hkdf.go

//go:build !cmd_go_bootstrap

package openssl

import "C"
import (
	"errors"
	"hash"
	"io"
	"runtime"
	"sync"
	"unsafe"
)

// SupprtHKDF reports whether the current OpenSSL version supports HKDF.
func SupportsHKDF() bool {
	switch vMajor {
	case 1:
		return versionAtOrAbove(1, 1, 1)
	case 3:
		_, err := fetchHKDF3()
		return err == nil
	default:
		panic(errUnsupportedVersion())
	}
}

func newHKDFCtx1(md _EVP_MD_PTR, mode int32, secret, salt, pseudorandomKey, info []byte) (ctx _EVP_PKEY_CTX_PTR, err error) {
	checkMajorVersion(1)

	ctx = go_openssl_EVP_PKEY_CTX_new_id(_EVP_PKEY_HKDF, nil)
	if ctx == nil {
		return nil, newOpenSSLError("EVP_PKEY_CTX_new_id")
	}
	defer func() {
		if err != nil {
			go_openssl_EVP_PKEY_CTX_free(ctx)
		}
	}()

	if go_openssl_EVP_PKEY_derive_init(ctx) != 1 {
		return ctx, newOpenSSLError("EVP_PKEY_derive_init")
	}

	ctrlSlice := func(ctrl int32, data []byte) int32 {
		if len(data) == 0 {
			return 1 // No data to set.
		}
		return go_openssl_EVP_PKEY_CTX_ctrl(ctx, -1, _EVP_PKEY_OP_DERIVE, ctrl, int32(len(data)), unsafe.Pointer(base(data)))
	}

	if go_openssl_EVP_PKEY_CTX_ctrl(ctx, -1, _EVP_PKEY_OP_DERIVE, _EVP_PKEY_CTRL_HKDF_MODE, mode, nil) != 1 {
		return ctx, newOpenSSLError("EVP_PKEY_CTX_set_hkdf_mode")
	}
	if go_openssl_EVP_PKEY_CTX_ctrl(ctx, -1, _EVP_PKEY_OP_DERIVE, _EVP_PKEY_CTRL_HKDF_MD, 0, unsafe.Pointer(md)) != 1 {
		return ctx, newOpenSSLError("EVP_PKEY_CTX_set_hkdf_md")
	}
	if ctrlSlice(_EVP_PKEY_CTRL_HKDF_KEY, secret) != 1 {
		return ctx, newOpenSSLError("EVP_PKEY_CTX_set1_hkdf_key")
	}
	if ctrlSlice(_EVP_PKEY_CTRL_HKDF_SALT, salt) != 1 {
		return ctx, newOpenSSLError("EVP_PKEY_CTX_set1_hkdf_salt")
	}
	if ctrlSlice(_EVP_PKEY_CTRL_HKDF_KEY, pseudorandomKey) != 1 {
		return ctx, newOpenSSLError("EVP_PKEY_CTX_set1_hkdf_key")
	}
	if ctrlSlice(_EVP_PKEY_CTRL_HKDF_INFO, info) != 1 {
		return ctx, newOpenSSLError("EVP_PKEY_CTX_add1_hkdf_info")
	}
	return ctx, nil
}

type hkdf1 struct {
	ctx _EVP_PKEY_CTX_PTR

	hashLen int
	buf     []byte
}

func (c *hkdf1) finalize() {
	if c.ctx != nil {
		go_openssl_EVP_PKEY_CTX_free(c.ctx)
	}
}

func (c *hkdf1) Read(p []byte) (int, error) {
	defer runtime.KeepAlive(c)

	// EVP_PKEY_derive doesn't support incremental output, each call
	// derives the key from scratch and returns the requested bytes.
	// To implement io.Reader, we need to ask for len(c.buf) + len(p)
	// bytes and copy the last derived len(p) bytes to p.
	// We use c.buf to know how many bytes we've already derived and
	// to avoid allocating the whole output buffer on each call.
	prevLen := len(c.buf)
	needLen := len(p)
	remains := 255*c.hashLen - prevLen
	// Check whether enough data can be generated.
	if remains < needLen {
		return 0, errors.New("hkdf: entropy limit reached")
	}
	c.buf = append(c.buf, make([]byte, needLen)...)
	outLen := prevLen + needLen
	if go_openssl_EVP_PKEY_derive(c.ctx, base(c.buf), &outLen) != 1 {
		return 0, newOpenSSLError("EVP_PKEY_derive")
	}
	n := copy(p, c.buf[prevLen:outLen])
	return n, nil
}

