (word64*)v;
wolfSSL 15:117db924cf7c 624 #else
wolfSSL 15:117db924cf7c 625 word32* x32 = (word32*)x;
wolfSSL 15:117db924cf7c 626 word32* v32 = (word32*)v;
wolfSSL 15:117db924cf7c 627 #endif
wolfSSL 15:117db924cf7c 628
wolfSSL 15:117db924cf7c 629 /* Step 1. X = B (B not needed therefore not implemented) */
wolfSSL 15:117db924cf7c 630 /* Step 2. */
wolfSSL 15:117db924cf7c 631 for (i = 0; i < n; i++)
wolfSSL 15:117db924cf7c 632 {
wolfSSL 15:117db924cf7c 633 XMEMCPY(v + i * bSz, x, bSz);
wolfSSL 15:117db924cf7c 634 scryptBlockMix(x, y, r);
wolfSSL 15:117db924cf7c 635 }
wolfSSL 15:117db924cf7c 636
wolfSSL 15:117db924cf7c 637 /* Step 3. */
wolfSSL 15:117db924cf7c 638 for (i = 0; i < n; i++)
wolfSSL 15:117db924cf7c 639 {
wolfSSL 15:117db924cf7c 640 #ifdef LITTLE_ENDIAN_ORDER
wolfSSL 15:117db924cf7c 641 #ifdef WORD64_AVAILABLE
wolfSSL 15:117db924cf7c 642 j = *(word64*)(x + (2*r - 1) * 64) & (n-1);
wolfSSL 15:117db924cf7c 643 #else
wolfSSL 15:117db924cf7c 644 j = *(word32*)(x + (2*r - 1) * 64) & (n-1);
wolfSSL 15:117db924cf7c 645 #endif
wolfSSL 15:117db924cf7c 646 #else
wolfSSL 15:117db924cf7c 647 byte* t = x + (2*r - 1) * 64;
wolfSSL 15:117db924cf7c 648 j = (t[0] | (t[1] << 8) | (t[2] << 16) | ((word32)t[3] << 24)) & (n-1);
wolfSSL 15:117db924cf7c 649 #endif
wolfSSL 15:117db924cf7c 650 #ifdef WORD64_AVAILABLE
wolfSSL 15:117db924cf7c 651 for (k = 0; k < bSz / 8; k++)
wolfSSL 15:117db924cf7c 652 x64[k] ^= v64[j * bSz / 8 + k];
wolfSSL 15:117db924cf7c 653 #else
wolfSSL 15:117db924cf7c 654 for (k = 0; k < bSz / 4; k++)
wolfSSL 15:117db924cf7c 655 x32[k] ^= v32[j * bSz / 4 + k];
wolfSSL 15:117db924cf7c 656 #endif
wolfSSL 15:117db924cf7c 657 scryptBlockMix(x, y, r);
wolfSSL 15:117db924cf7c 658 }
wolfSSL 15:117db924cf7c 659 /* Step 4. B' = X (B = X = B' so not needed, therefore not implemented) */
wolfSSL 15:117db924cf7c 660 }
wolfSSL 15:117db924cf7c 661
wolfSSL 15:117db924cf7c 662 /* Generates an key derived from a password and salt using a memory hard
wolfSSL 15:117db924cf7c 663 * algorithm.
wolfSSL 15:117db924cf7c 664 * Implements RFC 7914: scrypt PBKDF.
wolfSSL 15:117db924cf7c 665 *
wolfSSL 15:117db924cf7c 666 * output The derived key.
wolfSSL 15:117db924cf7c 667 * passwd The password to derive key from.
wolfSSL 15:117db924cf7c 668 * passLen The length of the password.
wolfSSL 15:117db924cf7c 669 * salt The key specific data.
wolfSSL 15:117db924cf7c 670 * saltLen The length of the salt data.
wolfSSL 15:117db924cf7c 671 * cost The CPU/memory cost parameter. Range: 1..(128*r/8-1)
wolfSSL 15:117db924cf7c 672 * (Iterations = 2^cost)
wolfSSL 15:117db924cf7c 673 * blockSize The number of 128 byte octets in a working block.
wolfSSL 15:117db924cf7c 674 * parallel The number of parallel mix operations to perform.
wolfSSL 15:117db924cf7c 675 * (Note: this implementation does not use threads.)
wolfSSL 15:117db924cf7c 676 * dkLen The length of the derived key in bytes.
wolfSSL 15:117db924cf7c 677 * returns BAD_FUNC_ARG when: parallel not 1, blockSize is too large for cost.
