-
Notifications
You must be signed in to change notification settings - Fork 56
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ConcatinationKDF: SSKDF from NIST.SP.800-56Cr2 Key Derivation
* The following algorithms for SecretKeyFactory are added for non-FIPS builds: * ConcatenationKdfWithSHA224 * ConcatenationKdfWithSHA256 * ConcatenationKdfWithSHA384 * ConcatenationKdfWithSHA512 * ConcatenationKdfWithHmacSHA256 * ConcatenationKdfWithHmacSHA512
- Loading branch information
Showing
14 changed files
with
1,717 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Submodule aws-lc
updated
from 4368aa to 057477
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| #include "buffer.h" | ||
| #include "env.h" | ||
| #include "generated-headers.h" | ||
| #include <openssl/evp.h> | ||
| #include <openssl/kdf.h> | ||
|
|
||
| using namespace AmazonCorrettoCryptoProvider; | ||
|
|
||
| extern "C" JNIEXPORT void Java_com_amazon_corretto_crypto_provider_ConcatenationKdfSpi_nSskdfDigest(JNIEnv* env, | ||
| jclass, | ||
| jint digestCode, | ||
| jbyteArray jSecret, | ||
| jint secretLen, | ||
| jbyteArray jInfo, | ||
| jint infoLen, | ||
| jbyteArray jOutput, | ||
| jint outputLen) | ||
| { | ||
| try { | ||
| EVP_MD const* digest = digest_code_to_EVP_MD(digestCode); | ||
| JBinaryBlob secret(env, nullptr, jSecret); | ||
| JBinaryBlob info(env, nullptr, jInfo); | ||
| JBinaryBlob output(env, nullptr, jOutput); | ||
| if (SSKDF_digest(output.get(), outputLen, digest, secret.get(), secretLen, info.get(), infoLen) != 1) { | ||
| throw_openssl(EX_RUNTIME_CRYPTO, "SSKDF_digest failed."); | ||
| } | ||
| } catch (java_ex& ex) { | ||
| ex.throw_to_java(env); | ||
| } | ||
| } | ||
|
|
||
| extern "C" JNIEXPORT void JNICALL Java_com_amazon_corretto_crypto_provider_ConcatenationKdfSpi_nSskdfHmac(JNIEnv* env, | ||
| jclass, | ||
| jint digestCode, | ||
| jbyteArray jSecret, | ||
| jint secretLen, | ||
| jbyteArray jInfo, | ||
| jint infoLen, | ||
| jbyteArray jSalt, | ||
| jint saltLen, | ||
| jbyteArray jOutput, | ||
| jint outputLen) | ||
| { | ||
| try { | ||
| EVP_MD const* digest = digest_code_to_EVP_MD(digestCode); | ||
| JBinaryBlob secret(env, nullptr, jSecret); | ||
| JBinaryBlob info(env, nullptr, jInfo); | ||
| JBinaryBlob salt(env, nullptr, jSalt); | ||
| JBinaryBlob output(env, nullptr, jOutput); | ||
| if (SSKDF_hmac( | ||
| output.get(), outputLen, digest, secret.get(), secretLen, info.get(), infoLen, salt.get(), saltLen) | ||
| != 1) { | ||
| throw_openssl(EX_RUNTIME_CRYPTO, "SSKDF_hmac failed."); | ||
| } | ||
|
|
||
| } catch (java_ex& ex) { | ||
| ex.throw_to_java(env); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
60 changes: 60 additions & 0 deletions
60
src/com/amazon/corretto/crypto/provider/ConcatenationKdfSpec.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| package com.amazon.corretto.crypto.provider; | ||
|
|
||
| import java.security.spec.KeySpec; | ||
| import java.util.Objects; | ||
| import java.util.Optional; | ||
|
|
||
| /** | ||
| * Represents the inputs to ConcatenationKdf algorithms. | ||
| * | ||
| * <p>When using HMAC variants, salt must be provided. The algorithmName is the name of algorithm | ||
| * used to create SecretKeySpec. | ||
| */ | ||
| public class ConcatenationKdfSpec implements KeySpec { | ||
| private final byte[] secret; | ||
| private final byte[] info; | ||
| private final Optional<byte[]> salt; | ||
| private final int outputLen; | ||
| private final String algorithmName; | ||
|
|
||
| public ConcatenationKdfSpec( | ||
| final byte[] secret, | ||
| final byte[] info, | ||
| final byte[] salt, | ||
| final int outputLen, | ||
| final String algorithmName) { | ||
| this.secret = Objects.requireNonNull(secret); | ||
| if (this.secret.length == 0) { | ||
| throw new IllegalArgumentException("Secret must be byte array with non-zero length."); | ||
| } | ||
| this.info = Objects.requireNonNull(info); | ||
| this.salt = Optional.ofNullable(salt); | ||
| if (outputLen <= 0) { | ||
| throw new IllegalArgumentException("Output size must be greater than zero."); | ||
| } | ||
| this.outputLen = outputLen; | ||
| this.algorithmName = Objects.requireNonNull(algorithmName); | ||
| } | ||
|
|
||
| public byte[] getSecret() { | ||
| return secret; | ||
| } | ||
|
|
||
| public byte[] getInfo() { | ||
| return info; | ||
| } | ||
|
|
||
| public int getOutputLen() { | ||
| return outputLen; | ||
| } | ||
|
|
||
| public Optional<byte[]> getSalt() { | ||
| return salt; | ||
| } | ||
|
|
||
| public String getAlgorithmName() { | ||
| return algorithmName; | ||
| } | ||
| } |
Oops, something went wrong.