1 /* $OpenBSD: bcrypt_pbkdf.c,v 1.6 2014/01/31 16:56:32 tedu Exp $ */ 2 /* 3 * Copyright (c) 2013 Ted Unangst <tedu@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <sys/types.h> 19 #include <sys/param.h> 20 21 #include <stdlib.h> 22 #include <blf.h> 23 #include <sha2.h> 24 #include <string.h> 25 #include <util.h> 26 27 /* 28 * pkcs #5 pbkdf2 implementation using the "bcrypt" hash 29 * 30 * The bcrypt hash function is derived from the bcrypt password hashing 31 * function with the following modifications: 32 * 1. The input password and salt are preprocessed with SHA512. 33 * 2. The output length is expanded to 256 bits. 34 * 3. Subsequently the magic string to be encrypted is lengthened and modifed 35 * to "OxychromaticBlowfishSwatDynamite" 36 * 4. The hash function is defined to perform 64 rounds of initial state 37 * expansion. (More rounds are performed by iterating the hash.) 38 * 39 * Note that this implementation pulls the SHA512 operations into the caller 40 * as a performance optimization. 41 * 42 * One modification from official pbkdf2. Instead of outputting key material 43 * linearly, we mix it. pbkdf2 has a known weakness where if one uses it to 44 * generate (e.g.) 512 bits of key material for use as two 256 bit keys, an 45 * attacker can merely run once through the outer loop, but the user 46 * always runs it twice. Shuffling output bytes requires computing the 47 * entirety of the key material to assemble any subkey. This is something a 48 * wise caller could do; we just do it for you. 49 */ 50 51 #define BCRYPT_BLOCKS 8 52 #define BCRYPT_HASHSIZE (BCRYPT_BLOCKS * 4) 53 54 static void 55 bcrypt_hash(uint8_t *sha2pass, uint8_t *sha2salt, uint8_t *out) 56 { 57 blf_ctx state; 58 uint8_t ciphertext[BCRYPT_HASHSIZE] = 59 "OxychromaticBlowfishSwatDynamite"; 60 uint32_t cdata[BCRYPT_BLOCKS]; 61 int i; 62 uint16_t j; 63 size_t shalen = SHA512_DIGEST_LENGTH; 64 65 /* key expansion */ 66 Blowfish_initstate(&state); 67 Blowfish_expandstate(&state, sha2salt, shalen, sha2pass, shalen); 68 for (i = 0; i < 64; i++) { 69 Blowfish_expand0state(&state, sha2salt, shalen); 70 Blowfish_expand0state(&state, sha2pass, shalen); 71 } 72 73 /* encryption */ 74 j = 0; 75 for (i = 0; i < BCRYPT_BLOCKS; i++) 76 cdata[i] = Blowfish_stream2word(ciphertext, sizeof(ciphertext), 77 &j); 78 for (i = 0; i < 64; i++) 79 blf_enc(&state, cdata, sizeof(cdata) / sizeof(uint64_t)); 80 81 /* copy out */ 82 for (i = 0; i < BCRYPT_BLOCKS; i++) { 83 out[4 * i + 3] = (cdata[i] >> 24) & 0xff; 84 out[4 * i + 2] = (cdata[i] >> 16) & 0xff; 85 out[4 * i + 1] = (cdata[i] >> 8) & 0xff; 86 out[4 * i + 0] = cdata[i] & 0xff; 87 } 88 89 /* zap */ 90 explicit_bzero(ciphertext, sizeof(ciphertext)); 91 explicit_bzero(cdata, sizeof(cdata)); 92 explicit_bzero(&state, sizeof(state)); 93 } 94 95 int 96 bcrypt_pbkdf(const char *pass, size_t passlen, const uint8_t *salt, size_t saltlen, 97 uint8_t *key, size_t keylen, unsigned int rounds) 98 { 99 SHA2_CTX ctx; 100 uint8_t sha2pass[SHA512_DIGEST_LENGTH]; 101 uint8_t sha2salt[SHA512_DIGEST_LENGTH]; 102 uint8_t out[BCRYPT_HASHSIZE]; 103 uint8_t tmpout[BCRYPT_HASHSIZE]; 104 uint8_t countsalt[4]; 105 size_t i, j, amt, stride; 106 uint32_t count; 107 108 /* nothing crazy */ 109 if (rounds < 1) 110 return -1; 111 if (passlen == 0 || saltlen == 0 || keylen == 0 || 112 keylen > sizeof(out) * sizeof(out)) 113 return -1; 114 stride = (keylen + sizeof(out) - 1) / sizeof(out); 115 amt = (keylen + stride - 1) / stride; 116 117 /* collapse password */ 118 SHA512Init(&ctx); 119 SHA512Update(&ctx, pass, passlen); 120 SHA512Final(sha2pass, &ctx); 121 122 123 /* generate key, sizeof(out) at a time */ 124 for (count = 1; keylen > 0; count++) { 125 countsalt[0] = (count >> 24) & 0xff; 126 countsalt[1] = (count >> 16) & 0xff; 127 countsalt[2] = (count >> 8) & 0xff; 128 countsalt[3] = count & 0xff; 129 130 /* first round, salt is salt */ 131 SHA512Init(&ctx); 132 SHA512Update(&ctx, salt, saltlen); 133 SHA512Update(&ctx, countsalt, sizeof(countsalt)); 134 SHA512Final(sha2salt, &ctx); 135 bcrypt_hash(sha2pass, sha2salt, tmpout); 136 memcpy(out, tmpout, sizeof(out)); 137 138 for (i = 1; i < rounds; i++) { 139 /* subsequent rounds, salt is previous output */ 140 SHA512Init(&ctx); 141 SHA512Update(&ctx, tmpout, sizeof(tmpout)); 142 SHA512Final(sha2salt, &ctx); 143 bcrypt_hash(sha2pass, sha2salt, tmpout); 144 for (j = 0; j < sizeof(out); j++) 145 out[j] ^= tmpout[j]; 146 } 147 148 /* 149 * pbkdf2 deviation: ouput the key material non-linearly. 150 */ 151 amt = MIN(amt, keylen); 152 for (i = 0; i < amt; i++) 153 key[i * stride + (count - 1)] = out[i]; 154 keylen -= amt; 155 } 156 157 /* zap */ 158 explicit_bzero(&ctx, sizeof(ctx)); 159 explicit_bzero(out, sizeof(out)); 160 161 return 0; 162 } 163