[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 17/26] crypto: add gnutls pbkdf provider
From: |
Daniel P . Berrangé |
Subject: |
[PULL 17/26] crypto: add gnutls pbkdf provider |
Date: |
Wed, 14 Jul 2021 15:08:49 +0100 |
This adds support for using gnutls as a provider of the crypto
pbkdf APIs.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
crypto/meson.build | 2 +-
crypto/pbkdf-gnutls.c | 90 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 91 insertions(+), 1 deletion(-)
create mode 100644 crypto/pbkdf-gnutls.c
diff --git a/crypto/meson.build b/crypto/meson.build
index e2f25810fc..95a6a83504 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -29,7 +29,7 @@ if nettle.found()
elif gcrypt.found()
crypto_ss.add(gcrypt, files('hash-gcrypt.c', 'hmac-gcrypt.c',
'pbkdf-gcrypt.c'))
elif gnutls_crypto.found()
- crypto_ss.add(gnutls, files('hash-gnutls.c', 'hmac-glib.c', 'pbkdf-stub.c')
+ crypto_ss.add(gnutls, files('hash-gnutls.c', 'hmac-gnutls.c',
'pbkdf-gnutls.c'))
else
crypto_ss.add(files('hash-glib.c', 'hmac-glib.c', 'pbkdf-stub.c'))
endif
diff --git a/crypto/pbkdf-gnutls.c b/crypto/pbkdf-gnutls.c
new file mode 100644
index 0000000000..2dfbbd382c
--- /dev/null
+++ b/crypto/pbkdf-gnutls.c
@@ -0,0 +1,90 @@
+/*
+ * QEMU Crypto PBKDF support (Password-Based Key Derivation Function)
+ *
+ * Copyright (c) 2021 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include <gnutls/crypto.h>
+#include "qapi/error.h"
+#include "crypto/pbkdf.h"
+
+bool qcrypto_pbkdf2_supports(QCryptoHashAlgorithm hash)
+{
+ switch (hash) {
+ case QCRYPTO_HASH_ALG_MD5:
+ case QCRYPTO_HASH_ALG_SHA1:
+ case QCRYPTO_HASH_ALG_SHA224:
+ case QCRYPTO_HASH_ALG_SHA256:
+ case QCRYPTO_HASH_ALG_SHA384:
+ case QCRYPTO_HASH_ALG_SHA512:
+ case QCRYPTO_HASH_ALG_RIPEMD160:
+ return true;
+ default:
+ return false;
+ }
+}
+
+int qcrypto_pbkdf2(QCryptoHashAlgorithm hash,
+ const uint8_t *key, size_t nkey,
+ const uint8_t *salt, size_t nsalt,
+ uint64_t iterations,
+ uint8_t *out, size_t nout,
+ Error **errp)
+{
+ static const int hash_map[QCRYPTO_HASH_ALG__MAX] = {
+ [QCRYPTO_HASH_ALG_MD5] = GNUTLS_DIG_MD5,
+ [QCRYPTO_HASH_ALG_SHA1] = GNUTLS_DIG_SHA1,
+ [QCRYPTO_HASH_ALG_SHA224] = GNUTLS_DIG_SHA224,
+ [QCRYPTO_HASH_ALG_SHA256] = GNUTLS_DIG_SHA256,
+ [QCRYPTO_HASH_ALG_SHA384] = GNUTLS_DIG_SHA384,
+ [QCRYPTO_HASH_ALG_SHA512] = GNUTLS_DIG_SHA512,
+ [QCRYPTO_HASH_ALG_RIPEMD160] = GNUTLS_DIG_RMD160,
+ };
+ int ret;
+ const gnutls_datum_t gkey = { (unsigned char *)key, nkey };
+ const gnutls_datum_t gsalt = { (unsigned char *)salt, nsalt };
+
+ if (iterations > ULONG_MAX) {
+ error_setg_errno(errp, ERANGE,
+ "PBKDF iterations %llu must be less than %lu",
+ (long long unsigned)iterations, ULONG_MAX);
+ return -1;
+ }
+
+ if (hash >= G_N_ELEMENTS(hash_map) ||
+ hash_map[hash] == GNUTLS_DIG_UNKNOWN) {
+ error_setg_errno(errp, ENOSYS,
+ "PBKDF does not support hash algorithm %s",
+ QCryptoHashAlgorithm_str(hash));
+ return -1;
+ }
+
+ ret = gnutls_pbkdf2(hash_map[hash],
+ &gkey,
+ &gsalt,
+ iterations,
+ out,
+ nout);
+ if (ret != 0) {
+ error_setg(errp, "Cannot derive password: %s",
+ gnutls_strerror(ret));
+ return -1;
+ }
+
+ return 0;
+}
--
2.31.1
- [PULL 07/26] crypto: drop custom XTS support in gcrypt driver, (continued)
- [PULL 07/26] crypto: drop custom XTS support in gcrypt driver, Daniel P . Berrangé, 2021/07/14
- [PULL 08/26] crypto: add crypto tests for single block DES-ECB and DES-CBC, Daniel P . Berrangé, 2021/07/14
- [PULL 09/26] crypto: delete built-in DES implementation, Daniel P . Berrangé, 2021/07/14
- [PULL 10/26] crypto: delete built-in XTS cipher mode support, Daniel P . Berrangé, 2021/07/14
- [PULL 11/26] crypto: replace 'des-rfb' cipher with 'des', Daniel P . Berrangé, 2021/07/14
- [PULL 13/26] crypto: introduce build system for gnutls crypto backend, Daniel P . Berrangé, 2021/07/14
- [PULL 12/26] crypto: flip priority of backends to prefer gcrypt, Daniel P . Berrangé, 2021/07/14
- [PULL 14/26] crypto: add gnutls cipher provider, Daniel P . Berrangé, 2021/07/14
- [PULL 15/26] crypto: add gnutls hash provider, Daniel P . Berrangé, 2021/07/14
- [PULL 16/26] crypto: add gnutls hmac provider, Daniel P . Berrangé, 2021/07/14
- [PULL 17/26] crypto: add gnutls pbkdf provider,
Daniel P . Berrangé <=
- [PULL 18/26] crypto: prefer gnutls as the crypto backend if new enough, Daniel P . Berrangé, 2021/07/14
- [PULL 19/26] net/rocker: use GDateTime for formatting timestamp in debug messages, Daniel P . Berrangé, 2021/07/14
- [PULL 20/26] io: use GDateTime for formatting timestamp for websock headers, Daniel P . Berrangé, 2021/07/14
- [PULL 21/26] seccomp: don't block getters for resource control syscalls, Daniel P . Berrangé, 2021/07/14
- [PULL 22/26] tests/migration: fix unix socket migration, Daniel P . Berrangé, 2021/07/14
- [PULL 23/26] docs: fix typo s/Intel/AMD/ in CPU model notes, Daniel P . Berrangé, 2021/07/14
- [PULL 24/26] qemu-options: re-arrange CPU topology options, Daniel P . Berrangé, 2021/07/14
- [PULL 25/26] qemu-options: tweak to show that CPU count is optional, Daniel P . Berrangé, 2021/07/14
- [PULL 26/26] qemu-options: rewrite help for -smp options, Daniel P . Berrangé, 2021/07/14
- Re: [PULL v2 00/26] Crypto and more patches, Peter Maydell, 2021/07/15