diff --git a/src/core/BUILD.gn b/src/core/BUILD.gn index 996ad5954..89a989229 100644 --- a/src/core/BUILD.gn +++ b/src/core/BUILD.gn @@ -406,7 +406,7 @@ openthread_core_files = [ "crypto/mbedtls.cpp", "crypto/mbedtls.hpp", "crypto/pbkdf2_cmac.cpp", - "crypto/pbkdf2_cmac.h", + "crypto/pbkdf2_cmac.hpp", "crypto/sha256.cpp", "crypto/sha256.hpp", "diags/factory_diags.cpp", diff --git a/src/core/Makefile.am b/src/core/Makefile.am index 01ba833cc..61732d87a 100644 --- a/src/core/Makefile.am +++ b/src/core/Makefile.am @@ -431,7 +431,7 @@ HEADERS_COMMON = \ crypto/hkdf_sha256.hpp \ crypto/hmac_sha256.hpp \ crypto/mbedtls.hpp \ - crypto/pbkdf2_cmac.h \ + crypto/pbkdf2_cmac.hpp \ crypto/sha256.hpp \ diags/factory_diags.hpp \ mac/channel_mask.hpp \ diff --git a/src/core/crypto/pbkdf2_cmac.cpp b/src/core/crypto/pbkdf2_cmac.cpp index 1af07f01e..988a57706 100644 --- a/src/core/crypto/pbkdf2_cmac.cpp +++ b/src/core/crypto/pbkdf2_cmac.cpp @@ -31,26 +31,29 @@ * This file implements PBKDF2 using AES-CMAC-PRF-128 */ -#include "pbkdf2_cmac.h" +#include "pbkdf2_cmac.hpp" +#include #include #include "common/debug.hpp" -#include +namespace ot { +namespace Crypto { +namespace Pbkdf2 { #if OPENTHREAD_FTD -void otPbkdf2Cmac(const uint8_t *aPassword, - uint16_t aPasswordLen, - const uint8_t *aSalt, - uint16_t aSaltLen, - uint32_t aIterationCounter, - uint16_t aKeyLen, - uint8_t * aKey) +void GenerateKey(const uint8_t *aPassword, + uint16_t aPasswordLen, + const uint8_t *aSalt, + uint16_t aSaltLen, + uint32_t aIterationCounter, + uint16_t aKeyLen, + uint8_t * aKey) { const size_t kBlockSize = MBEDTLS_CIPHER_BLKSIZE_MAX; - uint8_t prfInput[OT_PBKDF2_SALT_MAX_LEN + 4]; // Salt || INT(), for U1 calculation + uint8_t prfInput[kMaxSaltLength + 4]; // Salt || INT(), for U1 calculation long prfOne[kBlockSize / sizeof(long)]; long prfTwo[kBlockSize / sizeof(long)]; long keyBlock[kBlockSize / sizeof(long)]; @@ -112,3 +115,7 @@ void otPbkdf2Cmac(const uint8_t *aPassword, } #endif // OPENTHREAD_FTD + +} // namespace Pbkdf2 +} // namespace Crypto +} // namespace ot diff --git a/src/core/crypto/pbkdf2_cmac.h b/src/core/crypto/pbkdf2_cmac.hpp similarity index 71% rename from src/core/crypto/pbkdf2_cmac.h rename to src/core/crypto/pbkdf2_cmac.hpp index fffb5baf7..7c8559c2b 100644 --- a/src/core/crypto/pbkdf2_cmac.h +++ b/src/core/crypto/pbkdf2_cmac.hpp @@ -29,25 +29,34 @@ /** * @file * @brief - * This file defines the PBKDF2 using CMAC C APIs. + * This file includes definitions for performing Password-Based Key Derivation Function 2 (PBKDF2) using CMAC. */ -#ifndef PBKDF2_CMAC_H_ -#define PBKDF2_CMAC_H_ +#ifndef PBKDF2_CMAC_HPP_ +#define PBKDF2_CMAC_HPP_ #include "openthread-core-config.h" -#include #include -#ifdef __cplusplus -extern "C" { -#endif - -#define OT_PBKDF2_SALT_MAX_LEN 30 // salt prefix (6) + extended panid (8) + network name (16) +namespace ot { +namespace Crypto { +namespace Pbkdf2 { /** - * This method perform PKCS#5 PBKDF2 using CMAC (AES-CMAC-PRF-128). + * @addtogroup core-security + * + * @{ + * + */ + +enum : uint16_t +{ + kMaxSaltLength = 30, ///< Max SALT length: salt prefix (6) + extended panid (8) + network name (16) +}; + +/** + * This function performs PKCS#5 PBKDF2 using CMAC (AES-CMAC-PRF-128). * * @param[in] aPassword Password to use when generating key. * @param[in] aPasswordLen Length of password. @@ -58,16 +67,21 @@ extern "C" { * @param[out] aKey A pointer to the generated key. * */ -void otPbkdf2Cmac(const uint8_t *aPassword, - uint16_t aPasswordLen, - const uint8_t *aSalt, - uint16_t aSaltLen, - uint32_t aIterationCounter, - uint16_t aKeyLen, - uint8_t * aKey); +void GenerateKey(const uint8_t *aPassword, + uint16_t aPasswordLen, + const uint8_t *aSalt, + uint16_t aSaltLen, + uint32_t aIterationCounter, + uint16_t aKeyLen, + uint8_t * aKey); -#ifdef __cplusplus -} // extern "C" -#endif +/** + * @} + * + */ -#endif // PBKDF2_CMAC_H_ +} // namespace Pbkdf2 +} // namespace Crypto +} // namespace ot + +#endif // PBKDF2_CMAC_HPP_ diff --git a/src/core/meshcop/commissioner.cpp b/src/core/meshcop/commissioner.cpp index b56d431ed..78bf2adb6 100644 --- a/src/core/meshcop/commissioner.cpp +++ b/src/core/meshcop/commissioner.cpp @@ -41,7 +41,6 @@ #include "common/locator-getters.hpp" #include "common/logging.hpp" #include "common/string.hpp" -#include "crypto/pbkdf2_cmac.h" #include "meshcop/joiner.hpp" #include "meshcop/joiner_router.hpp" #include "meshcop/meshcop.hpp" diff --git a/src/core/meshcop/meshcop.cpp b/src/core/meshcop/meshcop.cpp index 082b6ed04..248986c65 100644 --- a/src/core/meshcop/meshcop.cpp +++ b/src/core/meshcop/meshcop.cpp @@ -38,7 +38,7 @@ #include "common/locator-getters.hpp" #include "common/logging.hpp" #include "common/string.hpp" -#include "crypto/pbkdf2_cmac.h" +#include "crypto/pbkdf2_cmac.hpp" #include "crypto/sha256.hpp" #include "mac/mac_types.hpp" #include "thread/thread_netif.hpp" @@ -321,7 +321,7 @@ otError GeneratePskc(const char * aPassPhrase, { otError error = OT_ERROR_NONE; const char saltPrefix[] = "Thread"; - uint8_t salt[OT_PBKDF2_SALT_MAX_LEN]; + uint8_t salt[Crypto::Pbkdf2::kMaxSaltLength]; uint16_t saltLen = 0; uint16_t passphraseLen; uint8_t networkNameLen; @@ -346,8 +346,8 @@ otError GeneratePskc(const char * aPassPhrase, memcpy(salt + saltLen, aNetworkName.GetAsCString(), networkNameLen); saltLen += networkNameLen; - otPbkdf2Cmac(reinterpret_cast(aPassPhrase), passphraseLen, reinterpret_cast(salt), - saltLen, 16384, OT_PSKC_MAX_SIZE, aPskc.m8); + Crypto::Pbkdf2::GenerateKey(reinterpret_cast(aPassPhrase), passphraseLen, salt, saltLen, 16384, + OT_PSKC_MAX_SIZE, aPskc.m8); exit: return error;