diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2019-05-03 13:04:58 +1000 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2019-06-11 20:40:07 +1000 |
| commit | f0efeea29eca6e528a976f62ae2422eee34ea0eb (patch) | |
| tree | 468ae2e94d4aaf2cd9bc2972d97f447117da68af /include/openssl/kdf.h | |
| parent | 83b4a24384e62ed8cf91f51bf9a303f98017e13e (diff) | |
| download | openssl-new-f0efeea29eca6e528a976f62ae2422eee34ea0eb.tar.gz | |
PBKDF2 updates to conform to SP800-132
The existing code used PKCS5 specifications.
SP800-132 adds the following additional constraints for:
- the range of the key length.
- the minimum iteration count (1000 recommended).
- salt length (at least 128 bits).
These additional constraints may cause errors (in scrypt, and
some PKCS5 related test vectors). To disable the new
constraints use the new ctrl string "pkcs5".
For backwards compatability, the checks are only enabled by
default for fips mode.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8868)
Diffstat (limited to 'include/openssl/kdf.h')
| -rw-r--r-- | include/openssl/kdf.h | 47 |
1 files changed, 24 insertions, 23 deletions
diff --git a/include/openssl/kdf.h b/include/openssl/kdf.h index b13b54cfc9..960098db29 100644 --- a/include/openssl/kdf.h +++ b/include/openssl/kdf.h @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -44,28 +44,29 @@ int EVP_KDF_nid(const EVP_KDF *kdf); # define EVP_KDF_name(o) OBJ_nid2sn(EVP_KDF_nid(o)) const EVP_KDF *EVP_get_kdfbyname(const char *name); -# define EVP_KDF_CTRL_SET_PASS 0x01 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_SET_SALT 0x02 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_SET_ITER 0x03 /* int */ -# define EVP_KDF_CTRL_SET_MD 0x04 /* EVP_MD * */ -# define EVP_KDF_CTRL_SET_KEY 0x05 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_SET_MAXMEM_BYTES 0x06 /* uint64_t */ -# define EVP_KDF_CTRL_SET_TLS_SECRET 0x07 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_RESET_TLS_SEED 0x08 -# define EVP_KDF_CTRL_ADD_TLS_SEED 0x09 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_RESET_HKDF_INFO 0x0a -# define EVP_KDF_CTRL_ADD_HKDF_INFO 0x0b /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_SET_HKDF_MODE 0x0c /* int */ -# define EVP_KDF_CTRL_SET_SCRYPT_N 0x0d /* uint64_t */ -# define EVP_KDF_CTRL_SET_SCRYPT_R 0x0e /* uint32_t */ -# define EVP_KDF_CTRL_SET_SCRYPT_P 0x0f /* uint32_t */ -# define EVP_KDF_CTRL_SET_SSHKDF_XCGHASH 0x10 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID 0x11 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_SET_SSHKDF_TYPE 0x12 /* int */ -# define EVP_KDF_CTRL_SET_MAC 0x13 /* EVP_MAC * */ -# define EVP_KDF_CTRL_SET_MAC_SIZE 0x14 /* size_t */ -# define EVP_KDF_CTRL_SET_SSKDF_INFO 0x15 /* unsigned char *, size_t */ -# define EVP_KDF_CTRL_SET_SHARED_INFO EVP_KDF_CTRL_SET_SSKDF_INFO +# define EVP_KDF_CTRL_SET_PASS 0x01 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_SET_SALT 0x02 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_SET_ITER 0x03 /* int */ +# define EVP_KDF_CTRL_SET_MD 0x04 /* EVP_MD * */ +# define EVP_KDF_CTRL_SET_KEY 0x05 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_SET_MAXMEM_BYTES 0x06 /* uint64_t */ +# define EVP_KDF_CTRL_SET_TLS_SECRET 0x07 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_RESET_TLS_SEED 0x08 +# define EVP_KDF_CTRL_ADD_TLS_SEED 0x09 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_RESET_HKDF_INFO 0x0a +# define EVP_KDF_CTRL_ADD_HKDF_INFO 0x0b /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_SET_HKDF_MODE 0x0c /* int */ +# define EVP_KDF_CTRL_SET_SCRYPT_N 0x0d /* uint64_t */ +# define EVP_KDF_CTRL_SET_SCRYPT_R 0x0e /* uint32_t */ +# define EVP_KDF_CTRL_SET_SCRYPT_P 0x0f /* uint32_t */ +# define EVP_KDF_CTRL_SET_SSHKDF_XCGHASH 0x10 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID 0x11 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_SET_SSHKDF_TYPE 0x12 /* int */ +# define EVP_KDF_CTRL_SET_MAC 0x13 /* EVP_MAC * */ +# define EVP_KDF_CTRL_SET_MAC_SIZE 0x14 /* size_t */ +# define EVP_KDF_CTRL_SET_SSKDF_INFO 0x15 /* unsigned char *, size_t */ +# define EVP_KDF_CTRL_SET_PBKDF2_PKCS5_MODE 0x16 /* int */ +# define EVP_KDF_CTRL_SET_SHARED_INFO EVP_KDF_CTRL_SET_SSKDF_INFO # define EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND 0 # define EVP_KDF_HKDF_MODE_EXTRACT_ONLY 1 |