Change mojo demo apps to use Application.
[chromium-blink-merge.git] / crypto / hkdf.cc
blob1cd8468977e3e6da1ae46b02a15316cc0fc0cfd9
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "crypto/hkdf.h"
7 #include "base/logging.h"
8 #include "crypto/hmac.h"
10 namespace crypto {
12 const size_t kSHA256HashLength = 32;
14 HKDF::HKDF(const base::StringPiece& secret,
15 const base::StringPiece& salt,
16 const base::StringPiece& info,
17 size_t key_bytes_to_generate,
18 size_t iv_bytes_to_generate) {
19 // https://tools.ietf.org/html/rfc5869#section-2.2
20 base::StringPiece actual_salt = salt;
21 char zeros[kSHA256HashLength];
22 if (actual_salt.empty()) {
23 // If salt is not given, HashLength zeros are used.
24 memset(zeros, 0, sizeof(zeros));
25 actual_salt.set(zeros, sizeof(zeros));
28 // Perform the Extract step to transform the input key and
29 // salt into the pseudorandom key (PRK) used for Expand.
30 HMAC prk_hmac(HMAC::SHA256);
31 bool result = prk_hmac.Init(actual_salt);
32 DCHECK(result);
34 // |prk| is a pseudorandom key (of kSHA256HashLength octets).
35 uint8 prk[kSHA256HashLength];
36 DCHECK_EQ(sizeof(prk), prk_hmac.DigestLength());
37 result = prk_hmac.Sign(secret, prk, sizeof(prk));
38 DCHECK(result);
40 // https://tools.ietf.org/html/rfc5869#section-2.3
41 // Perform the Expand phase to turn the pseudorandom key
42 // and info into the output keying material.
43 const size_t material_length =
44 2*key_bytes_to_generate + 2*iv_bytes_to_generate;
45 const size_t n = (material_length + kSHA256HashLength-1) /
46 kSHA256HashLength;
47 DCHECK_LT(n, 256u);
49 output_.resize(n * kSHA256HashLength);
50 base::StringPiece previous;
52 scoped_ptr<char[]> buf(new char[kSHA256HashLength + info.size() + 1]);
53 uint8 digest[kSHA256HashLength];
55 HMAC hmac(HMAC::SHA256);
56 result = hmac.Init(prk, sizeof(prk));
57 DCHECK(result);
59 for (size_t i = 0; i < n; i++) {
60 memcpy(buf.get(), previous.data(), previous.size());
61 size_t j = previous.size();
62 memcpy(buf.get() + j, info.data(), info.size());
63 j += info.size();
64 buf[j++] = static_cast<char>(i + 1);
66 result = hmac.Sign(base::StringPiece(buf.get(), j), digest, sizeof(digest));
67 DCHECK(result);
69 memcpy(&output_[i*sizeof(digest)], digest, sizeof(digest));
70 previous = base::StringPiece(reinterpret_cast<char*>(digest),
71 sizeof(digest));
74 size_t j = 0;
75 // On Windows, when the size of output_ is zero, dereference of 0'th element
76 // results in a crash. C++11 solves this problem by adding a data() getter
77 // method to std::vector.
78 if (key_bytes_to_generate) {
79 client_write_key_ = base::StringPiece(reinterpret_cast<char*>(&output_[j]),
80 key_bytes_to_generate);
81 j += key_bytes_to_generate;
82 server_write_key_ = base::StringPiece(reinterpret_cast<char*>(&output_[j]),
83 key_bytes_to_generate);
84 j += key_bytes_to_generate;
87 if (iv_bytes_to_generate) {
88 client_write_iv_ = base::StringPiece(reinterpret_cast<char*>(&output_[j]),
89 iv_bytes_to_generate);
90 j += iv_bytes_to_generate;
91 server_write_iv_ = base::StringPiece(reinterpret_cast<char*>(&output_[j]),
92 iv_bytes_to_generate);
96 HKDF::~HKDF() {
99 } // namespace crypto