pbkdf2.h File Reference

Module. More...

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
ORDO_PUBLIC int	kdf_pbkdf2 (prim_t hash, const void *params, const void *pwd, size_t pwd_len, const void *salt, size_t salt_len, uintmax_t iterations, void *out, size_t out_len)

Detailed Description

Module.

Module for the PBKDF2 algorithm (Password-Based Key Derivation Function v2) which combines a keyed PRF (here HMAC) with a salt in order to generate secure cryptographic keys, as per RFC 2898. Also features a variable iteration count (work factor) to help thwart brute-force attacks.

Unlike most other cryptographic modules, the PBKDF2 API does not follow the traditional init/update/final pattern but is a context-free function as its inputs are almost always known in advance. As such this module does not benefit from the use of contexts.

Function Documentation

ORDO_PUBLIC int kdf_pbkdf2	(	prim_t	hash,
		const void *	params,
		const void *	pwd,
		size_t	pwd_len,
		const void *	salt,
		size_t	salt_len,
		uintmax_t	iterations,
		void *	out,
		size_t	out_len
	)

Derives a key using PBKDF2.

Parameters

[in]	hash	The hash function to use (the PRF used will be an instantiation of HMAC with it).
[in]	params	Hash-specific parameters.
[in]	pwd	The password to derive a key from.
[in]	pwd_len	The length in bytes of the password.
[in]	salt	The cryptographic salt to use.
[in]	salt_len	The length in bytes of the salt.
[in]	iterations	The number of PBKDF2 iterations to use.
[out]	out	The output buffer for the derived key.
[in]	out_len	The required length, in bytes, of the key.

Returns

ORDO_SUCCESS on success, else an error code.

Remarks

The salt may be zero-length in which case the buffer may be zero.

The password or out buffers cannot be zero-length.

Warning

There is a maximum output length of 2^32 - 1 multiplied by the digest length of the chosen hash function, but it is unlikely to be reached as derived keys are generally no longer than a few hundred bits. Reaching the limit will result in an ORDO_ARG error code. This limit is mandated by the PBKDF2 specification.

Remarks

The out buffer should be at least out_len bytes long.