9#include <botan/internal/pbes2.h>
11#include <botan/asn1_obj.h>
12#include <botan/ber_dec.h>
13#include <botan/cipher_mode.h>
14#include <botan/der_enc.h>
15#include <botan/pwdhash.h>
17#include <botan/internal/fmt.h>
18#include <botan/internal/parsing.h>
24bool known_pbes_cipher_mode(std::string_view mode) {
25 return (mode ==
"CBC" || mode ==
"GCM" || mode ==
"SIV");
28secure_vector<uint8_t> derive_key(std::string_view passphrase,
29 const AlgorithmIdentifier& kdf_algo,
30 size_t default_key_size) {
32 secure_vector<uint8_t> salt;
33 size_t iterations = 0, key_length = 0;
35 AlgorithmIdentifier prf_algo;
36 BER_Decoder(kdf_algo.parameters())
41 .decode_optional(prf_algo,
48 throw Decoding_Error(
"PBE-PKCS5 v2.0: Encoded salt is too small");
52 key_length = default_key_size;
55 const std::string prf = prf_algo.oid().human_name_or_empty();
56 if(prf.empty() || !prf.starts_with(
"HMAC")) {
57 throw Decoding_Error(
fmt(
"Unknown PBES2 PRF {}", prf_algo.oid()));
61 auto pbkdf = pbkdf_fam->from_params(iterations);
63 secure_vector<uint8_t> derived_key(key_length);
64 pbkdf->hash(derived_key, passphrase, salt);
67 secure_vector<uint8_t> salt;
68 size_t N = 0, r = 0, p = 0;
69 size_t key_length = 0;
71 AlgorithmIdentifier prf_algo;
72 BER_Decoder(kdf_algo.parameters())
82 key_length = default_key_size;
85 secure_vector<uint8_t> derived_key(key_length);
88 auto pwdhash = pwdhash_fam->from_params(N, r, p);
89 pwdhash->hash(derived_key, passphrase, salt);
93 throw Decoding_Error(
fmt(
"PBE-PKCS5 v2.0: Unknown KDF algorithm {}", kdf_algo.oid()));
97secure_vector<uint8_t> derive_key(std::string_view passphrase,
98 std::string_view digest,
99 RandomNumberGenerator& rng,
100 size_t* msec_in_iterations_out,
101 size_t iterations_if_msec_null,
103 AlgorithmIdentifier& kdf_algo) {
104 const secure_vector<uint8_t> salt = rng.random_vec(12);
106 if(digest ==
"Scrypt") {
109 std::unique_ptr<PasswordHash> pwhash;
111 if(msec_in_iterations_out) {
112 const std::chrono::milliseconds msec(*msec_in_iterations_out);
113 pwhash = pwhash_fam->tune(key_length, msec);
115 pwhash = pwhash_fam->from_iterations(iterations_if_msec_null);
118 secure_vector<uint8_t> key(key_length);
119 pwhash->hash(key, passphrase, salt);
121 const size_t N = pwhash->memory_param();
122 const size_t r = pwhash->iterations();
123 const size_t p = pwhash->parallelism();
125 if(msec_in_iterations_out) {
126 *msec_in_iterations_out = 0;
129 std::vector<uint8_t> scrypt_params;
130 DER_Encoder(scrypt_params)
142 const std::string prf =
fmt(
"HMAC({})", digest);
143 const std::string pbkdf_name =
fmt(
"PBKDF2({})", prf);
147 throw Invalid_Argument(
fmt(
"Unknown password hash digest {}", digest));
150 std::unique_ptr<PasswordHash> pwhash;
152 if(msec_in_iterations_out) {
153 const std::chrono::milliseconds msec(*msec_in_iterations_out);
154 pwhash = pwhash_fam->tune(key_length, msec);
156 pwhash = pwhash_fam->from_iterations(iterations_if_msec_null);
159 secure_vector<uint8_t> key(key_length);
160 pwhash->hash(key, passphrase, salt);
162 std::vector<uint8_t> pbkdf2_params;
164 const size_t iterations = pwhash->iterations();
166 if(msec_in_iterations_out) {
167 *msec_in_iterations_out = iterations;
170 DER_Encoder(pbkdf2_params)
178 kdf_algo = AlgorithmIdentifier(
"PKCS5.PBKDF2", pbkdf2_params);
186std::pair<AlgorithmIdentifier, std::vector<uint8_t>> pbes2_encrypt_shared(std::span<const uint8_t> key_bits,
187 std::string_view passphrase,
188 size_t* msec_in_iterations_out,
189 size_t iterations_if_msec_null,
190 std::string_view cipher,
191 std::string_view prf,
192 RandomNumberGenerator& rng) {
195 const auto cipher_spec =
split_on(cipher,
'/');
197 if(cipher_spec.size() != 2 || !known_pbes_cipher_mode(cipher_spec[1]) || !enc) {
198 throw Encoding_Error(
fmt(
"PBE-PKCS5 v2.0: Invalid or unavailable cipher '{}'", cipher));
