| | 1 | | using System.Diagnostics; |
| | 2 | |
|
| | 3 | | namespace NLightning.Infrastructure.Crypto.Functions; |
| | 4 | |
|
| | 5 | | using Domain.Crypto.Constants; |
| | 6 | | using Hashes; |
| | 7 | | using Primitives; |
| | 8 | |
|
| | 9 | | /// <summary> |
| | 10 | | /// HMAC-based Extract-and-Expand Key Derivation Function, defined in |
| | 11 | | /// <see href="https://tools.ietf.org/html/rfc5869">RFC 5869</see>. |
| | 12 | | /// </summary> |
| | 13 | | internal sealed class Hkdf : IDisposable |
| | 14 | | { |
| 8 | 15 | | private static readonly byte[] s_one = [1]; |
| 8 | 16 | | private static readonly byte[] s_two = [2]; |
| 8 | 17 | | private static readonly byte[] s_three = [3]; |
| | 18 | |
|
| 288 | 19 | | private readonly Sha256 _sha256 = new(); |
| | 20 | |
|
| | 21 | | private bool _disposed; |
| | 22 | |
|
| | 23 | | /// <summary> |
| | 24 | | /// Takes a chainingKey byte sequence of length HashLen, |
| | 25 | | /// and an inputKeyMaterial byte sequence with length |
| | 26 | | /// either zero bytes, 32 bytes, or DhLen bytes. Writes a |
| | 27 | | /// byte sequences of length 2 * HashLen into output parameter. |
| | 28 | | /// </summary> |
| | 29 | | public void ExtractAndExpand2(SecureMemory chainingKey, ReadOnlySpan<byte> inputKeyMaterial, Span<byte> output) |
| | 30 | | { |
| | 31 | | // ExceptionUtils.ThrowIfDisposed(_disposed, nameof(Hkdf)); |
| | 32 | |
|
| | 33 | | Debug.Assert(chainingKey.Length == CryptoConstants.SHA256_HASH_LEN); |
| | 34 | | Debug.Assert(output.Length == 2 * CryptoConstants.SHA256_HASH_LEN); |
| | 35 | |
|
| 232 | 36 | | Span<byte> tempKey = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| 232 | 37 | | HmacHash(chainingKey, tempKey, inputKeyMaterial); |
| | 38 | |
|
| 232 | 39 | | var output1 = output[..CryptoConstants.SHA256_HASH_LEN]; |
| 232 | 40 | | HmacHash(tempKey, output1, s_one); |
| | 41 | |
|
| 232 | 42 | | var output2 = output.Slice(CryptoConstants.SHA256_HASH_LEN, CryptoConstants.SHA256_HASH_LEN); |
| 232 | 43 | | HmacHash(tempKey, output2, output1, s_two); |
| 232 | 44 | | } |
| | 45 | |
|
| | 46 | | /// <summary> |
| | 47 | | /// Takes a chainingKey byte sequence of length HashLen, |
| | 48 | | /// and an inputKeyMaterial byte sequence with length |
| | 49 | | /// either zero bytes, 32 bytes, or DhLen bytes. Writes a |
| | 50 | | /// byte sequences of length 3 * HashLen into output parameter. |
| | 51 | | /// </summary> |
| | 52 | | public void ExtractAndExpand3(SecureMemory chainingKey, ReadOnlySpan<byte> inputKeyMaterial, Span<byte> output) |
| | 53 | | { |
| | 54 | | // ExceptionUtils.ThrowIfDisposed(_disposed, nameof(Hkdf)); |
| | 55 | |
|
| | 56 | | Debug.Assert(chainingKey.Length == CryptoConstants.SHA256_HASH_LEN); |
| | 57 | | Debug.Assert(output.Length == 3 * CryptoConstants.SHA256_HASH_LEN); |
| | 58 | |
|
| 0 | 59 | | Span<byte> tempKey = stackalloc byte[CryptoConstants.SHA256_HASH_LEN]; |
| 0 | 60 | | HmacHash(chainingKey, tempKey, inputKeyMaterial); |
| | 61 | |
|
| 0 | 62 | | var output1 = output[..CryptoConstants.SHA256_HASH_LEN]; |
| 0 | 63 | | HmacHash(tempKey, output1, s_one); |
| | 64 | |
|
| 0 | 65 | | var output2 = output.Slice(CryptoConstants.SHA256_HASH_LEN, CryptoConstants.SHA256_HASH_LEN); |
| 0 | 66 | | HmacHash(tempKey, output2, output1, s_two); |
| | 67 | |
|
| 0 | 68 | | var output3 = output.Slice(2 * CryptoConstants.SHA256_HASH_LEN, CryptoConstants.SHA256_HASH_LEN); |
| 0 | 69 | | HmacHash(tempKey, output3, output2, s_three); |
| 0 | 70 | | } |
| | 71 | |
|
| | 72 | | private void HmacHash(ReadOnlySpan<byte> key, Span<byte> hmac, ReadOnlySpan<byte> data1 = default, ReadOnlySpan<byte |
| | 73 | | { |
| | 74 | | // ExceptionUtils.ThrowIfDisposed(_disposed, nameof(Hkdf)); |
| | 75 | |
|
| | 76 | | Debug.Assert(key.Length == CryptoConstants.SHA256_HASH_LEN); |
| | 77 | | Debug.Assert(hmac.Length == CryptoConstants.SHA256_HASH_LEN); |
| | 78 | |
|
| 696 | 79 | | Span<byte> ipad = stackalloc byte[CryptoConstants.SHA256_BLOCK_LEN]; |
| 696 | 80 | | Span<byte> opad = stackalloc byte[CryptoConstants.SHA256_BLOCK_LEN]; |
| | 81 | |
|
| 696 | 82 | | key.CopyTo(ipad); |
| 696 | 83 | | key.CopyTo(opad); |
| | 84 | |
|
| 90480 | 85 | | for (var i = 0; i < CryptoConstants.SHA256_BLOCK_LEN; ++i) |
| | 86 | | { |
| 44544 | 87 | | ipad[i] ^= 0x36; |
| 44544 | 88 | | opad[i] ^= 0x5C; |
| | 89 | | } |
| | 90 | |
|
| 696 | 91 | | _sha256.AppendData(ipad); |
| 696 | 92 | | _sha256.AppendData(data1); |
| 696 | 93 | | _sha256.AppendData(data2); |
| 696 | 94 | | _sha256.GetHashAndReset(hmac); |
| | 95 | |
|
| 696 | 96 | | _sha256.AppendData(opad); |
| 696 | 97 | | _sha256.AppendData(hmac); |
| 696 | 98 | | _sha256.GetHashAndReset(hmac); |
| 696 | 99 | | } |
| | 100 | |
|
| | 101 | | public void Dispose() |
| | 102 | | { |
| 240 | 103 | | if (_disposed) |
| | 104 | | { |
| 0 | 105 | | return; |
| | 106 | | } |
| | 107 | |
|
| 240 | 108 | | _sha256.Dispose(); |
| | 109 | |
|
| 240 | 110 | | _disposed = true; |
| 240 | 111 | | } |
| | 112 | | } |