| < draft-kaliski-pkcs5-v2-01.txt | draft-kaliski-pkcs5-v2-02.txt > | |||
|---|---|---|---|---|
| RSA Laboratories B. Kaliski | INTERNET-DRAFT B. Kaliski | |||
| Internet Draft Security Dynamics | Expires: May 2000 RSA Laboratories | |||
| Expires December 1999 June 1999 | Intended Category: Informational November 1999 | |||
| Password-Based Cryptography Specification | Password-Based Cryptography Specification | |||
| PKCS #5 v2.0 | PKCS #5 v2.0 | |||
| <draft-kaliski-pkcs5-v2-01.txt> | <draft-kaliski-pkcs5-v2-02.txt> | |||
| Status of this Memo | Status of this Memo | |||
| This document is an Internet-Draft and is in full conformance with | This document is an Internet-Draft and is in full conformance with | |||
| all provisions of Section 10 of RFC2026 except that the right to | all provisions of Section 10 of RFC2026 except that the right to | |||
| produce derivative works is not granted.. Internet-Drafts are | produce derivative works is not granted. Internet-Drafts are working | |||
| working documents of the Internet Engineering Task Force (IETF), its | documents of the Internet Engineering Task Force (IETF), its areas, | |||
| areas, and its working groups. Note that other groups may also | and its working groups. Note that other groups may also distribute | |||
| distribute working documents as Internet-Drafts. | working documents as Internet-Drafts. | |||
| Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| The list of current Internet-Drafts can be accessed at | The list of current Internet-Drafts can be accessed at | |||
| http://www.ietf.org/ietf/1id-abstracts.txt | http://www.ietf.org/ietf/1id-abstracts.txt | |||
| The list of Internet-Draft Shadow Directories can be accessed at | The list of Internet-Draft Shadow Directories can be accessed at | |||
| http://www.ietf.org/shadow.html. | http://www.ietf.org/shadow.html. | |||
| Abstract | Abstract | |||
| This document provides recommendations for the implementation of | This document provides recommendations for the implementation of | |||
| password-based cryptography, covering key derivation functions, | password-based cryptography, covering key derivation functions, | |||
| encryption schemes, message-authentication schemes, and ASN.1 syntax | encryption schemes, message-authentication schemes, and ASN.1 syntax | |||
| identifying the techniques. | identifying the techniques. | |||
| The recommendations are intended for general application within | The recommendations are intended for general application within | |||
| computer and communications systems, and as such include a fair | computer and communications systems, and as such include a fair | |||
| skipping to change at page 2, line 7 ¶ | skipping to change at page 2, line 7 ¶ | |||
| profiles based on these specifications may include additional | profiles based on these specifications may include additional | |||
| constraints. | constraints. | |||
| Other cryptographic techniques based on passwords, such as password- | Other cryptographic techniques based on passwords, such as password- | |||
| based key entity authentication and key establishment protocols | based key entity authentication and key establishment protocols | |||
| [4][5][26] are outside the scope of this document. Guidelines for the | [4][5][26] are outside the scope of this document. Guidelines for the | |||
| selection of passwords are also outside the scope. | selection of passwords are also outside the scope. | |||
| Table of Contents | Table of Contents | |||
| Status of this Memo .............................................. 1 | 1 Introduction ................................................. 3 | |||
| Abstract ......................................................... 1 | 2 Notation ..................................................... 3 | |||
| Table of Contents ................................................ 2 | 3 Overview ..................................................... 4 | |||
| 1 Introduction ................................................. 3 | 4 Salt and Iteration Count ..................................... 6 | |||
| 2 Notation ..................................................... 3 | 4.1 Salt .................................................... 6 | |||
| 3 Overview ..................................................... 4 | 4.2 Iteration Count ......................................... 8 | |||
| 4 Salt and Iteration Count ..................................... 6 | 5 Key Derivation Functions ..................................... 8 | |||
| 4.1 Salt .................................................... 6 | 5.1 PBKDF1 .................................................. 9 | |||
| 4.2 Iteration Count ......................................... 8 | 5.2 PBKDF2 .................................................. 9 | |||
| 5 Key Derivation Functions ..................................... 8 | ||||
| 5.1 PBKDF1 .................................................. 9 | ||||
| 5.2 PBKDF2 .................................................. 10 | ||||
| 6 Encryption Schemes ........................................... 11 | 6 Encryption Schemes ........................................... 11 | |||
| 6.1 PBES1 ................................................... 11 | 6.1 PBES1 ................................................... 12 | |||
| 6.1.1 Encryption Operation ............................. 12 | 6.1.1 Encryption Operation ............................. 12 | |||
| 6.1.2 Decryption Operation ............................. 13 | 6.1.2 Decryption Operation ............................. 13 | |||
| 6.2 PBES2 ................................................... 14 | 6.2 PBES2 ................................................... 14 | |||
| 6.2.1 Encryption Operation ............................. 14 | 6.2.1 Encryption Operation ............................. 14 | |||
| 6.2.2 Decryption Operation ............................. 14 | 6.2.2 Decryption Operation ............................. 15 | |||
| 7 Message Authentication Schemes ............................... 15 | 7 Message Authentication Schemes ............................... 15 | |||
| 7.1 PBMAC1 .................................................. 15 | 7.1 PBMAC1 .................................................. 15 | |||
| 7.1.1 MAC Generation ................................... 15 | 7.1.1 MAC Generation ................................... 16 | |||
| 7.1.2 MAC Verification ................................. 16 | 7.1.2 MAC Verification ................................. 16 | |||
| 8 Security Considerations ...................................... 17 | ||||
| 9 Author's Address.............................................. 17 | ||||
| Appendices | Appendices | |||
| A ASN.1 Syntax ................................................. 17 | A ASN.1 Syntax ................................................. 18 | |||
| A.1 PBKDF1 .................................................. 17 | A.1 PBKDF1 .................................................. 18 | |||
| A.2 PBKDF2 .................................................. 17 | A.2 PBKDF2 .................................................. 18 | |||
| A.3 PBES1 ................................................... 19 | A.3 PBES1 ................................................... 20 | |||
| A.4 PBES2 ................................................... 19 | A.4 PBES2 ................................................... 20 | |||
| A.5 PBMAC1 .................................................. 20 | A.5 PBMAC1 .................................................. 21 | |||
| B Supporting Techniques ........................................ 20 | B Supporting Techniques ........................................ 22 | |||
| B.1 Pseudorandom Functions .................................. 21 | B.1 Pseudorandom Functions .................................. 22 | |||
| B.1.1 HMAC-SHA-1 ....................................... 21 | B.1.1 HMAC-SHA-1 ....................................... 22 | |||
| B.2 Encryption Schemes ...................................... 22 | B.2 Encryption Schemes ...................................... 23 | |||
| B.2.1 DES-CBC-Pad ...................................... 22 | B.2.1 DES-CBC-Pad ...................................... 23 | |||
| B.2.2 DES-EDE3-CBC-Pad ................................. 22 | B.2.2 DES-EDE3-CBC-Pad ................................. 24 | |||
| B.2.3 RC2-CBC-Pad ...................................... 23 | B.2.3 RC2-CBC-Pad ...................................... 24 | |||
| B.2.4 RC5-CBC-Pad ...................................... 24 | B.2.4 RC5-CBC-Pad ...................................... 25 | |||
| B.3 Message Authentication Schemes .......................... 24 | B.3 Message Authentication Schemes .......................... 26 | |||
| B.3.1 HMAC-SHA-1 ....................................... 25 | B.3.1 HMAC-SHA-1 ....................................... 26 | |||
| C ASN.1 Module ................................................. 25 | C ASN.1 Module ................................................. 26 | |||
| D Intellectual Property Considerations ......................... 28 | D Intellectual Property Considerations ......................... 30 | |||
| E Revision History ............................................. 30 | ||||
| Table of Contents | F References ................................................... 31 | |||
| G Contact Information & About PKCS ............................. 33 | ||||
| E Revision History ............................................. 28 | ||||
| E.1 Versions 1.0-1.3 ........................................ 28 | ||||
| E.2 Version 1.4 ............................................. 28 | ||||
| E.3 Version 1.5 ............................................. 28 | ||||
| E.4 Version 2.0 ............................................. 29 | ||||
| F References ................................................... 29 | ||||
| G Contact Information & About PKCS ............................. 31 | ||||
| 1. Introduction | 1. Introduction | |||
| This document provides recommendations for the implementation of | This document provides recommendations for the implementation of | |||
| password-based cryptography, covering the following aspects: | password-based cryptography, covering the following aspects: | |||
| - key derivation functions | - key derivation functions | |||
| - encryption schemes | - encryption schemes | |||
| - message-authentication schemes | - message-authentication schemes | |||
| - ASN.1 syntax identifying the techniques | - ASN.1 syntax identifying the techniques | |||
| The recommendations are intended for general application within | The recommendations are intended for general application within | |||
| computer and communications systems, and as such include a fair | computer and communications systems, and as such include a fair | |||
| amount of flexibility. They are particularly intended for the | amount of flexibility. They are particularly intended for the | |||
| protection of sensitive information such as private keys, as in PKCS | protection of sensitive information such as private keys, as in PKCS | |||
| #8 [25]. It is expected that application standards and implementation | #8 [25]. It is expected that application standards and implementation | |||
| profiles based on these specifications may include additional | profiles based on these specifications may include additional | |||
| constraints. | constraints. | |||
| Other cryptographic techniques based on passwords, such as | Other cryptographic techniques based on passwords, such as password- | |||
| password-based key entity authentication and key establishment | based key entity authentication and key establishment protocols | |||
| protocols [4][5][26] are outside the scope of this document. | [4][5][26] are outside the scope of this document. Guidelines for the | |||
| Guidelines for the selection of passwords are also outside the scope. | selection of passwords are also outside the scope. | |||
| This document supersedes PKCS #5 version 1.5 [24], but includes | This document supersedes PKCS #5 version 1.5 [24], but includes | |||
| compatible techniques. | compatible techniques. | |||
| 2. Notation | 2. Notation | |||
| C ciphertext, an octet string | C ciphertext, an octet string | |||
| c iteration count, a positive integer | c iteration count, a positive integer | |||
| DK derived key, an octet string | DK derived key, an octet string | |||
| dkLen length in octets of derived key, a positive integer | dkLen length in octets of derived key, a positive integer | |||
| EM encoded message, an octet string | EM encoded message, an octet string | |||
| skipping to change at page 4, line 14 ¶ | skipping to change at page 4, line 4 ¶ | |||
| Hash underlying hash function | Hash underlying hash function | |||
| hLen length in octets of pseudorandom function output, a positive | hLen length in octets of pseudorandom function output, a positive | |||
| integer | integer | |||
| l length in blocks of derived key, a positive integer | l length in blocks of derived key, a positive integer | |||
| IV initialization vector, an octet string | IV initialization vector, an octet string | |||
| K encryption key, an octet string | K encryption key, an octet string | |||
| KDF key derivation function | KDF key derivation function | |||
| M message, an octet string | M message, an octet string | |||
| P password, an octet string | P password, an octet string | |||
| PRF underlying pseudorandom function | PRF underlying pseudorandom function | |||
| PS padding string, an octet string | PS padding string, an octet string | |||
| psLen length in octets of padding string, a positive integer | psLen length in octets of padding string, a positive integer | |||
| S salt, an octet string | S salt, an octet string | |||
| T message authentication code, an octet string | T message authentication code, an octet string | |||
| T1, ..., Tl, U1, ..., Uc | T_1, ..., T_l, U_1, ..., U_c | |||
| intermediate values, octet strings | intermediate values, octet strings | |||
| 01, 02, ..., 08 | 01, 02, ..., 08 | |||
| octets with value 1, 2, ..., 8 | octets with value 1, 2, ..., 8 | |||
| \xor bit-wise exclusive-or of two octet strings | \xor bit-wise exclusive-or of two octet strings | |||
| || || octet length operator | || || octet length operator | |||
| || concatenation operator | || concatenation operator | |||
| <i..j> substring extraction operator: extracts octets i through j, | <i..j> substring extraction operator: extracts octets i through j, | |||
| 0 <= i <= j | 0 <= i <= j | |||
| 3. Overview | 3. Overview | |||
| In many applications of public-key cryptography, user security is | In many applications of public-key cryptography, user security is | |||
| ultimately dependent on one or more secret text values or passwords. | ultimately dependent on one or more secret text values or passwords. | |||
| Since a password is not directly applicable as a key to any | Since a password is not directly applicable as a key to any | |||
| conventional cryptosystem, however, some processing of the password | conventional cryptosystem, however, some processing of the password | |||
