/* * Copyright 2015 The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include "hkdf.h" #include <new> #include <keymaster/android_keymaster_utils.h> #include "hmac.h" namespace keymaster { bool Rfc5869Sha256Kdf::GenerateKey(const uint8_t* info, size_t info_len, uint8_t* output, size_t output_len) { if (!is_initialized_ || output == nullptr) return false; /** * Step 1. Extract: PRK = HMAC-SHA256(actual_salt, secret) * https://tools.ietf.org/html/rfc5869#section-2.2 */ HmacSha256 prk_hmac; bool result; if (salt_.get() != nullptr && salt_len_ > 0) { result = prk_hmac.Init(salt_.get(), salt_len_); } else { UniquePtr<uint8_t[]> zeros(new uint8_t[digest_size_]); if (zeros.get() == nullptr) return false; /* If salt is not given, digest size of zeros are used. */ memset(zeros.get(), 0, digest_size_); result = prk_hmac.Init(zeros.get(), digest_size_); } if (!result) return false; UniquePtr<uint8_t[]> pseudo_random_key(new uint8_t[digest_size_]); if (pseudo_random_key.get() == nullptr || digest_size_ != prk_hmac.DigestLength()) return false; result = prk_hmac.Sign(secret_key_.get(), secret_key_len_, pseudo_random_key.get(), digest_size_); if (!result) return false; /** * Step 2. Expand: OUTPUT = HKDF-Expand(PRK, info) * https://tools.ietf.org/html/rfc5869#section-2.3 */ const size_t num_blocks = (output_len + digest_size_ - 1) / digest_size_; if (num_blocks >= 256u) return false; UniquePtr<uint8_t[]> buf(new uint8_t[digest_size_ + info_len + 1]); UniquePtr<uint8_t[]> digest(new uint8_t[digest_size_]); if (buf.get() == nullptr || digest.get() == nullptr) return false; HmacSha256 hmac; result = hmac.Init(pseudo_random_key.get(), digest_size_); if (!result) return false; for (size_t i = 0; i < num_blocks; i++) { size_t block_input_len = 0; if (i != 0) { memcpy(buf.get(), digest.get(), digest_size_); block_input_len = digest_size_; } if (info != nullptr && info_len > 0) memcpy(buf.get() + block_input_len, info, info_len); block_input_len += info_len; *(buf.get() + block_input_len++) = static_cast<uint8_t>(i + 1); result = hmac.Sign(buf.get(), block_input_len, digest.get(), digest_size_); if (!result) return false; size_t block_output_len = digest_size_ < output_len - i * digest_size_ ? digest_size_ : output_len - i * digest_size_; memcpy(output + i * digest_size_, digest.get(), block_output_len); } return true; } } // namespace keymaster