libsec: add scrypt password based key derivation function
This commit is contained in:
parent
677dd90b02
commit
1492f46f87
6 changed files with 210 additions and 84 deletions
|
@ -154,6 +154,8 @@ void salsa_setblock(Salsastate*, u64int);
|
|||
void salsa_encrypt(uchar*, ulong, Salsastate*);
|
||||
void salsa_encrypt2(uchar*, uchar*, ulong, Salsastate*);
|
||||
|
||||
void salsa_core(u32int in[16], u32int out[16], int rounds);
|
||||
|
||||
void hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
|
||||
|
||||
/*
|
||||
|
@ -575,6 +577,11 @@ void curve25519_dh_finish(uchar x[32], uchar y[32], uchar z[32]);
|
|||
void pbkdf2_x(uchar *p, ulong plen, uchar *s, ulong slen, ulong rounds, uchar *d, ulong dlen,
|
||||
DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);
|
||||
|
||||
/* scrypt password-based key derivation function */
|
||||
char* scrypt(uchar *p, ulong plen, uchar *s, ulong slen,
|
||||
ulong N, ulong R, ulong P,
|
||||
uchar *d, ulong dlen);
|
||||
|
||||
/* hmac-based key derivation function (rfc5869) */
|
||||
void hkdf_x(uchar *salt, ulong nsalt, uchar *info, ulong ninfo, uchar *key, ulong nkey, uchar *d, ulong dlen,
|
||||
DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);
|
||||
|
|
|
@ -146,6 +146,8 @@ void salsa_setblock(Salsastate*, u64int);
|
|||
void salsa_encrypt(uchar*, ulong, Salsastate*);
|
||||
void salsa_encrypt2(uchar*, uchar*, ulong, Salsastate*);
|
||||
|
||||
void salsa_core(u32int in[16], u32int out[16], int rounds);
|
||||
|
||||
void hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
|
||||
|
||||
/*
|
||||
|
@ -567,6 +569,11 @@ void curve25519_dh_finish(uchar x[32], uchar y[32], uchar z[32]);
|
|||
void pbkdf2_x(uchar *p, ulong plen, uchar *s, ulong slen, ulong rounds, uchar *d, ulong dlen,
|
||||
DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);
|
||||
|
||||
/* scrypt password-based key derivation function */
|
||||
char* scrypt(uchar *p, ulong plen, uchar *s, ulong slen,
|
||||
ulong N, ulong R, ulong P,
|
||||
uchar *d, ulong dlen);
|
||||
|
||||
/* hmac-based key derivation function (rfc5869) */
|
||||
void hkdf_x(uchar *salt, ulong nsalt, uchar *info, ulong ninfo, uchar *key, ulong nkey, uchar *d, ulong dlen,
|
||||
DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);
|
||||
|
|
|
@ -32,6 +32,7 @@ CFILES = des.c desmodes.c desECB.c desCBC.c des3ECB.c des3CBC.c\
|
|||
curve25519.c\
|
||||
curve25519_dh.c\
|
||||
pbkdf2.c\
|
||||
scrypt.c\
|
||||
hkdf.c\
|
||||
ccpoly.c\
|
||||
tsmemcmp.c\