| is required to perform cryptographic operations with it. Moreover, as | is required to perform cryptographic operations with it. Moreover, as | |||
| passwords are often chosen from a relatively small space, special | passwords are often chosen from a relatively small space, special | |||
| care is required in that processing to defend against search attacks. | care is required in that processing to defend against search attacks. | |||
| A general approach to password-based cryptography, as described by | A general approach to password-based cryptography, as described by | |||
| Morris and Thompson [8] for the protection of password tables, is to | Morris and Thompson [8] for the protection of password tables, is to | |||
| combine a password with a salt to produce a key. The salt can be | combine a password with a salt to produce a key. The salt can be | |||
| viewed as an index into a large set of keys derived from the | viewed as an index into a large set of keys derived from the | |||
| password, and need not be kept secret. Although it may be possible | password, and need not be kept secret. Although it may be possible | |||
| for an opponent to construct a table of possible passwords (a | for an opponent to construct a table of possible passwords (a so- | |||
| so-called "dictionary attack"), constructing a table of possible keys | called "dictionary attack"), constructing a table of possible keys | |||
| will be difficult, since there will be many possible keys for each | will be difficult, since there will be many possible keys for each | |||
| password. An opponent will thus be limited to searching through | password. An opponent will thus be limited to searching through | |||
| passwords separately for each salt. | passwords separately for each salt. | |||
| Another approach to password-based cryptography is to construct key | Another approach to password-based cryptography is to construct key | |||
| derivation techniques that are relatively expensive, thereby | derivation techniques that are relatively expensive, thereby | |||
| increasing the cost of exhaustive search. One way to do this is to | increasing the cost of exhaustive search. One way to do this is to | |||
| include an iteration count in the key derivation technique, | include an iteration count in the key derivation technique, | |||
| indicating how many times to iterate some underlying function by | indicating how many times to iterate some underlying function by | |||
| which keys are derived. A modest number of iterations, say 1000, is | which keys are derived. A modest number of iterations, say 1000, is | |||
| skipping to change at page 5, line 37 ¶ | skipping to change at page 5, line 28 ¶ | |||
| encryption in PKCS #5 v1.5, and adopted here as well for the various | encryption in PKCS #5 v1.5, and adopted here as well for the various | |||
| cryptographic operations. Thus, password-based key derivation as | cryptographic operations. Thus, password-based key derivation as | |||
| defined here is a function of a password, a salt, and an iteration | defined here is a function of a password, a salt, and an iteration | |||
| count, where the latter two quantities need not be kept secret. | count, where the latter two quantities need not be kept secret. | |||
| From a password-based key derivation function, it is straightforward | From a password-based key derivation function, it is straightforward | |||
| to define password-based encryption and message authentication | to define password-based encryption and message authentication | |||
| schemes. As in PKCS #5 v1.5, the password-based encryption schemes | schemes. As in PKCS #5 v1.5, the password-based encryption schemes | |||
| here are based on an underlying, conventional encryption scheme, | here are based on an underlying, conventional encryption scheme, | |||
| where the key for the conventional scheme is derived from the | where the key for the conventional scheme is derived from the | |||
| password. Similarly, the password-based message authentication | password. Similarly, the password-based message authentication scheme | |||
| scheme is based on an underlying conventional scheme. This two- | is based on an underlying conventional scheme. This two- layered | |||
| layered approach makes the password-based techniques modular in terms | approach makes the password-based techniques modular in terms of the | |||
| of the underlying techniques they can be based on. | underlying techniques they can be based on. | |||
| It is expected that the password-based key derivation functions may | It is expected that the password-based key derivation functions may | |||
| find other applications than just the encryption and message | find other applications than just the encryption and message | |||
| authentication schemes defined here. For instance, one might derive | authentication schemes defined here. For instance, one might derive a | |||
| a set of keys with a single application of a key derivation function, | set of keys with a single application of a key derivation function, | |||
| rather than derive each key with a separate application of the | rather than derive each key with a separate application of the | |||
| function. The keys in the set would be obtained as substrings of the | function. The keys in the set would be obtained as substrings of the | |||
| output of the key derivation function. This approach might be | output of the key derivation function. This approach might be | |||
| employed as part of key establishment in a session-oriented protocol. | employed as part of key establishment in a session-oriented protocol. | |||
| Another application is password checking, where the output of the key | Another application is password checking, where the output of the key | |||
| derivation function is stored (along with the salt and iteration | derivation function is stored (along with the salt and iteration | |||
| count) for the purposes of subsequent verification of a password. | count) for the purposes of subsequent verification of a password. | |||
| Throughout this document, a password is considered to be an octet | Throughout this document, a password is considered to be an octet | |||
| string of arbitrary length whose interpretation as a text string is | string of arbitrary length whose interpretation as a text string is | |||
| skipping to change at page 6, line 11 ¶ | skipping to change at page 6, line 4 ¶ | |||
| Another application is password checking, where the output of the key | Another application is password checking, where the output of the key | |||
| derivation function is stored (along with the salt and iteration | derivation function is stored (along with the salt and iteration | |||
| count) for the purposes of subsequent verification of a password. | count) for the purposes of subsequent verification of a password. | |||
| Throughout this document, a password is considered to be an octet | Throughout this document, a password is considered to be an octet | |||
| string of arbitrary length whose interpretation as a text string is | string of arbitrary length whose interpretation as a text string is | |||
| unspecified. In the interest of interoperability, however, it is | unspecified. In the interest of interoperability, however, it is | |||
| recommended that applications follow some common text encoding rules. | recommended that applications follow some common text encoding rules. | |||
| ASCII and UTF-8 [27] are two possibilities. (ASCII is a subset of | ASCII and UTF-8 [27] are two possibilities. (ASCII is a subset of | |||
| UTF-8.) | UTF-8.) | |||
| Although the selection of passwords is outside the scope of this | Although the selection of passwords is outside the scope of this | |||
| document, guidelines have been published [17] that may well be taken | document, guidelines have been published [17] that may well be taken | |||
| into account. | into account. | |||
| 4. Salt and iteration count | 4. Salt and iteration count | |||
| Inasmuch as salt and iteration count are central to the techniques | Inasmuch as salt and iteration count are central to the techniques | |||
| defined in this document, some further discussion is warranted. | defined in this document, some further discussion is warranted. | |||
| 4.1 Salt | 4.1 Salt | |||
| A salt in password-based cryptography has traditionally served the | A salt in password-based cryptography has traditionally served the | |||
| purpose of producing a large set of keys corresponding to a given | purpose of producing a large set of keys corresponding to a given | |||
| password, among which one is selected at random according to the | password, among which one is selected at random according to the | |||
| salt. An individual key in the set is selected by applying a key | salt. An individual key in the set is selected by applying a key | |||
| derivation function KDF, as | derivation function KDF, as | |||
| DK = KDF (P, S) | DK = KDF (P, S) | |||
| where DK is the derived key, P is the password, and S is the salt. | where DK is the derived key, P is the password, and S is the salt. | |||
| This has two benefits: | This has two benefits: | |||
| 1. It is difficult for an opponent to precompute all the keys | 1. It is difficult for an opponent to precompute all the keys | |||
| corresponding to a dictionary of passwords, or even the | corresponding to a dictionary of passwords, or even the | |||
| most likely keys. If the salt is 64 bits long, for | most likely keys. If the salt is 64 bits long, for | |||
| instance, there will be as many as 2^64 keys for each | instance, there will be as many as 2^64 keys for each | |||
| password. An opponent is thus limited to searching for | password. An opponent is thus limited to searching for | |||
| passwords after a password-based operation has been | passwords after a password-based operation has been | |||
| performed and the salt is known. | performed and the salt is known. | |||
| 2. It is unlikely that the same key will be selected twice. | 2. It is unlikely that the same key will be selected twice. | |||
| Again, if the salt is 64 bits long, the chance of | Again, if the salt is 64 bits long, the chance of | |||
| "collision" between keys does not become significant until | "collision" between keys does not become significant until | |||
| about 2^32 keys have been produced, according to the | about 2^32 keys have been produced, according to the | |||
| Birthday Paradox. This addresses some of the concerns about | Birthday Paradox. This addresses some of the concerns about | |||
| interactions between multiple uses of the same key, which | interactions between multiple uses of the same key, which | |||
| may apply for some encryption and authentication | may apply for some encryption and authentication | |||
| techniques. | techniques. | |||
| In password-based encryption, the party encrypting a message can gain | In password-based encryption, the party encrypting a message can gain | |||
| assurance that these benefits are realized simply by selecting a | assurance that these benefits are realized simply by selecting a | |||
| large and sufficiently random salt when deriving an encryption key | large and sufficiently random salt when deriving an encryption key | |||
| from a password. A party generating a message authentication code | from a password. A party generating a message authentication code can | |||
| can gain such assurance in a similar fashion. | gain such assurance in a similar fashion. | |||
| The party decrypting a message or verifying a message authentication | The party decrypting a message or verifying a message authentication | |||
| code, however, cannot be sure that a salt supplied by another party | code, however, cannot be sure that a salt supplied by another party | |||
| has actually been generated at random. It is possible, for instance, | has actually been generated at random. It is possible, for instance, | |||
| that the salt may have been copied from another password-based | that the salt may have been copied from another password-based | |||
| operation, in an attempt to exploit interactions between multiple | operation, in an attempt to exploit interactions between multiple | |||
| uses of the same key. For instance, suppose two legitimate parties | uses of the same key. For instance, suppose two legitimate parties | |||
| exchange a encrypted message, where the encryption key is an 80-bit | exchange a encrypted message, where the encryption key is an 80-bit | |||
| key derived from a shared password with some salt. An opponent could | key derived from a shared password with some salt. An opponent could | |||
| take the salt from that encryption and provide it to one of the | take the salt from that encryption and provide it to one of the | |||
| skipping to change at page 7, line 33 ¶ | skipping to change at page 7, line 26 ¶ | |||
| To defend against such attacks, either the interaction between | To defend against such attacks, either the interaction between | |||
| multiple uses of the same key should be carefully analyzed, or the | multiple uses of the same key should be carefully analyzed, or the | |||
| salt should contain data that explicitly distinguishes between | salt should contain data that explicitly distinguishes between | |||
| different operations. For instance, the salt might have an | different operations. For instance, the salt might have an | |||
| additional, non-random octet that specifies whether the derived key | additional, non-random octet that specifies whether the derived key | |||
| is for encryption, for message authentication, or for some other | is for encryption, for message authentication, or for some other | |||
| operation. | operation. | |||
| Based on this, the following is recommended for salt selection: | Based on this, the following is recommended for salt selection: | |||
| 1. If there is no concern about interactions between multiple | 1. If there is no concern about interactions between multiple | |||
| uses of the same key (or a prefix of that key) with the | uses of the same key (or a prefix of that key) with the | |||
| password-based encryption and authentication techniques | password-based encryption and authentication techniques | |||
| supported for a given password, then the salt may be | supported for a given password, then the salt may be | |||
| generated at random and need not be checked for a | generated at random and need not be checked for a | |||
| particular format by the party receiving the salt. It | particular format by the party receiving the salt. It | |||
| should be at least eight octets (64 bits) long. | should be at least eight octets (64 bits) long. | |||
| 2. Otherwise, the salt should contain data that explicitly | 2. Otherwise, the salt should contain data that explicitly | |||
| distinguishes between different operations and different | distinguishes between different operations and different | |||
| key lengths, in addition to a random part that is at least | key lengths, in addition to a random part that is at least | |||
