Internet-Draft | GOST Password-based Keys | September 2022 |
Karelina | Expires 1 April 2023 | [Page] |
This document specifies how to use the Password-Based Cryptography Specification version 2.1 (PKCS #5) defined in RFC8018 to generate a symmetric key from a password in conjunction with the Russian national standard GOST algorithms.¶
PKCS #5 applies a pseudorandom function (a cryptographic hash, cipher, or HMAC) to the input password along with a salt value and repeats the process many times to produce a derived key.¶
This specification is developed outside the IETF and is published to facilitate interoperable implementations that wish to support the GOST algorithms. This document does not imply IETF endorsement of the cryptographic algorithms used in this document.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 1 April 2023.¶
Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
This document provides a specification of usage of GOST R 34.12-2015 encryption algorithms and the GOST R 34.11-2012 hashing functions with PKCS #5. The methods described in this document are designed to generate key information using the user's password and to protect information using the generated keys.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
Throughout this document, the following notation is used:¶
P | a password encoded as a Unicode UTF-8 string |
S | a random initializing value |
c | a number of iterations of algorithm, a positive integer |
dkLen | a length in octets of derived key, a positive integer |
DK | a derived key of length dkLen |
B_n | a set of all octet strings of length n, n >= 0; if n = 0, then the set B_n consists of an empty string of length 0 |
A||C | a concatenation of two octet strings A, C, i.e., a vector from B_(|A|+|C|), where the left subvector from B_(|A|) is equal to the vector A and the right subvector from B_(|C|) is equal to the vector C: A = (a_(n_1),...,a_1) in B_(n_1) and C = (c_(n_2),..., c_1) in B_(n_2), res = (a_(n_1),...,a_1,c_(n_2),..., c_1) in B_(n_1 + n_2); |
\xor | a bit-wise exclusive-or of two octet strings of the same length |
MSB^n_r: B_n -> B_r | a truncating of an octet string to size r by removing the least significant n-r octets: MSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1) =(a_n,...,a_(n-r+1)); |
LSB^n_r: B_n -> B_r | a truncating of a octet string to size r by removing the most significant n-r octets: LSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1) =(a_r,...,a_1) |
Int(i) | a four-octet encoding of the integer i =< 2^32: (i_1, i_2, i_3, i_4) in B_4, i = i_1 + 2^8 * i_2 + 2^16 * i_3 + 2^24 * i_4 |
b[i, j] | a substring extraction operator: extracts octets i through j, 0 =< i =< j. |
CEIL(x) | the smallest integer greater than, or equal to, x |
This document uses the following abbreviations and symbols:¶
HMAC_GOSTR3411 | Hashed-based Message Authentication Code. A function for calculating a message authentication code, based on the GOST R 34.11-2012 hash function ([RFC6986]) with 512-bit output in accordance with [RFC2104]. |
The DK key is calculated by means of a key derivation function PBKDF2(P, S, c, dkLen) [RFC8018], section 5.2 using the HMAC_GOSTR3411 function as the PRF pseudo-random function:¶
The PBKDF2 function is defined as the following algorithm:¶
Calculate a set of values for each i from 1 to n:¶
Concatenate the octet strings T(i) and extract the first dkLen octets to produce a derived key DK:¶
Data encryption using the DK key is carried out in accordance with the PBES2 scheme (see [RFC8018], section 6.2) using GOST R 34.12-2015 in CTR_ACPKM mode (see [RFC8645]).¶
The encryption process for PBES2 consists of the following steps:¶
Apply the key derivation function to the password P, the random value S and the iteration count c to produce a derived key DK of length dkLen octets in accordance with the algorithm from Section 4. Generate the sequence T(1) and truncate it to 32 octets, i.e.,¶
