PBKDF2 updates to conform to SP800-132

The existing code used PKCS5 specifications.
SP800-132 adds the following additional constraints for:
  - the range of the key length.
  - the minimum iteration count (1000 recommended).
  - salt length (at least 128 bits).
These additional constraints may cause errors (in scrypt, and
some PKCS5 related test vectors). To disable the new
constraints use the new ctrl string "pkcs5".
For backwards compatability, the checks are only enabled by
default for fips mode.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8868)

2 files changed, 29 insertions, 23 deletions

diff --git a/include/openssl/kdf.h b/include/openssl/kdf.h
index b13b54cfc9..960098db29 100644
--- a/include/openssl/kdf.h
+++ b/include/openssl/kdf.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -44,28 +44,29 @@ int EVP_KDF_nid(const EVP_KDF *kdf);
 # define EVP_KDF_name(o)        OBJ_nid2sn(EVP_KDF_nid(o))
 const EVP_KDF *EVP_get_kdfbyname(const char *name);
 
-# define EVP_KDF_CTRL_SET_PASS          0x01 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_SET_SALT          0x02 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_SET_ITER          0x03 /* int */
-# define EVP_KDF_CTRL_SET_MD            0x04 /* EVP_MD * */
-# define EVP_KDF_CTRL_SET_KEY           0x05 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_SET_MAXMEM_BYTES  0x06 /* uint64_t */
-# define EVP_KDF_CTRL_SET_TLS_SECRET    0x07 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_RESET_TLS_SEED    0x08
-# define EVP_KDF_CTRL_ADD_TLS_SEED      0x09 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_RESET_HKDF_INFO   0x0a
-# define EVP_KDF_CTRL_ADD_HKDF_INFO     0x0b /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_SET_HKDF_MODE     0x0c /* int */
-# define EVP_KDF_CTRL_SET_SCRYPT_N      0x0d /* uint64_t */
-# define EVP_KDF_CTRL_SET_SCRYPT_R      0x0e /* uint32_t */
-# define EVP_KDF_CTRL_SET_SCRYPT_P      0x0f /* uint32_t */
-# define EVP_KDF_CTRL_SET_SSHKDF_XCGHASH    0x10 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID 0x11 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_SET_SSHKDF_TYPE       0x12 /* int */
-# define EVP_KDF_CTRL_SET_MAC           0x13 /* EVP_MAC * */
-# define EVP_KDF_CTRL_SET_MAC_SIZE      0x14 /* size_t */
-# define EVP_KDF_CTRL_SET_SSKDF_INFO    0x15 /* unsigned char *, size_t */
-# define EVP_KDF_CTRL_SET_SHARED_INFO   EVP_KDF_CTRL_SET_SSKDF_INFO
+# define EVP_KDF_CTRL_SET_PASS               0x01 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_SET_SALT               0x02 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_SET_ITER               0x03 /* int */
+# define EVP_KDF_CTRL_SET_MD                 0x04 /* EVP_MD * */
+# define EVP_KDF_CTRL_SET_KEY                0x05 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_SET_MAXMEM_BYTES       0x06 /* uint64_t */
+# define EVP_KDF_CTRL_SET_TLS_SECRET         0x07 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_RESET_TLS_SEED         0x08
+# define EVP_KDF_CTRL_ADD_TLS_SEED           0x09 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_RESET_HKDF_INFO        0x0a
+# define EVP_KDF_CTRL_ADD_HKDF_INFO          0x0b /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_SET_HKDF_MODE          0x0c /* int */
+# define EVP_KDF_CTRL_SET_SCRYPT_N           0x0d /* uint64_t */
+# define EVP_KDF_CTRL_SET_SCRYPT_R           0x0e /* uint32_t */
+# define EVP_KDF_CTRL_SET_SCRYPT_P           0x0f /* uint32_t */
+# define EVP_KDF_CTRL_SET_SSHKDF_XCGHASH     0x10 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID  0x11 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_SET_SSHKDF_TYPE        0x12 /* int */
+# define EVP_KDF_CTRL_SET_MAC                0x13 /* EVP_MAC * */
+# define EVP_KDF_CTRL_SET_MAC_SIZE           0x14 /* size_t */
+# define EVP_KDF_CTRL_SET_SSKDF_INFO         0x15 /* unsigned char *, size_t */
+# define EVP_KDF_CTRL_SET_PBKDF2_PKCS5_MODE  0x16 /* int */
+# define EVP_KDF_CTRL_SET_SHARED_INFO        EVP_KDF_CTRL_SET_SSKDF_INFO
 
 # define EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND  0
 # define EVP_KDF_HKDF_MODE_EXTRACT_ONLY        1
diff --git a/include/openssl/kdferr.h b/include/openssl/kdferr.h
index db87f69ed2..2899955b7d 100644
--- a/include/openssl/kdferr.h
+++ b/include/openssl/kdferr.h
@@ -28,6 +28,7 @@ int ERR_load_KDF_strings(void);
 # define KDF_F_KDF_HKDF_NEW                               114
 # define KDF_F_KDF_HKDF_SIZE                              115
 # define KDF_F_KDF_MD2CTRL                                116
+# define KDF_F_KDF_PBKDF2_CTRL                            140
 # define KDF_F_KDF_PBKDF2_CTRL_STR                        117
 # define KDF_F_KDF_PBKDF2_DERIVE                          118
 # define KDF_F_KDF_PBKDF2_NEW                             119
@@ -43,6 +44,7 @@ int ERR_load_KDF_strings(void);
 # define KDF_F_KDF_TLS1_PRF_CTRL_STR                      125
 # define KDF_F_KDF_TLS1_PRF_DERIVE                        126
 # define KDF_F_KDF_TLS1_PRF_NEW                           127
+# define KDF_F_PBKDF2_DERIVE                              141
 # define KDF_F_PBKDF2_SET_MEMBUF                          128
 # define KDF_F_PKEY_HKDF_CTRL_STR                         103
 # define KDF_F_PKEY_HKDF_DERIVE                           102
@@ -68,7 +70,10 @@ int ERR_load_KDF_strings(void);
  * KDF reason codes.
  */
 # define KDF_R_INVALID_DIGEST                             100
+# define KDF_R_INVALID_ITERATION_COUNT                    119
+# define KDF_R_INVALID_KEY_LEN                            120
 # define KDF_R_INVALID_MAC_TYPE                           116
+# define KDF_R_INVALID_SALT_LEN                           121
 # define KDF_R_MISSING_ITERATION_COUNT                    109
 # define KDF_R_MISSING_KEY                                104
 # define KDF_R_MISSING_MESSAGE_DIGEST                     105