| eight octets long, and this data should be checked or | eight octets long, and this data should be checked or | |||
| regenerated by the party receiving the salt. For instance, | regenerated by the party receiving the salt. For instance, | |||
| the salt could have an additional non-random octet that | the salt could have an additional non-random octet that | |||
| specifies the purpose of the derived key. Alternatively, | specifies the purpose of the derived key. Alternatively, | |||
| it could be the encoding of a structure that specifies | it could be the encoding of a structure that specifies | |||
| detailed information about the derived key, such as the | detailed information about the derived key, such as the | |||
| encryption or authentication technique and a sequence | encryption or authentication technique and a sequence | |||
| number among the different keys derived from the password. | number among the different keys derived from the password. | |||
| The particular format of the additional data is left to the | The particular format of the additional data is left to the | |||
| application. | application. | |||
| Note. If a random number generator or pseudorandom generator is not | Note. If a random number generator or pseudorandom generator is not | |||
| available, a deterministic alternative for generating the salt (or | available, a deterministic alternative for generating the salt (or | |||
| the random part of it) is to apply a password-based key derivation | the random part of it) is to apply a password-based key derivation | |||
| function to the password and the message M to be processed. For | function to the password and the message M to be processed. For | |||
| instance, the salt could be computed with a key derivation function | instance, the salt could be computed with a key derivation function | |||
| as S = KDF (P, M). This approach is not recommended if the message M | as S = KDF (P, M). This approach is not recommended if the message M | |||
| is known to belong to a small message space (e.g., "Yes" or "No"), | is known to belong to a small message space (e.g., "Yes" or "No"), | |||
| however, since then there will only be a small number of possible | however, since then there will only be a small number of possible | |||
| salts. | salts. | |||
| 4.2 Iteration count | 4.2 Iteration count | |||
| An iteration count has traditionally served the purpose of increasing | An iteration count has traditionally served the purpose of increasing | |||
| the cost of producing keys from a password, thereby also increasing | the cost of producing keys from a password, thereby also increasing | |||
| the difficulty of attack. For the methods in this document, a minimum | the difficulty of attack. For the methods in this document, a minimum | |||
| of 1000 iterations is recommended. This will increase the cost of | of 1000 iterations is recommended. This will increase the cost of | |||
| exhaustive search for passwords significantly, without a noticeable | exhaustive search for passwords significantly, without a noticeable | |||
| impact in the cost of deriving individual keys. | impact in the cost of deriving individual keys. | |||
| 5. Key derivation functions | 5. Key derivation functions | |||
| A key derivation function produces a derived key from a base key and | A key derivation function produces a derived key from a base key and | |||
| other parameters. In a password-based key derivation function, the | other parameters. In a password-based key derivation function, the | |||
| base key is a password and the other parameters are a salt value and | base key is a password and the other parameters are a salt value and | |||
| an iteration count, as outlined in Section 3. | an iteration count, as outlined in Section 3. | |||
| The primary application of the password-based key derivation | The primary application of the password-based key derivation | |||
| functions defined here is in the encryption schemes in Section 6 and | functions defined here is in the encryption schemes in Section 6 and | |||
| the message authentication scheme in Section 7. Other applications | the message authentication scheme in Section 7. Other applications | |||
| are certainly possible, hence the independent definition of these | are certainly possible, hence the independent definition of these | |||
| functions. | functions. | |||
| Two functions are specified in this section: PBKDF1 and PBKDF2. | Two functions are specified in this section: PBKDF1 and PBKDF2. | |||
| PBKDF2 is recommended for new applications; PBKDF1 is included only | PBKDF2 is recommended for new applications; PBKDF1 is included only | |||
| for compatibility with existing applications, and is not recommended | for compatibility with existing applications, and is not recommended | |||
| for new applications. | for new applications. | |||
| A typical application of the key derivation functions defined here | A typical application of the key derivation functions defined here | |||
| might include the following steps: | might include the following steps: | |||
| 1. Select a salt S and an iteration count c, as outlined in | 1. Select a salt S and an iteration count c, as outlined in | |||
| Section 4. | Section 4. | |||
| 2. Select a length in octets for the derived key, dkLen. | 2. Select a length in octets for the derived key, dkLen. | |||
| 3. Apply the key derivation function to the password, the | 3. Apply the key derivation function to the password, the | |||
| salt, the iteration count and the key length to produce a | salt, the iteration count and the key length to produce a | |||
| derived key. | derived key. | |||
| 4. Output the derived key. | 4. Output the derived key. | |||
| Any number of keys may be derived from a password by varying the | Any number of keys may be derived from a password by varying the | |||
| salt, as described in Section 3. | salt, as described in Section 3. | |||
| 5.1 PBKDF1 | 5.1 PBKDF1 | |||
| PBKDF1 applies a hash function, which shall be MD2 [6], MD5 [19] or | PBKDF1 applies a hash function, which shall be MD2 [6], MD5 [19] or | |||
| SHA-1 [18], to derive keys. The length of the derived key is bounded | SHA-1 [18], to derive keys. The length of the derived key is bounded | |||
| by the length of the hash function output, which is 16 octets for MD2 | by the length of the hash function output, which is 16 octets for MD2 | |||
| and MD5 and 20 octets for SHA-1. PBKDF1 is compatible with the key | and MD5 and 20 octets for SHA-1. PBKDF1 is compatible with the key | |||
| derivation process in PKCS #5 v1.5. | derivation process in PKCS #5 v1.5. | |||
| PBKDF1 is recommended only for compatibility with existing | PBKDF1 is recommended only for compatibility with existing | |||
| applications since the keys it produces may not be large enough for | applications since the keys it produces may not be large enough for | |||
| some applications. | some applications. | |||
| PBKDF1 (P, S, c, dkLen) | PBKDF1 (P, S, c, dkLen) | |||
| Options: Hash underlying hash function | Options: Hash underlying hash function | |||
| Input: P password, an octet string | Input: P password, an octet string | |||
| S salt, an eight-octet string | S salt, an eight-octet string | |||
| c iteration count, a positive integer | c iteration count, a positive integer | |||
| dkLen intended length in octets of derived key, a | dkLen intended length in octets of derived key, | |||
| positive integer, at most 16 for MD2 or MD5 | a positive integer, at most 16 for MD2 or | |||
| and 20 for SHA-1 | MD5 and 20 for SHA-1 | |||
| Output: DK derived key, a dkLen-octet string | Output: DK derived key, a dkLen-octet string | |||
| Steps: | Steps: | |||
| 1. If dkLen > 16 for MD2 and MD5, or dkLen > 20 for SHA-1, output | 1. If dkLen > 16 for MD2 and MD5, or dkLen > 20 for SHA-1, | |||
| "derived key too long" and stop. | output "derived key too long" and stop. | |||
| 2. Apply the underlying hash function Hash for c iterations to | 2. Apply the underlying hash function Hash for c iterations to | |||
| the concatenation of the password P and the salt S, then | the concatenation of the password P and the salt S, then | |||
| extract the first dkLen octets to produce a derived key DK: | extract the first dkLen octets to produce a derived key DK: | |||
| T1 = Hash (P || S) , | T_1 = Hash (P || S) , | |||
| T2 = Hash (T1) , | T_2 = Hash (T_1) , | |||
| ... | ... | |||
| Tc = Hash (Tc-1) , | T_c = Hash (T_{c-1}) , | |||
| DK = Tc<0..dkLen-1> | DK = Tc<0..dkLen-1> | |||
| 3. Output the derived key DK. | 3. Output the derived key DK. | |||
| 5.2 PBKDF2 | 5.2 PBKDF2 | |||
| PBKDF2 applies a pseudorandom function (see Appendix B.1 for an | PBKDF2 applies a pseudorandom function (see Appendix B.1 for an | |||
| example) to derive keys. The length of the derived key is essentially | example) to derive keys. The length of the derived key is essentially | |||
| unbounded. (However, the maximum effective search space for the | unbounded. (However, the maximum effective search space for the | |||
| derived key may be limited by the structure of the underlying | derived key may be limited by the structure of the underlying | |||
| pseudorandom function. See Appendix B.1 for further discussion.) | pseudorandom function. See Appendix B.1 for further discussion.) | |||
| PBKDF2 is recommended for new applications. | PBKDF2 is recommended for new applications. | |||
| PBKDF2 (P, S, c, dkLen) | PBKDF2 (P, S, c, dkLen) | |||
| Options: PRF underlying pseudorandom function (hLen | Options: PRF underlying pseudorandom function (hLen | |||
| denotes the length in octets of the | denotes the length in octets of the | |||
| pseudorandom function output) | pseudorandom function output) | |||
| Input: P password, an octet string | Input: P password, an octet string | |||
| S salt, an octet string | S salt, an octet string | |||
| c iteration count, a positive integer | c iteration count, a positive integer | |||
| dkLen intended length in octets of the derived key, | dkLen intended length in octets of the derived | |||
| a positive integer, at most | key, a positive integer, at most | |||
| (2^32 - 1) * hLen | (2^32 - 1) * hLen | |||
| Output: DK derived key, a dkLen-octet string | Output: DK derived key, a dkLen-octet string | |||
| Steps: | Steps: | |||
| 1. If dkLen > (2^32 - 1) * hLen, output "derived key too long" | 1. If dkLen > (2^32 - 1) * hLen, output "derived key too long" | |||
| and stop. | and stop. | |||
| 2. Let l be the number of hLen-octet blocks in the derived key, | 2. Let l be the number of hLen-octet blocks in the derived key, | |||
| rounding up, and let r be the number of octets in the last | rounding up, and let r be the number of octets in the last | |||
| block: | block: | |||
| l = [dkLen / hLen] , | l = CEIL (dkLen / hLen) , | |||
| r = dkLen - (l - 1) * hLen . | r = dkLen - (l - 1) * hLen . | |||
| 3. For each block of the derived key apply the function F defined | Here, CEIL (x) is the "ceiling" function, i.e. the smallest | |||
| below to the password P, the salt S, the iteration count c, | integer greater than, or equal to, x. | |||
| and the block index to compute the block: | ||||
| T1 = F (P, S, c, 1) , | 3. For each block of the derived key apply the function F | |||
| T2 = F (P, S, c, 2) , | defined below to the password P, the salt S, the iteration | |||
| ... | count c, and the block index to compute the block: | |||
| Tl = F (P, S, c, l) , | ||||
| where the function F is defined as the exclusive-or sum of the | T_1 = F (P, S, c, 1) , | |||
| first c iterates of the underlying pseudorandom function PRF | T_2 = F (P, S, c, 2) , | |||
| applied to the password P and the concatenation of the salt S | ... | |||
| and the block index i: | T_l = F (P, S, c, l) , | |||
| F (P, S, c, i) = U1 \xor U2 \xor ... \xor Uc | where the function F is defined as the exclusive-or sum of | |||
| the first c iterates of the underlying pseudorandom function | ||||
| PRF applied to the password P and the concatenation of the | ||||
| salt S and the block index i: | ||||
| where | F (P, S, c, i) = U_1 \xor U_2 \xor ... \xor U_c | |||
| U1 = PRF (P, S || INT (i)) , | where | |||
| U2 = PRF (P, U1) , | ||||
| ... | ||||
| Uc = PRF (P, Uc-1) . | ||||
| Here, INT (i) is a four-octet encoding of the integer i, most | U_1 = PRF (P, S || INT (i)) , | |||
| significant octet first. | U_2 = PRF (P, U_1) , | |||
| ... | ||||
| U_c = PRF (P, U_{c-1}) . | ||||
| 4. Concatenate the blocks and extract the first dkLen octets to | Here, INT (i) is a four-octet encoding of the integer i, most | |||
| produce a derived key DK: | significant octet first. | |||
| DK = T1 || T2 || ... || Tl<0..r-1> | 4. Concatenate the blocks and extract the first dkLen octets to | |||
| produce a derived key DK: | ||||
| 5. Output the derived key DK. | DK = T_1 || T_2 || ... || T_l<0..r-1> | |||
| 5. Output the derived key DK. | ||||
| Note. The construction of the function F follows a "belt-and- | Note. The construction of the function F follows a "belt-and- | |||
| suspenders" approach. The iterates Ui are computed recursively to | suspenders" approach. The iterates U_i are computed recursively to | |||
| remove a degree of parallelism from an opponent; they are | remove a degree of parallelism from an opponent; they are exclusive- | |||
| exclusive-ored together to reduce concerns about the recursion | ored together to reduce concerns about the recursion degenerating | |||
| degenerating into a small set of values. | into a small set of values. | |||
| 6. Encryption schemes | 6. Encryption schemes | |||
| An encryption scheme, in the symmetric setting, consists of an | An encryption scheme, in the symmetric setting, consists of an | |||
| encryption operation and a decryption operation, where the encryption | encryption operation and a decryption operation, where the encryption | |||
| operation produces a ciphertext from a message under a key, and the | operation produces a ciphertext from a message under a key, and the | |||
| decryption operation recovers the message from the ciphertext under | decryption operation recovers the message from the ciphertext under | |||
| the same key. In a password-based encryption scheme, the key is a | the same key. In a password-based encryption scheme, the key is a | |||
| password. | password. | |||
| A typical application of a password-based encryption scheme is a | A typical application of a password-based encryption scheme is a | |||
| private-key protection method, where the message contains private-key | private-key protection method, where the message contains private-key | |||
| information, as in PKCS #8. The encryption schemes defined here would | information, as in PKCS #8. The encryption schemes defined here would | |||
| be suitable encryption algorithms in that context. | be suitable encryption algorithms in that context. | |||
| Two schemes are specified in this section: PBES1 and PBES2. PBES2 is | Two schemes are specified in this section: PBES1 and PBES2. PBES2 is | |||