Generate the random value ukm of size n, where n takes a value of 12 or 16 octets, depending on the selected encryption algorithm:¶
For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see Section 7.3) encrypt the message M with GOST R 34.12-2015 algorithm with the derived key DK and the ukm in accordance with the following steps:¶
- Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm (see [RFC7836]):¶
Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take the folowing values:¶
The input string label above is encoded using ASCII ( [RFC0020] ).¶
The decryption process for PBES2 consists of the following steps:¶
For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see Section 7.3) decrypt the ciphertext C with GOST R 34.12-2015 algorithm with the derived key DK and the ukm in accordance with the following steps:¶
- Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm:¶
Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take the folowing values:¶
The input string label above is encoded using ASCII ( [RFC0020] ).¶
PBMAC1 scheme is used for message authentication (see [RFC8018], section 7.1). This scheme bases on the HMAC_GOSTR3411 function.¶
The MAC generation operation for PBMAC1 consists of the following steps:¶
The MAC verification operation for PBMAC1 consists of the following steps:¶
This section defines ASN.1 syntax for the key derivation functions, the encryption schemes, the message authentication scheme, and supporting techniques ([RFC8018]).¶
rsadsi OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) 113549 } pkcs OBJECT IDENTIFIER ::= { rsadsi 1 } pkcs-5 OBJECT IDENTIFIER ::= { pkcs 5 }¶
The object identifier id-PBKDF2 identifies the PBKDF2 key derivation function:¶
id-PBKDF2 OBJECT IDENTIFIER ::= { pkcs-5 12 }¶
The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type PBKDF2-params:¶
PBKDF2-params ::= SEQUENCE { salt CHOICE { specified OCTET STRING, otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}} }, iterationCount INTEGER (1000..MAX), keyLength INTEGER (32..MAX) OPTIONAL, prf AlgorithmIdentifier {{PBKDF2-PRFs}} }¶
The fields of type PBKDF2-params have the following meanings:¶
id-tc26-hmac-gost-3411-12-512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) reg7(7) tk26(1) algorithms(1) hmac(4) 512(2) }¶
The object identifier id-PBES2 identifies the PBES2 encryption scheme:¶
id-PBES2 OBJECT IDENTIFIER ::= { pkcs-5 13 }¶
The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type PBES2-params:¶
PBES2-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier { { PBES2-KDFs } }, encryptionScheme AlgorithmIdentifier { { PBES2-Encs } } }¶
The fields of type PBES2-params have the following meanings:¶
The Gost34.12-2015 encryption algorithm identifier SHALL take one of the following values:¶
id-gostr3412-2015-magma-ctracpkm OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-magma(1) mode-ctracpkm(1) }¶
In case of use id-gostr3412-2015-magma-ctracpkm identifier the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with [RFC8645]. The block size is 64 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.¶
id-gostr3412-2015-magma-ctracpkm-omac OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-magma(1) mode-ctracpkm-omac(2) }¶
In case of use id-gostr3412-2015-magma-ctracpkm-omac identifier the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with [RFC8645], and MAC is computed by the GOST R 34.12-2015 Magma cipher in MAC mode (MAC size is 64 bits). The block size is 64 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.¶
id-gostr3412-2015-kuznyechik-ctracpkm OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-kuznyechik(2) mode-ctracpkm(1) }¶