wolfSSL 15:117db924cf7c 678 */
wolfSSL 15:117db924cf7c 679 int wc_scrypt(byte* output, const byte* passwd, int passLen,
wolfSSL 15:117db924cf7c 680 const byte* salt, int saltLen, int cost, int blockSize,
wolfSSL 15:117db924cf7c 681 int parallel, int dkLen)
wolfSSL 15:117db924cf7c 682 {
wolfSSL 15:117db924cf7c 683 int ret = 0;
wolfSSL 15:117db924cf7c 684 int i;
wolfSSL 15:117db924cf7c 685 byte* v = NULL;
wolfSSL 15:117db924cf7c 686 byte* y = NULL;
wolfSSL 15:117db924cf7c 687 byte* blocks = NULL;
wolfSSL 15:117db924cf7c 688 word32 blocksSz;
wolfSSL 15:117db924cf7c 689 word32 bSz;
wolfSSL 15:117db924cf7c 690
wolfSSL 15:117db924cf7c 691 if (blockSize > 8)
wolfSSL 15:117db924cf7c 692 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 693
wolfSSL 15:117db924cf7c 694 if (cost < 1 || cost >= 128 * blockSize / 8)
wolfSSL 15:117db924cf7c 695 return BAD_FUNC_ARG;
wolfSSL 15:117db924cf7c 696
wolfSSL 15:117db924cf7c 697 bSz = 128 * blockSize;
wolfSSL 15:117db924cf7c 698 blocksSz = bSz * parallel;
wolfSSL 15:117db924cf7c 699 blocks = (byte*)XMALLOC(blocksSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 700 if (blocks == NULL)
wolfSSL 15:117db924cf7c 701 goto end;
wolfSSL 15:117db924cf7c 702 /* Temporary for scryptROMix. */
wolfSSL 15:117db924cf7c 703 v = (byte*)XMALLOC((1 << cost) * bSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 704 if (v == NULL)
wolfSSL 15:117db924cf7c 705 goto end;
wolfSSL 15:117db924cf7c 706 /* Temporary for scryptBlockMix. */
wolfSSL 15:117db924cf7c 707 y = (byte*)XMALLOC(blockSize * 128, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 708 if (y == NULL)
wolfSSL 15:117db924cf7c 709 goto end;
wolfSSL 15:117db924cf7c 710
wolfSSL 15:117db924cf7c 711 /* Step 1. */
wolfSSL 15:117db924cf7c 712 ret = wc_PBKDF2(blocks, passwd, passLen, salt, saltLen, 1, blocksSz,
wolfSSL 15:117db924cf7c 713 WC_SHA256);
wolfSSL 15:117db924cf7c 714 if (ret != 0)
wolfSSL 15:117db924cf7c 715 goto end;
wolfSSL 15:117db924cf7c 716
wolfSSL 15:117db924cf7c 717 /* Step 2. */
wolfSSL 15:117db924cf7c 718 for (i = 0; i < parallel; i++)
wolfSSL 15:117db924cf7c 719 scryptROMix(blocks + i * bSz, v, y, blockSize, 1 << cost);
wolfSSL 15:117db924cf7c 720
wolfSSL 15:117db924cf7c 721 /* Step 3. */
wolfSSL 15:117db924cf7c 722 ret = wc_PBKDF2(output, passwd, passLen, blocks, blocksSz, 1, dkLen,
wolfSSL 15:117db924cf7c 723 WC_SHA256);
wolfSSL 15:117db924cf7c 724 end:
wolfSSL 15:117db924cf7c 725 if (blocks != NULL)
wolfSSL 15:117db924cf7c 726 XFREE(blocks, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 727 if (v != NULL)
wolfSSL 15:117db924cf7c 728 XFREE(v, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 729 if (y != NULL)
wolfSSL 15:117db924cf7c 730 XFREE(y, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 15:117db924cf7c 731
wolfSSL 15:117db924cf7c 732 return ret;
wolfSSL 15:117db924cf7c 733 }
wolfSSL 15:117db924cf7c 734 #endif
wolfSSL 15:117db924cf7c 735
wolfSSL 15:117db924cf7c 736 #undef WC_MAX_DIGEST_SIZE
wolfSSL 15:117db924cf7c 737
wolfSSL 15:117db924cf7c 738 #endif /* NO_PWDBASED */
wolfSSL 15:117db924cf7c 739
wolfSSL 15:117db924cf7c 740