| recommended for new applications; PBES1 is included only for | recommended for new applications; PBES1 is included only for | |||
| compatibility with existing applications, and is not recommended | compatibility with existing applications, and is not recommended for | |||
| for new applications. | new applications. | |||
| 6.1 PBES1 | 6.1 PBES1 | |||
| PBES1 combines the PBKDF1 function (Section 5.1) with an underlying | PBES1 combines the PBKDF1 function (Section 5.1) with an underlying | |||
| block cipher, which shall be either DES [15] or RC2TM [21] in CBC | block cipher, which shall be either DES [15] or RC2(tm) [21] in CBC | |||
| mode [16]. PBES1 is compatible with the encryption scheme in PKCS #5 | mode [16]. PBES1 is compatible with the encryption scheme in PKCS #5 | |||
| v1.5. | v1.5. | |||
| PBES1 is recommended only for compatibility with existing | PBES1 is recommended only for compatibility with existing | |||
| applications, since it supports only two underlying encryption | applications, since it supports only two underlying encryption | |||
| schemes, each of which has a key size (56 or 64 bits) that may not be | schemes, each of which has a key size (56 or 64 bits) that may not be | |||
| large enough for some applications. | large enough for some applications. | |||
| 6.1.1 Encryption operation | 6.1.1 Encryption operation | |||
| The encryption operation for PBES1 consists of the following steps, | The encryption operation for PBES1 consists of the following steps, | |||
| which encrypt a message M under a password P to produce a ciphertext | which encrypt a message M under a password P to produce a ciphertext | |||
| C: | C: | |||
| 1. Select an eight-octet salt S and an iteration count c, as | 1. Select an eight-octet salt S and an iteration count c, as | |||
| outlined in Section 4. | outlined in Section 4. | |||
| 2. Apply the PBKDF1 key derivation function (Section 5.1) to the | 2. Apply the PBKDF1 key derivation function (Section 5.1) to the | |||
| password P, the salt S, and the iteration count c to produce a | password P, the salt S, and the iteration count c to produce | |||
| derived key DK of length 16 octets: | at derived key DK of length 16 octets: | |||
| DK = PBKDF1 (P, S, c, 16) . | DK = PBKDF1 (P, S, c, 16) . | |||
| 3. Separate the derived key DK into an encryption key K | 3. Separate the derived key DK into an encryption key K | |||
| consisting of the first eight octets of DK and an | consisting of the first eight octets of DK and an | |||
| initialization vector IV consisting of the next eight octets: | initialization vector IV consisting of the next eight octets: | |||
| K = DK<0..7> , | K = DK<0..7> , | |||
| IV = DK<8..15> . | IV = DK<8..15> . | |||
| 4. Concatenate M and a padding string PS to form an encoded | 4. Concatenate M and a padding string PS to form an encoded | |||
| message EM: | message EM: | |||
| EM = M || PS , | EM = M || PS , | |||
| where the padding string PS consists of 8-(||M|| mod 8) | where the padding string PS consists of 8-(||M|| mod 8) | |||
| octets each with value 8-(||M|| mod 8). The padding string PS | octets each with value 8-(||M|| mod 8). The padding string PS | |||
| will satisfy one of the following statements: | will satisfy one of the following statements: | |||
| PS = 01, if ||M|| mod 8 = 7 ; | PS = 01, if ||M|| mod 8 = 7 ; | |||
| PS = 02 02, if ||M|| mod 8 = 6 ; | PS = 02 02, if ||M|| mod 8 = 6 ; | |||
| ... | ... | |||
| PS = 08 08 08 08 08 08 08 08, if ||M|| mod 8 = 0. | PS = 08 08 08 08 08 08 08 08, if ||M|| mod 8 = 0. | |||
| The length in octets of the encoded message will be a multiple | The length in octets of the encoded message will be a | |||
| of eight and it will be possible to recover the message M | multiple of eight and it will be possible to recover the | |||
| unambiguously from the encoded message. (This padding rule is | message M unambiguously from the encoded message. (This | |||
| taken from RFC 1423 [3].) | padding rule is taken from RFC 1423 [3].) | |||
| 5. Encrypt the encoded message EM with the underlying block | 5. Encrypt the encoded message EM with the underlying block | |||
| cipher (DES or RC2) in cipher block chaining mode under the | cipher (DES or RC2) in cipher block chaining mode under the | |||
| encryption key K with initialization vector IV to produce the | encryption key K with initialization vector IV to produce the | |||
| ciphertext C. For DES, the key K shall be considered as a | ciphertext C. For DES, the key K shall be considered as a | |||
| 64-bit encoding of a 56-bit DES key with parity bits ignored | 64-bit encoding of a 56-bit DES key with parity bits ignored | |||
| (see [9]). For RC2, the "effective key bits" shall be 64 bits. | (see [9]). For RC2, the "effective key bits" shall be 64 | |||
| bits. | ||||
| 6. Output the ciphertext C. | 6. Output the ciphertext C. | |||
| The salt S and the iteration count c may be conveyed to the party | The salt S and the iteration count c may be conveyed to the party | |||
| performing decryption in an AlgorithmIdentifier value (see Appendix | performing decryption in an AlgorithmIdentifier value (see Appendix | |||
| A.3). | A.3). | |||
| 6.1.2 Decryption operation | 6.1.2 Decryption operation | |||
| The decryption operation for PBES1 consists of the following steps, | The decryption operation for PBES1 consists of the following steps, | |||
| which decrypt a ciphertext C under a password P to recover a message | which decrypt a ciphertext C under a password P to recover a message | |||
| M: | M: | |||
| 1. Obtain the eight-octet salt S and the iteration count c. | 1. Obtain the eight-octet salt S and the iteration count c. | |||
| 2. Apply the PBKDF1 key derivation function (Section 5.1) to the | ||||
| password P, the salt S, and the iteration count c to produce a | ||||
| derived key DK of length 16 octets: | ||||
| DK = PBKDF1 (P, S, c, 16) | 2. Apply the PBKDF1 key derivation function (Section 5.1) to the | |||
| password P, the salt S, and the iteration count c to produce | ||||
| a derived key DK of length 16 octets: | ||||
| 3. Separate the derived key DK into an encryption key K | DK = PBKDF1 (P, S, c, 16) | |||
| consisting of the first eight octets of DK and an | ||||
| initialization vector IV consisting of the next eight octets: | ||||
| K = DK<0..7> , | 3. Separate the derived key DK into an encryption key K | |||
| IV = DK<8..15> . | consisting of the first eight octets of DK and an | |||
| initialization vector IV consisting of the next eight octets: | ||||
| 4. Decrypt the ciphertext C with the underlying block cipher (DES | K = DK<0..7> , | |||
| or RC2) in cipher block chaining mode under the encryption key | IV = DK<8..15> . | |||
| K with initialization vector IV to recover an encoded message | ||||
| EM. If the length in octets of the ciphertext C is not a | ||||
| multiple of eight, output "decryption error" and stop. | ||||
| 5. Separate the encoded message EM into a message M and a padding | 4. Decrypt the ciphertext C with the underlying block cipher | |||
| string PS: | (DES or RC2) in cipher block chaining mode under the | |||
| encryption key K with initialization vector IV to recover an | ||||
| encoded message EM. If the length in octets of the ciphertext | ||||
| C is not a multiple of eight, output "decryption error" and | ||||
| stop. | ||||
| EM = M || PS , | 5. Separate the encoded message EM into a message M and a | |||
| padding string PS: | ||||
| where the padding string PS consists of some number psLen | EM = M || PS , | |||
| octets each with value psLen, where psLen is between 1 and 8. | ||||
| If it is not possible to separate the encoded message EM in | ||||
| this manner, output "decryption error" and stop. | ||||
| 6. Output the recovered message M. | where the padding string PS consists of some number psLen | |||
| octets each with value psLen, where psLen is between 1 and 8. | ||||
| If it is not possible to separate the encoded message EM in | ||||
| this manner, output "decryption error" and stop. | ||||
| 6.2 PBES2 | 6. Output the recovered message M. | |||
| 6.2 PBES2 | ||||
| PBES2 combines a password-based key derivation function, which shall | PBES2 combines a password-based key derivation function, which shall | |||
| be PBKDF2 (Section 5.2) for this version of PKCS #5, with an | be PBKDF2 (Section 5.2) for this version of PKCS #5, with an | |||
| underlying encryption scheme (see Appendix B.2 for examples). The key | underlying encryption scheme (see Appendix B.2 for examples). The key | |||
| length and any other parameters for the underlying encryption scheme | length and any other parameters for the underlying encryption scheme | |||
| depend on the scheme. | depend on the scheme. | |||
| PBES2 is recommended for new applications. | PBES2 is recommended for new applications. | |||
| 6.2.1 Encryption operation | 6.2.1 Encryption operation | |||
| The encryption operation for PBES2 consists of the following steps, | The encryption operation for PBES2 consists of the following steps, | |||
| which encrypt a message M under a password P to produce a ciphertext | which encrypt a message M under a password P to produce a ciphertext | |||
| C, applying a selected key derivation function KDF and a selected | C, applying a selected key derivation function KDF and a selected | |||
| underlying encryption scheme: | underlying encryption scheme: | |||
| 1. Select a salt S and an iteration count c, as outlined in | 1. Select a salt S and an iteration count c, as outlined in | |||
| Section 4. | Section 4. | |||
| 2. Select the length in octets, dkLen, for the derived key for | 2. Select the length in octets, dkLen, for the derived key for | |||
| the underlying encryption scheme. | the underlying encryption scheme. | |||
| 3. Apply the selected key derivation function to the password P, | 3. Apply the selected key derivation function to the password P, | |||
| the salt S, and the iteration count c to produce a derived key | the salt S, and the iteration count c to produce a derived | |||
| DK of length dkLen octets: | key DK of length dkLen octets: | |||
| DK = KDF (P, S, c, dkLen) . | DK = KDF (P, S, c, dkLen) . | |||
| 4. Encrypt the message M with the underlying encryption scheme | 4. Encrypt the message M with the underlying encryption scheme | |||
| under the derived key DK to produce a ciphertext C. (This | under the derived key DK to produce a ciphertext C. (This | |||
| step may involve selection of parameters such as an | step may involve selection of parameters such as an | |||
| initialization vector and padding, depending on the underlying | initialization vector and padding, depending on the | |||
| scheme.) | underlying scheme.) | |||
| 5. Output the ciphertext C. | 5. Output the ciphertext C. | |||
| The salt S, the iteration count c, the key length dkLen, and | The salt S, the iteration count c, the key length dkLen, and | |||
| identifiers for the key derivation function and the underlying | identifiers for the key derivation function and the underlying | |||
| encryption scheme may be conveyed to the party performing decryption | encryption scheme may be conveyed to the party performing decryption | |||
| in an AlgorithmIdentifier value (see Appendix A.4). | in an AlgorithmIdentifier value (see Appendix A.4). | |||
| 6.2.2 Decryption operation | 6.2.2 Decryption operation | |||
| The decryption operation for PBES2 consists of the following steps, | The decryption operation for PBES2 consists of the following steps, | |||
| which decrypt a ciphertext C under a password P to recover a message | which decrypt a ciphertext C under a password P to recover a message | |||
| M: | M: | |||
| 1. Obtain the salt S for the operation. | 1. Obtain the salt S for the operation. | |||
| 2. Obtain the iteration count c for the key derivation function. | 2. Obtain the iteration count c for the key derivation function. | |||
| 3. Obtain the key length in octets, dkLen, for the derived key | 3. Obtain the key length in octets, dkLen, for the derived key | |||
| for the underlying encryption scheme. | for the underlying encryption scheme. | |||
| 4. Apply the selected key derivation function to the password P, | 4. Apply the selected key derivation function to the password P, | |||
| the salt S, and the iteration count c to produce a derived key | the salt S, and the iteration count c to produce a derived | |||
| DK of length dkLen octets: | key DK of length dkLen octets: | |||
| DK = KDF (P, S, c, dkLen) . | DK = KDF (P, S, c, dkLen) . | |||
| 5. Decrypt the ciphertext C with the underlying encryption scheme | 5. Decrypt the ciphertext C with the underlying encryption | |||
| under the derived key DK to recover a message M. If the | scheme under the derived key DK to recover a message M. If | |||
| decryption function outputs "decryption error," then output | the decryption function outputs "decryption error," then | |||
| "decryption error" and stop. | output "decryption error" and stop. | |||
| 6. Output the recovered message M. | 6. Output the recovered message M. | |||
| 7. Message authentication schemes | 7. Message authentication schemes | |||
| A message authentication scheme consists of a MAC (message | A message authentication scheme consists of a MAC (message | |||
| authentication code) generation operation and a MAC verification | authentication code) generation operation and a MAC verification | |||
| operation, where the MAC generation operation produces a message | operation, where the MAC generation operation produces a message | |||
| authentication code from a message under a key, and the MAC | authentication code from a message under a key, and the MAC | |||
| verification operation verifies the message authentication code | verification operation verifies the message authentication code under | |||
| under the same key. In a password-based message authentication | the same key. In a password-based message authentication scheme, the | |||
| scheme, the key is a password. | key is a password. | |||
| One scheme is specified in this section: PBMAC1. | One scheme is specified in this section: PBMAC1. | |||
| 7.1 PBMAC1 | 7.1 PBMAC1 | |||
| PBMAC1 combines a password-based key derivation function, which | PBMAC1 combines a password-based key derivation function, which shall | |||
| shall be PBKDF2 (Section 5.2) for this version of PKCS #5, with an | be PBKDF2 (Section 5.2) for this version of PKCS #5, with an | |||
| underlying message authentication scheme (see Appendix B.3 for an | underlying message authentication scheme (see Appendix B.3 for an | |||
| example). The key length and any other parameters for the underlying | example). The key length and any other parameters for the underlying | |||
| message authentication scheme depend on the scheme. | message authentication scheme depend on the scheme. | |||
| 7.1.1 MAC generation | 7.1.1 MAC generation | |||
| The MAC generation operation for PBMAC1 consists of the following | The MAC generation operation for PBMAC1 consists of the following | |||
