add label parameter to KDF::derive_key

2 files changed, 95 insertions, 8 deletions

diff --git a/src/lib/kdf/sp800_108/sp800_108.cpp b/src/lib/kdf/sp800_108/sp800_108.cpp
index 873db814c..aafb349b2 100644
--- a/src/lib/kdf/sp800_108/sp800_108.cpp
+++ b/src/lib/kdf/sp800_108/sp800_108.cpp
@@ -8,6 +8,8 @@
 #include <botan/sp800_108.h>
 #include <botan/hmac.h>
 
+#include <iterator>
+
 namespace Botan {
 
 SP800_108_Counter* SP800_108_Counter::make(const Spec& spec)
@@ -23,13 +25,18 @@ SP800_108_Counter* SP800_108_Counter::make(const Spec& spec)
 
 size_t SP800_108_Counter::kdf(byte key[], size_t key_len,
                               const byte secret[], size_t secret_len,
-                              const byte salt[], size_t salt_len) const
+                              const byte salt[], size_t salt_len,
+                              const byte label[], size_t label_len) const
    {
       const std::size_t prf_len =  m_prf->output_length();
+      const byte delim = 0;
       byte *p = key;
       uint32_t counter = 1;
+      uint32_t length = key_len * 8;
+      byte be_len[4] = { 0 };
       secure_vector<byte> tmp;
 
+      store_be(length, be_len);
       m_prf->set_key(secret, secret_len);
 
       while(p < key + key_len && counter != 0)
@@ -40,7 +47,10 @@ size_t SP800_108_Counter::kdf(byte key[], size_t key_len,
          store_be(counter, be_cnt);
 
          m_prf->update(be_cnt,4);
-         m_prf->update(salt, salt_len);
+         m_prf->update(label,label_len);
+         m_prf->update(delim);
+         m_prf->update(salt,salt_len);
+         m_prf->update(be_len,4);
          m_prf->final(tmp);
 
          std::move(tmp.begin(), tmp.begin() + to_copy, p);
@@ -68,16 +78,21 @@ SP800_108_Feedback* SP800_108_Feedback::make(const Spec& spec)
 
 size_t SP800_108_Feedback::kdf(byte key[], size_t key_len,
                                const byte secret[], size_t secret_len,
-                               const byte salt[], size_t salt_len) const
+                               const byte salt[], size_t salt_len,
+                               const byte label[], size_t label_len) const
    {
       const std::size_t prf_len =  m_prf->output_length();
       const std::size_t iv_len = (salt_len >= prf_len ? prf_len : 0);
+      const byte delim = 0;
 
       byte *p = key;
       uint32_t counter = 1;
+      uint32_t length = key_len * 8;
+      byte be_len[4] = { 0 };
       secure_vector< byte > prev(salt, salt + iv_len);
       secure_vector< byte > ctx(salt + iv_len, salt + salt_len);
 
+      store_be(length, be_len);
       m_prf->set_key(secret, secret_len);
 
       while(p < key + key_len && counter != 0)
@@ -89,7 +104,10 @@ size_t SP800_108_Feedback::kdf(byte key[], size_t key_len,
 
          m_prf->update(prev);
          m_prf->update(be_cnt,4);
+         m_prf->update(label,label_len);
+         m_prf->update(delim);
          m_prf->update(ctx);
+         m_prf->update(be_len,4);
          m_prf->final(prev);
 
          std::copy(prev.begin(), prev.begin() + to_copy, p);
@@ -117,15 +135,27 @@ SP800_108_Pipeline* SP800_108_Pipeline::make(const Spec& spec)
 
 size_t SP800_108_Pipeline::kdf(byte key[], size_t key_len,
                     const byte secret[], size_t secret_len,
-                    const byte salt[], size_t salt_len) const
+                    const byte salt[], size_t salt_len,
+                    const byte label[], size_t label_len) const
    {
       const std::size_t prf_len =  m_prf->output_length();
+      const byte delim = 0;
+
       byte *p = key;
       uint32_t counter = 1;
-      secure_vector<byte> ai(salt, salt + salt_len), ki;
+      uint32_t length = key_len * 8;
+      byte be_len[4] = { 0 };
+      secure_vector<byte> ai, ki;
 
+      store_be(length, be_len);
       m_prf->set_key(secret,secret_len);
 
