Commit b0809bc8 authored by Rich Salz's avatar Rich Salz Committed by Rich Salz
Browse files

RT3998: Allow scrypt to be disabled 



This does 64-bit division and multiplication, and on 32-bit platforms
pulls in libgcc symbols (and MSVC does similar) which may not be
available.  Mostly done by David Woodhouse.

Reviewed-by: default avatarDr. Stephen Henson <steve@openssl.org>
parent a939b0aa

apps/pkcs8.c

+12 −2
Original line number Diff line number Diff line
@@ -68,8 +68,10 @@ typedef enum OPTION_choice { 
    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,

    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,

    OPT_TOPK8, OPT_NOITER, OPT_NOCRYPT, OPT_NOOCT, OPT_NSDB, OPT_EMBED,

    OPT_V2, OPT_V1, OPT_V2PRF, OPT_ITER, OPT_PASSIN, OPT_PASSOUT,

    OPT_SCRYPT, OPT_SCRYPT_N, OPT_SCRYPT_R, OPT_SCRYPT_P

#ifndef OPENSSL_NO_SCRYPT

    OPT_SCRYPT, OPT_SCRYPT_N, OPT_SCRYPT_R, OPT_SCRYPT_P,

#endif

    OPT_V2, OPT_V1, OPT_V2PRF, OPT_ITER, OPT_PASSIN, OPT_PASSOUT

} OPTION_CHOICE;



OPTIONS pkcs8_options[] = {
@@ -94,10 +96,12 @@ OPTIONS pkcs8_options[] = { 
#ifndef OPENSSL_NO_ENGINE

    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},

#endif

#ifndef OPENSSL_NO_SCRYPT

    {"scrypt", OPT_SCRYPT, '-', "Use scrypt algorithm"},

    {"scrypt_N", OPT_SCRYPT_N, 's', "Set scrypt N parameter"},

    {"scrypt_r", OPT_SCRYPT_R, 's', "Set scrypt r parameter"},

    {"scrypt_p", OPT_SCRYPT_P, 's', "Set scrypt p parameter"},

#endif

    {NULL}

};
@@ -116,7 +120,9 @@ int pkcs8_main(int argc, char **argv) 
    int nocrypt = 0, ret = 1, iter = PKCS12_DEFAULT_ITER, p8_broken = PKCS8_OK;

    int informat = FORMAT_PEM, outformat = FORMAT_PEM, topk8 = 0, pbe_nid = -1;

    int private = 0;

#ifndef OPENSSL_NO_SCRYPT

    unsigned long scrypt_N = 0, scrypt_r = 0, scrypt_p = 0;

#endif



    prog = opt_init(argc, argv, pkcs8_options);

    while ((o = opt_next()) != OPT_EOF) {
@@ -195,6 +201,7 @@ int pkcs8_main(int argc, char **argv) 
        case OPT_ENGINE:

            e = setup_engine(opt_arg(), 0);

            break;

#ifndef OPENSSL_NO_SCRYPT

        case OPT_SCRYPT:

            scrypt_N = 1024;

            scrypt_r = 8;
@@ -214,6 +221,7 @@ int pkcs8_main(int argc, char **argv) 
            if (!opt_ulong(opt_arg(), &scrypt_p))

                goto opthelp;

            break;

#endif

        }

    }

    argc = opt_num_rest();
@@ -260,10 +268,12 @@ int pkcs8_main(int argc, char **argv) 
        } else {

            X509_ALGOR *pbe;

            if (cipher) {

#ifndef OPENSSL_NO_SCRYPT

                if (scrypt_N && scrypt_r && scrypt_p)

                    pbe = PKCS5_pbe2_set_scrypt(cipher, NULL, 0, NULL,

                                                scrypt_N, scrypt_r, scrypt_p);

                else

#endif

                    pbe = PKCS5_pbe2_set_iv(cipher, iter, NULL, 0, NULL,

                                            pbe_nid);

            } else {

crypto/asn1/p5_scrypt.c

+2 −0
Original line number Diff line number Diff line
@@ -65,6 +65,7 @@ 
#include <openssl/x509.h>

#include <openssl/rand.h>



#ifndef OPENSSL_NO_SCRYPT

/* PKCS#5 scrypt password based encryption structures */



typedef struct {
@@ -330,3 +331,4 @@ int PKCS5_v2_scrypt_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, 
    SCRYPT_PARAMS_free(sparam);

    return rv;

}

#endif /* OPENSSL_NO_SCRYPT */

crypto/evp/evp_pbe.c

+2 −0
Original line number Diff line number Diff line
@@ -119,7 +119,9 @@ static const EVP_PBE_CTL builtin_pbe[] = { 
    {EVP_PBE_TYPE_PRF, NID_hmacWithSHA512, -1, NID_sha512, 0},

    {EVP_PBE_TYPE_PRF, NID_id_HMACGostR3411_94, -1, NID_id_GostR3411_94, 0},

    {EVP_PBE_TYPE_KDF, NID_id_pbkdf2, -1, -1, PKCS5_v2_PBKDF2_keyivgen},

#ifndef OPENSSL_NO_SCRYPT

    {EVP_PBE_TYPE_KDF, NID_id_scrypt, -1, -1, PKCS5_v2_scrypt_keyivgen}

#endif

};



int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,

crypto/evp/scrypt.c

+3 −0
Original line number Diff line number Diff line
@@ -64,6 +64,8 @@ 
#include <openssl/err.h>

#include <internal/numbers.h>



#ifndef OPENSSL_NO_SCRYPT



#define R(a,b) (((a) << (b)) | ((a) >> (32 - (b))))

static void salsa208_word_specification(uint32_t inout[16])

{
@@ -296,3 +298,4 @@ int EVP_PBE_scrypt(const char *pass, size_t passlen, 
    OPENSSL_clear_free(B, Blen + Vlen);

    return rv;

}

#endif

include/openssl/evp.h

+2 −0
Original line number Diff line number Diff line
@@ -1075,6 +1075,7 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen, 
                          ASN1_TYPE *param, const EVP_CIPHER *cipher,

                          const EVP_MD *md, int en_de);



#ifndef OPENSSL_NO_SCRYPT

int EVP_PBE_scrypt(const char *pass, size_t passlen,

                   const unsigned char *salt, size_t saltlen,

                   uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem,
@@ -1083,6 +1084,7 @@ int EVP_PBE_scrypt(const char *pass, size_t passlen, 
int PKCS5_v2_scrypt_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass,

                             int passlen, ASN1_TYPE *param,

                             const EVP_CIPHER *c, const EVP_MD *md, int en_de);

#endif



void PKCS5_PBE_add(void);