| steps, which process a message M under a password P to generate a | steps, which process a message M under a password P to generate a | |||
| message authentication code T, applying a selected key derivation | message authentication code T, applying a selected key derivation | |||
| function KDF and a selected underlying message authentication scheme: | function KDF and a selected underlying message authentication scheme: | |||
| 1. Select a salt S and an iteration count c, as outlined in | 1. Select a salt S and an iteration count c, as outlined in | |||
| Section 4. | Section 4. | |||
| 2. Select a key length in octets, dkLen, for the derived key for | 2. Select a key length in octets, dkLen, for the derived key for | |||
| the underlying message authentication function. | the underlying message authentication function. | |||
| 3. Apply the selected key derivation function to the password P, | 3. Apply the selected key derivation function to the password P, | |||
| the salt S, and the iteration count c to produce a derived key | the salt S, and the iteration count c to produce a derived | |||
| DK of length dkLen octets: | key DK of length dkLen octets: | |||
| DK = KDF (P, S, c, dkLen) . | DK = KDF (P, S, c, dkLen) . | |||
| 4. Process the message M with the underlying message | 4. Process the message M with the underlying message | |||
| authentication scheme under the derived key DK to generate a | authentication scheme under the derived key DK to generate a | |||
| message authentication code T. | message authentication code T. | |||
| 5. Output the message authentication code T. | 5. Output the message authentication code T. | |||
| The salt S, the iteration count c, the key length dkLen, and | The salt S, the iteration count c, the key length dkLen, and | |||
| identifiers for the key derivation function and underlying message | identifiers for the key derivation function and underlying message | |||
| authentication scheme may be conveyed to the party performing | authentication scheme may be conveyed to the party performing | |||
| verification in an AlgorithmIdentifier value (see Appendix A.5). | verification in an AlgorithmIdentifier value (see Appendix A.5). | |||
| 7.1.2 MAC verification | 7.1.2 MAC verification | |||
| The MAC verification operation for PBMAC1 consists of the following | The MAC verification operation for PBMAC1 consists of the following | |||
| steps, which process a message M under a password P to verify a | steps, which process a message M under a password P to verify a | |||
| message authentication code T: | message authentication code T: | |||
| 1. Obtain the salt S and the iteration count c. | 1. Obtain the salt S and the iteration count c. | |||
| 2. Obtain the key length in octets, dkLen, for the derived key | 2. Obtain the key length in octets, dkLen, for the derived key | |||
| for the underlying message authentication scheme. | for the underlying message authentication scheme. | |||
| 3. Apply the selected key derivation function to the password P, | 3. Apply the selected key derivation function to the password P, | |||
| the salt S, and the iteration count c to produce a derived key | the salt S, and the iteration count c to produce a derived | |||
| DK of length dkLen octets: | key DK of length dkLen octets: | |||
| DK = KDF (P, S, c, dkLen) . | DK = KDF (P, S, c, dkLen) . | |||
| 4. Process the message M with the underlying message | 4. Process the message M with the underlying message | |||
| authentication scheme under the derived key DK to verify the | authentication scheme under the derived key DK to verify the | |||
| message authentication code T. | message authentication code T. | |||
| 5. If the message authentication code verifies, output "correct"; | 5. If the message authentication code verifies, output | |||
| else output "incorrect." | "correct"; else output "incorrect." | |||
| 8. Security Considerations | ||||
| Password-based cryptography is generally limited in the security that | ||||
| it can provide, particularly for methods such as those defined in | ||||
| this document where off-line password search is possible. While the | ||||
| use of salt and iteration count can increase the complexity of attack | ||||
| (see Section 4 for recommendations), it is essential that passwords | ||||
| are selected well, and relevant guidelines (e.g., [17]) should be | ||||
| taken into account. It is also important that passwords be protected | ||||
| well if stored. | ||||
| In general, different keys should be derived from a password for | ||||
| different uses to minimize the possibility of unintended | ||||
| interactions. For password-based encryption with a single algorithm, | ||||
| a random salt is sufficient to ensure that different keys will be | ||||
| produced. In certain other situations, as outlined in Section 4, a | ||||
| structured salt is necessary. The recommendations in Section 4 should | ||||
| thus be taken into account when selecting the salt value. | ||||
| 9. Author's Address | ||||
| Burt Kaliski | ||||
| RSA Laboratories | ||||
| 20 Crosby Drive | ||||
| Bedford, MA 01730 USA | ||||
| Email: bkaliski@rsasecurity.com | ||||
| APPENDICES | APPENDICES | |||
| A. ASN.1 syntax | A. ASN.1 syntax | |||
| This section defines ASN.1 syntax for the key derivation functions, | This section defines ASN.1 syntax for the key derivation functions, | |||
| the encryption schemes, the message authentication scheme, and | the encryption schemes, the message authentication scheme, and | |||
| supporting techniques. The intended application of these definitions | supporting techniques. The intended application of these definitions | |||
| includes PKCS #8 and other syntax for key management, encrypted data, | includes PKCS #8 and other syntax for key management, encrypted data, | |||
| and integrity-protected data. (Various aspects of ASN.1 are specified | and integrity-protected data. (Various aspects of ASN.1 are specified | |||
| in several ISO/IEC standards [9][10][11][12][13][14].) | in several ISO/IEC standards [9][10][11][12][13][14].) | |||
| The object identifier pkcs-5 identifies the arc of the OID tree from | The object identifier pkcs-5 identifies the arc of the OID tree from | |||
| which the PKCS #5-specific OIDs in this section are derived: | which the PKCS #5-specific OIDs in this section are derived: | |||
| rsadsi OBJECT IDENTIFIER ::= | rsadsi OBJECT IDENTIFIER ::= {iso(1) member-body(2) us(840) 113549} | |||
| {iso(1) member-body(2) us(840) 113549} | pkcs OBJECT IDENTIFIER ::= {rsadsi 1} | |||
| pkcs OBJECT IDENTIFIER ::= {rsadsi 1} | pkcs-5 OBJECT IDENTIFIER ::= {pkcs 5} | |||
| pkcs-5 OBJECT IDENTIFIER ::= {pkcs 5} | ||||
| A.1 PBKDF1 | A.1 PBKDF1 | |||
| No object identifier is given for PBKDF1, as the object identifiers | No object identifier is given for PBKDF1, as the object identifiers | |||
| for PBES1 are sufficient for existing applications and PBKDF2 is | for PBES1 are sufficient for existing applications and PBKDF2 is | |||
| recommended for new applications. | recommended for new applications. | |||
| A.2 PBKDF2 | A.2 PBKDF2 | |||
| The object identifier id-PBKDF2 identifies the PBKDF2 key derivation | The object identifier id-PBKDF2 identifies the PBKDF2 key derivation | |||
| function (Section 5.2). | function (Section 5.2). | |||
| id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12} | id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12} | |||
| The parameters field associated with this OID in an | The parameters field associated with this OID in an | |||
| AlgorithmIdentifier shall have type PBKDF2-params: | AlgorithmIdentifier shall have type PBKDF2-params: | |||
| PBKDF2-params ::= SEQUENCE { | PBKDF2-params ::= SEQUENCE { | |||
| salt CHOICE { | salt CHOICE { | |||
| specified OCTET STRING, | specified OCTET STRING, | |||
| otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}} | otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}} | |||
| }, | }, | |||
| iterationCount INTEGER (1..MAX), | iterationCount INTEGER (1..MAX), | |||
| keyLength INTEGER (1..MAX) OPTIONAL, | keyLength INTEGER (1..MAX) OPTIONAL, | |||
| prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT | prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT | |||
| algid-hmacWithSHA1 } | algid-hmacWithSHA1 } | |||
| The fields of type PKDF2-params have the following meanings: | The fields of type PKDF2-params have the following meanings: | |||
| - salt specifies the salt value, or the source of the salt value. | - salt specifies the salt value, or the source of the salt value. | |||
| It shall either be an octet string or an algorithm ID with an OID | It shall either be an octet string or an algorithm ID with an OID | |||
| in the set PBKDF2-SaltSources, which is reserved for future | in the set PBKDF2-SaltSources, which is reserved for future | |||
| versions of PKCS #5. | versions of PKCS #5. | |||
| The salt-source approach is intended to indicate how the salt | The salt-source approach is intended to indicate how the salt | |||
| value is to be generated as a function of parameters in the | value is to be generated as a function of parameters in the | |||
| algorithm ID, application data, or both. For instance, it may | algorithm ID, application data, or both. For instance, it may | |||
| indicate that the salt value is produced from the encoding of | indicate that the salt value is produced from the encoding of | |||
| a structure that specifies detailed information about the derived | a structure that specifies detailed information about the derived | |||
| key as suggested in Section 4.1. Some of the information may be | key as suggested in Section 4.1. Some of the information may be | |||
| carried elsewhere, e.g., in the encryption algorithm ID. However, | carried elsewhere, e.g., in the encryption algorithm ID. However, | |||
| such facilities are deferred to a future version of PKCS #5. | such facilities are deferred to a future version of PKCS #5. | |||
| In this version, an application may achieve the benefits | In this version, an application may achieve the benefits | |||
| mentioned in Section 4.1 by choosing a particular interpretation | mentioned in Section 4.1 by choosing a particular interpretation | |||
| of the salt value in the specified alternative. | of the salt value in the specified alternative. | |||
| PBKDF2-SaltSources ALGORITHM-IDENTIFIER ::= { ... } | PBKDF2-SaltSources ALGORITHM-IDENTIFIER ::= { ... } | |||
| - iterationCount specifies the iteration count. The maximum | - iterationCount specifies the iteration count. The maximum | |||
| iteration count allowed depends on the implementation. It is | iteration count allowed depends on the implementation. It is | |||
| expected that implementation profiles may further constrain the | expected that implementation profiles may further constrain the | |||
| bounds. | bounds. | |||
| - keyLength, an optional field, is the length in octets of the | - keyLength, an optional field, is the length in octets of the | |||
| derived key. The maximum key length allowed depends on the | derived key. The maximum key length allowed depends on the | |||
| implementation; it is expected that implementation profiles may | implementation; it is expected that implementation profiles may | |||
| further constrain the bounds. The field is provided for | further constrain the bounds. The field is provided for | |||
| skipping to change at page 18, line 47 ¶ | skipping to change at page 19, line 42 ¶ | |||
| protected. If there is concern about interaction between | protected. If there is concern about interaction between | |||
| operations with different key lengths for a given salt (see | operations with different key lengths for a given salt (see | |||
| Section 4.1), the salt should distinguishes among the different | Section 4.1), the salt should distinguishes among the different | |||
| key lengths. | key lengths. | |||
| - prf identifies the underlying pseudorandom function. It shall be | - prf identifies the underlying pseudorandom function. It shall be | |||
| an algorithm ID with an OID in the set PBKDF2-PRFs, which for | an algorithm ID with an OID in the set PBKDF2-PRFs, which for | |||
| this version of PKCS #5 shall consist of id-hmacWithSHA1 (see | this version of PKCS #5 shall consist of id-hmacWithSHA1 (see | |||
| Appendix B.1.1) and any other OIDs defined by the application. | Appendix B.1.1) and any other OIDs defined by the application. | |||
| PBKDF2-PRFs ALGORITHM-IDENTIFIER ::= | PBKDF2-PRFs ALGORITHM-IDENTIFIER ::= | |||
| { {NULL IDENTIFIED BY id-hmacWithSHA1}, ... } | { {NULL IDENTIFIED BY id-hmacWithSHA1}, ... } | |||
| The default pseudorandom function is HMAC-SHA-1: | The default pseudorandom function is HMAC-SHA-1: | |||
| algid-hmacWithSHA1 AlgorithmIdentifier {{PBKDF2-PRFs}} ::= | algid-hmacWithSHA1 AlgorithmIdentifier {{PBKDF2-PRFs}} ::= | |||
| {algorithm id-hmacWithSHA1, parameters NULL : NULL} | {algorithm id-hmacWithSHA1, parameters NULL : NULL} | |||
| A.3 PBES1 | A.3 PBES1 | |||
| Different object identifiers identify the PBES1 encryption scheme | Different object identifiers identify the PBES1 encryption scheme | |||
| (Section 6.1) according to the underlying hash function in the key | (Section 6.1) according to the underlying hash function in the key | |||
| derivation function and the underlying block cipher, as summarized | derivation function and the underlying block cipher, as summarized in | |||
| in the following table: | the following table: | |||
| Hash Function Block Cipher OID | Hash Function Block Cipher OID | |||
| MD2 DES pkcs-5.1 | MD2 DES pkcs-5.1 | |||
| MD2 RC2 pkcs-5.4 | MD2 RC2 pkcs-5.4 | |||
| MD5 DES pkcs-5.3 | MD5 DES pkcs-5.3 | |||
| MD5 RC2 pkcs-5.6 | MD5 RC2 pkcs-5.6 | |||
| SHA-1 DES pkcs-5.10 | SHA-1 DES pkcs-5.10 | |||
| SHA-1 RC2 pkcs-5.11 | SHA-1 RC2 pkcs-5.11 | |||
| pbeWithMD2AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 1} | pbeWithMD2AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 1} | |||
| pbeWithMD2AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 4} | pbeWithMD2AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 4} | |||
| pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3} | pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3} | |||
| pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6} | pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6} | |||
| pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10} | pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10} | |||
| pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11} | pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11} | |||
| For each OID, the parameters field associated with the OID in an | For each OID, the parameters field associated with the OID in an | |||
| AlgorithmIdentifier shall have type PBEParameter: | AlgorithmIdentifier shall have type PBEParameter: | |||
| PBEParameter ::= SEQUENCE { | PBEParameter ::= SEQUENCE { | |||
| salt OCTET STRING (SIZE(8)), | salt OCTET STRING (SIZE(8)), | |||
| iterationCount INTEGER } | iterationCount INTEGER } | |||
