go.crypto/scrypt: add package
R=golang-dev, agl, r CC=golang-dev https://golang.org/cl/6535043
This commit is contained in:
Dmitry Chestnykh
committed by
Adam Langley
Adam Langley
parent
815dd50d91
commit
6ba10a7acb
@@ -0,0 +1,109 @@
|
||||
// Copyright 2012 The Go Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
// Package scrypt implements the scrypt key derivation function as defined in
|
||||
// Colin Percival's paper "Stronger Key Derivation via Sequential Memory-Hard
|
||||
// Functions" (http://www.tarsnap.com/scrypt/scrypt.pdf).
|
||||
package scrypt
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"encoding/binary"
|
||||
"errors"
|
||||
|
||||
"code.google.com/p/go.crypto/pbkdf2"
|
||||
"code.google.com/p/go.crypto/salsa20/salsa"
|
||||
)
|
||||
|
||||
const maxInt = int(^uint(0) >> 1)
|
||||
|
||||
// blockCopy copies n bytes from src into dst.
|
||||
func blockCopy(dst, src []byte, n int) {
|
||||
copy(dst, src[:n])
|
||||
}
|
||||
|
||||
// blockXOR XORs bytes from dst with n bytes from src.
|
||||
func blockXOR(dst, src []byte, n int) {
|
||||
for i, v := range src[:n] {
|
||||
dst[i] ^= v
|
||||
}
|
||||
}
|
||||
|
||||
func blockMix(b, y []byte, r int) {
|
||||
var x [64]byte
|
||||
|
||||
blockCopy(x[:], b[(2*r-1)*64:], 64)
|
||||
|
||||
for i := 0; i < 2*r*64; i += 64 {
|
||||
blockXOR(x[:], b[i:], 64)
|
||||
salsa.Core208(&x, &x)
|
||||
blockCopy(y[i:], x[:], 64)
|
||||
}
|
||||
|
||||
for i := 0; i < r; i++ {
|
||||
blockCopy(b[i*64:], y[i*2*64:], 64)
|
||||
}
|
||||
|
||||
for i := 0; i < r; i++ {
|
||||
blockCopy(b[(i+r)*64:], y[(i*2+1)*64:], 64)
|
||||
}
|
||||
}
|
||||
|
||||
func integer(b []byte, r int) uint64 {
|
||||
return binary.LittleEndian.Uint64(b[(2*r-1)*64:])
|
||||
}
|
||||
|
||||
func smix(b []byte, r, N int, v, xy []byte) {
|
||||
x := xy
|
||||
y := xy[128*r:]
|
||||
|
||||
blockCopy(x, b, 128*r)
|
||||
|
||||
for i := 0; i < N; i++ {
|
||||
blockCopy(v[i*128*r:], x, 128*r)
|
||||
blockMix(x, y, r)
|
||||
}
|
||||
|
||||
for i := 0; i < N; i++ {
|
||||
j := int(integer(x, r) & uint64(N-1))
|
||||
blockXOR(x, v[j*128*r:], 128*r)
|
||||
blockMix(x, y, r)
|
||||
}
|
||||
|
||||
blockCopy(b, x, 128*r)
|
||||
}
|
||||
|
||||
// Key derives a key from the password, salt, and cost parameters, returning
|
||||
// a byte slice of length keyLen that can be used as cryptographic key.
|
||||
//
|
||||
// N is a CPU/memory cost parameter, which must be a power of two greater than 1.
|
||||
// r and p must satisfy r * p < 2³⁰. If the parameters do not satisfy the
|
||||
// limits, the function returns a nil byte slice and an error.
|
||||
//
|
||||
// For example, you can get a derived key for e.g. AES-256 (which needs a
|
||||
// 32-byte key) by doing:
|
||||
//
|
||||
// dk := scrypt.Key([]byte("some password"), salt, 16384, 8, 1, 32)
|
||||
//
|
||||
// The recommended parameters for interactive logins as of 2009 are N=16384,
|
||||
// r=8, p=1. They should be increased as memory latency and CPU parallelism
|
||||
// increases. Remember to get a good random salt.