|
||||
|
|
|
@ -28,6 +28,7 @@ CFILES = des.c desmodes.c desECB.c desCBC.c des3ECB.c des3CBC.c\
|
|||
curve25519.c\
|
||||
curve25519_dh.c\
|
||||
pbkdf2.c\
|
||||
scrypt.c\
|
||||
hkdf.c\
|
||||
ccpoly.c\
|
||||
tsmemcmp.c\
|
||||
|
|
|
@ -1,13 +1,9 @@
|
|||
#include "os.h"
|
||||
#include <libsec.h>
|
||||
|
||||
enum{
|
||||
Blockwords= SalsaBsize/sizeof(u32int)
|
||||
};
|
||||
|
||||
/* little-endian data order */
|
||||
#define GET4(p) ((((((p)[3]<<8) | (p)[2])<<8) | (p)[1])<<8 | (p)[0])
|
||||
#define PUT4(p, v) (((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v))
|
||||
#define GET4(p) ((p)[0]|((p)[1]<<8)|((p)[2]<<16)|((p)[3]<<24))
|
||||
#define PUT4(p,v) (p)[0]=(v);(p)[1]=(v)>>8;(p)[2]=(v)>>16;(p)[3]=(v)>>24
|
||||
|
||||
#define ROTATE(v,c) (t = v, (u32int)(t << (c)) | (t >> (32 - (c))))
|
||||
|
||||
|
@ -78,30 +74,11 @@ setupSalsastate(Salsastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivlen,
|
|||
}
|
||||
|
||||
static void
|
||||
hsalsablock(uchar h[32], Salsastate *s)
|
||||
dorounds(u32int x[16], int rounds)
|
||||
{
|
||||
u32int x[Blockwords], t;
|
||||
int i, rounds;
|
||||
u32int t;
|
||||
|
||||
rounds = s->rounds;
|
||||
x[0] = s->input[0];
|
||||
x[1] = s->input[1];
|
||||
x[2] = s->input[2];
|
||||
x[3] = s->input[3];
|
||||
x[4] = s->input[4];
|
||||
x[5] = s->input[5];
|
||||
x[6] = s->input[6];
|
||||
x[7] = s->input[7];
|
||||
x[8] = s->input[8];
|
||||
x[9] = s->input[9];
|
||||
x[10] = s->input[10];
|
||||
x[11] = s->input[11];
|
||||
x[12] = s->input[12];
|
||||
x[13] = s->input[13];
|
||||
x[14] = s->input[14];
|
||||
x[15] = s->input[15];
|
||||
|
||||
for(i = rounds; i > 0; i -= 2) {
|
||||
for(; rounds > 0; rounds -= 2) {
|
||||
x[4] ^= ROTATE( x[0]+x[12], 7);
|
||||
x[8] ^= ROTATE( x[4]+ x[0], 9);
|
||||
x[12] ^= ROTATE( x[8]+ x[4],13);
|
||||
|
@ -135,6 +112,31 @@ hsalsablock(uchar h[32], Salsastate *s)
|
|||
x[14] ^= ROTATE(x[13]+x[12],13);
|
||||
x[15] ^= ROTATE(x[14]+x[13],18);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
hsalsablock(uchar h[32], Salsastate *s)
|
||||
{
|
||||
u32int x[16];
|
||||
|
||||
x[0] = s->input[0];
|
||||
x[1] = s->input[1];
|
||||
x[2] = s->input[2];
|
||||
x[3] = s->input[3];
|
||||
x[4] = s->input[4];
|
||||
x[5] = s->input[5];
|
||||
x[6] = s->input[6];
|
||||
x[7] = s->input[7];
|
||||
x[8] = s->input[8];
|
||||
x[9] = s->input[9];
|
||||
x[10] = s->input[10];
|
||||
x[11] = s->input[11];
|
||||
x[12] = s->input[12];
|
||||
x[13] = s->input[13];
|
||||