| The fields of type PBEParameter have the following meanings: | The fields of type PBEParameter have the following meanings: | |||
| - salt specifies the salt value, an eight-octet string. | - salt specifies the salt value, an eight-octet string. | |||
| - iterationCount specifies the iteration count. | - iterationCount specifies the iteration count. | |||
| A.4 PBES2 | A.4 PBES2 | |||
| The object identifier id-PBES2 identifies the PBES2 encryption | The object identifier id-PBES2 identifies the PBES2 encryption scheme | |||
| scheme (Section 6.2). | (Section 6.2). | |||
| id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13} | id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13} | |||
| The parameters field associated with this OID in an | The parameters field associated with this OID in an | |||
| AlgorithmIdentifier shall have type PBES2-params: | AlgorithmIdentifier shall have type PBES2-params: | |||
| PBES2-params ::= SEQUENCE { | PBES2-params ::= SEQUENCE { | |||
| keyDerivationFunc AlgorithmIdentifier {{PBES2-KDFs}}, | keyDerivationFunc AlgorithmIdentifier {{PBES2-KDFs}}, | |||
| encryptionScheme AlgorithmIdentifier {{PBES2-Encs}} } | encryptionScheme AlgorithmIdentifier {{PBES2-Encs}} } | |||
| The fields of type PBES2-params have the following meanings: | The fields of type PBES2-params have the following meanings: | |||
| - keyDerivationFunc identifies the underlying key derivation | - keyDerivationFunc identifies the underlying key derivation | |||
| function. It shall be an algorithm ID with an OID in the set | function. It shall be an algorithm ID with an OID in the set | |||
| PBES2-KDFs, which for this version of PKCS #5 shall consist of | PBES2-KDFs, which for this version of PKCS #5 shall consist of | |||
| id-PBKDF2 (Appendix A.2). | id-PBKDF2 (Appendix A.2). | |||
| PBES2-KDFs ALGORITHM-IDENTIFIER ::= | PBES2-KDFs ALGORITHM-IDENTIFIER ::= | |||
| { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | |||
| - encryptionScheme identifies the underlying encryption scheme. It | - encryptionScheme identifies the underlying encryption scheme. It | |||
| shall be an algorithm ID with an OID in the set PBES2-Encs, whose | shall be an algorithm ID with an OID in the set PBES2-Encs, whose | |||
| definition is left to the application. Example underlying | definition is left to the application. Example underlying | |||
| encryption schemes are given in Appendix B.2. | encryption schemes are given in Appendix B.2. | |||
| PBES2-Encs ALGORITHM-IDENTIFIER ::= { ... } | PBES2-Encs ALGORITHM-IDENTIFIER ::= { ... } | |||
| A.5 PBMAC1 | A.5 PBMAC1 | |||
| The object identifier id-PBMAC1 identifies the PBMAC1 message | The object identifier id-PBMAC1 identifies the PBMAC1 message | |||
| authentication scheme (Section 7.1). | authentication scheme (Section 7.1). | |||
| id-PBMAC1 OBJECT IDENTIFIER ::= {pkcs-5 14} | id-PBMAC1 OBJECT IDENTIFIER ::= {pkcs-5 14} | |||
| The parameters field associated with this OID in an | The parameters field associated with this OID in an | |||
| AlgorithmIdentifier shall have type PBMAC1-params: | AlgorithmIdentifier shall have type PBMAC1-params: | |||
| PBMAC1-params ::= SEQUENCE { | PBMAC1-params ::= SEQUENCE { | |||
| keyDerivationFunc AlgorithmIdentifier {{PBMAC1-KDFs}}, | keyDerivationFunc AlgorithmIdentifier {{PBMAC1-KDFs}}, | |||
| messageAuthScheme AlgorithmIdentifier {{PBMAC1-MACs}} } | messageAuthScheme AlgorithmIdentifier {{PBMAC1-MACs}} } | |||
| The keyDerivationFunc field has the same meaning as the corresponding | The keyDerivationFunc field has the same meaning as the corresponding | |||
| field of PBES2-params (Appendix A.4) except that the set of OIDs is | field of PBES2-params (Appendix A.4) except that the set of OIDs is | |||
| PBMAC1-KDFs. | PBMAC1-KDFs. | |||
| PBMAC1-KDFs ALGORITHM-IDENTIFIER ::= | PBMAC1-KDFs ALGORITHM-IDENTIFIER ::= | |||
| { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | |||
| The messageAuthScheme field identifies the underlying message | The messageAuthScheme field identifies the underlying message | |||
| authentication scheme. It shall be an algorithm ID with an OID in the | authentication scheme. It shall be an algorithm ID with an OID in the | |||
| set PBMAC1-MACs, whose definition is left to the application. Example | set PBMAC1-MACs, whose definition is left to the application. Example | |||
| underlying encryption schemes are given in Appendix B.3. | underlying encryption schemes are given in Appendix B.3. | |||
| PBMAC1-MACs ALGORITHM-IDENTIFIER ::= { ... } | PBMAC1-MACs ALGORITHM-IDENTIFIER ::= { ... } | |||
| B. Supporting techniques | B. Supporting techniques | |||
| This section gives several examples of underlying functions and | This section gives several examples of underlying functions and | |||
| schemes supporting the password-based schemes in Sections 5, 6 and 7. | schemes supporting the password-based schemes in Sections 5, 6 and 7. | |||
| While these supporting techniques are appropriate for applications to | While these supporting techniques are appropriate for applications to | |||
| implement, none of them is required to be implemented. It is | implement, none of them is required to be implemented. It is | |||
| expected, however, that profiles for PKCS #5 will be developed that | expected, however, that profiles for PKCS #5 will be developed that | |||
| specify particular supporting techniques. | specify particular supporting techniques. | |||
| This section also gives object identifiers for the supporting | This section also gives object identifiers for the supporting | |||
| techniques. The object identifiers digestAlgorithm and | techniques. The object identifiers digestAlgorithm and | |||
| encryptionAlgorithm identify the arcs from which certain algorithm | encryptionAlgorithm identify the arcs from which certain algorithm | |||
| OIDs referenced in this section are derived: | OIDs referenced in this section are derived: | |||
| digestAlgorithm OBJECT IDENTIFIER ::= {rsadsi 2} | digestAlgorithm OBJECT IDENTIFIER ::= {rsadsi 2} | |||
| encryptionAlgorithm OBJECT IDENTIFIER ::= {rsadsi 3} | encryptionAlgorithm OBJECT IDENTIFIER ::= {rsadsi 3} | |||
| B.1 Pseudorandom functions | B.1 Pseudorandom functions | |||
| An example pseudorandom function for PBKDF2 (Section 5.2) is | An example pseudorandom function for PBKDF2 (Section 5.2) is HMAC- | |||
| HMAC-SHA-1. | SHA-1. | |||
| B.1.1 HMAC-SHA-1 | B.1.1 HMAC-SHA-1 | |||
| HMAC-SHA-1 is the pseudorandom function corresponding to the HMAC | HMAC-SHA-1 is the pseudorandom function corresponding to the HMAC | |||
| message authentication code [7] based on the SHA-1 hash function | message authentication code [7] based on the SHA-1 hash function | |||
| [18]. The pseudorandom function is the same function by which the | [18]. The pseudorandom function is the same function by which the | |||
| message authentication code is computed, with a full-length output. | message authentication code is computed, with a full-length output. | |||
| (The first argument to the pseudorandom function PRF serves as HMACĘs | (The first argument to the pseudorandom function PRF serves as HMAC's | |||
| "key," and the second serves as HMACĘs "text." In the case of PBKDF2, | "key," and the second serves as HMAC's "text." In the case of PBKDF2, | |||
| the "key" is thus the password and the "text" is the salt.) | the "key" is thus the password and the "text" is the salt.) HMAC- | |||
| HMAC-SHA-1 has a variable key length and a 20-octet (160-bit) output | SHA-1 has a variable key length and a 20-octet (160-bit) output | |||
| value. | value. | |||
| Although the length of the key to HMAC-SHA-1 is essentially | Although the length of the key to HMAC-SHA-1 is essentially | |||
| unbounded, the effective search space for pseudorandom function | unbounded, the effective search space for pseudorandom function | |||
| outputs may be limited by the structure of the function. In | outputs may be limited by the structure of the function. In | |||
| particular, when the key is longer than 512 bits, HMAC-SHA-1 will | particular, when the key is longer than 512 bits, HMAC-SHA-1 will | |||
| first hash it to 160 bits. Thus, even if a long derived key | first hash it to 160 bits. Thus, even if a long derived key | |||
| consisting of several pseudorandom function outputs is produced from | consisting of several pseudorandom function outputs is produced from | |||
| a key, the effective search space for the derived key will be at most | a key, the effective search space for the derived key will be at most | |||
| 160 bits. Although the specific limitation for other key sizes | 160 bits. Although the specific limitation for other key sizes | |||
| skipping to change at page 22, line 5 ¶ | skipping to change at page 23, line 10 ¶ | |||
| conservative, that the effective search space is limited to 160 bits | conservative, that the effective search space is limited to 160 bits | |||
| for other key sizes as well. | for other key sizes as well. | |||
| (The 160-bit limitation should not generally pose a practical | (The 160-bit limitation should not generally pose a practical | |||
| limitation in the case of password-based cryptography, since the | limitation in the case of password-based cryptography, since the | |||
| search space for a password is unlikely to be greater than 160 bits.) | search space for a password is unlikely to be greater than 160 bits.) | |||
| The object identifier id-hmacWithSHA1 identifies the HMAC-SHA-1 | The object identifier id-hmacWithSHA1 identifies the HMAC-SHA-1 | |||
| pseudorandom function: | pseudorandom function: | |||
| id-hmacWithSHA1 OBJECT IDENTIFIER ::= {digestAlgorithm 7} | id-hmacWithSHA1 OBJECT IDENTIFIER ::= {digestAlgorithm 7} | |||
| The parameters field associated with this OID in an | The parameters field associated with this OID in an | |||
| AlgorithmIdentifier shall have type NULL. This object identifier is | AlgorithmIdentifier shall have type NULL. This object identifier is | |||
| employed in the object set PBKDF2-PRFs (Appendix A.2). | employed in the object set PBKDF2-PRFs (Appendix A.2). | |||
| Note. Although HMAC-SHA-1 was designed as a message authentication | Note. Although HMAC-SHA-1 was designed as a message authentication | |||
| code, its proof of security is readily modified to accommodate | code, its proof of security is readily modified to accommodate | |||
| requirements for a pseudorandom function, under stronger assumptions. | requirements for a pseudorandom function, under stronger assumptions. | |||
| A hash function may also meet the requirements of a pseudorandom | A hash function may also meet the requirements of a pseudorandom | |||
| function under certain assumptions. For instance, the direct | function under certain assumptions. For instance, the direct | |||
| application of a hash function to to the concatenation of the "key" | application of a hash function to to the concatenation of the "key" | |||
| and the "text" may be appropriate, provided that "text" has | and the "text" may be appropriate, provided that "text" has | |||
| appropriate structure to prevent certain attacks. HMAC-SHA-1 is | appropriate structure to prevent certain attacks. HMAC-SHA-1 is | |||
| preferable, however, because it treats "key" and "text" as separate | preferable, however, because it treats "key" and "text" as separate | |||
| arguments and does not require "text" to have any structure. | arguments and does not require "text" to have any structure. | |||
| B.2 Encryption schemes | B.2 Encryption schemes | |||
| Example pseudorandom functions for PBES2 (Section 6.2) are | Example pseudorandom functions for PBES2 (Section 6.2) are DES-CBC- | |||
| DES-CBC-Pad, DES-EDE2-CBC-Pad, RC2-CBC-Pad, and RC5-CBC-Pad. | Pad, DES-EDE2-CBC-Pad, RC2-CBC-Pad, and RC5-CBC-Pad. | |||
| The object identifiers given in this section are intended to be | The object identifiers given in this section are intended to be | |||
| employed in the object set PBES2-Encs (Appendix A.4). | employed in the object set PBES2-Encs (Appendix A.4). | |||
| B.2.1 DES-CBC-Pad | B.2.1 DES-CBC-Pad | |||
| DES-CBC-Pad is single-key DES [15] in CBC mode [16] with the RFC 1423 | DES-CBC-Pad is single-key DES [15] in CBC mode [16] with the RFC 1423 | |||
| padding operation (see Section 6.1.1). DES-CBC-Pad has an | padding operation (see Section 6.1.1). DES-CBC-Pad has an eight-octet | |||
| eight-octet encryption key and an eight-octet initialization vector. | encryption key and an eight-octet initialization vector. The key is | |||
| The key is considered as a 64-bit encoding of a 56-bit DES key with | considered as a 64-bit encoding of a 56-bit DES key with parity bits | |||
| parity bits ignored. | ignored. | |||
| The object identifier desCBC (defined in the NIST/OSI ImplementorsĘ | The object identifier desCBC (defined in the NIST/OSI Implementors' | |||
| Workshop agreements) identifies the DES-CBC-Pad encryption scheme: | Workshop agreements) identifies the DES-CBC-Pad encryption scheme: | |||
| desCBC OBJECT IDENTIFIER ::= | desCBC OBJECT IDENTIFIER ::= | |||
| {iso(1) identified-organization(3) oiw(14) secsig(3) | {iso(1) identified-organization(3) oiw(14) secsig(3) | |||
| algorithms(2) 7} | algorithms(2) 7} | |||
| The parameters field associated with this OID in an | The parameters field associated with this OID in an | |||
| AlgorithmIdentifier shall have type OCTET STRING (SIZE(8)), | AlgorithmIdentifier shall have type OCTET STRING (SIZE(8)), | |||
| specifying the initialization vector for CBC mode. | specifying the initialization vector for CBC mode. | |||
| B.2.2 DES-EDE3-CBC-Pad | B.2.2 DES-EDE3-CBC-Pad | |||
| DES-EDE3-CBC-Pad is three-key triple-DES in CBC mode [1] with the | DES-EDE3-CBC-Pad is three-key triple-DES in CBC mode [1] with the RFC | |||
| RFC 1423 padding operation. DES-EDE3-CBC-Pad has a 24-octet | 1423 padding operation. DES-EDE3-CBC-Pad has a 24-octet encryption | |||
| encryption key and an eight-octet initialization vector. The key is | key and an eight-octet initialization vector. The key is considered | |||
| considered as the concatenation of three eight-octet keys, each of | as the concatenation of three eight-octet keys, each of which is a | |||
| which is a 64-bit encoding of a 56-bit DES key with parity bits | 64-bit encoding of a 56-bit DES key with parity bits ignored. | |||
| ignored. | ||||
| The object identifier des-EDE3-CBC identifies the DES-EDE3-CBC-Pad | The object identifier des-EDE3-CBC identifies the DES-EDE3-CBC-Pad | |||
| encryption scheme: | encryption scheme: | |||
| des-EDE3-CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 7} | des-EDE3-CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 7} | |||
| The parameters field associated with this OID in an | The parameters field associated with this OID in an | |||
| AlgorithmIdentifier shall have type OCTET STRING (SIZE(8)), | AlgorithmIdentifier shall have type OCTET STRING (SIZE(8)), | |||
| specifying the initialization vector for CBC mode. | specifying the initialization vector for CBC mode. | |||
