1 /* 2 * Copyright 2015 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 #include "hkdf.h" 18 19 #include <new> 20 21 #include <keymaster/android_keymaster_utils.h> 22 23 #include "hmac.h" 24 25 namespace keymaster { 26 27 bool Rfc5869Sha256Kdf::GenerateKey(const uint8_t* info, size_t info_len, uint8_t* output, 28 size_t output_len) { 29 if (!is_initialized_ || output == nullptr) 30 return false; 31 /** 32 * Step 1. Extract: PRK = HMAC-SHA256(actual_salt, secret) 33 * https://tools.ietf.org/html/rfc5869#section-2.2 34 */ 35 HmacSha256 prk_hmac; 36 bool result; 37 if (salt_.get() != nullptr && salt_len_ > 0) { 38 result = prk_hmac.Init(salt_.get(), salt_len_); 39 } else { 40 UniquePtr<uint8_t[]> zeros(new uint8_t[digest_size_]); 41 if (zeros.get() == nullptr) 42 return false; 43 /* If salt is not given, digest size of zeros are used. */ 44 memset(zeros.get(), 0, digest_size_); 45 result = prk_hmac.Init(zeros.get(), digest_size_); 46 } 47 if (!result) 48 return false; 49 50 UniquePtr<uint8_t[]> pseudo_random_key(new uint8_t[digest_size_]); 51 if (pseudo_random_key.get() == nullptr || digest_size_ != prk_hmac.DigestLength()) 52 return false; 53 result = 54 prk_hmac.Sign(secret_key_.get(), secret_key_len_, pseudo_random_key.get(), digest_size_); 55 if (!result) 56 return false; 57 58 /** 59 * Step 2. Expand: OUTPUT = HKDF-Expand(PRK, info) 60 * https://tools.ietf.org/html/rfc5869#section-2.3 61 */ 62 const size_t num_blocks = (output_len + digest_size_ - 1) / digest_size_; 63 if (num_blocks >= 256u) 64 return false; 65 66 UniquePtr<uint8_t[]> buf(new uint8_t[digest_size_ + info_len + 1]); 67 UniquePtr<uint8_t[]> digest(new uint8_t[digest_size_]); 68 if (buf.get() == nullptr || digest.get() == nullptr) 69 return false; 70 HmacSha256 hmac; 71 result = hmac.Init(pseudo_random_key.get(), digest_size_); 72 if (!result) 73 return false; 74 75 for (size_t i = 0; i < num_blocks; i++) { 76 size_t block_input_len = 0; 77 if (i != 0) { 78 memcpy(buf.get(), digest.get(), digest_size_); 79 block_input_len = digest_size_; 80 } 81 if (info != nullptr && info_len > 0) 82 memcpy(buf.get() + block_input_len, info, info_len); 83 block_input_len += info_len; 84 *(buf.get() + block_input_len++) = static_cast<uint8_t>(i + 1); 85 result = hmac.Sign(buf.get(), block_input_len, digest.get(), digest_size_); 86 if (!result) 87 return false; 88 size_t block_output_len = digest_size_ < output_len - i * digest_size_ 89 ? digest_size_ 90 : output_len - i * digest_size_; 91 memcpy(output + i * digest_size_, digest.get(), block_output_len); 92 } 93 return true; 94 } 95 96 } // namespace keymaster 97