x[14] = s->input[14];
|
||||
x[15] = s->input[15];
|
||||
|
||||
dorounds(x, s->rounds);
|
||||
|
||||
PUT4(h+0*4, x[0]);
|
||||
PUT4(h+1*4, x[5]);
|
||||
|
@ -197,10 +199,9 @@ salsa_setblock(Salsastate *s, u64int blockno)
|
|||
static void
|
||||
encryptblock(Salsastate *s, uchar *src, uchar *dst)
|
||||
{
|
||||
u32int x[Blockwords], t;
|
||||
int i, rounds;
|
||||
u32int x[16];
|
||||
int i;
|
||||
|
||||
rounds = s->rounds;
|
||||
x[0] = s->input[0];
|
||||
x[1] = s->input[1];
|
||||
x[2] = s->input[2];
|
||||
|
@ -218,59 +219,8 @@ encryptblock(Salsastate *s, uchar *src, uchar *dst)
|
|||
x[14] = s->input[14];
|
||||
x[15] = s->input[15];
|
||||
|
||||
for(i = rounds; i > 0; i -= 2) {
|
||||
x[4] ^= ROTATE( x[0]+x[12], 7);
|
||||
x[8] ^= ROTATE( x[4]+ x[0], 9);
|
||||
x[12] ^= ROTATE( x[8]+ x[4],13);
|
||||
x[0] ^= ROTATE(x[12]+ x[8],18);
|
||||
x[9] ^= ROTATE( x[5]+ x[1], 7);
|
||||
x[13] ^= ROTATE( x[9]+ x[5], 9);
|
||||
x[1] ^= ROTATE(x[13]+ x[9],13);
|
||||
x[5] ^= ROTATE( x[1]+x[13],18);
|
||||
x[14] ^= ROTATE(x[10]+ x[6], 7);
|
||||
x[2] ^= ROTATE(x[14]+x[10], 9);
|
||||
x[6] ^= ROTATE( x[2]+x[14],13);
|
||||
x[10] ^= ROTATE( x[6]+ x[2],18);
|
||||
x[3] ^= ROTATE(x[15]+x[11], 7);
|
||||
x[7] ^= ROTATE( x[3]+x[15], 9);
|
||||
x[11] ^= ROTATE( x[7]+ x[3],13);
|
||||
x[15] ^= ROTATE(x[11]+ x[7],18);
|
||||
x[1] ^= ROTATE( x[0]+ x[3], 7);
|
||||
x[2] ^= ROTATE( x[1]+ x[0], 9);
|
||||
x[3] ^= ROTATE( x[2]+ x[1],13);
|
||||
x[0] ^= ROTATE( x[3]+ x[2],18);
|
||||
x[6] ^= ROTATE( x[5]+ x[4], 7);
|
||||
x[7] ^= ROTATE( x[6]+ x[5], 9);
|
||||
x[4] ^= ROTATE( x[7]+ x[6],13);
|
||||
x[5] ^= ROTATE( x[4]+ x[7],18);
|
||||
x[11] ^= ROTATE(x[10]+ x[9], 7);
|
||||
x[8] ^= ROTATE(x[11]+x[10], 9);
|
||||
x[9] ^= ROTATE( x[8]+x[11],13);
|
||||
x[10] ^= ROTATE( x[9]+ x[8],18);
|
||||
x[12] ^= ROTATE(x[15]+x[14], 7);
|
||||
x[13] ^= ROTATE(x[12]+x[15], 9);
|
||||
x[14] ^= ROTATE(x[13]+x[12],13);
|
||||
x[15] ^= ROTATE(x[14]+x[13],18);
|
||||
}
|
||||
dorounds(x, s->rounds);
|
||||
|
||||
#ifdef FULL_UNROLL
|
||||
ENCRYPT(src+0*4, x[0], s->input[0], dst+0*4);
|
||||
ENCRYPT(src+1*4, x[1], s->input[1], dst+1*4);
|
||||
ENCRYPT(src+2*4, x[2], s->input[2], dst+2*4);
|
||||
ENCRYPT(src+3*4, x[3], s->input[3], dst+3*4);
|
||||
ENCRYPT(src+4*4, x[4], s->input[4], dst+4*4);
|
||||
ENCRYPT(src+5*4, x[5], s->input[5], dst+5*4);
|
||||
ENCRYPT(src+6*4, x[6], s->input[6], dst+6*4);
|
||||
ENCRYPT(src+7*4, x[7], s->input[7], dst+7*4);
|
||||
ENCRYPT(src+8*4, x[8], s->input[8], dst+8*4);
