2 prf.c -- Pseudo-Random Function for key material generation
3 Copyright (C) 2014 Guus Sliepen <guus@meshlink.io>
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 2 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License along
16 with this program; if not, write to the Free Software Foundation, Inc.,
17 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 #include "ed25519/sha512.h"
25 static void memxor(char *buf, char c, size_t len) {
29 for(size_t i = 0; i < len; i++) {
36 // TODO: separate key setup from hmac_sha512
38 static bool hmac_sha512(const char *key, size_t keylen, const char *msg, size_t msglen, char *out) {
46 memcpy(tmp, key, keylen);
47 memset(tmp + keylen, 0, mdlen - keylen);
49 if(sha512(key, keylen, tmp) != 0) {
54 if(sha512_init(&md) != 0) {
59 memxor(tmp, 0x36, mdlen);
61 if(sha512_update(&md, tmp, mdlen) != 0) {
66 if(sha512_update(&md, msg, msglen) != 0) {
70 if(sha512_final(&md, tmp + mdlen) != 0) {
75 memxor(tmp, 0x36 ^ 0x5c, mdlen);
77 if(sha512(tmp, sizeof(tmp), out) != 0) {
84 /* Generate key material from a master secret and a seed, based on RFC 4346 section 5.
85 We use SHA512 instead of MD5 and SHA1.
88 bool prf(const char *secret, size_t secretlen, const char *seed, size_t seedlen, char *out, size_t outlen) {
96 /* Data is what the "inner" HMAC function processes.
97 It consists of the previous HMAC result plus the seed.
100 char data[mdlen + seedlen];
101 memset(data, 0, mdlen);
102 memcpy(data + mdlen, seed, seedlen);
108 if(!hmac_sha512(data, sizeof(data), secret, secretlen, data)) {
113 if(outlen >= mdlen) {
114 if(!hmac_sha512(data, sizeof(data), secret, secretlen, out)) {
121 if(!hmac_sha512(data, sizeof(data), secret, secretlen, hash)) {
125 memcpy(out, hash, outlen);