common/mbedtls/hkdf.h

   1 /**
   2  * \file hkdf.h
   3  *
   4  * \brief   This file contains the HKDF interface.
   5  *
   6  *          The HMAC-based Extract-and-Expand Key Derivation Function (HKDF) is
   7  *          specified by RFC 5869.
   8  */
   9 /*
  10  *  Copyright The Mbed TLS Contributors
  11  *  SPDX-License-Identifier: Apache-2.0
  12  *
  13  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
  14  *  not use this file except in compliance with the License.
  15  *  You may obtain a copy of the License at
  16  *
  17  *  http://www.apache.org/licenses/LICENSE-2.0
  18  *
  19  *  Unless required by applicable law or agreed to in writing, software
  20  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  21  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  22  *  See the License for the specific language governing permissions and
  23  *  limitations under the License.
  24  */
  25 #ifndef MBEDTLS_HKDF_H
  26 #define MBEDTLS_HKDF_H
  27
  28 #if !defined(MBEDTLS_CONFIG_FILE)
  29 #include "mbedtls/config.h"
  30 #else
  31 #include MBEDTLS_CONFIG_FILE
  32 #endif
  33
  34 #include "mbedtls/md.h"
  35
  36 /**
  37  *  \name HKDF Error codes
  38  *  \{
  39  */
  40 #define MBEDTLS_ERR_HKDF_BAD_INPUT_DATA  -0x5F80  /**< Bad input parameters to function. */
  41 /* \} name */
  42
  43 #ifdef __cplusplus
  44 extern "C" {
  45 #endif
  46
  47 /**
  48  *  \brief  This is the HMAC-based Extract-and-Expand Key Derivation Function
  49  *          (HKDF).
  50  *
  51  *  \param  md        A hash function; md.size denotes the length of the hash
  52  *                    function output in bytes.
  53  *  \param  salt      An optional salt value (a non-secret random value);
  54  *                    if the salt is not provided, a string of all zeros of
  55  *                    md.size length is used as the salt.
  56  *  \param  salt_len  The length in bytes of the optional \p salt.
  57  *  \param  ikm       The input keying material.
  58  *  \param  ikm_len   The length in bytes of \p ikm.
  59  *  \param  info      An optional context and application specific information
  60  *                    string. This can be a zero-length string.
  61  *  \param  info_len  The length of \p info in bytes.
  62  *  \param  okm       The output keying material of \p okm_len bytes.
  63  *  \param  okm_len   The length of the output keying material in bytes. This
  64  *                    must be less than or equal to 255 * md.size bytes.
  65  *
  66  *  \return 0 on success.
  67  *  \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid.
  68  *  \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying
  69  *          MD layer.
  70  */
  71 int mbedtls_hkdf(const mbedtls_md_info_t *md, const unsigned char *salt,
  72                  size_t salt_len, const unsigned char *ikm, size_t ikm_len,
  73                  const unsigned char *info, size_t info_len,
  74                  unsigned char *okm, size_t okm_len);
  75
  76 /**
  77  *  \brief  Take the input keying material \p ikm and extract from it a
  78  *          fixed-length pseudorandom key \p prk.
  79  *
  80  *  \warning    This function should only be used if the security of it has been
  81  *              studied and established in that particular context (eg. TLS 1.3
  82  *              key schedule). For standard HKDF security guarantees use
  83  *              \c mbedtls_hkdf instead.
  84  *
  85  *  \param       md        A hash function; md.size denotes the length of the
  86  *                         hash function output in bytes.
  87  *  \param       salt      An optional salt value (a non-secret random value);
  88  *                         if the salt is not provided, a string of all zeros
  89  *                         of md.size length is used as the salt.
  90  *  \param       salt_len  The length in bytes of the optional \p salt.
  91  *  \param       ikm       The input keying material.
  92  *  \param       ikm_len   The length in bytes of \p ikm.
  93  *  \param[out]  prk       A pseudorandom key of at least md.size bytes.
  94  *
  95  *  \return 0 on success.
  96  *  \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid.
  97  *  \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying
  98  *          MD layer.
  99  */
 100 int mbedtls_hkdf_extract(const mbedtls_md_info_t *md,
 101                          const unsigned char *salt, size_t salt_len,
 102                          const unsigned char *ikm, size_t ikm_len,
 103                          unsigned char *prk);
 104
 105 /**
 106  *  \brief  Expand the supplied \p prk into several additional pseudorandom
 107  *          keys, which is the output of the HKDF.
 108  *
 109  *  \warning    This function should only be used if the security of it has been
 110  *              studied and established in that particular context (eg. TLS 1.3
 111  *              key schedule). For standard HKDF security guarantees use
 112  *              \c mbedtls_hkdf instead.
 113  *
 114  *  \param  md        A hash function; md.size denotes the length of the hash
 115  *                    function output in bytes.
 116  *  \param  prk       A pseudorandom key of at least md.size bytes. \p prk is
 117  *                    usually the output from the HKDF extract step.
 118  *  \param  prk_len   The length in bytes of \p prk.
 119  *  \param  info      An optional context and application specific information
 120  *                    string. This can be a zero-length string.
 121  *  \param  info_len  The length of \p info in bytes.
 122  *  \param  okm       The output keying material of \p okm_len bytes.
 123  *  \param  okm_len   The length of the output keying material in bytes. This
 124  *                    must be less than or equal to 255 * md.size bytes.
 125  *
 126  *  \return 0 on success.
 127  *  \return #MBEDTLS_ERR_HKDF_BAD_INPUT_DATA when the parameters are invalid.
 128  *  \return An MBEDTLS_ERR_MD_* error for errors returned from the underlying
 129  *          MD layer.
 130  */
 131 int mbedtls_hkdf_expand(const mbedtls_md_info_t *md, const unsigned char *prk,
 132                         size_t prk_len, const unsigned char *info,
 133                         size_t info_len, unsigned char *okm, size_t okm_len);
 134
 135 #ifdef __cplusplus
 136 }
 137 #endif
 138
 139 #endif /* hkdf.h */