|
||||
ENCRYPT(src+9*4, x[9], s->input[9], dst+9*4);
|
||||
ENCRYPT(src+10*4, x[10], s->input[10], dst+10*4);
|
||||
ENCRYPT(src+11*4, x[11], s->input[11], dst+11*4);
|
||||
ENCRYPT(src+12*4, x[12], s->input[12], dst+12*4);
|
||||
ENCRYPT(src+13*4, x[13], s->input[13], dst+13*4);
|
||||
ENCRYPT(src+14*4, x[14], s->input[14], dst+14*4);
|
||||
ENCRYPT(src+15*4, x[15], s->input[15], dst+15*4);
|
||||
#else
|
||||
for(i=0; i<nelem(x); i+=4){
|
||||
ENCRYPT(src, x[i], s->input[i], dst);
|
||||
ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);
|
||||
|
@ -279,7 +229,6 @@ encryptblock(Salsastate *s, uchar *src, uchar *dst)
|
|||
src += 16;
|
||||
dst += 16;
|
||||
}
|
||||
#endif
|
||||
|
||||
if(++s->input[8] == 0)
|
||||
s->input[9]++;
|
||||
|
@ -308,6 +257,48 @@ salsa_encrypt(uchar *buf, ulong bytes, Salsastate *s)
|
|||
salsa_encrypt2(buf, buf, bytes, s);
|
||||
}
|
||||
|
||||
void
|
||||
salsa_core(u32int in[16], u32int out[16], int rounds)
|
||||
{
|
||||
u32int x[16];
|
||||
|
||||
x[0] = in[0];
|
||||
x[1] = in[1];
|
||||
x[2] = in[2];
|
||||
x[3] = in[3];
|
||||
x[4] = in[4];
|
||||
x[5] = in[5];
|
||||
x[6] = in[6];
|
||||
x[7] = in[7];
|
||||
x[8] = in[8];
|
||||
x[9] = in[9];
|
||||
x[10] = in[10];
|
||||
x[11] = in[11];
|
||||
x[12] = in[12];
|
||||
x[13] = in[13];
|
||||
x[14] = in[14];
|
||||
x[15] = in[15];
|
||||
|
||||
dorounds(x, rounds);
|
||||
|
||||
out[0] = x[0] + in[0];
|
||||
out[1] = x[1] + in[1];
|
||||
out[2] = x[2] + in[2];
|
||||
out[3] = x[3] + in[3];
|
||||
out[4] = x[4] + in[4];
|
||||
out[5] = x[5] + in[5];
|
||||
out[6] = x[6] + in[6];
|
||||
out[7] = x[7] + in[7];
|
||||
out[8] = x[8] + in[8];
|
||||
out[9] = x[9] + in[9];
|
||||
out[10] = x[10] + in[10];
|
||||
out[11] = x[11] + in[11];
|
||||
out[12] = x[12] + in[12];
|
||||
out[13] = x[13] + in[13];
|
||||
out[14] = x[14] + in[14];
|
||||
out[15] = x[15] + in[15];
|
||||
}
|
||||
|
||||
void
|
||||
hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)
|
||||
{
|
||||
|
|
119
sys/src/libsec/port/scrypt.c
Normal file
119
sys/src/libsec/port/scrypt.c
Normal file
|
@ -0,0 +1,119 @@
|
|||
#include "os.h"
|
||||
#include <libsec.h>
|
||||
|
||||
#define movw(w, S, D) memmove(D, S, (w)*4)
|
||||
|
||||
static void
|
||||
xorw(ulong w, u32int *S, u32int *D)
|
||||
{
|
||||
for(w /= 8; w; w--, D += 8, S += 8){
|
||||
D[0] ^= S[0];
|
||||
D[1] ^= S[1];
|
||||
D[2] ^= S[2];
|
||||
D[3] ^= S[3];
|
||||
D[4] ^= S[4];
|
||||
D[5] ^= S[5];
|
||||
D[6] ^= S[6];
|