201 const size_t key_length = enc->key_spec().maximum_keylength();
203 const secure_vector<uint8_t> iv = rng.random_vec(enc->default_nonce_length());
205 AlgorithmIdentifier kdf_algo;
207 const secure_vector<uint8_t> derived_key =
208 derive_key(passphrase, prf, rng, msec_in_iterations_out, iterations_if_msec_null, key_length, kdf_algo);
210 enc->set_key(derived_key);
212 secure_vector<uint8_t> ctext(key_bits.begin(), key_bits.end());
215 std::vector<uint8_t> encoded_iv;
218 std::vector<uint8_t> pbes2_params;
219 DER_Encoder(pbes2_params)
222 .encode(AlgorithmIdentifier(cipher, encoded_iv))
227 return std::make_pair(
id,
unlock(ctext));
232std::pair<AlgorithmIdentifier, std::vector<uint8_t>>
pbes2_encrypt(std::span<const uint8_t> key_bits,
233 std::string_view passphrase,
234 std::chrono::milliseconds msec,
235 std::string_view cipher,
236 std::string_view digest,
238 size_t msec_in_iterations_out =
static_cast<size_t>(msec.count());
239 return pbes2_encrypt_shared(key_bits, passphrase, &msec_in_iterations_out, 0, cipher, digest, rng);
243std::pair<AlgorithmIdentifier, std::vector<uint8_t>>
pbes2_encrypt_msec(std::span<const uint8_t> key_bits,
244 std::string_view passphrase,
245 std::chrono::milliseconds msec,
246 size_t* out_iterations_if_nonnull,
247 std::string_view cipher,
248 std::string_view digest,
250 size_t msec_in_iterations_out =
static_cast<size_t>(msec.count());
252 auto ret = pbes2_encrypt_shared(key_bits, passphrase, &msec_in_iterations_out, 0, cipher, digest, rng);
254 if(out_iterations_if_nonnull) {
255 *out_iterations_if_nonnull = msec_in_iterations_out;
261std::pair<AlgorithmIdentifier, std::vector<uint8_t>>
pbes2_encrypt_iter(std::span<const uint8_t> key_bits,
262 std::string_view passphrase,
264 std::string_view cipher,
265 std::string_view digest,
267 return pbes2_encrypt_shared(key_bits, passphrase,
nullptr, pbkdf_iter, cipher, digest, rng);
271 std::string_view passphrase,
272 const std::vector<uint8_t>& params) {
278 const auto cipher_spec =
split_on(cipher,
'/');
279 if(cipher_spec.size() != 2 || !known_pbes_cipher_mode(cipher_spec[1])) {
291 dec->set_key(derive_key(passphrase, kdf_algo, dec->key_spec().maximum_keylength()));
const std::vector< uint8_t > & parameters() const
BER_Decoder & decode(bool &out)
BER_Decoder & verify_end()
BER_Decoder start_sequence()
static std::unique_ptr< Cipher_Mode > create(std::string_view algo, Cipher_Dir direction, std::string_view provider="")
std::string human_name_or_empty() const
static OID from_string(std::string_view str)
static std::unique_ptr< PasswordHashFamily > create_or_throw(std::string_view algo_spec, std::string_view provider="")
static std::unique_ptr< PasswordHashFamily > create(std::string_view algo_spec, std::string_view provider="")
std::string fmt(std::string_view format, const T &... args)
std::vector< std::string > split_on(std::string_view str, char delim)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > > pbes2_encrypt_iter(std::span< const uint8_t > key_bits, std::string_view passphrase, size_t pbkdf_iter, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
secure_vector< uint8_t > pbes2_decrypt(std::span< const uint8_t > key_bits, std::string_view passphrase, const std::vector< uint8_t > ¶ms)
std::vector< T > unlock(const secure_vector< T > &in)
std::pair< AlgorithmIdentifier, std::vector< uint8_t > > pbes2_encrypt_msec(std::span< const uint8_t > key_bits, std::string_view passphrase, std::chrono::milliseconds msec, size_t *out_iterations_if_nonnull, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)
std::vector< T, secure_allocator< T > > secure_vector
std::pair< AlgorithmIdentifier, std::vector< uint8_t > > pbes2_encrypt(std::span< const uint8_t > key_bits, std::string_view passphrase, std::chrono::milliseconds msec, std::string_view cipher, std::string_view digest, RandomNumberGenerator &rng)