authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-09-29 12:48:05+02:00
committergravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-09-30 01:39:55+02:00
log6eaba61ef57c54231eccfdda42ed0c4de2985f27
tree0817c1d2975cf831800ca605a2e05790b9a083bb
parentbb636cb3bffadf5a03e592b97a1968492f16f8cd

std/crypto: implement the HKDF construction

2 files changed, 73 insertions(+), 0 deletions(-)

lib/std/crypto.zig+5
......@@ -95,6 +95,11 @@ pub const stream = struct {
9595 pub const ChaCha20With64BitNonce = @import("crypto/chacha20.zig").ChaCha20With64BitNonce;
9696};
9797
98/// Key derivation functions.
99pub const kdf = struct {
100 pub const hkdf = @import("crypto/hkdf.zig");
101};
102
98103const std = @import("std.zig");
99104pub const randomBytes = std.os.getrandom;
100105
lib/std/crypto/hkdf.zig created+68
......@@ -0,0 +1,68 @@
1const std = @import("../std.zig");
2const assert = std.debug.assert;
3const hmac = std.crypto.auth.hmac;
4const mem = std.mem;
5
6/// HKDF-SHA256
7pub const HkdfSha256 = Hkdf(hmac.sha2.HmacSha256);
8
9/// HKDF-SHA512
10pub const HkdfSha512 = Hkdf(hmac.sha2.HmacSha512);
11
12/// The Hkdf construction takes some source of initial keying material and
13/// derives one or more uniform keys from it.
14pub fn Hkdf(comptime Hmac: type) type {
15 return struct {
16 pub const prk_length = Hmac.mac_length;
17
18 /// Return a master key from a salt and initial keying material.
19 fn extract(salt: []const u8, ikm: []const u8) [Hmac.mac_length]u8 {
20 var prk: [Hmac.mac_length]u8 = undefined;
21 Hmac.create(&prk, ikm, salt);
22 return prk;
23 }
24
25 /// Derive a subkey from a master key `prk` and a subkey description `ctx`.
26 fn expand(out: []u8, ctx: []const u8, prk: [Hmac.mac_length]u8) void {
27 assert(out.len < Hmac.mac_length * 255); // output size is too large for the Hkdf construction
28 var i: usize = 0;
29 var counter = [1]u8{1};
30 while (i + Hmac.mac_length <= out.len) : (i += Hmac.mac_length) {
31 var st = Hmac.init(&prk);
32 if (i != 0) {
33 st.update(out[i - Hmac.mac_length ..][0..Hmac.mac_length]);
34 }
35 st.update(ctx);
36 st.update(&counter);
37 st.final(out[i..][0..Hmac.mac_length]);
38 counter[0] += 1;
39 }
40 const left = out.len % Hmac.mac_length;
41 if (left > 0) {
42 var st = Hmac.init(&prk);
43 if (i != 0) {
44 st.update(out[i - Hmac.mac_length ..][0..Hmac.mac_length]);
45 }
46 st.update(ctx);
47 st.update(&counter);
48 var tmp: [Hmac.mac_length]u8 = undefined;
49 st.final(tmp[0..Hmac.mac_length]);
50 mem.copy(u8, out[i..][0..left], tmp[0..left]);
51 }
52 }
53 };
54}
55
56const htest = @import("test.zig");
57
58test "Hkdf" {
59 const ikm = [_]u8{0x0b} ** 22;
60 const salt = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c };
61 const context = [_]u8{ 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9 };
62 const kdf = HkdfSha256;
63 const prk = kdf.extract(&salt, &ikm);
64 htest.assertEqual("077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5", &prk);
65 var out: [42]u8 = undefined;
66 kdf.expand(&out, &context, prk);
67 htest.assertEqual("3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865", &out);
68}