Botan 3.9.0
Crypto and TLS for C&
pbkdf2.cpp
Go to the documentation of this file.
1/*
2* PBKDF2
3* (C) 1999-2007 Jack Lloyd
4* (C) 2018 Ribose Inc
5*
6* Botan is released under the Simplified BSD License (see license.txt)
7*/
8
9#include <botan/pbkdf2.h>
10
11#include <botan/exceptn.h>
12#include <botan/mem_ops.h>
13#include <botan/internal/fmt.h>
14#include <botan/internal/mem_utils.h>
15#include <botan/internal/time_utils.h>
16
17namespace Botan {
18
19namespace {
20
21void pbkdf2_set_key(MessageAuthenticationCode& prf, const char* password, size_t password_len) {
22 try {
23 prf.set_key(as_span_of_bytes(password, password_len));
24 } catch(Invalid_Key_Length&) {
25 throw Invalid_Argument("PBKDF2 cannot accept passphrase of the given size");
26 }
27}
28
29size_t tune_pbkdf2(MessageAuthenticationCode& prf,
30 size_t output_length,
31 std::chrono::milliseconds msec,
32 std::chrono::milliseconds tune_time = std::chrono::milliseconds(10)) {
33 if(output_length == 0) {
34 output_length = 1;
35 }
36
37 const size_t prf_sz = prf.output_length();
38 BOTAN_ASSERT_NOMSG(prf_sz > 0);
39 secure_vector<uint8_t> U(prf_sz);
40
41 const size_t trial_iterations = 2000;
42
43 // Short output ensures we only need a single PBKDF2 block
44
45 prf.set_key(nullptr, 0);
46
47 const uint64_t duration_nsec = measure_cost(tune_time, [&]() {
48 uint8_t out[12] = {0};
49 uint8_t salt[12] = {0};
50 pbkdf2(prf, out, sizeof(out), salt, sizeof(salt), trial_iterations);
51 });
52
53 const uint64_t desired_nsec = static_cast<uint64_t>(msec.count()) * 1000000;
54
55 if(duration_nsec > desired_nsec) {
56 return trial_iterations;
57 }
58
59 const size_t blocks_needed = (output_length + prf_sz - 1) / prf_sz;
60
61 const size_t multiplier = static_cast<size_t>(desired_nsec / duration_nsec / blocks_needed);
62
63 if(multiplier == 0) {
64 return trial_iterations;
65 } else {
66 return trial_iterations * multiplier;
67 }
68}
69
70} // namespace
71
73 uint8_t out[],
74 size_t out_len,
75 std::string_view password,
76 const uint8_t salt[],
77 size_t salt_len,
78 size_t iterations,
79 std::chrono::milliseconds msec) {
80 if(iterations == 0) {
81 iterations = tune_pbkdf2(prf, out_len, msec);
82 }
83
84 PBKDF2 pbkdf2(prf, iterations);
85
86 pbkdf2.derive_key(out, out_len, password.data(), password.size(), salt, salt_len);
87
88 return iterations;
89}
90
92 uint8_t out[],
93 size_t out_len,
94 const uint8_t salt[],
95 size_t salt_len,
96 size_t iterations) {
97 if(iterations == 0) {
98 throw Invalid_Argument("PBKDF2: Invalid iteration count");
99 }
100
101 clear_mem(out, out_len);
102
103 if(out_len == 0) {
104 return;
105 }
106
107 const size_t prf_sz = prf.output_length();
108 BOTAN_ASSERT_NOMSG(prf_sz > 0);
109
110 secure_vector<uint8_t> U(prf_sz);
111
112 uint32_t counter = 1;
113 while(out_len > 0) {
114 const size_t prf_output = std::min<size_t>(prf_sz, out_len);
115
116 prf.update(salt, salt_len);
117 prf.update_be(counter++);
118 prf.final(U.data());
119
120 xor_buf(out, U.data(), prf_output);
121
122 for(size_t i = 1; i != iterations; ++i) {
123 prf.update(U);
124 prf.final(U.data());
125 xor_buf(out, U.data(), prf_output);
126 }
127
128 out_len -= prf_output;
129 out += prf_output;
130 }
131}
132
133// PBKDF interface
134size_t PKCS5_PBKDF2::pbkdf(uint8_t key[],
135 size_t key_len,
136 std::string_view password,
137 const uint8_t salt[],
138 size_t salt_len,
139 size_t iterations,
140 std::chrono::milliseconds msec) const {
141 if(iterations == 0) {
142 iterations = tune_pbkdf2(*m_mac, key_len, msec);
143 }
144
145 PBKDF2 pbkdf2(*m_mac, iterations);
146
147 pbkdf2.derive_key(key, key_len, password.data(), password.size(), salt, salt_len);
148
149 return iterations;
150}
151
152std::string PKCS5_PBKDF2::name() const {
153 return fmt("PBKDF2({})", m_mac->name());
154}
155
156std::unique_ptr<PBKDF> PKCS5_PBKDF2::new_object() const {
