authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2022-12-29 11:29:50+01:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2022-12-29 17:56:50-05:00
log0d83487dd098f9498d907f06535e645cc8bcf3de
tree28e9dd0bc357ea10fb6b8d8638709ebe4470ca25
parent9b665a59f27b4de0ae648438617b0a1a08a620c1

hkdf: add prk_length and extractInit()

The HKDF extract function uses HMAC under the hood, but requiring applications to directly use HMAC functions reduces clarity and feels like the wrong abstraction. So, in order to get the PRK length, add a `prk_length` constant that applications can use directly. Also add an `extractInit()` function for cases where the keying material has to be provided as multiple chunks.

1 files changed, 34 insertions(+), 11 deletions(-)

lib/std/crypto/hkdf.zig+34-11
...@@ -13,39 +13,56 @@ pub const HkdfSha512 = Hkdf(hmac.sha2.HmacSha512);...@@ -13,39 +13,56 @@ pub const HkdfSha512 = Hkdf(hmac.sha2.HmacSha512);
13/// derives one or more uniform keys from it.13/// derives one or more uniform keys from it.
14pub fn Hkdf(comptime Hmac: type) type {14pub fn Hkdf(comptime Hmac: type) type {
15 return struct {15 return struct {
16 /// Length of a master key, in bytes.
17 pub const prk_length = Hmac.mac_length;
18
16 /// Return a master key from a salt and initial keying material.19 /// Return a master key from a salt and initial keying material.
17 pub fn extract(salt: []const u8, ikm: []const u8) [Hmac.mac_length]u8 {20 pub fn extract(salt: []const u8, ikm: []const u8) [prk_length]u8 {
18 var prk: [Hmac.mac_length]u8 = undefined;21 var prk: [prk_length]u8 = undefined;
19 Hmac.create(&prk, ikm, salt);22 Hmac.create(&prk, ikm, salt);
20 return prk;23 return prk;
21 }24 }
2225
26 /// Initialize the creation of a master key from a salt
27 /// and keying material that can be added later, possibly in chunks.
28 /// Example:
29 /// ```
30 /// var prk: [hkdf.prk_length]u8 = undefined;
31 /// var hkdf = HkdfSha256.extractInit(salt);
32 /// hkdf.update(ikm1);
33 /// hkdf.update(ikm2);
34 /// hkdf.final(&prk);
35 /// ```
36 pub fn extractInit(salt: []const u8) Hmac {
37 return Hmac.init(salt);
38 }
39
23 /// Derive a subkey from a master key `prk` and a subkey description `ctx`.40 /// Derive a subkey from a master key `prk` and a subkey description `ctx`.
24 pub fn expand(out: []u8, ctx: []const u8, prk: [Hmac.mac_length]u8) void {41 pub fn expand(out: []u8, ctx: []const u8, prk: [prk_length]u8) void {
25 assert(out.len <= Hmac.mac_length * 255); // output size is too large for the Hkdf construction42 assert(out.len <= prk_length * 255); // output size is too large for the Hkdf construction
26 var i: usize = 0;43 var i: usize = 0;
27 var counter = [1]u8{1};44 var counter = [1]u8{1};
28 while (i + Hmac.mac_length <= out.len) : (i += Hmac.mac_length) {45 while (i + prk_length <= out.len) : (i += prk_length) {
29 var st = Hmac.init(&prk);46 var st = Hmac.init(&prk);
30 if (i != 0) {47 if (i != 0) {
31 st.update(out[i - Hmac.mac_length ..][0..Hmac.mac_length]);48 st.update(out[i - prk_length ..][0..prk_length]);
32 }49 }
33 st.update(ctx);50 st.update(ctx);
34 st.update(&counter);51 st.update(&counter);
35 st.final(out[i..][0..Hmac.mac_length]);52 st.final(out[i..][0..prk_length]);
36 counter[0] +%= 1;53 counter[0] +%= 1;
37 assert(counter[0] != 1);54 assert(counter[0] != 1);
38 }55 }
39 const left = out.len % Hmac.mac_length;56 const left = out.len % prk_length;
40 if (left > 0) {57 if (left > 0) {
41 var st = Hmac.init(&prk);58 var st = Hmac.init(&prk);
42 if (i != 0) {59 if (i != 0) {
43 st.update(out[i - Hmac.mac_length ..][0..Hmac.mac_length]);60 st.update(out[i - prk_length ..][0..prk_length]);
44 }61 }
45 st.update(ctx);62 st.update(ctx);
46 st.update(&counter);63 st.update(&counter);
47 var tmp: [Hmac.mac_length]u8 = undefined;64 var tmp: [prk_length]u8 = undefined;
48 st.final(tmp[0..Hmac.mac_length]);65 st.final(tmp[0..prk_length]);
49 mem.copy(u8, out[i..][0..left], tmp[0..left]);66 mem.copy(u8, out[i..][0..left], tmp[0..left]);
50 }67 }
51 }68 }
...@@ -64,4 +81,10 @@ test "Hkdf" {...@@ -64,4 +81,10 @@ test "Hkdf" {
64 var out: [42]u8 = undefined;81 var out: [42]u8 = undefined;
65 kdf.expand(&out, &context, prk);82 kdf.expand(&out, &context, prk);
66 try htest.assertEqual("3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865", &out);83 try htest.assertEqual("3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865", &out);
84
85 var hkdf = kdf.extractInit(&salt);
86 hkdf.update(&ikm);
87 var prk2: [kdf.prk_length]u8 = undefined;
88 hkdf.final(&prk2);
89 try htest.assertEqual("077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5", &prk2);
67}90}