+      // A(0)
+      std::copy(label,label + label_len,std::back_inserter(ai));
+      ai.emplace_back(delim);
+      std::copy(salt,salt + salt_len,std::back_inserter(ai));
+      std::copy(be_len,be_len + 4,std::back_inserter(ai));
+
       while(p < key + key_len && counter != 0)
          {
          // A(i)
@@ -140,7 +170,10 @@ size_t SP800_108_Pipeline::kdf(byte key[], size_t key_len,
 
          m_prf->update(ai);
          m_prf->update(be_cnt,4);
+         m_prf->update(label, label_len);
+         m_prf->update(delim);
          m_prf->update(salt, salt_len);
+         m_prf->update(be_len,4);
          m_prf->final(ki);
 
          std::copy(ki.begin(), ki.begin() + to_copy, p);
diff --git a/src/lib/kdf/sp800_108/sp800_108.h b/src/lib/kdf/sp800_108/sp800_108.h
index 0acdfacf9..71a918c15 100644
--- a/src/lib/kdf/sp800_108/sp800_108.h
+++ b/src/lib/kdf/sp800_108/sp800_108.h
@@ -23,9 +23,27 @@ class BOTAN_DLL SP800_108_Counter : public KDF
 
       KDF* clone() const override { return new SP800_108_Counter(m_prf->clone()); }
 
+      /**
+      * Derive a key using the SP800-108 KDF in Counter mode.
+      *
+      * The implementation hard codes the length of [L]_2
+      * and [i]_2 (the value r) to 32 bits.
+      *
+      * @param key resulting keying material
+      * @param key_len the desired output length in bytes
+      * @param secret K_I
+      * @param secret_len size of K_I in bytes
+      * @param salt Context
+      * @param salt_len size of Context in bytes
+      * @param label Label
+      * @param label_len size of Label in bytes
+      *
+      * @throws Invalid_Argument key_len > 2^32
+      */
       size_t kdf(byte key[], size_t key_len,
                  const byte secret[], size_t secret_len,
-                 const byte salt[], size_t salt_len) const override;
+                 const byte salt[], size_t salt_len,
+                 const byte label[], size_t label_len) const override;
 
       SP800_108_Counter(MessageAuthenticationCode* mac) : m_prf(mac) {}
 
@@ -44,9 +62,27 @@ class BOTAN_DLL SP800_108_Feedback : public KDF
 
       KDF* clone() const override { return new SP800_108_Feedback(m_prf->clone()); }
 
+      /**
+      * Derive a key using the SP800-108 KDF in Feedback mode.
+      *
+      * The implementation uses the optional counter i and hard
+      * codes the length of [L]_2 and [i]_2 (the value r) to 32 bits.
+      *
+      * @param key resulting keying material
+      * @param key_len the desired output length in bytes
+      * @param secret K_I
+      * @param secret_len size of K_I in bytes
+      * @param salt IV || Context
+      * @param salt_len size of Context plus IV in bytes
+      * @param label Label
+      * @param label_len size of Label in bytes
+      *
+      * @throws Invalid_Argument key_len > 2^32
+      */
       size_t kdf(byte key[], size_t key_len,
                  const byte secret[], size_t secret_len,
-                 const byte salt[], size_t salt_len) const override;
+                 const byte salt[], size_t salt_len,
+                 const byte label[], size_t label_len) const override;
 
       SP800_108_Feedback(MessageAuthenticationCode* mac) : m_prf(mac) {}
 
@@ -65,9 +101,27 @@ class BOTAN_DLL SP800_108_Pipeline : public KDF
 
       KDF* clone() const override { return new SP800_108_Pipeline(m_prf->clone()); }
 
+      /**
+      * Derive a key using the SP800-108 KDF in Double Pipeline mode.
+      *
+      * The implementation uses the optional counter i and hard
+      * codes the length of [L]_2 and [i]_2 (the value r) to 32 bits.
+      *
+      * @param key resulting keying material
+      * @param key_len the desired output length in bytes
+      * @param secret K_I
+      * @param secret_len size of K_I in bytes
+      * @param salt Context
+      * @param salt_len size of Context in bytes
+      * @param label Label
+      * @param label_len size of Label in bytes
+      *
+      * @throws Invalid_Argument key_len > 2^32
+      */
       size_t kdf(byte key[], size_t key_len,
                  const byte secret[], size_t secret_len,
-                 const byte salt[], size_t salt_len) const override;
+                 const byte salt[], size_t salt_len,
+                 const byte label[], size_t label_len) const override;
 
       SP800_108_Pipeline(MessageAuthenticationCode* mac) : m_prf(mac) {}