In case of use id-gostr3412-2015-kuznyechik-ctracpkm identifier the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with [RFC8645]. The block size is 128 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.¶
id-gostr3412-2015-kuznyechik-ctracpkm-omac OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-kuznyechik(2) mode-ctracpkm-omac(2) }¶
In case of use id-gostr3412-2015-kuznyechik-ctracpkm-omac identifier the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with [RFC8645], and MAC is computed by the GOST R 34.12-2015 Kuznyechik cipher in MAC mode (MAC size is 128 bits). The block size is 128 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.¶
The parameters field in an AlgorithmIdentifier SHALL have type Gost3412-15-Encryption-Parameters:¶
Gost3412-15-Encryption-Parameters ::= SEQUENCE { ukm OCTET STRING }¶
The field of type Gost3412-15-Encryption-Parameters have the following meanings:¶
The object identifier id-PBMAC1 identifies the PBMAC1 message authentication scheme:¶
id-PBMAC1 OBJECT IDENTIFIER ::= { pkcs-5 14 }¶
The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type PBMAC1-params:¶
PBMAC1-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier { { PBMAC1-KDFs } }, messageAuthScheme AlgorithmIdentifier { { PBMAC1-MACs } } }¶
The fields of type PBMAC1-params have the following meanings:¶
For information on security considerations for password-based cryptography see [RFC8018].¶
Conforming applications MUST use unique values for ukm and S in order to avoid the encryption of different data on the same keys with the same initialization vector.¶
It is RECOMMENDED that parameter S consist of at least 32 octets of pseudo-random data in order to reduce the probability of collisions of keys generated from the same password.¶
This document makes no requests for IANA action.¶
These test vectors are formed by analogy with test vectors from [RFC6070]. The input strings below are encoded using ASCII ( [RFC0020] ). The sequence "\0" (without quotation marks) means a literal ASCII NULL value (1 octet). "DK" refers to the Derived Key.¶
Input: P = "password" (8 octets) S = "salt" (4 octets) c = 1 dkLen = 64 Output: DK = 64 77 0a f7 f7 48 c3 b1 c9 ac 83 1d bc fd 85 c2 61 11 b3 0a 8a 65 7d dc 30 56 b8 0c a7 3e 04 0d 28 54 fd 36 81 1f 6d 82 5c c4 ab 66 ec 0a 68 a4 90 a9 e5 cf 51 56 b3 a2 b7 ee cd db f9 a1 6b 47 Input: P = "password" (8 octets) S = "salt" (4 octets) c = 2 dkLen = 64 Output: DK = 5a 58 5b af df bb 6e 88 30 d6 d6 8a a3 b4 3a c0 0d 2e 4a eb ce 01 c9 b3 1c 2c ae d5 6f 02 36 d4 d3 4b 2b 8f bd 2c 4e 89 d5 4d 46 f5 0e 47 d4 5b ba c3 01 57 17 43 11 9e 8d 3c 42 ba 66 d3 48 de Input: P = "password" (8 octets) S = "salt" (4 octets) c = 4096 dkLen = 64 Output: DK = e5 2d eb 9a 2d 2a af f4 e2 ac 9d 47 a4 1f 34 c2 03 76 59 1c 67 80 7f 04 77 e3 25 49 dc 34 1b c7 86 7c 09 84 1b 6d 58 e2 9d 03 47 c9 96 30 1d 55 df 0d 34 e4 7c f6 8f 4e 3c 2c da f1 d9 ab 86 c3 Input: P = "password" (8 octets) S = "salt" (4 octets) c = 16777216 dkLen = 64 Output: DK = 49 e4 84 3b ba 76 e3 00 af e2 4c 4d 23 dc 73 92 de f1 2f 2c 0e 24 41 72 36 7c d7 0a 89 82 ac 36 1a db 60 1c 7e 2a 31 4e 8c b7 b1 e9 df 84 0e 36 ab 56 15 be 5d 74 2b 6c f2 03 fb 55 fd c4 80 71 Input: P = "passwordPASSWORDpassword" (24 octets) S = "saltSALTsaltSALTsaltSALTsaltSALTsalt" (36 octets) c = 4096 dkLen = 100 Output: DK = b2 d8 f1 24 5f c4 d2 92 74 80 20 57 e4 b5 4e 0a 07 53 aa 22 fc 53 76 0b 30 1c f0 08 67 9e 58 fe 4b ee 9a dd ca e9 9b a2 b0 b2 0f 43 1a 9c 5e 50 f3 95 c8 93 87 d0 94 5a ed ec a6 eb 40 15 df c2 bd 24 21 ee 9b b7 11 83 ba 88 2c ee bf ef 25 9f 33 f9 e2 7d c6 17 8c b8 9d c3 74 28 cf 9c c5 2a 2b aa 2d 3a Input: P = "pass\0word" (9 octets) S = "sa\0lt" (5 octets) c = 4096 dkLen = 64 Output: DK = 50 df 06 28 85 b6 98 01 a3 c1 02 48 eb 0a 27 ab 6e 52 2f fe b2 0c 99 1c 66 0f 00 14 75 d7 3a 4e 16 7f 78 2c 18 e9 7e 92 97 6d 9c 1d 97 08 31 ea 78 cc b8 79 f6 70 68 cd ac 19 10 74 08 44 e8 30¶