Botan 3.9.0
Crypto and TLS for C&
bcrypt_pbkdf.cpp
Go to the documentation of this file.
1/*
2* (C) 2018,2019 Jack Lloyd
3*
4* Botan is released under the Simplified BSD License (see license.txt)
5*/
6
7#include <botan/bcrypt_pbkdf.h>
8
9#include <botan/hash.h>
10#include <botan/internal/blowfish.h>
11#include <botan/internal/fmt.h>
12#include <botan/internal/loadstor.h>
13#include <botan/internal/mem_utils.h>
14#include <botan/internal/time_utils.h>
15
16namespace Botan {
17
19 BOTAN_ARG_CHECK(m_iterations > 0, "Invalid Bcrypt-PBKDF iterations");
20}
21
22std::string Bcrypt_PBKDF::to_string() const {
23 return fmt("Bcrypt-PBKDF({})", m_iterations);
24}
25
26std::string Bcrypt_PBKDF_Family::name() const {
27 return "Bcrypt-PBKDF";
28}
29
30std::unique_ptr<PasswordHash> Bcrypt_PBKDF_Family::tune(size_t output_length,
31 std::chrono::milliseconds msec,
32 size_t /*max_memory*/,
33 std::chrono::milliseconds tune_time) const {
34 const size_t blocks = (output_length + 32 - 1) / 32;
35
36 if(blocks == 0) {
37 return default_params();
38 }
39
40 const size_t starting_iter = 2;
41
42 auto pwhash = this->from_iterations(starting_iter);
43
44 auto tune_fn = [&]() {
45 uint8_t output[32] = {0};
46 pwhash->derive_key(output, sizeof(output), "test", 4, nullptr, 0);
47 };
48
49 const uint64_t measured_time = measure_cost(tune_time, tune_fn) / blocks;
50
51 const uint64_t target_nsec = msec.count() * static_cast<uint64_t>(1000000);
52
53 const uint64_t desired_increase = target_nsec / measured_time;
54
55 if(desired_increase == 0) {
56 return this->from_iterations(starting_iter);
57 }
58
59 return this->from_iterations(static_cast<size_t>(desired_increase * starting_iter));
60}
61
62std::unique_ptr<PasswordHash> Bcrypt_PBKDF_Family::default_params() const {
63 return this->from_iterations(32); // About 100 ms on fast machine
64}
65
66std::unique_ptr<PasswordHash> Bcrypt_PBKDF_Family::from_iterations(size_t iterations) const {
67 return std::make_unique<Bcrypt_PBKDF>(iterations);
68}
69
70std::unique_ptr<PasswordHash> Bcrypt_PBKDF_Family::from_params(size_t iterations, size_t /*t*/, size_t /*p*/) const {
71 return this->from_iterations(iterations);
72}
73
74namespace {
75
76void bcrypt_round(Blowfish& blowfish,
77 const secure_vector<uint8_t>& pass_hash,
78 const secure_vector<uint8_t>& salt_hash,
81 const size_t BCRYPT_PBKDF_OUTPUT = 32;
82
83 // "OxychromaticBlowfishSwatDynamite"
84 alignas(64) static const uint8_t BCRYPT_PBKDF_MAGIC[BCRYPT_PBKDF_OUTPUT] = {
85 0x4F, 0x78, 0x79, 0x63, 0x68, 0x72, 0x6F, 0x6D, 0x61, 0x74, 0x69, 0x63, 0x42, 0x6C, 0x6F, 0x77,
86 0x66, 0x69, 0x73, 0x68, 0x53, 0x77, 0x61, 0x74, 0x44, 0x79, 0x6E, 0x61, 0x6D, 0x69, 0x74, 0x65};
87
88 const size_t BCRYPT_PBKDF_WORKFACTOR = 6;
89 const size_t BCRYPT_PBKDF_ROUNDS = 64;
90
91 blowfish.salted_set_key(
92 pass_hash.data(), pass_hash.size(), salt_hash.data(), salt_hash.size(), BCRYPT_PBKDF_WORKFACTOR, true);
93
94 copy_mem(tmp.data(), BCRYPT_PBKDF_MAGIC, BCRYPT_PBKDF_OUTPUT);
95 for(size_t i = 0; i != BCRYPT_PBKDF_ROUNDS; ++i) {
96 blowfish.encrypt(tmp);
97 }
98
99 /*
100 Bcrypt PBKDF loads the Blowfish output as big endian for no reason
101 in particular. We can't just swap everything once at the end
102 because the (big-endian) values are fed into SHA-512 to generate
103 the salt for the next round
104 */
105 for(size_t i = 0; i != 32 / 4; ++i) {
106 const uint32_t w = load_le<uint32_t>(tmp.data(), i);
107 store_be(w, &tmp[sizeof(uint32_t) * i]);
108 }
109
110 xor_buf(out.data(), tmp.data(), BCRYPT_PBKDF_OUTPUT);
111}
112
113} // namespace
114
115void Bcrypt_PBKDF::derive_key(uint8_t output[],
116 size_t output_len,
117 const char* password,
118 size_t password_len,
119 const uint8_t salt[],
120 size_t salt_len) const {
121 // No output desired, so we are all done already...