func ExtractHKDF(h func() hash.Hash, secret, salt []byte) ([]byte, error) {
	if !SupportsHKDF() {
		return nil, errUnsupportedVersion()
	}

	md, err := hashFuncToMD(h)
	if err != nil {
		return nil, err
	}

	switch vMajor {
	case 1:
		ctx, err := newHKDFCtx1(md, _EVP_KDF_HKDF_MODE_EXTRACT_ONLY, secret, salt, nil, nil)
		if err != nil {
			return nil, err
		}
		defer go_openssl_EVP_PKEY_CTX_free(ctx)
		var keylen int
		if go_openssl_EVP_PKEY_derive(ctx, nil, &keylen) != 1 {
			return nil, newOpenSSLError("EVP_PKEY_derive_init")
		}
		out := make([]byte, keylen)
		if go_openssl_EVP_PKEY_derive(ctx, base(out), &keylen) != 1 {
			return nil, newOpenSSLError("EVP_PKEY_derive")
		}
		return out[:keylen], nil
	case 3:
		ctx, err := newHKDFCtx3(md, _EVP_KDF_HKDF_MODE_EXTRACT_ONLY, secret, salt, nil, nil)
		if err != nil {
			return nil, err
		}
		defer go_openssl_EVP_KDF_CTX_free(ctx)
		out := make([]byte, go_openssl_EVP_KDF_CTX_get_kdf_size(ctx))
		if go_openssl_EVP_KDF_derive(ctx, base(out), len(out), nil) != 1 {
			return nil, newOpenSSLError("EVP_KDF_derive")
		}
		return out, nil
	default:
		panic(errUnsupportedVersion())
	}
}

// ExpandHKDFOneShot derives a key from the given hash, key, and optional context info.
func ExpandHKDFOneShot(h func() hash.Hash, pseudorandomKey, info []byte, keyLength int) ([]byte, error) {
	if !SupportsHKDF() {
		return nil, errUnsupportedVersion()
	}

	md, err := hashFuncToMD(h)
	if err != nil {
		return nil, err
	}

	out := make([]byte, keyLength)
	switch vMajor {
	case 1:
		ctx, err := newHKDFCtx1(md, _EVP_KDF_HKDF_MODE_EXPAND_ONLY, nil, nil, pseudorandomKey, info)
		if err != nil {
			return nil, err
		}
		defer go_openssl_EVP_PKEY_CTX_free(ctx)
		keylen := keyLength
		if go_openssl_EVP_PKEY_derive(ctx, base(out), &keylen) != 1 {
			return nil, newOpenSSLError("EVP_PKEY_derive")
		}
	case 3:
		ctx, err := newHKDFCtx3(md, _EVP_KDF_HKDF_MODE_EXPAND_ONLY, nil, nil, pseudorandomKey, info)
		if err != nil {
			return nil, err
		}
		defer go_openssl_EVP_KDF_CTX_free(ctx)
		if go_openssl_EVP_KDF_derive(ctx, base(out), keyLength, nil) != 1 {
			return nil, newOpenSSLError("EVP_KDF_derive")
		}
	default:
		panic(errUnsupportedVersion())
	}
	return out, nil
}

func ExpandHKDF(h func() hash.Hash, pseudorandomKey, info []byte) (io.Reader, error) {
	if !SupportsHKDF() {
		return nil, errUnsupportedVersion()
	}

	md, err := hashFuncToMD(h)
	if err != nil {
		return nil, err
	}

	size := int(go_openssl_EVP_MD_get_size(md))