| Note. An OID for DES-EDE3-CBC without padding is given in ANSI X9.52 | Note. An OID for DES-EDE3-CBC without padding is given in ANSI X9.52 | |||
| [1]; the one given here is preferred since it specifies padding. | [1]; the one given here is preferred since it specifies padding. | |||
| B.2.3 RC2-CBC-Pad | B.2.3 RC2-CBC-Pad | |||
| RC2-CBC-Pad is the RC2TM encryption algorithm [21] in CBC mode with | RC2-CBC-Pad is the RC2(tm) encryption algorithm [21] in CBC mode with | |||
| the RFC 1423 padding operation. RC2-CBC-Pad has a variable key | the RFC 1423 padding operation. RC2-CBC-Pad has a variable key | |||
| length, from one to 128 octets, a separate "effective key bits" | length, from one to 128 octets, a separate "effective key bits" | |||
| parameter from one to 1024 bits that limits the effective search | parameter from one to 1024 bits that limits the effective search | |||
| space independent of the key length, and an eight-octet | space independent of the key length, and an eight-octet | |||
| initialization vector. | initialization vector. | |||
| The object identifier rc2CBC identifies the RC2-CBC-Pad encryption | The object identifier rc2CBC identifies the RC2-CBC-Pad encryption | |||
| scheme: | scheme: | |||
| rc2CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 2} | rc2CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 2} | |||
| The parameters field associated with OID in an AlgorithmIdentifier | The parameters field associated with OID in an AlgorithmIdentifier | |||
| shall have type RC2-CBC-Parameter: | shall have type RC2-CBC-Parameter: | |||
| RC2-CBC-Parameter ::= SEQUENCE { | RC2-CBC-Parameter ::= SEQUENCE { | |||
| rc2ParameterVersion INTEGER OPTIONAL, | rc2ParameterVersion INTEGER OPTIONAL, | |||
| iv OCTET STRING (SIZE(8)) } | iv OCTET STRING (SIZE(8)) } | |||
| The fields of type RC2-CBCParameter have the following meanings: | The fields of type RC2-CBCParameter have the following meanings: | |||
| - rc2ParameterVersion is a proprietary RSA Data Security, Inc. | - rc2ParameterVersion is a proprietary RSA Security Inc. encoding | |||
| encoding of the "effective key bits" for RC2. The following | of the "effective key bits" for RC2. The following encodings are | |||
| encodings are defined: | defined: | |||
| Effective Key Bits Encoding | Effective Key Bits Encoding | |||
| 40 160 | 40 160 | |||
| 64 120 | 64 120 | |||
| 128 58 | 128 58 | |||
| b >= 256 b | b >= 256 b | |||
| If the rc2ParameterVersion field is omitted, the "effective key bits" | If the rc2ParameterVersion field is omitted, the "effective key bits" | |||
| defaults to 32. (This is for backward compatibility with certain very | defaults to 32. (This is for backward compatibility with certain very | |||
| old implementations.) | old implementations.) | |||
| - iv is the eight-octet initialization vector. | - iv is the eight-octet initialization vector. | |||
| B.2.4 RC5-CBC-Pad | B.2.4 RC5-CBC-Pad | |||
| RC5-CBC-Pad is the RC5TM encryption algorithm [20] in CBC mode with a | RC5-CBC-Pad is the RC5(tm) encryption algorithm [20] in CBC mode with | |||
| generalization of the RFC 1423 padding operation . This scheme is | a generalization of the RFC 1423 padding operation. This scheme is | |||
| fully specified in [2]. RC5-CBC-Pad has a variable key length, from 0 | fully specified in [2]. RC5-CBC-Pad has a variable key length, from 0 | |||
| to 256 octets, and supports both a 64-bit block size and a 128-bit | to 256 octets, and supports both a 64-bit block size and a 128-bit | |||
| block size. For the former, it has an eight-octet initialization | block size. For the former, it has an eight-octet initialization | |||
| vector, and for the latter, a 16-octet initialization vector. | vector, and for the latter, a 16-octet initialization vector. RC5- | |||
| RC5-CBC-Pad also has a variable number of "rounds" in the encryption | CBC-Pad also has a variable number of "rounds" in the encryption | |||
| operation, from 8 to 127. | operation, from 8 to 127. | |||
| Note: The generalization of the padding operation is as follows. For | ||||
| RC5 with a 64-bit block size, the padding string is as defined in RFC | ||||
| 1423. For RC5 with a 128-bit block size, the padding string consists | ||||
| of 16-(||M|| mod 16) octets each with value 16-(||M|| mod 16). | ||||
| The object identifier rc5-CBC-PAD [2] identifies RC5-CBC-Pad | The object identifier rc5-CBC-PAD [2] identifies RC5-CBC-Pad | |||
| encryption scheme: | encryption scheme: | |||
| rc5-CBC-PAD OBJECT IDENTIFIER ::= {encryptionAlgorithm 9} | rc5-CBC-PAD OBJECT IDENTIFIER ::= {encryptionAlgorithm 9} | |||
| The parameters field associated with this OID in an | The parameters field associated with this OID in an | |||
| AlgorithmIdentifier shall have type RC5-CBC-Parameters: | AlgorithmIdentifier shall have type RC5-CBC-Parameters: | |||
| RC5-CBC-Parameters ::= SEQUENCE { | RC5-CBC-Parameters ::= SEQUENCE { | |||
| version INTEGER {v1-0(16)} (v1-0), | version INTEGER {v1-0(16)} (v1-0), | |||
| rounds INTEGER (8..127), | rounds INTEGER (8..127), | |||
| blockSizeInBits INTEGER (64 | 128), | blockSizeInBits INTEGER (64 | 128), | |||
| iv OCTET STRING OPTIONAL } | iv OCTET STRING OPTIONAL } | |||
| The fields of type RC5-CBC-Parameters have the following meanings: | The fields of type RC5-CBC-Parameters have the following meanings: | |||
| - version is the version of the algorithm, which shall be v1-0. | - version is the version of the algorithm, which shall be v1-0. | |||
| - rounds is the number of rounds in the encryption operation, | - rounds is the number of rounds in the encryption operation, | |||
| which shall be between 8 and 127. | which shall be between 8 and 127. | |||
| - blockSizeInBits is the block size in bits, which shall be 64 or | - blockSizeInBits is the block size in bits, which shall be 64 or | |||
| 128. | 128. | |||
| - iv is the initialization vector, an eight-octet string for 64-bit | - iv is the initialization vector, an eight-octet string for 64-bit | |||
| RC5 and a 16-octet string for 128-bit RC5. The default is a | RC5 and a 16-octet string for 128-bit RC5. The default is a | |||
| string of the appropriate length consisting of zero octets. | string of the appropriate length consisting of zero octets. | |||
| B.3 Message authentication schemes | B.3 Message authentication schemes | |||
| An example message authentication scheme for PBMAC1 (Section 7.1) is | An example message authentication scheme for PBMAC1 (Section 7.1) is | |||
| HMAC-SHA-1. | HMAC-SHA-1. | |||
| B.3.1 HMAC-SHA-1 | B.3.1 HMAC-SHA-1 | |||
| HMAC-SHA-1 is the HMAC message authentication scheme [7] based on the | HMAC-SHA-1 is the HMAC message authentication scheme [7] based on the | |||
| SHA-1 hash function [18]. HMAC-SHA-1 has a variable key length and a | SHA-1 hash function [18]. HMAC-SHA-1 has a variable key length and a | |||
| 20-octet (160-bit) message authentication code. | 20-octet (160-bit) message authentication code. | |||
| The object identifier id-hmacWithSHA1 (see Appendix B.1.1) identifies | The object identifier id-hmacWithSHA1 (see Appendix B.1.1) identifies | |||
| the HMAC-SHA-1 message authentication scheme. (The object identifier | the HMAC-SHA-1 message authentication scheme. (The object identifier | |||
| is the same for both the pseudorandom function and the message | is the same for both the pseudorandom function and the message | |||
| authentication scheme; the distinction is to be understood by | authentication scheme; the distinction is to be understood by | |||
| context.) This object identifier is intended to be employed in the | context.) This object identifier is intended to be employed in the | |||
| object set PBMAC1-Macs (Appendix A.5). | object set PBMAC1-Macs (Appendix A.5). | |||
| C. ASN.1 module | C. ASN.1 module | |||
| For reference purposes, the ASN.1 syntax in the preceding sections | For reference purposes, the ASN.1 syntax in the preceding sections is | |||
| is presented as an ASN.1 module here. | presented as an ASN.1 module here. | |||
| -- PKCS #5 v2.0 ASN.1 Module | ||||
| -- Revised March 25, 1999 | ||||
| -- This module has been checked for conformance with the | ||||
| -- ASN.1 standard by the OSS ASN.1 Tools | ||||
| PKCS5v2-0 {iso(1) member-body(2) us(840) rsadsi(113549) | PKCS5v2-0 {iso(1) member-body(2) us(840) rsadsi(113549) | |||
| pkcs(1) pkcs-5(5) modules(16) pkcs5v2-0(1)} | pkcs(1) pkcs-5(5) modules(16) pkcs5v2-0(1)} | |||
| DEFINITIONS ::= BEGIN | DEFINITIONS ::= BEGIN | |||
| -- Basic object identifiers | ||||
| rsadsi OBJECT IDENTIFIER ::= | rsadsi OBJECT IDENTIFIER ::= {iso(1) member-body(2) us(840) 113549} | |||
| {iso(1) member-body(2) us(840) 113549} | pkcs OBJECT IDENTIFIER ::= {rsadsi 1} | |||
| pkcs OBJECT IDENTIFIER ::= {rsadsi 1} | pkcs-5 OBJECT IDENTIFIER ::= {pkcs 5} | |||
| pkcs-5 OBJECT IDENTIFIER ::= {pkcs 5} | ||||
| -- Basic types and classes | ||||
| AlgorithmIdentifier { ALGORITHM-IDENTIFIER:InfoObjectSet } ::= | AlgorithmIdentifier { ALGORITHM-IDENTIFIER:InfoObjectSet } ::= | |||
| SEQUENCE { | SEQUENCE { | |||
| algorithm ALGORITHM-IDENTIFIER.&id({InfoObjectSet}), | algorithm ALGORITHM-IDENTIFIER.&id({InfoObjectSet}), | |||
| parameters ALGORITHM-IDENTIFIER.&Type({InfoObjectSet} | parameters ALGORITHM-IDENTIFIER.&Type({InfoObjectSet} | |||
| {@algorithm}) OPTIONAL } | {@algorithm}) OPTIONAL | |||
| } | ||||
| ALGORITHM-IDENTIFIER ::= TYPE-IDENTIFIER | ALGORITHM-IDENTIFIER ::= TYPE-IDENTIFIER | |||
| -- PBKDF2 | ||||
| PBKDF2Algorithms ALGORITHM-IDENTIFIER ::= | PBKDF2Algorithms ALGORITHM-IDENTIFIER ::= | |||
| { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ...} | { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ...} | |||
| id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12} | id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12} | |||
| algid-hmacWithSHA1 AlgorithmIdentifier {{PBKDF2-PRFs}} ::= | algid-hmacWithSHA1 AlgorithmIdentifier {{PBKDF2-PRFs}} ::= | |||
| {algorithm id-hmacWithSHA1, parameters NULL : NULL} | {algorithm id-hmacWithSHA1, parameters NULL : NULL} | |||
| PBKDF2-params ::= SEQUENCE { | PBKDF2-params ::= SEQUENCE { | |||
| salt CHOICE { | salt CHOICE { | |||
| specified OCTET STRING, | specified OCTET STRING, | |||
| otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}} | otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}} | |||
| }, | }, | |||
| iterationCount INTEGER (1..MAX), | iterationCount INTEGER (1..MAX), | |||
| keyLength INTEGER (1..MAX) OPTIONAL, | keyLength INTEGER (1..MAX) OPTIONAL, | |||
| prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT | prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT | |||
| algid-hmacWithSHA1 } | algid-hmacWithSHA1 | |||
| } | ||||
| PBKDF2-SaltSources ALGORITHM-IDENTIFIER ::= { ... } | PBKDF2-SaltSources ALGORITHM-IDENTIFIER ::= { ... } | |||
| PBKDF2-PRFs ALGORITHM-IDENTIFIER ::= | PBKDF2-PRFs ALGORITHM-IDENTIFIER ::= | |||
| { {NULL IDENTIFIED BY id-hmacWithSHA1}, ... } | { {NULL IDENTIFIED BY id-hmacWithSHA1}, ... } | |||
| -- PBES1 | -- PBES1 | |||
| PBES1Algorithms ALGORITHM-IDENTIFIER ::= | PBES1Algorithms ALGORITHM-IDENTIFIER ::= { | |||
| { {PBEParameter IDENTIFIED BY pbeWithMD2AndDES-CBC} | | {PBEParameter IDENTIFIED BY pbeWithMD2AndDES-CBC} | | |||
| {PBEParameter IDENTIFIED BY pbeWithMD2AndRC2-CBC} | | {PBEParameter IDENTIFIED BY pbeWithMD2AndRC2-CBC} | | |||
| {PBEParameter IDENTIFIED BY pbeWithMD5AndDES-CBC} | | {PBEParameter IDENTIFIED BY pbeWithMD5AndDES-CBC} | | |||
| {PBEParameter IDENTIFIED BY pbeWithMD5AndRC2-CBC} | | {PBEParameter IDENTIFIED BY pbeWithMD5AndRC2-CBC} | | |||
| {PBEParameter IDENTIFIED BY pbeWithSHA1AndDES-CBC} | | {PBEParameter IDENTIFIED BY pbeWithSHA1AndDES-CBC} | | |||
| {PBEParameter IDENTIFIED BY pbeWithSHA1AndRC2-CBC}, ...} | {PBEParameter IDENTIFIED BY pbeWithSHA1AndRC2-CBC}, | |||
| ... | ||||
| } | ||||
| pbeWithMD2AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 1} | pbeWithMD2AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 1} | |||
| pbeWithMD2AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 4} | pbeWithMD2AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 4} | |||
| pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3} | pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3} | |||
| pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6} | pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6} | |||
| pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10} | pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10} | |||
| pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11} | pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11} | |||
| PBEParameter ::= SEQUENCE { | PBEParameter ::= SEQUENCE { | |||
| salt OCTET STRING (SIZE(8)), | salt OCTET STRING (SIZE(8)), | |||
| iterationCount INTEGER } | iterationCount INTEGER | |||
| } | ||||
| -- PBES2 | ||||
| PBES2Algorithms ALGORITHM-IDENTIFIER ::= | PBES2Algorithms ALGORITHM-IDENTIFIER ::= | |||
| { {PBES2-params IDENTIFIED BY id-PBES2}, ...} | { {PBES2-params IDENTIFIED BY id-PBES2}, ...} | |||
| id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13} | id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13} | |||
| PBES2-params ::= SEQUENCE { | ||||
| keyDerivationFunc AlgorithmIdentifier {{PBES2-KDFs}}, | ||||
| encryptionScheme AlgorithmIdentifier {{PBES2-Encs}} } | ||||
| PBES2-KDFs ALGORITHM-IDENTIFIER ::= | PBES2-params ::= SEQUENCE { | |||
| { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | keyDerivationFunc AlgorithmIdentifier {{PBES2-KDFs}}, | |||
| encryptionScheme AlgorithmIdentifier {{PBES2-Encs}} | ||||
| } | ||||
| PBES2-Encs ALGORITHM-IDENTIFIER ::= { ... } | PBES2-KDFs ALGORITHM-IDENTIFIER ::= | |||
| { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | ||||
| PBES2-Encs ALGORITHM-IDENTIFIER ::= { ... } | ||||
| PBMAC1Algorithms ALGORITHM-IDENTIFIER ::= | -- PBMAC1 | |||
| { {PBMAC1-params IDENTIFIED BY id-PBMAC1}, ...} | ||||
| id-PBMAC1 OBJECT IDENTIFIER ::= {pkcs-5 14} | PBMAC1Algorithms ALGORITHM-IDENTIFIER ::= | |||
| { {PBMAC1-params IDENTIFIED BY id-PBMAC1}, ...} | ||||
| PBMAC1-params ::= SEQUENCE { | id-PBMAC1 OBJECT IDENTIFIER ::= {pkcs-5 14} | |||
| keyDerivationFunc AlgorithmIdentifier {{PBMAC1-KDFs}}, | ||||
| messageAuthScheme AlgorithmIdentifier {{PBMAC1-MACs}} } | ||||
| PBMAC1-KDFs ALGORITHM-IDENTIFIER ::= | PBMAC1-params ::= SEQUENCE { | |||
| { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | keyDerivationFunc AlgorithmIdentifier {{PBMAC1-KDFs}}, | |||
| messageAuthScheme AlgorithmIdentifier {{PBMAC1-MACs}} | ||||
| } | ||||
| PBMAC1-MACs ALGORITHM-IDENTIFIER ::= { ... } | PBMAC1-KDFs ALGORITHM-IDENTIFIER ::= | |||
| { {PBKDF2-params IDENTIFIED BY id-PBKDF2}, ... } | ||||
| PBMAC1-MACs ALGORITHM-IDENTIFIER ::= { ... } | ||||
| digestAlgorithm OBJECT IDENTIFIER ::= {rsadsi 2} | -- Supporting techniques | |||
| encryptionAlgorithm OBJECT IDENTIFIER ::= {rsadsi 3} | ||||
| SupportingAlgorithms ALGORITHM-IDENTIFIER ::= | digestAlgorithm OBJECT IDENTIFIER ::= {rsadsi 2} | |||
| { {NULL IDENTIFIED BY id-hmacWithSHA1} | | encryptionAlgorithm OBJECT IDENTIFIER ::= {rsadsi 3} | |||
| {OCTET STRING (SIZE(8)) IDENTIFIED BY desCBC} | | ||||
