ConcatinationKDF: SSKDF from NIST.SP.800-56Cr2 Key Derivation #397
Conversation
* The following algorithms for SecretKeyFactory are added for non-FIPS builds: * ConcatenationKdfWithSHA224 * ConcatenationKdfWithSHA256 * ConcatenationKdfWithSHA384 * ConcatenationKdfWithSHA512 * ConcatenationKdfWithHmacSHA256 * ConcatenationKdfWithHmacSHA512
src/com/amazon/corretto/crypto/provider/ConcatenationKdfSpi.java
Outdated
Show resolved
Hide resolved
| throw new IllegalArgumentException("Output size must be greater than zero."); | ||
| } | ||
| this.outputLen = outputLen; | ||
| this.algorithmName = Objects.requireNonNull(algorithmName); |
There was a problem hiding this comment.
Should you validate the algorithmName here?
There was a problem hiding this comment.
The KDFs are used in different context. It's hard to come up with the exhaustive list of all acceptable algorithm names.
| throw new IllegalArgumentException("Secret must be byte array with non-zero length."); | ||
| } | ||
| this.info = Objects.requireNonNull(info); | ||
| this.salt = Optional.ofNullable(salt); |
There was a problem hiding this comment.
If the salt is provided, it should be non-zero as well.
Validate the constraint documented above "When using HMAC variants, a salt must be provided."
There was a problem hiding this comment.
I simplified the logic so that salt is never null. In case it's not provided, an empty array is used. The same goes for info.
| * <p>If info or salt is not provided, empty byte arrays are used. | ||
| * | ||
| * <p>The algorithmName is the name of algorithm used to create SecretKeySpec. |
There was a problem hiding this comment.
| * <p>If info or salt is not provided, empty byte arrays are used. | |
| * | |
| * <p>The algorithmName is the name of algorithm used to create SecretKeySpec. | |
| * <p>If info or salt is not provided, empty byte arrays are used.</p> | |
| * | |
| * <p>The algorithmName is the name of algorithm used to create SecretKeySpec.</p> |
There was a problem hiding this comment.
Turns out this is unnecessary in a java docstring, and the linter will even remove the close tags. 🤦
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.