1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/mobile/android/base/sync/crypto/HKDF.java Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,128 @@
1.4 +/* This Source Code Form is subject to the terms of the Mozilla Public
1.5 + * License, v. 2.0. If a copy of the MPL was not distributed with this
1.6 + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1.7 +
1.8 +package org.mozilla.gecko.sync.crypto;
1.9 +
1.10 +import java.security.InvalidKeyException;
1.11 +import java.security.Key;
1.12 +import java.security.NoSuchAlgorithmException;
1.13 +
1.14 +import javax.crypto.Mac;
1.15 +import javax.crypto.spec.SecretKeySpec;
1.16 +
1.17 +import org.mozilla.gecko.sync.Utils;
1.18 +
1.19 +/*
1.20 + * A standards-compliant implementation of RFC 5869
1.21 + * for HMAC-based Key Derivation Function.
1.22 + * HMAC uses HMAC SHA256 standard.
1.23 + */
1.24 +public class HKDF {
1.25 + public static String HMAC_ALGORITHM = "hmacSHA256";
1.26 +
1.27 + /**
1.28 + * Used for conversion in cases in which you *know* the encoding exists.
1.29 + */
1.30 + public static final byte[] bytes(String in) {
1.31 + try {
1.32 + return in.getBytes("UTF-8");
1.33 + } catch (java.io.UnsupportedEncodingException e) {
1.34 + return null;
1.35 + }
1.36 + }
1.37 +
1.38 + public static final int BLOCKSIZE = 256 / 8;
1.39 + public static final byte[] HMAC_INPUT = bytes("Sync-AES_256_CBC-HMAC256");
1.40 +
1.41 + /*
1.42 + * Step 1 of RFC 5869
1.43 + * Get sha256HMAC Bytes
1.44 + * Input: salt (message), IKM (input keyring material)
1.45 + * Output: PRK (pseudorandom key)
1.46 + */
1.47 + public static byte[] hkdfExtract(byte[] salt, byte[] IKM) throws NoSuchAlgorithmException, InvalidKeyException {
1.48 + return digestBytes(IKM, makeHMACHasher(salt));
1.49 + }
1.50 +
1.51 + /*
1.52 + * Step 2 of RFC 5869.
1.53 + * Input: PRK from step 1, info, length.
1.54 + * Output: OKM (output keyring material).
1.55 + */
1.56 + public static byte[] hkdfExpand(byte[] prk, byte[] info, int len) throws NoSuchAlgorithmException, InvalidKeyException {
1.57 + Mac hmacHasher = makeHMACHasher(prk);
1.58 +
1.59 + byte[] T = {};
1.60 + byte[] Tn = {};
1.61 +
1.62 + int iterations = (int) Math.ceil(((double)len) / ((double)BLOCKSIZE));
1.63 + for (int i = 0; i < iterations; i++) {
1.64 + Tn = digestBytes(Utils.concatAll(Tn, info, Utils.hex2Byte(Integer.toHexString(i + 1))),
1.65 + hmacHasher);
1.66 + T = Utils.concatAll(T, Tn);
1.67 + }
1.68 +
1.69 + byte[] result = new byte[len];
1.70 + System.arraycopy(T, 0, result, 0, len);
1.71 + return result;
1.72 + }
1.73 +
1.74 + /*
1.75 + * Make HMAC key
1.76 + * Input: key (salt)
1.77 + * Output: Key HMAC-Key
1.78 + */
1.79 + public static Key makeHMACKey(byte[] key) {
1.80 + if (key.length == 0) {
1.81 + key = new byte[BLOCKSIZE];
1.82 + }
1.83 + return new SecretKeySpec(key, HMAC_ALGORITHM);
1.84 + }
1.85 +
1.86 + /*
1.87 + * Make an HMAC hasher
1.88 + * Input: Key hmacKey
1.89 + * Ouput: An HMAC Hasher
1.90 + */
1.91 + public static Mac makeHMACHasher(byte[] key) throws NoSuchAlgorithmException, InvalidKeyException {
1.92 + Mac hmacHasher = null;
1.93 + hmacHasher = Mac.getInstance(HMAC_ALGORITHM);
1.94 +
1.95 + // If Mac.getInstance doesn't throw NoSuchAlgorithmException, hmacHasher is
1.96 + // non-null.
1.97 + assert(hmacHasher != null);
1.98 +
1.99 + hmacHasher.init(makeHMACKey(key));
1.100 + return hmacHasher;
1.101 + }
1.102 +
1.103 + /*
1.104 + * Hash bytes with given hasher
1.105 + * Input: message to hash, HMAC hasher
1.106 + * Output: hashed byte[].
1.107 + */
1.108 + public static byte[] digestBytes(byte[] message, Mac hasher) {
1.109 + hasher.update(message);
1.110 + byte[] ret = hasher.doFinal();
1.111 + hasher.reset();
1.112 + return ret;
1.113 + }
1.114 +
1.115 + public static byte[] derive(byte[] skm, byte[] xts, byte[] ctxInfo, int dkLen) throws InvalidKeyException, NoSuchAlgorithmException {
1.116 + return hkdfExpand(hkdfExtract(xts, skm), ctxInfo, dkLen);
1.117 + }
1.118 +
1.119 + public static void deriveMany(byte[] skm, byte[] xts, byte[] ctxInfo, byte[]... keys) throws InvalidKeyException, NoSuchAlgorithmException {
1.120 + int length = 0;
1.121 + for (byte[] key : keys) {
1.122 + length += key.length;
1.123 + }
1.124 + byte[] derived = hkdfExpand(hkdfExtract(xts, skm), ctxInfo, length);
1.125 + int offset = 0;
1.126 + for (byte[] key : keys) {
1.127 + System.arraycopy(derived, offset, key, 0, key.length);
1.128 + offset += key.length;
1.129 + }
1.130 + }
1.131 +}
