openpgp: Implement S2K::Argon2.

  - See https://openpgp-wg.gitlab.io/rfc4880bis/#name-argon2

5 files changed, 115 insertions, 2 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 66173d54..f9cb2069 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -139,6 +139,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "59d2a3357dde987206219e78ecfbbb6e8dad06cbb65292758d3270e6254f7355"
 
 [[package]]
+name = "arrayref"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b4930d2cb77ce62f89ee5d5289b4ac049559b1c45539271f5ed4fdc7db34545"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
 name = "ascii-canvas"
 version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -245,6 +257,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
 
 [[package]]
+name = "blake2b_simd"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23285ad32269793932e830392f2fe2f83e26488fd3ec778883a93c8323735780"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "constant_time_eq",
+]
+
+[[package]]
 name = "block-buffer"
 version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -550,6 +573,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
 [[package]]
+name = "constant_time_eq"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7144d30dcf0fafbce74250a3963025d8d52177934239851c917d29f1df280c2"
+
+[[package]]
 name = "core-foundation"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2384,6 +2413,18 @@ dependencies = [
 ]
 
 [[package]]
+name = "rust-argon2"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5885493fdf0be6cdff808d1533ce878d21cfa49c7086fa00c66355cd9141bfc"
+dependencies = [
+ "base64",
+ "blake2b_simd",
+ "constant_time_eq",
+ "crossbeam-utils",
+]
+
+[[package]]
 name = "rustc-demangle"
 version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -2640,6 +2681,7 @@ dependencies = [
  "ripemd",
  "rpassword",
  "rsa",
+ "rust-argon2",
  "sha1collisiondetection",
  "sha2",
  "thiserror",
diff --git a/openpgp/Cargo.toml b/openpgp/Cargo.toml
index 3c77a8b3..a74c1311 100644
--- a/openpgp/Cargo.toml
+++ b/openpgp/Cargo.toml
@@ -45,6 +45,7 @@ nettle = { version = "7.3", optional = true }
 once_cell = "1"
 regex = "1"
 regex-syntax = "0.8"
+rust-argon2 = "1"
 sha1collisiondetection = { version = "0.3.1", default-features = false, features = ["std"] }
 thiserror = "1.0.2"
 xxhash-rust = { version = "0.8", features = ["xxh3"] }
diff --git a/openpgp/src/crypto/s2k.rs b/openpgp/src/crypto/s2k.rs
index 9b7c24d6..1717caff 100644
--- a/openpgp/src/crypto/s2k.rs
+++ b/openpgp/src/crypto/s2k.rs
@@ -6,6 +6,8 @@
 //!
 //!   [Section 3.7 of RFC 4880]: https://tools.ietf.org/html/rfc4880#section-3.7
 
+use std::convert::TryInto;
+
 use crate::Error;
 use crate::Result;
 use crate::HashAlgorithm;
@@ -35,6 +37,18 @@ use quickcheck::{Arbitrary, Gen};
 #[non_exhaustive]
 #[derive(Clone, PartialEq, Eq, Hash, Debug)]
 pub enum S2K {
+    /// Argon2 Memory-Hard Password Hashing Function.
+    Argon2 {
+        /// The salt.
+        salt: [u8; 16],
+        /// Number of passes.
+        t: u8,
+        /// Degree of parallelism.
+        p: u8,
+        /// Exponent of memory size.
+        m: u8,
+    },
+
     /// Repeatently hashes the password with a public `salt` value.
     Iterated {
         /// Hash used for key derivation.
@@ -167,6 +181,27 @@ impl S2K {
     -> Result<SessionKey> {
         #[allow(deprecated)]
         match self {
+            &S2K::Argon2 { salt, t, p, m, } => {
+                let config = argon2::Config {
+                    time_cost: t.into(),
+                    lanes: p.into(),
+                    mem_cost: 2u32.checked_pow(m.into())
+                        .ok_or_else(|| Error::InvalidArgument(
+                            format!("Argon2 memory parameter out of bounds: {}",
+                                    m)))?,
+                    hash_length: key_size.try_into()
+                        .map_err(|_| Error::InvalidArgument(
+                            format!("key size parameter out of bounds: {}",
+                                    key_size)))?,
+                    thread_mode: argon2::ThreadMode::Parallel,
+                    variant: argon2::Variant::Argon2id,
+                    ..argon2::Config::default()
+                };
+                password.map(|password| {
+                    Ok(argon2::hash_raw(password, &salt, &config)?
+                       .into())
+                })
+            },
             &S2K::Simple { hash } | &S2K::Salted { hash, .. }
             | &S2K::Iterated { hash, .. } => password.map(|string| {
                 let mut hash = hash.context()?;
@@ -183,6 +218,7 @@ impl S2K {
                     hash.update(&zeros[..]);
 