| {OCTET STRING (SIZE(8)) IDENTIFIED BY des-EDE3-CBC} | | ||||
| {RC2-CBC-Parameter IDENTIFIED BY rc2CBC} | | ||||
| {RC5-CBC-Parameters IDENTIFIED BY rc5-CBC-PAD}, ... } | ||||
| id-hmacWithSHA1 OBJECT IDENTIFIER ::= {digestAlgorithm 7} | SupportingAlgorithms ALGORITHM-IDENTIFIER ::= { | |||
| {NULL IDENTIFIED BY id-hmacWithSHA1} | | ||||
| {OCTET STRING (SIZE(8)) IDENTIFIED BY desCBC} | | ||||
| {OCTET STRING (SIZE(8)) IDENTIFIED BY des-EDE3-CBC} | | ||||
| {RC2-CBC-Parameter IDENTIFIED BY rc2CBC} | | ||||
| {RC5-CBC-Parameters IDENTIFIED BY rc5-CBC-PAD}, | ||||
| ... | ||||
| } | ||||
| desCBC OBJECT IDENTIFIER ::= | id-hmacWithSHA1 OBJECT IDENTIFIER ::= {digestAlgorithm 7} | |||
| {iso(1) identified-organization(3) oiw(14) secsig(3) | ||||
| algorithms(2) 7} -- from OIW | ||||
| des-EDE3-CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 7} | desCBC OBJECT IDENTIFIER ::= | |||
| {iso(1) identified-organization(3) oiw(14) secsig(3) | ||||
| algorithms(2) 7} -- from OIW | ||||
| rc2CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 2} | des-EDE3-CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 7} | |||
| RC2-CBC-Parameter ::= SEQUENCE { | rc2CBC OBJECT IDENTIFIER ::= {encryptionAlgorithm 2} | |||
| rc2ParameterVersion INTEGER OPTIONAL, | ||||
| iv OCTET STRING (SIZE(8)) } | ||||
| rc5-CBC-PAD OBJECT IDENTIFIER ::= {encryptionAlgorithm 9} | RC2-CBC-Parameter ::= SEQUENCE { | |||
| rc2ParameterVersion INTEGER OPTIONAL, | ||||
| iv OCTET STRING (SIZE(8)) | ||||
| } | ||||
| RC5-CBC-Parameters ::= SEQUENCE { | rc5-CBC-PAD OBJECT IDENTIFIER ::= {encryptionAlgorithm 9} | |||
| version INTEGER {v1-0(16)} (v1-0), | ||||
| rounds INTEGER (8..127), | ||||
| blockSizeInBits INTEGER (64 | 128), | ||||
| iv OCTET STRING OPTIONAL } | ||||
| END | RC5-CBC-Parameters ::= SEQUENCE { | |||
| version INTEGER {v1-0(16)} (v1-0), | ||||
| rounds INTEGER (8..127), | ||||
| blockSizeInBits INTEGER (64 | 128), | ||||
| iv OCTET STRING OPTIONAL | ||||
| } | ||||
| END | ||||
| D. Intellectual property considerations | D. Intellectual property considerations | |||
| RSA Data Security makes no patent claims on the general constructions | RSA Security makes no patent claims on the general constructions | |||
| described in this document, although specific underlying techniques | described in this document, although specific underlying techniques | |||
| may be covered. Among the underlying techniques, the RC5 encryption | may be covered. Among the underlying techniques, the RC5 encryption | |||
| algorithm (Appendix B.2.4) is protected by U.S. Patents 5,724,428 | algorithm (Appendix B.2.4) is protected by U.S. Patents 5,724,428 | |||
| [22] and 5,835,600 [23]. | [22] and 5,835,600 [23]. | |||
| RC2 and RC5 are trademarks of RSA Data Security. | RC2 and RC5 are trademarks of RSA Security. | |||
| License to copy this document is granted provided that it is | License to copy this document is granted provided that it is | |||
| identified as RSA Data Security, Inc. Public-Key Cryptography | identified as RSA Security Inc. Public-Key Cryptography Standards | |||
| Standards (PKCS) in all material mentioning or referencing this | (PKCS) in all material mentioning or referencing this document. | |||
| document. | ||||
| RSA Data Security makes no representations regarding intellectual | RSA Security makes no representations regarding intellectual property | |||
| property claims by other parties. Such determination is the | claims by other parties. Such determination is the responsibility of | |||
| responsibility of the user. | the user. | |||
| E. Revision history | E. Revision history | |||
| Versions 1.0-1.3 | Versions 1.0-1.3 | |||
| Versions 1.0-1.3 were distributed to participants in RSA Data | Versions 1.0-1.3 were distributed to participants in RSA Data | |||
| Security, Inc.Ęs Public-Key Cryptography Standards meetings in | Security Inc.'s Public-Key Cryptography Standards meetings in | |||
| February and March 1991. | February and March 1991. | |||
| Version 1.4 | Version 1.4 | |||
| Version 1.4 was part of the June 3, 1991 initial public release of | Version 1.4 was part of the June 3, 1991 initial public release of | |||
| PKCS. Version 1.4 was published as NIST/OSI ImplementorsĘ Workshop | PKCS. Version 1.4 was published as NIST/OSI Implementors' Workshop | |||
| document SEC-SIG-91-20. | document SEC-SIG-91-20. | |||
| Version 1.5 | Version 1.5 | |||
| Version 1.5 incorporated several editorial changes, including updates | Version 1.5 incorporated several editorial changes, including | |||
| to the references and the addition of a revision history. | updates to the references and the addition of a revision history. | |||
| Version 2.0 | Version 2.0 | |||
| Version 2.0 incorporates major editorial changes in terms of the | Version 2.0 incorporates major editorial changes in terms of the | |||
| document structure, and introduces the PBES2 encryption scheme, the | document structure, and introduces the PBES2 encryption scheme, | |||
| PBMAC1 message authentication scheme, and independent password-based | the PBMAC1 message authentication scheme, and independent | |||
| key derivation functions. This version continues to support the | password-based key derivation functions. This version continues to | |||
| encryption process in version 1.5. | support the encryption process in version 1.5. | |||
| F. References | F. References | |||
| [1] American National Standard X9.52 - 1998, Triple Data Encryption | [1] American National Standard X9.52 - 1998, Triple Data Encryption | |||
| Algorithm Modes of Operation. Working draft, Accredited Standards | Algorithm Modes of Operation. Working draft, Accredited Standards | |||
| Committee X9, July 27, 1998. | Committee X9, July 27, 1998. | |||
| [2] R. Baldwin and R. Rivest. RFC 2040: The RC5, RC5-CBC, RC5-CBC-Pad, | [2] R. Baldwin and R. Rivest. RFC 2040: The RC5, RC5-CBC, RC5-CBC- | |||
| and RC5-CTS Algorithms. IETF, October 1996. | Pad, and RC5-CTS Algorithms. IETF, October 1996. | |||
| [3] D. Balenson. RFC 1423: Privacy Enhancement for Internet Electronic | [3] D. Balenson. RFC 1423: Privacy Enhancement for Internet | |||
| Mail: Part III: Algorithms, Modes, and Identifiers. IETF, February | Electronic Mail: Part III: Algorithms, Modes, and Identifiers. IETF, | |||
| 1993. | February 1993. | |||
| [4] S.M. Bellovin and M. Merritt. Encrypted key exchange: Password-based | [4] S.M. Bellovin and M. Merritt. Encrypted key exchange: Password- | |||
| protocols secure against dictionary attacks. In Proceedings of the | based protocols secure against dictionary attacks. In Proceedings of | |||
| 1992 IEEE Computer Society Conference on Research in Security and | the 1992 IEEE Computer Society Conference on Research in Security and | |||
| Privacy, pages 72-84, IEEE Computer Society, 1992. | Privacy, pages 72-84, IEEE Computer Society, 1992. | |||
| [5] D. Jablon. Strong password-only authenticated key exchange. ACM | [5] D. Jablon. Strong password-only authenticated key exchange. ACM | |||
| Computer Communications Review, October 1996. | Computer Communications Review, October 1996. | |||
| [6] B. Kaliski. RFC 1319: The MD2 Message-Digest Algorithm. IETF, April | [6] B. Kaliski. RFC 1319: The MD2 Message-Digest Algorithm. IETF, | |||
| 1992. | April 1992. | |||
| [7] H. Krawczyk, M. Bellare, and R. Canetti. RFC 2104: HMAC: | [7] H. Krawczyk, M. Bellare, and R. Canetti. RFC 2104: HMAC: Keyed- | |||
| Keyed-Hashing for Message Authentication. IETF, February 1997. | Hashing for Message Authentication. IETF, February 1997. | |||
| [8] Robert Morris and Ken Thompson. Password security: A case history. | [8] Robert Morris and Ken Thompson. Password security: A case | |||
| Communications of the ACM, 22(11):594-597, November 1979. | history. Communications of the ACM, 22(11):594-597, November 1979. | |||
| [9] ISO/IEC 8824-1:1995: Information technology - Abstract Syntax | [9] ISO/IEC 8824-1:1995: Information technology - Abstract Syntax | |||
| Notation One (ASN.1) - Specification of basic notation. 1995. | Notation One (ASN.1) - Specification of basic notation. 1995. | |||
| [10] ISO/IEC 8824-1:1995/Amd.1:1995 Information technology - Abstract | [10] ISO/IEC 8824-1:1995/Amd.1:1995 Information technology - Abstract | |||
| Syntax Notation One (ASN.1) - Specification of basic notation - | Syntax Notation One (ASN.1) - Specification of basic notation - | |||
| Amendment 1 - Rules of extensibility. 1995. | Amendment 1 - Rules of extensibility. 1995. | |||
| [11] ISO/IEC 8824-2:1995 Information technology - Abstract Syntax | [11] ISO/IEC 8824-2:1995 Information technology - Abstract Syntax | |||
| Notation One (ASN.1) - Information object specification. 1995. | Notation One (ASN.1) - Information object specification. 1995. | |||
| [12] ISO/IEC 8824-2:1995/Amd.1:1995 Information technology - Abstract | [12] ISO/IEC 8824-2:1995/Amd.1:1995 Information technology - Abstract | |||
| Syntax Notation One (ASN.1) - Information object specification - | Syntax Notation One (ASN.1) - Information object specification - | |||
| Amendment 1 - Rules of extensibility. 1995. | Amendment 1 - Rules of extensibility. 1995. | |||
| [13] ISO/IEC 8824-3:1995 Information technology - Abstract Syntax | [13] ISO/IEC 8824-3:1995 Information technology - Abstract Syntax | |||
| Notation One (ASN.1) - Constraint specification. 1995. | Notation One (ASN.1) - Constraint specification. 1995. | |||
| [14] ISO/IEC 8824-4:1995 Information technology - Abstract Syntax | [14] ISO/IEC 8824-4:1995 Information technology - Abstract Syntax | |||
| Notation One (ASN.1) - Parameterization of ASN.1 specifications. | Notation One (ASN.1) - Parameterization of ASN.1 specifications. | |||
| 1995. | 1995. | |||
| [15] National Institute of Standards and Technology (NIST). FIPS PUB | [15] National Institute of Standards and Technology (NIST). FIPS PUB | |||
| 46-2: Data Encryption Standard. December 30, 1993. | 46-2: Data Encryption Standard. December 30, 1993. | |||
| [16] National Institute of Standards and Technology (NIST). FIPS PUB | [16] National Institute of Standards and Technology (NIST). FIPS PUB | |||
| 81: DES Modes of Operation. December 2, 1980. | 81: DES Modes of Operation. December 2, 1980. | |||
| [17] National Institute of Standards and Technology (NIST). FIPS PUB | [17] National Institute of Standards and Technology (NIST). FIPS PUB | |||
| 112: Password Usage. May 30, 1985. | 112: Password Usage. May 30, 1985. | |||
| [18] National Institute of Standards and Technology (NIST). FIPS PUB | [18] National Institute of Standards and Technology (NIST). FIPS PUB | |||
| 180-1: Secure Hash Standard. April 1994. | 180-1: Secure Hash Standard. April 1994. | |||
| [19] R. Rivest. RFC 1321: The MD5 Message-Digest Algorithm. IETF, April | [19] R. Rivest. RFC 1321: The MD5 Message-Digest Algorithm. IETF, | |||
| 1992. | April 1992. | |||
| [20] R.L. Rivest. The RC5 encryption algorithm. In Proceedings of the | [20] R.L. Rivest. The RC5 encryption algorithm. In Proceedings of the | |||
| Second International Workshop on Fast Software Encryption, pages | Second International Workshop on Fast Software Encryption, pages 86- | |||
| 86-96, Springer-Verlag, 1994. | 96, Springer-Verlag, 1994. | |||
| [21] R. Rivest. RFC 2268: A Description of the RC2(r) Encryption | [21] R. Rivest. RFC 2268: A Description of the RC2(r) Encryption | |||
| Algorithm. IETF, March 1998. | Algorithm. IETF, March 1998. | |||
| [22] R.L. Rivest. Block-Encryption Algorithm with Data-Dependent | [22] R.L. Rivest. Block-Encryption Algorithm with Data-Dependent | |||
| Rotations. U.S. Patent No. 5,724,428, March 3, 1998. | Rotations. U.S. Patent No. 5,724,428, March 3, 1998. | |||
| [23] R.L. Rivest. Block Encryption Algorithm with Data-Dependent | [23] R.L. Rivest. Block Encryption Algorithm with Data-Dependent | |||
| Rotations. U.S. Patent No. 5,835,600, November 10, 1998. | Rotations. U.S. Patent No. 5,835,600, November 10, 1998. | |||
| [24] RSA Laboratories. PKCS #5: Password-Based Encryption Standard. | [24] RSA Laboratories. PKCS #5: Password-Based Encryption Standard. | |||
| Version 1.5, November 1993. | Version 1.5, November 1993. | |||
| [25] RSA Laboratories. PKCS #8: Private-Key Information Syntax Standard. | [25] RSA Laboratories. PKCS #8: Private-Key Information Syntax | |||
| Version 1.2, November 1993. | Standard. Version 1.2, November 1993. | |||
| [26] T. Wu. The Secure Remote Password protocol. In Proceedings of the | [26] T. Wu. The Secure Remote Password protocol. In Proceedings of | |||
| 1998 Internet Society Network and Distributed System Security | the 1998 Internet Society Network and Distributed System Security | |||
| Symposium, pages 97-111, Internet Society, 1998. | Symposium, pages 97-111, Internet Society, 1998. | |||
| [27] F. Yergeau. RFC 2279: UTF-8, a Transformation Format of ISO 10646. | [27] F. Yergeau. RFC 2279: UTF-8, a Transformation Format of ISO | |||
| IETF, January 1998. | 10646. IETF, January 1998. | |||
| G. Contact Information & About PKCS | G. Contact Information & About PKCS | |||
| The Public-Key Cryptography Standards are specifications produced by | The Public-Key Cryptography Standards are specifications produced by | |||
| RSA Laboratories in cooperation with secure systems developers | RSA Laboratories in cooperation with secure systems developers | |||
| worldwide for the purpose of accelerating the deployment of | worldwide for the purpose of accelerating the deployment of public- | |||
| public-key cryptography. First published in 1991 as a result of | key cryptography. First published in 1991 as a result of meetings | |||
| meetings with a small group of early adopters of public-key | with a small group of early adopters of public-key technology, the | |||
| technology, the PKCS documents have become widely referenced and | PKCS documents have become widely referenced and implemented. | |||
| implemented. Contributions from the PKCS series have become part of | Contributions from the PKCS series have become part of many formal | |||
| many formal and de facto standards, including ANSI X9 documents, | and de facto standards, including ANSI X9 documents, PKIX, SET, | |||
| PKIX, SET, S/MIME, and SSL. | S/MIME, and SSL. | |||
| Further development of PKCS occurs through mailing list discussions | Further development of PKCS occurs through mailing list discussions | |||
| and occasional workshops, and suggestions for improvement are | and occasional workshops, and suggestions for improvement are | |||
| welcome. For more information, contact: | welcome. For more information, contact: | |||
| PKCS Editor | PKCS Editor | |||
| RSA Laboratories | RSA Laboratories | |||
| 20 Crosby Drive | 20 Crosby Drive | |||
| Bedford, MA 01730 USA | Bedford, MA 01730 USA | |||
| pkcs-editor@rsa.com | pkcs-editor@rsasecurity.com | |||
| http://www.rsa.com/rsalabs/pubs/PKCS | http://www.rsalabs.com/pkcs/ | |||
| Expires December 1999 | ||||
| End of changes. 268 change blocks. | ||||
| 616 lines changed or deleted | 664 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||