diff options
author | Pauli <paul.dale@oracle.com> | 2020-08-11 10:29:02 +1000 |
---|---|---|
committer | Pauli <paul.dale@oracle.com> | 2020-08-14 18:15:12 +1000 |
commit | b7466c1303b2e16815092ae4ef6c97ae1f0f347d (patch) | |
tree | a2faf89d6620fe6274bb6d02b854efcd8fde0b12 /doc/man7/EVP_KDF-PKCS12KDF.pod | |
parent | c19e6da9a345b1e14caca23c50a0c7690309e0e4 (diff) |
Move PKCS#12 KDF to provider.
This KDF is defined in RFC7292 in appendix B. It is widely used in PKCS#12
and should be provided.
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/12624)
Diffstat (limited to 'doc/man7/EVP_KDF-PKCS12KDF.pod')
-rw-r--r-- | doc/man7/EVP_KDF-PKCS12KDF.pod | 86 |
1 files changed, 86 insertions, 0 deletions
diff --git a/doc/man7/EVP_KDF-PKCS12KDF.pod b/doc/man7/EVP_KDF-PKCS12KDF.pod new file mode 100644 index 0000000000..68f987b050 --- /dev/null +++ b/doc/man7/EVP_KDF-PKCS12KDF.pod @@ -0,0 +1,86 @@ +=pod + +=head1 NAME + +EVP_KDF-PKCS12KDF - The PKCS#12 EVP_KDF implementation + +=head1 DESCRIPTION + +Support for computing the B<PKCS#12> password-based KDF through the B<EVP_KDF> +API. + +The EVP_KDF-PKCS12KDF algorithm implements the PKCS#12 password-based key +derivation function, as described in appendix B of RFC 7292 (PKCS #12: +Personal Information Exchange Syntax); it derives a key from a password +using a salt, iteration count and the intended usage. + +=head2 Identity + +"PKCS12KDF" is the name for this implementation; it +can be used with the EVP_KDF_fetch() function. + +=head2 Supported parameters + +The supported parameters are: + +=over 4 + +=item "pass" (B<OSSL_KDF_PARAM_PASSWORD>) <octet string> + +=item "salt" (B<OSSL_KDF_PARAM_SALT>) <octet string> + +=item "iter" (B<OSSL_KDF_PARAM_ITER>) <unsigned integer> + +=item "properties" (B<OSSL_KDF_PARAM_PROPERTIES>) <UTF8 string> + +=item "digest" (B<OSSL_KDF_PARAM_DIGEST>) <UTF8 string> + +These parameters work as described in L<EVP_KDF(3)/PARAMETERS>. + +=item "id" (B<OSSL_KDF_PARAM_PKCS12_ID>) <integer> + +This parameter is used to specify the intended usage of the output bits, as per +RFC 7292 section B.3. + +=back + +=head1 NOTES + +A typical application of this algorithm is to derive keying material for an +encryption algorithm from a password in the "pass", a salt in "salt", +and an iteration count. + +Increasing the "iter" parameter slows down the algorithm which makes it +harder for an attacker to perform a brute force attack using a large number +of candidate passwords. + +No assumption is made regarding the given password; it is simply treated as a +byte sequence. + +=head1 CONFORMING TO + +RFC7292 + +=head1 SEE ALSO + +L<EVP_KDF(3)>, +L<EVP_KDF_CTX_new(3)>, +L<EVP_KDF_CTX_free(3)>, +L<EVP_KDF_CTX_set_params(3)>, +L<EVP_KDF_derive(3)>, +L<EVP_KDF(3)/PARAMETERS> + +=head1 HISTORY + +This functionality was added to OpenSSL 3.0. + +=head1 COPYRIGHT + +Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. + +Licensed under the Apache License 2.0 (the "License"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file LICENSE in the source distribution or at +L<https://www.openssl.org/source/license.html>. + +=cut |