luajitos

HKDF.c (4910B)

---

 /*
  * HKDF Implementation
  * RFC 5869 - HMAC-based Extract-and-Expand Key Derivation Function
  */
 
 #include "HKDF.h"
 #include <string.h>
 
 /* Use existing SHA-256 implementation */
 typedef struct {
     uint32_t state[8];
     uint64_t count;
     uint8_t buffer[64];
 } sha256_context;
 
 extern void sha256_init(sha256_context *ctx);
 extern void sha256_update(sha256_context *ctx, const uint8_t *data, size_t len);
 extern void sha256_final(sha256_context *ctx, uint8_t digest[32]);
 extern void sha256(const uint8_t *data, size_t len, uint8_t digest[32]);
 
 #define SHA256_BLOCK_SIZE 64
 #define SHA256_DIGEST_SIZE 32
 
 /* HMAC-SHA256 context for incremental updates */
 typedef struct {
     sha256_context inner;
     uint8_t o_key_pad[SHA256_BLOCK_SIZE];
 } hmac_sha256_context;
 
 static void hmac_sha256_init(hmac_sha256_context *ctx, const uint8_t *key, size_t key_len) {
     uint8_t k_pad[SHA256_BLOCK_SIZE];
     uint8_t tk[SHA256_DIGEST_SIZE];
 
     /* If key is longer than block size, hash it first */
     if (key_len > SHA256_BLOCK_SIZE) {
         sha256(key, key_len, tk);
         key = tk;
         key_len = SHA256_DIGEST_SIZE;
     }
 
     /* Prepare padded key */
     memset(k_pad, 0, sizeof(k_pad));
     memcpy(k_pad, key, key_len);
 
     /* Store outer key pad for finalization */
     for (int i = 0; i < SHA256_BLOCK_SIZE; i++) {
         ctx->o_key_pad[i] = k_pad[i] ^ 0x5c;
         k_pad[i] ^= 0x36;
     }
 
     /* Initialize inner hash with i_key_pad */
     sha256_init(&ctx->inner);
     sha256_update(&ctx->inner, k_pad, SHA256_BLOCK_SIZE);
 
     memset(k_pad, 0, sizeof(k_pad));
 }
 
 static void hmac_sha256_update(hmac_sha256_context *ctx, const uint8_t *data, size_t len) {
     sha256_update(&ctx->inner, data, len);
 }
 
 static void hmac_sha256_final(hmac_sha256_context *ctx, uint8_t output[32]) {
     uint8_t inner_hash[SHA256_DIGEST_SIZE];
 
     /* Finalize inner hash */
     sha256_final(&ctx->inner, inner_hash);
 
     /* Compute outer hash: H(o_key_pad || inner_hash) */
     sha256_context outer;
     sha256_init(&outer);
     sha256_update(&outer, ctx->o_key_pad, SHA256_BLOCK_SIZE);
     sha256_update(&outer, inner_hash, SHA256_DIGEST_SIZE);
     sha256_final(&outer, output);
 
     memset(inner_hash, 0, sizeof(inner_hash));
 }
 
 /* Single-shot HMAC-SHA256 */
 static void hmac_sha256(const uint8_t *key, size_t key_len,
                         const uint8_t *data, size_t data_len,
                         uint8_t output[32]) {
     hmac_sha256_context ctx;
     hmac_sha256_init(&ctx, key, key_len);
     hmac_sha256_update(&ctx, data, data_len);
     hmac_sha256_final(&ctx, output);
 }
 
 /* HKDF-Extract using HMAC-SHA256 */
 void hkdf_sha256_extract(const uint8_t *salt, size_t salt_len,
                          const uint8_t *ikm, size_t ikm_len,
                          uint8_t prk[32]) {
     /* If no salt provided, use zero salt */
     uint8_t zero_salt[32] = {0};
     if (!salt || salt_len == 0) {
         salt = zero_salt;
         salt_len = 32;
     }
 
     /* PRK = HMAC-SHA256(salt, IKM) */
     hmac_sha256(salt, salt_len, ikm, ikm_len, prk);
 }
 
 /* HKDF-Expand using HMAC-SHA256 */
 int hkdf_sha256_expand(const uint8_t prk[32],
                        const uint8_t *info, size_t info_len,
                        uint8_t *okm, size_t okm_len) {
     /* Max output length: 255 * hash_len = 255 * 32 = 8160 bytes */
     if (okm_len > 255 * 32) {
         return -1;
     }
 
     if (!info) {
         info_len = 0;
     }
 
     uint8_t T[32] = {0};  /* Previous block */
     size_t T_len = 0;
     uint8_t counter = 1;
     size_t offset = 0;
 
     while (offset < okm_len) {
         /* Compute T(i) = HMAC(PRK, T(i-1) | info | i) */
         hmac_sha256_context ctx;
         hmac_sha256_init(&ctx, prk, 32);
 
         /* Add T(i-1) if not first iteration */
         if (T_len > 0) {
             hmac_sha256_update(&ctx, T, T_len);
         }
 
         /* Add info */
         if (info_len > 0) {
             hmac_sha256_update(&ctx, info, info_len);
         }
 
         /* Add counter */
         hmac_sha256_update(&ctx, &counter, 1);
 
         /* Finalize */
         hmac_sha256_final(&ctx, T);
         T_len = 32;
 
         /* Copy to output */
         size_t to_copy = okm_len - offset;
         if (to_copy > 32) {
             to_copy = 32;
         }
         memcpy(okm + offset, T, to_copy);
         offset += to_copy;
 
         counter++;
     }
 
     /* Clean up */
     memset(T, 0, sizeof(T));
 
     return 0;
 }
 
 /* HKDF (Extract-then-Expand) */
 int hkdf_sha256(const uint8_t *salt, size_t salt_len,
                 const uint8_t *ikm, size_t ikm_len,
                 const uint8_t *info, size_t info_len,
                 uint8_t *okm, size_t okm_len) {
     uint8_t prk[32];
 
     /* Extract */
     hkdf_sha256_extract(salt, salt_len, ikm, ikm_len, prk);
 
     /* Expand */
     int result = hkdf_sha256_expand(prk, info, info_len, okm, okm_len);
 
     /* Clean up */
     memset(prk, 0, sizeof(prk));
 
     return result;
 }