2 prf.c -- Pseudo-Random Function for key material generation
3 Copyright (C) 2014 Guus Sliepen <guus@meshlink.io>
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 2 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License along
16 with this program; if not, write to the Free Software Foundation, Inc.,
17 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 #include "ed25519/sha512.h"
25 static void memxor(char *buf, char c, size_t len) {
26 for(size_t i = 0; i < len; i++)
30 static const size_t mdlen = 64;
32 // TODO: separate key setup from hmac_sha512
34 static bool hmac_sha512(const char *key, size_t keylen, const char *msg, size_t msglen, char *out) {
39 memcpy(tmp, key, keylen);
40 memset(tmp + keylen, 0, mdlen - keylen);
42 if(sha512(key, keylen, tmp) != 0)
46 if(sha512_init(&md) != 0)
50 memxor(tmp, 0x36, mdlen);
51 if(sha512_update(&md, tmp, mdlen) != 0)
55 if(sha512_update(&md, msg, msglen) != 0)
58 if(sha512_final(&md, tmp + mdlen) != 0)
62 memxor(tmp, 0x36 ^ 0x5c, mdlen);
63 if(sha512(tmp, sizeof tmp, out) != 0)
69 /* Generate key material from a master secret and a seed, based on RFC 4346 section 5.
70 We use SHA512 instead of MD5 and SHA1.
73 bool prf(const char *secret, size_t secretlen, char *seed, size_t seedlen, char *out, size_t outlen) {
74 /* Data is what the "inner" HMAC function processes.
75 It consists of the previous HMAC result plus the seed.
78 char data[mdlen + seedlen];
79 memset(data, 0, mdlen);
80 memcpy(data + mdlen, seed, seedlen);
86 if(!hmac_sha512(data, sizeof data, secret, secretlen, data))
91 if(!hmac_sha512(data, sizeof data, secret, secretlen, out))
96 if(!hmac_sha512(data, sizeof data, secret, secretlen, hash))
98 memcpy(out, hash, outlen);