Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2015 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #include "hmac.h" |
| 18 | #include "hkdf.h" |
| 19 | |
| 20 | #include <assert.h> |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 21 | |
| 22 | namespace keymaster { |
| 23 | |
| 24 | const size_t kSHA256HashLength = 32; |
| 25 | |
| 26 | Rfc5869HmacSha256Kdf::Rfc5869HmacSha256Kdf(Buffer& secret, Buffer& salt, Buffer& info, |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 27 | size_t key_bytes_to_generate, keymaster_error_t* error) { |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 28 | Rfc5869HmacSha256Kdf(secret.peek_read(), secret.available_read(), salt.peek_read(), |
| 29 | salt.available_read(), info.peek_read(), info.available_read(), |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 30 | key_bytes_to_generate, error); |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 31 | } |
| 32 | |
| 33 | Rfc5869HmacSha256Kdf::Rfc5869HmacSha256Kdf(const uint8_t* secret, size_t secret_len, |
| 34 | const uint8_t* salt, size_t salt_len, |
| 35 | const uint8_t* info, size_t info_len, |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 36 | size_t key_bytes_to_generate, keymaster_error_t* error) { |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 37 | // Step 1. Extract: PRK = HMAC-SHA256(actual_salt, secret) |
| 38 | // https://tools.ietf.org/html/rfc5869#section-2.2 |
| 39 | HmacSha256 prk_hmac; |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 40 | bool result; |
| 41 | if (salt) { |
| 42 | result = prk_hmac.Init(salt, salt_len); |
| 43 | } else { |
| 44 | uint8_t zeros[kSHA256HashLength]; |
| 45 | // If salt is not given, HashLength zeros are used. |
| 46 | memset(zeros, 0, sizeof(zeros)); |
| 47 | result = prk_hmac.Init(zeros, sizeof(zeros)); |
| 48 | } |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 49 | assert(result); |
Chad Brubaker | 3e37f0a | 2015-06-03 10:39:00 -0700 | [diff] [blame] | 50 | // avoid the unused variable warning if asserts are disabled. |
| 51 | (void) result; |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 52 | |
| 53 | // |prk| is a pseudorandom key (of kSHA256HashLength octets). |
| 54 | uint8_t prk[kSHA256HashLength]; |
| 55 | assert(sizeof(prk) == prk_hmac.DigestLength()); |
| 56 | result = prk_hmac.Sign(secret, secret_len, prk, sizeof(prk)); |
| 57 | assert(result); |
| 58 | |
| 59 | // Step 2. Expand: OUTPUT = HKDF-Expand(PRK, info) |
| 60 | // https://tools.ietf.org/html/rfc5869#section-2.3 |
| 61 | const size_t n = (key_bytes_to_generate + kSHA256HashLength - 1) / kSHA256HashLength; |
| 62 | assert(n < 256u); |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 63 | output_.reset(new uint8_t[n * kSHA256HashLength]); |
| 64 | if (!output_.get()) { |
| 65 | *error = KM_ERROR_MEMORY_ALLOCATION_FAILED; |
| 66 | return; |
| 67 | } |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 68 | |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 69 | uint8_t buf[kSHA256HashLength + info_len + 1]; |
| 70 | uint8_t digest[kSHA256HashLength]; |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 71 | HmacSha256 hmac; |
| 72 | result = hmac.Init(prk, sizeof(prk)); |
| 73 | assert(result); |
| 74 | |
| 75 | for (size_t i = 1; i <= n; i++) { |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 76 | size_t j = 0; |
| 77 | if (i != 1) { |
| 78 | memcpy(buf, digest, sizeof(digest)); |
| 79 | j = sizeof(digest); |
| 80 | } |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 81 | memcpy(buf + j, info, info_len); |
| 82 | j += info_len; |
| 83 | buf[j++] = static_cast<uint8_t>(i); |
| 84 | result = hmac.Sign(buf, j, digest, sizeof(digest)); |
| 85 | assert(result); |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 86 | memcpy(output_.get() + (i - 1) * sizeof(digest), digest, sizeof(digest)); |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 87 | } |
| 88 | |
Thai Duong | 60eebdc | 2015-03-25 17:20:24 -0700 | [diff] [blame] | 89 | if (key_bytes_to_generate) { |
| 90 | secret_key_len_ = key_bytes_to_generate; |
| 91 | secret_key_.reset(new uint8_t[key_bytes_to_generate]); |
| 92 | if (!secret_key_.get()) { |
| 93 | *error = KM_ERROR_MEMORY_ALLOCATION_FAILED; |
| 94 | return; |
| 95 | } |
| 96 | memcpy(secret_key_.get(), output_.get(), key_bytes_to_generate); |
| 97 | } |
| 98 | *error = KM_ERROR_OK; |
Thai Duong | 7689ed6 | 2015-03-20 16:50:18 -0700 | [diff] [blame] | 99 | } |
| 100 | |
| 101 | } // namespace keymaster |