|
||||
func Key(password, salt []byte, N, r, p, keyLen int) ([]byte, error) {
|
||||
if N <= 1 || N&(N-1) != 0 {
|
||||
return nil, errors.New("scrypt: N must be > 1 and a power of 2")
|
||||
}
|
||||
if uint64(r)*uint64(p) >= 1<<30 || r > maxInt/128/p || r > maxInt/256 || N > maxInt/128/r {
|
||||
return nil, errors.New("scrypt: parameters are too large")
|
||||
}
|
||||
|
||||
xy := make([]byte, 256*r)
|
||||
v := make([]byte, 128*r*N)
|
||||
b := pbkdf2.Key(password, salt, 1, p*128*r, sha256.New)
|
||||
|
||||
for i := 0; i < p; i++ {
|
||||
smix(b[i*128*r:], r, N, v, xy)
|
||||
}
|
||||
|
||||
return pbkdf2.Key(password, b, 1, keyLen, sha256.New), nil
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
// Copyright 2012 The Go Authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style
|
||||
// license that can be found in the LICENSE file.
|
||||
|
||||
package scrypt
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"testing"
|
||||
)
|
||||
|
||||
type testVector struct {
|
||||
password string
|
||||
salt string
|
||||
N, r, p int
|
||||
output []byte
|
||||
}
|
||||
|
||||
var good = []testVector{
|
||||
{
|
||||
"",
|
||||
"",
|
||||
16, 1, 1,
|
||||
[]byte{
|
||||
0x77, 0xd6, 0x57, 0x62, 0x38, 0x65, 0x7b, 0x20, 0x3b,
|
||||
0x19, 0xca, 0x42, 0xc1, 0x8a, 0x04, 0x97, 0xf1, 0x6b,
|
||||
0x48, 0x44, 0xe3, 0x07, 0x4a, 0xe8, 0xdf, 0xdf, 0xfa,
|
||||
0x3f, 0xed, 0xe2, 0x14, 0x42, 0xfc, 0xd0, 0x06, 0x9d,
|
||||
0xed, 0x09, 0x48, 0xf8, 0x32, 0x6a, 0x75, 0x3a, 0x0f,
|
||||
0xc8, 0x1f, 0x17, 0xe8, 0xd3, 0xe0, 0xfb, 0x2e, 0x0d,
|
||||
0x36, 0x28, 0xcf, 0x35, 0xe2, 0x0c, 0x38, 0xd1, 0x89,
|
||||
0x06,
|
||||
},
|
||||
},
|
||||
{
|
||||
"password",
|
||||
"NaCl",
|
||||
1024, 8, 16,
|
||||
[]byte{
|
||||
0xfd, 0xba, 0xbe, 0x1c, 0x9d, 0x34, 0x72, 0x00, 0x78,
|
||||
0x56, 0xe7, 0x19, 0x0d, 0x01, 0xe9, 0xfe, 0x7c, 0x6a,
|
||||
0xd7, 0xcb, 0xc8, 0x23, 0x78, 0x30, 0xe7, 0x73, 0x76,
|
||||
0x63, 0x4b, 0x37, 0x31, 0x62, 0x2e, 0xaf, 0x30, 0xd9,
|
||||
0x2e, 0x22, 0xa3, 0x88, 0x6f, 0xf1, 0x09, 0x27, 0x9d,
|
||||
0x98, 0x30, 0xda, 0xc7, 0x27, 0xaf, 0xb9, 0x4a, 0x83,
|
||||
0xee, 0x6d, 0x83, 0x60, 0xcb, 0xdf, 0xa2, 0xcc, 0x06,
|
||||
0x40,
|
||||
},
|
||||
},
|
||||
{
|
||||