||||
D[7] ^= S[7];
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
scryptBlockMix(ulong R, u32int *B, u32int *Y)
|
||||
{
|
||||
u32int X[16];
|
||||
ulong i;
|
||||
|
||||
R *= 2;
|
||||
movw(16, &B[(R-1)*16], X);
|
||||
for(i = 0; i < R; i += 2){
|
||||
xorw(16, &B[i*16], X);
|
||||
salsa_core(X, X, 8);
|
||||
movw(16, X, &Y[i*8]);
|
||||
|
||||
xorw(16, &B[(i+1)*16], X);
|
||||
salsa_core(X, X, 8);
|
||||
movw(16, X, &Y[i*8 + R*8]);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
scryptROMix(ulong R, ulong N, u32int *V, u32int *X, uchar *B)
|
||||
{
|
||||
ulong w, i, d;
|
||||
u32int *Y;
|
||||
|
||||
w = R*32;
|
||||
for(i=0; i<w; i++, B+=4)
|
||||
X[i] = B[0] | (B[1]<<8) | (B[2]<<16) | (B[3]<<24);
|
||||
|
||||
Y = &X[w];
|
||||
for(i=0; i<N; i += 2){
|
||||
movw(w, X, &V[i*w]);
|
||||
scryptBlockMix(R, X, Y);
|
||||
|
||||
movw(w, Y, &V[(i+1)*w]);
|
||||
scryptBlockMix(R, Y, X);
|
||||
}
|
||||
for(i=0; i<N; i += 2){
|
||||
xorw(w, &V[(X[w-16] & (N-1))*w], X);
|
||||
scryptBlockMix(R, X, Y);
|
||||
|
||||
xorw(w, &V[(Y[w-16] & (N-1))*w], Y);
|
||||
scryptBlockMix(R, Y, X);
|
||||
}
|
||||
|
||||
B -= w*4;
|
||||
for(i=0; i<w; i++, B+=4)
|
||||
d = X[i], B[0]=d, B[1]=d>>8, B[2]=d>>16, B[3]=d>>24;
|
||||
}
|
||||
|
||||
char*
|
||||
scrypt(p, plen, s, slen, N, R, P, d, dlen)
|
||||
ulong plen, slen, dlen, N, R, P;
|
||||
uchar *p, *s, *d;
|
||||
{
|
||||
static char oom[] = "out of memory";
|
||||
|
||||
ulong rb, i;
|
||||
u32int *V, *X;
|
||||
uchar *B;
|
||||
|
||||
if(P < 1)
|
||||
return "invalid parallelization parameter P";
|
||||
if(R < 1 || R >= (1UL<<(31-7))/P)
|
||||
return "invalid block size parameter R";
|
||||
if(N < 2 || (N & (N-1)) != 0 || N >= (1UL<<(31-7))/R)
|
||||
return "invalid cpu/memory cost parameter N";
|
||||
|
||||
rb = R<<7;
|
||||
if((B = malloc(P*rb)) == nil)
|
||||
return oom;
|
||||
if((V = malloc(N*rb)) == nil){
|
||||
free(B);
|
||||
return oom;
|
||||
}
|
||||
if((X = malloc(2*rb)) == nil){
|
||||
free(V);
|
||||
free(B);
|
||||
return oom;
|
||||
}
|
||||
|
||||
pbkdf2_x(p, plen, s, slen, 1, B, P*rb, hmac_sha2_256, SHA2_256dlen);
|
||||
|
||||
for(i=0; i<P; i++)
|
||||
scryptROMix(R, N, V, X, &B[i*rb]);
|
||||
|
||||
memset(X, 0, 2*rb);
|
||||
free(X);
|
||||
|
||||
memset(V, 0, N*rb);
|
||||
free(V);
|
||||
|
||||
pbkdf2_x(p, plen, B, P*rb, 1, d, dlen, hmac_sha2_256, SHA2_256dlen);
|
||||
|
||||
memset(B, 0, P*rb);
|
||||
free(B);
|
||||
|
||||
return nil;
|
||||
}
|
Loading…
Reference in a new issue