                     match self {
+                        &S2K::Argon2 { .. } => unreachable!("handled above"),
                         &S2K::Simple { .. } => {
                             hash.update(string);
                         }
@@ -248,6 +284,7 @@ impl S2K {
             Simple { .. }
             | Salted { .. }
             | Iterated { .. }
+            | Argon2 { .. }
             => true,
             S2K::Private { .. }
             | S2K::Unknown { .. }
@@ -353,6 +390,11 @@ impl fmt::Display for S2K {
                     salt[4], salt[5], salt[6], salt[7],
                     hash_bytes))
             }
+            S2K::Argon2 { salt, t, p, m, } => {
+                write!(f,
+                       "Argon2id with t: {}, p: {}, m: 2^{}, salt: {}",
+                       t, p, m, crate::fmt::hex::encode(salt))
+            },
             S2K::Private { tag, parameters } =>
                 if let Some(p) = parameters.as_ref() {
                     write!(f, "Private/Experimental S2K {}:{:?}", tag, p)
@@ -375,7 +417,7 @@ impl Arbitrary for S2K {
         use crate::arbitrary_helper::*;
 
         #[allow(deprecated)]
-        match gen_arbitrary_from_range(0..7, g) {
+        match gen_arbitrary_from_range(0..8, g) {
             0 => S2K::Simple{ hash: HashAlgorithm::arbitrary(g) },
             1 => S2K::Salted{
                 hash: HashAlgorithm::arbitrary(g),
@@ -394,6 +436,16 @@ impl Arbitrary for S2K {
                 },
                 hash_bytes: S2K::nearest_hash_count(Arbitrary::arbitrary(g)),
             },
+            7 => S2K::Argon2 {
+                salt: {
+                    let mut salt = [0u8; 16];
+                    arbitrary_slice(g, &mut salt);
+                    salt
+                },
+                t: Arbitrary::arbitrary(g),
+                p: Arbitrary::arbitrary(g),
+                m: Arbitrary::arbitrary(g),
+            },
             3 => S2K::Private {
                 tag: gen_arbitrary_from_range(100..111, g),
                 parameters: Some(arbitrary_bounded_vec(g, 200).into()),
@@ -403,7 +455,7 @@ impl Arbitrary for S2K {
                 parameters: Some(arbitrary_bounded_vec(g, 200).into()),
             },
             5 => S2K::Unknown {
-                tag: gen_arbitrary_from_range(4..100, g),
+                tag: gen_arbitrary_from_range(5..100, g),
                 parameters: Some(arbitrary_bounded_vec(g, 200).into()),
             },
             6 => S2K::Unknown {
diff --git a/openpgp/src/parse.rs b/openpgp/src/parse.rs
index f1c5ad99..05598ea7 100644
--- a/openpgp/src/parse.rs
+++ b/openpgp/src/parse.rs
@@ -1083,6 +1083,18 @@ impl S2K {
                     hash_bytes: S2K::decode_count(php.parse_u8("s2k_count")?),
                 }
             },
+            4 => S2K::Argon2 {
+                salt: {
+                    let mut b = [0u8; 16];
+                    let b_len = b.len();
+                    b.copy_from_slice(
+                        &php.parse_bytes("argon2_salt", b_len)?);
+                    b
+                },
+                t: php.parse_u8("argon2_t")?,
+                p: php.parse_u8("argon2_p")?,
+                m: php.parse_u8("argon2_m")?,
+            },
             100..=110 => S2K::Private {
                 tag: s2k,
                 parameters: if let Some(l) = s2k_len {
diff --git a/openpgp/src/serialize.rs b/openpgp/src/serialize.rs
index 510e9bf8..1bdd062f 100644
--- a/openpgp/src/serialize.rs
+++ b/openpgp/src/serialize.rs
@@ -1319,6 +1319,11 @@ impl Marshal for S2K {
                 w.write_all(&salt[..])?;
                 w.write_all(&[S2K::encode_count(hash_bytes)?])?;
             }
+            S2K::Argon2 { salt, t, p, m, } => {
+                w.write_all(&[4])?;
+                w.write_all(salt)?;
+                w.write_all(&[*t, *p, *m])?;
+            },
             S2K::Private { tag, parameters }
             | S2K::Unknown { tag, parameters} => {
                 w.write_all(&[*tag])?;
@@ -1339,6 +1344,7 @@ impl MarshalInto for S2K {
             &S2K::Simple{ .. } => 2,
             &S2K::Salted{ .. } => 2 + 8,
             &S2K::Iterated{ .. } => 2 + 8 + 1,
+            S2K::Argon2 { .. } => 20,
             S2K::Private { parameters, .. }
             | S2K::Unknown { parameters, .. } =>
                 1 + parameters.as_ref().map(|p| p.len()).unwrap_or(0),