"pleaseletmein", "SodiumChloride",
|
||||
16384, 8, 1,
|
||||
[]byte{
|
||||
0x70, 0x23, 0xbd, 0xcb, 0x3a, 0xfd, 0x73, 0x48, 0x46,
|
||||
0x1c, 0x06, 0xcd, 0x81, 0xfd, 0x38, 0xeb, 0xfd, 0xa8,
|
||||
0xfb, 0xba, 0x90, 0x4f, 0x8e, 0x3e, 0xa9, 0xb5, 0x43,
|
||||
0xf6, 0x54, 0x5d, 0xa1, 0xf2, 0xd5, 0x43, 0x29, 0x55,
|
||||
0x61, 0x3f, 0x0f, 0xcf, 0x62, 0xd4, 0x97, 0x05, 0x24,
|
||||
0x2a, 0x9a, 0xf9, 0xe6, 0x1e, 0x85, 0xdc, 0x0d, 0x65,
|
||||
0x1e, 0x40, 0xdf, 0xcf, 0x01, 0x7b, 0x45, 0x57, 0x58,
|
||||
0x87,
|
||||
},
|
||||
},
|
||||
/*
|
||||
// Disabled: needs 1 GiB RAM and takes too long for a simple test.
|
||||
{
|
||||
"pleaseletmein", "SodiumChloride",
|
||||
1048576, 8, 1,
|
||||
[]byte{
|
||||
0x21, 0x01, 0xcb, 0x9b, 0x6a, 0x51, 0x1a, 0xae, 0xad,
|
||||
0xdb, 0xbe, 0x09, 0xcf, 0x70, 0xf8, 0x81, 0xec, 0x56,
|
||||
0x8d, 0x57, 0x4a, 0x2f, 0xfd, 0x4d, 0xab, 0xe5, 0xee,
|
||||
0x98, 0x20, 0xad, 0xaa, 0x47, 0x8e, 0x56, 0xfd, 0x8f,
|
||||
0x4b, 0xa5, 0xd0, 0x9f, 0xfa, 0x1c, 0x6d, 0x92, 0x7c,
|
||||
0x40, 0xf4, 0xc3, 0x37, 0x30, 0x40, 0x49, 0xe8, 0xa9,
|
||||
0x52, 0xfb, 0xcb, 0xf4, 0x5c, 0x6f, 0xa7, 0x7a, 0x41,
|
||||
0xa4,
|
||||
},
|
||||
},
|
||||
*/
|
||||
}
|
||||
|
||||
var bad = []testVector{
|
||||
{"p", "s", 0, 1, 1, nil}, // N == 0
|
||||
{"p", "s", 1, 1, 1, nil}, // N == 1
|
||||
{"p", "s", 7, 8, 1, nil}, // N is not power of 2
|
||||
{"p", "s", 16, maxInt / 2, maxInt / 2, nil}, // p * r too large
|
||||
}
|
||||
|
||||
func TestKey(t *testing.T) {
|
||||
for i, v := range good {
|
||||
k, err := Key([]byte(v.password), []byte(v.salt), v.N, v.r, v.p, len(v.output))
|
||||
if err != nil {
|
||||
t.Errorf("%d: got unexpected error: %s", i, err)
|
||||
}
|
||||
if !bytes.Equal(k, v.output) {
|
||||
t.Errorf("%d: expected %x, got %x", i, v.output, k)
|
||||
}
|
||||
}
|
||||
for i, v := range bad {
|
||||
_, err := Key([]byte(v.password), []byte(v.salt), v.N, v.r, v.p, 32)
|
||||
if err == nil {
|
||||
t.Errorf("%d: expected error, got nil", i)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func BenchmarkKey(b *testing.B) {
|
||||
for i := 0; i < b.N; i++ {
|
||||
Key([]byte("password"), []byte("salt"), 16384, 8, 1, 64)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user