1 /* $OpenBSD: hkdf.c,v 1.7 2021/12/12 21:30:14 tb Exp $ */
2 /* Copyright (c) 2014, Google Inc.
3 *
4 * Permission to use, copy, modify, and/or distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
13 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
14 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17 #include <openssl/hkdf.h>
18
19 #include <string.h>
20
21 #include <openssl/err.h>
22 #include <openssl/hmac.h>
23
24 #include "evp_locl.h"
25 #include "hmac_local.h"
26
27 /* https://tools.ietf.org/html/rfc5869#section-2 */
28 int
HKDF(uint8_t * out_key,size_t out_len,const EVP_MD * digest,const uint8_t * secret,size_t secret_len,const uint8_t * salt,size_t salt_len,const uint8_t * info,size_t info_len)29 HKDF(uint8_t *out_key, size_t out_len, const EVP_MD *digest,
30 const uint8_t *secret, size_t secret_len, const uint8_t *salt,
31 size_t salt_len, const uint8_t *info, size_t info_len)
32 {
33 uint8_t prk[EVP_MAX_MD_SIZE];
34 size_t prk_len;
35
36 if (!HKDF_extract(prk, &prk_len, digest, secret, secret_len, salt,
37 salt_len))
38 return 0;
39 if (!HKDF_expand(out_key, out_len, digest, prk, prk_len, info,
40 info_len))
41 return 0;
42
43 return 1;
44 }
45
46 /* https://tools.ietf.org/html/rfc5869#section-2.2 */
47 int
HKDF_extract(uint8_t * out_key,size_t * out_len,const EVP_MD * digest,const uint8_t * secret,size_t secret_len,const uint8_t * salt,size_t salt_len)48 HKDF_extract(uint8_t *out_key, size_t *out_len,
49 const EVP_MD *digest, const uint8_t *secret, size_t secret_len,
50 const uint8_t *salt, size_t salt_len)
51 {
52 unsigned int len;
53
54 /*
55 * If salt is not given, HashLength zeros are used. However, HMAC does
56 * that internally already so we can ignore it.
57 */
58 if (HMAC(digest, salt, salt_len, secret, secret_len, out_key, &len) ==
59 NULL) {
60 CRYPTOerror(ERR_R_CRYPTO_LIB);
61 return 0;
62 }
63 *out_len = len;
64 return 1;
65 }
66
67 /* https://tools.ietf.org/html/rfc5869#section-2.3 */
68 int
HKDF_expand(uint8_t * out_key,size_t out_len,const EVP_MD * digest,const uint8_t * prk,size_t prk_len,const uint8_t * info,size_t info_len)69 HKDF_expand(uint8_t *out_key, size_t out_len,
70 const EVP_MD *digest, const uint8_t *prk, size_t prk_len,
71 const uint8_t *info, size_t info_len)
72 {
73 const size_t digest_len = EVP_MD_size(digest);
74 uint8_t previous[EVP_MAX_MD_SIZE];
75 size_t n, done = 0;
76 unsigned int i;
77 int ret = 0;
78 HMAC_CTX hmac;
79
80 /* Expand key material to desired length. */
81 n = (out_len + digest_len - 1) / digest_len;
82 if (out_len + digest_len < out_len || n > 255) {
83 CRYPTOerror(EVP_R_TOO_LARGE);
84 return 0;
85 }
86
87 HMAC_CTX_init(&hmac);
88 if (!HMAC_Init_ex(&hmac, prk, prk_len, digest, NULL))
89 goto out;
90
91 for (i = 0; i < n; i++) {
92 uint8_t ctr = i + 1;
93 size_t todo;
94
95 if (i != 0 && (!HMAC_Init_ex(&hmac, NULL, 0, NULL, NULL) ||
96 !HMAC_Update(&hmac, previous, digest_len)))
97 goto out;
98
99 if (!HMAC_Update(&hmac, info, info_len) ||
100 !HMAC_Update(&hmac, &ctr, 1) ||
101 !HMAC_Final(&hmac, previous, NULL))
102 goto out;
103
104 todo = digest_len;
105 if (done + todo > out_len)
106 todo = out_len - done;
107
108 memcpy(out_key + done, previous, todo);
109 done += todo;
110 }
111
112 ret = 1;
113
114 out:
115 HMAC_CTX_cleanup(&hmac);
116 explicit_bzero(previous, sizeof(previous));
117 if (ret != 1)
118 CRYPTOerror(ERR_R_CRYPTO_LIB);
119 return ret;
120 }
121