1 /* $OpenBSD: hkdf.c,v 1.11 2024/03/25 13:09:13 jsing Exp $ */ 2 /* 3 * Copyright (c) 2014, Google Inc. 4 * 5 * Permission to use, copy, modify, and/or distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY 12 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 14 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN 15 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <openssl/hkdf.h> 19 20 #include <string.h> 21 22 #include <openssl/err.h> 23 #include <openssl/hmac.h> 24 25 #include "bytestring.h" 26 #include "evp_local.h" 27 #include "hmac_local.h" 28 29 /* https://tools.ietf.org/html/rfc5869#section-2 */ 30 int 31 HKDF(uint8_t *out_key, size_t out_len, const EVP_MD *digest, 32 const uint8_t *secret, size_t secret_len, const uint8_t *salt, 33 size_t salt_len, const uint8_t *info, size_t info_len) 34 { 35 uint8_t prk[EVP_MAX_MD_SIZE]; 36 size_t prk_len; 37 38 if (!HKDF_extract(prk, &prk_len, digest, secret, secret_len, salt, 39 salt_len)) 40 return 0; 41 if (!HKDF_expand(out_key, out_len, digest, prk, prk_len, info, 42 info_len)) 43 return 0; 44 45 return 1; 46 } 47 LCRYPTO_ALIAS(HKDF); 48 49 /* https://tools.ietf.org/html/rfc5869#section-2.2 */ 50 int 51 HKDF_extract(uint8_t *out_key, size_t *out_len, 52 const EVP_MD *digest, const uint8_t *secret, size_t secret_len, 53 const uint8_t *salt, size_t salt_len) 54 { 55 unsigned int len; 56 57 /* 58 * If salt is not given, HashLength zeros are used. However, HMAC does 59 * that internally already so we can ignore it. 60 */ 61 if (HMAC(digest, salt, salt_len, secret, secret_len, out_key, &len) == 62 NULL) { 63 CRYPTOerror(ERR_R_CRYPTO_LIB); 64 return 0; 65 } 66 *out_len = len; 67 return 1; 68 } 69 LCRYPTO_ALIAS(HKDF_extract); 70 71 /* https://tools.ietf.org/html/rfc5869#section-2.3 */ 72 int 73 HKDF_expand(uint8_t *out_key, size_t out_len, 74 const EVP_MD *digest, const uint8_t *prk, size_t prk_len, 75 const uint8_t *info, size_t info_len) 76 { 77 const size_t digest_len = EVP_MD_size(digest); 78 uint8_t out_hmac[EVP_MAX_MD_SIZE]; 79 size_t n, remaining; 80 uint8_t ctr; 81 HMAC_CTX *hmac = NULL; 82 CBB cbb; 83 int ret = 0; 84 85 if (!CBB_init_fixed(&cbb, out_key, out_len)) 86 goto err; 87 88 if ((hmac = HMAC_CTX_new()) == NULL) 89 goto err; 90 if (!HMAC_Init_ex(hmac, prk, prk_len, digest, NULL)) 91 goto err; 92 93 remaining = out_len; 94 ctr = 0; 95 96 /* Expand key material to desired length. */ 97 while (remaining > 0) { 98 if (++ctr == 0) { 99 CRYPTOerror(EVP_R_TOO_LARGE); 100 goto err; 101 } 102 103 if (!HMAC_Update(hmac, info, info_len)) 104 goto err; 105 if (!HMAC_Update(hmac, &ctr, 1)) 106 goto err; 107 if (!HMAC_Final(hmac, out_hmac, NULL)) 108 goto err; 109 110 if ((n = remaining) > digest_len) 111 n = digest_len; 112 113 if (!CBB_add_bytes(&cbb, out_hmac, n)) 114 goto err; 115 116 remaining -= n; 117 118 if (remaining > 0) { 119 if (!HMAC_Init_ex(hmac, NULL, 0, NULL, NULL)) 120 goto err; 121 if (!HMAC_Update(hmac, out_hmac, digest_len)) 122 goto err; 123 } 124 } 125 126 ret = 1; 127 128 err: 129 CBB_cleanup(&cbb); 130 HMAC_CTX_free(hmac); 131 explicit_bzero(out_hmac, sizeof(out_hmac)); 132 133 return ret; 134 } 135 LCRYPTO_ALIAS(HKDF_expand); 136