/* * HMAC_DRBG update, using optional additional data (10.1.2.2) */ SSL_ROM_TEXT_SECTION void hmac_drbg_update( hmac_drbg_context *ctx, const unsigned char *additional, size_t add_len ) { size_t md_len = ctx->md_ctx.md_info->size; unsigned char rounds = ( additional != NULL && add_len != 0 ) ? 2 : 1; unsigned char sep[1]; unsigned char K[POLARSSL_MD_MAX_SIZE]; for( sep[0] = 0; sep[0] < rounds; sep[0]++ ) { /* Step 1 or 4 */ md_hmac_reset( &ctx->md_ctx ); md_hmac_update( &ctx->md_ctx, ctx->V, md_len ); md_hmac_update( &ctx->md_ctx, sep, 1 ); if( rounds == 2 ) md_hmac_update( &ctx->md_ctx, additional, add_len ); md_hmac_finish( &ctx->md_ctx, K ); /* Step 2 or 5 */ md_hmac_starts( &ctx->md_ctx, K, md_len ); md_hmac_update( &ctx->md_ctx, ctx->V, md_len ); md_hmac_finish( &ctx->md_ctx, ctx->V ); } }
/* * HMAC_DRBG random function with optional additional data: * 10.1.2.5 (arabic) + 9.3 (Roman) */ SSL_ROM_TEXT_SECTION int hmac_drbg_random_with_add( void *p_rng, unsigned char *output, size_t out_len, const unsigned char *additional, size_t add_len ) { int ret; hmac_drbg_context *ctx = (hmac_drbg_context *) p_rng; size_t md_len = md_get_size( ctx->md_ctx.md_info ); size_t left = out_len; unsigned char *out = output; /* II. Check request length */ if( out_len > POLARSSL_HMAC_DRBG_MAX_REQUEST ) return( POLARSSL_ERR_HMAC_DRBG_REQUEST_TOO_BIG ); /* III. Check input length */ if( add_len > POLARSSL_HMAC_DRBG_MAX_INPUT ) return( POLARSSL_ERR_HMAC_DRBG_INPUT_TOO_BIG ); /* 1. (aka VII and IX) Check reseed counter and PR */ if( ctx->f_entropy != NULL && /* For no-reseeding instances */ ( ctx->prediction_resistance == POLARSSL_HMAC_DRBG_PR_ON || ctx->reseed_counter > ctx->reseed_interval ) ) { if( ( ret = hmac_drbg_reseed( ctx, additional, add_len ) ) != 0 ) return( ret ); add_len = 0; /* VII.4 */ } /* 2. Use additional data if any */ if( additional != NULL && add_len != 0 ) hmac_drbg_update( ctx, additional, add_len ); /* 3, 4, 5. Generate bytes */ while( left != 0 ) { size_t use_len = left > md_len ? md_len : left; md_hmac_reset( &ctx->md_ctx ); md_hmac_update( &ctx->md_ctx, ctx->V, md_len ); md_hmac_finish( &ctx->md_ctx, ctx->V ); memcpy( out, ctx->V, use_len ); out += use_len; left -= use_len; } /* 6. Update */ hmac_drbg_update( ctx, additional, add_len ); /* 7. Update reseed counter */ ctx->reseed_counter++; /* 8. Done */ return( 0 ); }
void hmac_ctx_final (md_context_t *ctx, uint8_t *dst) { ASSERT(0 == md_hmac_finish(ctx, dst)); }
int pkcs5_pbkdf2_hmac( md_context_t *ctx, const unsigned char *password, size_t plen, const unsigned char *salt, size_t slen, unsigned int iteration_count, uint32_t key_length, unsigned char *output ) { int ret, j; unsigned int i; unsigned char md1[POLARSSL_MD_MAX_SIZE]; unsigned char work[POLARSSL_MD_MAX_SIZE]; unsigned char md_size = md_get_size( ctx->md_info ); size_t use_len; unsigned char *out_p = output; unsigned char counter[4]; memset( counter, 0, 4 ); counter[3] = 1; if( iteration_count > 0xFFFFFFFF ) return( POLARSSL_ERR_PKCS5_BAD_INPUT_DATA ); while( key_length ) { // U1 ends up in work // if( ( ret = md_hmac_starts( ctx, password, plen ) ) != 0 ) return( ret ); if( ( ret = md_hmac_update( ctx, salt, slen ) ) != 0 ) return( ret ); if( ( ret = md_hmac_update( ctx, counter, 4 ) ) != 0 ) return( ret ); if( ( ret = md_hmac_finish( ctx, work ) ) != 0 ) return( ret ); memcpy( md1, work, md_size ); for ( i = 1; i < iteration_count; i++ ) { // U2 ends up in md1 // if( ( ret = md_hmac_starts( ctx, password, plen ) ) != 0 ) return( ret ); if( ( ret = md_hmac_update( ctx, md1, md_size ) ) != 0 ) return( ret ); if( ( ret = md_hmac_finish( ctx, md1 ) ) != 0 ) return( ret ); // U1 xor U2 // for( j = 0; j < md_size; j++ ) work[j] ^= md1[j]; } use_len = ( key_length < md_size ) ? key_length : md_size; memcpy( out_p, work, use_len ); key_length -= use_len; out_p += use_len; for( i = 4; i > 0; i-- ) if( ++counter[i - 1] != 0 ) break; } return( 0 ); }