157 return std::make_unique<PKCS5_PBKDF2>(m_mac->new_object());
158}
159
160// PasswordHash interface
161
162PBKDF2::PBKDF2(const MessageAuthenticationCode& prf, size_t olen, std::chrono::milliseconds msec) :
163 m_prf(prf.new_object()), m_iterations(tune_pbkdf2(*m_prf, olen, msec)) {}
164
165std::string PBKDF2::to_string() const {
166 return fmt("PBKDF2({},{})", m_prf->name(), m_iterations);
167}
168
169void PBKDF2::derive_key(uint8_t out[],
170 size_t out_len,
171 const char* password,
172 const size_t password_len,
173 const uint8_t salt[],
174 size_t salt_len) const {
175 pbkdf2_set_key(*m_prf, password, password_len);
176 pbkdf2(*m_prf, out, out_len, salt, salt_len, m_iterations);
177}
178
179std::string PBKDF2_Family::name() const {
180 return fmt("PBKDF2({})", m_prf->name());
181}
182
183std::unique_ptr<PasswordHash> PBKDF2_Family::tune(size_t output_len,
184 std::chrono::milliseconds msec,
185 size_t /*max_memory_usage_mb*/,
186 std::chrono::milliseconds tune_time) const {
187 auto iterations = tune_pbkdf2(*m_prf, output_len, msec, tune_time);
188 return std::make_unique<PBKDF2>(*m_prf, iterations);
189}
190
191std::unique_ptr<PasswordHash> PBKDF2_Family::default_params() const {
192 return std::make_unique<PBKDF2>(*m_prf, 150000);
193}
194
195std::unique_ptr<PasswordHash> PBKDF2_Family::from_params(size_t iter, size_t /*i2*/, size_t /*i3*/) const {
196 return std::make_unique<PBKDF2>(*m_prf, iter);
197}
198
199std::unique_ptr<PasswordHash> PBKDF2_Family::from_iterations(size_t iter) const {
200 return std::make_unique<PBKDF2>(*m_prf, iter);
201}
202
203} // namespace Botan
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:75
void update(const uint8_t in[], size_t length)
Definition buf_comp.h:34
virtual size_t output_length() const =0
void update_be(uint16_t val)
Definition buf_comp.cpp:18
void final(uint8_t out[])
Definition buf_comp.h:69
std::string name() const override
Definition pbkdf2.cpp:179
std::unique_ptr< PasswordHash > default_params() const override
Definition pbkdf2.cpp:191
std::unique_ptr< PasswordHash > from_iterations(size_t iter) const override
Definition pbkdf2.cpp:199
std::unique_ptr< PasswordHash > tune(size_t output_len, std::chrono::milliseconds msec, size_t max_memory, std::chrono::milliseconds tune_msec) const override
Definition pbkdf2.cpp:183
std::unique_ptr< PasswordHash > from_params(size_t iter, size_t, size_t) const override
Definition pbkdf2.cpp:195
PBKDF2(const MessageAuthenticationCode &prf, size_t iter)
Definition pbkdf2.h:47
void derive_key(uint8_t out[], size_t out_len, const char *password, size_t password_len, const uint8_t salt[], size_t salt_len) const override
Definition pbkdf2.cpp:169
std::string to_string() const override
Definition pbkdf2.cpp:165
size_t pbkdf(uint8_t output_buf[], size_t output_len, std::string_view passphrase, const uint8_t salt[], size_t salt_len, size_t iterations, std::chrono::milliseconds msec) const override
Definition pbkdf2.cpp:134
std::string name() const override
Definition pbkdf2.cpp:152
std::unique_ptr< PBKDF > new_object() const override
Definition pbkdf2.cpp:156
std::span< const uint8_t > as_span_of_bytes(const char *s, size_t len)
Definition mem_utils.h:28
std::string fmt(std::string_view format, const T &... args)
Definition fmt.h:53
constexpr void xor_buf(ranges::contiguous_output_range< uint8_t > auto &&out, ranges::contiguous_range< uint8_t > auto &&in)
Definition mem_ops.h:342
std::vector< T, secure_allocator< T > > secure_vector
Definition secmem.h:69
uint64_t measure_cost(std::chrono::milliseconds trial_msec, F func)
Definition time_utils.h:21
size_t pbkdf2(MessageAuthenticationCode &prf, uint8_t out[], size_t out_len, std::string_view password, const uint8_t salt[], size_t salt_len, size_t iterations, std::chrono::milliseconds msec)
Definition pbkdf2.cpp:72
constexpr void clear_mem(T *ptr, size_t n)
Definition mem_ops.h:119