122 if(output_len == 0) {
123 return;
124 }
125
126 BOTAN_ARG_CHECK(output_len <= 10 * 1024 * 1024, "Too much output for Bcrypt PBKDF");
127
128 const size_t BCRYPT_BLOCK_SIZE = 32;
129 const size_t blocks = (output_len + BCRYPT_BLOCK_SIZE - 1) / BCRYPT_BLOCK_SIZE;
130
131 auto sha512 = HashFunction::create_or_throw("SHA-512");
132 const auto pass_hash = sha512->process(as_span_of_bytes(password, password_len));
133
134 secure_vector<uint8_t> salt_hash(sha512->output_length());
135
136 Blowfish blowfish;
137 secure_vector<uint8_t> out(BCRYPT_BLOCK_SIZE);
138 secure_vector<uint8_t> tmp(BCRYPT_BLOCK_SIZE);
139
140 for(size_t block = 0; block != blocks; ++block) {
141 clear_mem(out.data(), out.size());
142
143 sha512->update(salt, salt_len);
144 sha512->update_be(static_cast<uint32_t>(block + 1));
145 sha512->final(salt_hash.data());
146
147 bcrypt_round(blowfish, pass_hash, salt_hash, out, tmp);
148
149 for(size_t r = 1; r < m_iterations; ++r) {
150 // Next salt is H(prev_output)
151 sha512->update(tmp);
152 sha512->final(salt_hash.data());
153
154 bcrypt_round(blowfish, pass_hash, salt_hash, out, tmp);
155 }
156
157 for(size_t i = 0; i != BCRYPT_BLOCK_SIZE; ++i) {
158 const size_t dest = i * blocks + block;
159 if(dest < output_len) {
160 output[dest] = out[i];
161 }
162 }
163 }
164}
165
166} // namespace Botan
#define BOTAN_ARG_CHECK(expr, msg)
Definition assert.h:33
std::unique_ptr< PasswordHash > from_iterations(size_t iterations) const override
std::unique_ptr< PasswordHash > from_params(size_t iterations, size_t, size_t) const override
std::unique_ptr< PasswordHash > default_params() const override
std::unique_ptr< PasswordHash > tune(size_t output_length, std::chrono::milliseconds msec, size_t max_memory, std::chrono::milliseconds tune_msec) const override
std::string name() const override
void derive_key(uint8_t out[], size_t out_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len) const override
size_t iterations() const override
BOTAN_FUTURE_EXPLICIT Bcrypt_PBKDF(size_t iterations)
std::string to_string() const override
void encrypt(const uint8_t in[], uint8_t out[]) const
void salted_set_key(const uint8_t key[], size_t key_length, const uint8_t salt[], size_t salt_length, size_t workfactor, bool salt_first=false)
Definition blowfish.cpp:339
static std::unique_ptr< HashFunction > create_or_throw(std::string_view algo_spec, std::string_view provider="")
Definition hash.cpp:298
std::span< const uint8_t > as_span_of_bytes(const char *s, size_t len)
Definition mem_utils.h:28
constexpr void copy_mem(T *out, const T *in, size_t n)
Definition mem_ops.h:145
std::string fmt(std::string_view format, const T &... args)
Definition fmt.h:53
constexpr auto load_le(ParamTs &&... params)
Definition loadstor.h:495
constexpr void xor_buf(ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in)
Definition mem_ops.h:342
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:69
uint64_t measure_cost(std::chrono::milliseconds trial_msec, F func)
Definition time_utils.h:21
constexpr auto store_be(ParamTs &&... params)
Definition loadstor.h:745
constexpr void clear_mem(T *ptr, size_t n)
Definition mem_ops.h:119