1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "crypto/hkdf.h"
7 #include "base/logging.h"
8 #include "crypto/hmac.h"
12 const size_t kSHA256HashLength
= 32;
14 HKDF::HKDF(const base::StringPiece
& secret
,
15 const base::StringPiece
& salt
,
16 const base::StringPiece
& info
,
17 size_t key_bytes_to_generate
,
18 size_t iv_bytes_to_generate
) {
19 // https://tools.ietf.org/html/rfc5869#section-2.2
20 base::StringPiece actual_salt
= salt
;
21 char zeros
[kSHA256HashLength
];
22 if (actual_salt
.empty()) {
23 // If salt is not given, HashLength zeros are used.
24 memset(zeros
, 0, sizeof(zeros
));
25 actual_salt
.set(zeros
, sizeof(zeros
));
28 // Perform the Extract step to transform the input key and
29 // salt into the pseudorandom key (PRK) used for Expand.
30 HMAC
prk_hmac(HMAC::SHA256
);
31 bool result
= prk_hmac
.Init(actual_salt
);
34 // |prk| is a pseudorandom key (of kSHA256HashLength octets).
35 uint8 prk
[kSHA256HashLength
];
36 DCHECK_EQ(sizeof(prk
), prk_hmac
.DigestLength());
37 result
= prk_hmac
.Sign(secret
, prk
, sizeof(prk
));
40 // https://tools.ietf.org/html/rfc5869#section-2.3
41 // Perform the Expand phase to turn the pseudorandom key
42 // and info into the output keying material.
43 const size_t material_length
=
44 2*key_bytes_to_generate
+ 2*iv_bytes_to_generate
;
45 const size_t n
= (material_length
+ kSHA256HashLength
-1) /
49 output_
.resize(n
* kSHA256HashLength
);
50 base::StringPiece previous
;
52 scoped_ptr
<char[]> buf(new char[kSHA256HashLength
+ info
.size() + 1]);
53 uint8 digest
[kSHA256HashLength
];
55 HMAC
hmac(HMAC::SHA256
);
56 result
= hmac
.Init(prk
, sizeof(prk
));
59 for (size_t i
= 0; i
< n
; i
++) {
60 memcpy(buf
.get(), previous
.data(), previous
.size());
61 size_t j
= previous
.size();
62 memcpy(buf
.get() + j
, info
.data(), info
.size());
64 buf
[j
++] = static_cast<char>(i
+ 1);
66 result
= hmac
.Sign(base::StringPiece(buf
.get(), j
), digest
, sizeof(digest
));
69 memcpy(&output_
[i
*sizeof(digest
)], digest
, sizeof(digest
));
70 previous
= base::StringPiece(reinterpret_cast<char*>(digest
),
75 // On Windows, when the size of output_ is zero, dereference of 0'th element
76 // results in a crash. C++11 solves this problem by adding a data() getter
77 // method to std::vector.
78 if (key_bytes_to_generate
) {
79 client_write_key_
= base::StringPiece(reinterpret_cast<char*>(&output_
[j
]),
80 key_bytes_to_generate
);
81 j
+= key_bytes_to_generate
;
82 server_write_key_
= base::StringPiece(reinterpret_cast<char*>(&output_
[j
]),
83 key_bytes_to_generate
);
84 j
+= key_bytes_to_generate
;
87 if (iv_bytes_to_generate
) {
88 client_write_iv_
= base::StringPiece(reinterpret_cast<char*>(&output_
[j
]),
89 iv_bytes_to_generate
);
90 j
+= iv_bytes_to_generate
;
91 server_write_iv_
= base::StringPiece(reinterpret_cast<char*>(&output_
[j
]),
92 iv_bytes_to_generate
);