	switch vMajor {
	case 1:
		ctx, err := newHKDFCtx1(md, _EVP_KDF_HKDF_MODE_EXPAND_ONLY, nil, nil, pseudorandomKey, info)
		if err != nil {
			return nil, err
		}
		c := &hkdf1{ctx: ctx, hashLen: size}
		runtime.SetFinalizer(c, (*hkdf1).finalize)
		return c, nil
	case 3:
		ctx, err := newHKDFCtx3(md, _EVP_KDF_HKDF_MODE_EXPAND_ONLY, nil, nil, pseudorandomKey, info)
		if err != nil {
			return nil, err
		}
		c := &hkdf3{ctx: ctx, hashLen: size}
		runtime.SetFinalizer(c, (*hkdf3).finalize)
		return c, nil
	default:
		panic(errUnsupportedVersion())
	}
}

type hkdf3 struct {
	ctx _EVP_KDF_CTX_PTR

	hashLen int
	buf     []byte
}

func (c *hkdf3) finalize() {
	if c.ctx != nil {
		go_openssl_EVP_KDF_CTX_free(c.ctx)
	}
}

// fetchHKDF3 fetches the HKDF algorithm.
// It is safe to call this function concurrently.
// The returned EVP_KDF_PTR shouldn't be freed.
var fetchHKDF3 = sync.OnceValues(func() (_EVP_KDF_PTR, error) {
	checkMajorVersion(3)

	kdf := go_openssl_EVP_KDF_fetch(nil, _OSSL_KDF_NAME_HKDF.ptr(), nil)
	if kdf == nil {
		return nil, newOpenSSLError("EVP_KDF_fetch")
	}
	return kdf, nil
})

// newHKDFCtx3 implements HKDF for OpenSSL 3 using the EVP_KDF API.
func newHKDFCtx3(md _EVP_MD_PTR, mode int32, secret, salt, pseudorandomKey, info []byte) (_ _EVP_KDF_CTX_PTR, err error) {
	checkMajorVersion(3)

	kdf, err := fetchHKDF3()
	if err != nil {
		return nil, err
	}
	ctx := go_openssl_EVP_KDF_CTX_new(kdf)
	if ctx == nil {
		return nil, newOpenSSLError("EVP_KDF_CTX_new")
	}
	defer func() {
		if err != nil {
			go_openssl_EVP_KDF_CTX_free(ctx)
		}
	}()

	bld, err := newParamBuilder()
	if err != nil {
		return ctx, err
	}
	bld.addUTF8String(_OSSL_KDF_PARAM_DIGEST, go_openssl_EVP_MD_get0_name(md), 0)
	bld.addInt32(_OSSL_KDF_PARAM_MODE, int32(mode))
	if len(secret) > 0 {
		bld.addOctetString(_OSSL_KDF_PARAM_KEY, secret)
	}
	if len(salt) > 0 {
		bld.addOctetString(_OSSL_KDF_PARAM_SALT, salt)
	}
	if len(pseudorandomKey) > 0 {
		bld.addOctetString(_OSSL_KDF_PARAM_KEY, pseudorandomKey)
	}
	if len(info) > 0 {
		bld.addOctetString(_OSSL_KDF_PARAM_INFO, info)
	}
	params, err := bld.build()
	if err != nil {
		return ctx, err
	}
	defer go_openssl_OSSL_PARAM_free(params)

	if go_openssl_EVP_KDF_CTX_set_params(ctx, params) != 1 {
		return ctx, newOpenSSLError("EVP_KDF_CTX_set_params")
	}
	return ctx, nil
}

func (c *hkdf3) Read(p []byte) (int, error) {
	defer runtime.KeepAlive(c)

	// EVP_KDF_derive doesn't support incremental output, each call
	// derives the key from scratch and returns the requested bytes.
	// To implement io.Reader, we need to ask for len(c.buf) + len(p)
	// bytes and copy the last derived len(p) bytes to p.
	// We use c.buf to know how many bytes we've already derived and
	// to avoid allocating the whole output buffer on each call.
	prevLen := len(c.buf)
	needLen := len(p)
	remains := 255*c.hashLen - prevLen
	// Check whether enough data can be generated.
	if remains < needLen {
		return 0, errors.New("hkdf: entropy limit reached")
	}
	c.buf = append(c.buf, make([]byte, needLen)...)
	outLen := prevLen + needLen
	if go_openssl_EVP_KDF_derive(c.ctx, base(c.buf), outLen, nil) != 1 {
		return 0, newOpenSSLError("EVP_KDF_derive")
	}
	n := copy(p, c.buf[prevLen:outLen])
	return n, nil
}