/src/botan/src/lib/pbkdf/argon2/argon2pwhash.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /** |
2 | | * (C) 2019 Jack Lloyd |
3 | | * |
4 | | * Botan is released under the Simplified BSD License (see license.txt) |
5 | | */ |
6 | | |
7 | | #include <botan/argon2.h> |
8 | | #include <botan/exceptn.h> |
9 | | #include <botan/internal/timer.h> |
10 | | #include <algorithm> |
11 | | |
12 | | namespace Botan { |
13 | | |
14 | | Argon2::Argon2(uint8_t family, size_t M, size_t t, size_t p) : |
15 | | m_family(family), |
16 | | m_M(M), |
17 | | m_t(t), |
18 | | m_p(p) |
19 | 0 | {} |
20 | | |
21 | | void Argon2::derive_key(uint8_t output[], size_t output_len, |
22 | | const char* password, size_t password_len, |
23 | | const uint8_t salt[], size_t salt_len) const |
24 | 0 | { |
25 | 0 | argon2(output, output_len, |
26 | 0 | password, password_len, |
27 | 0 | salt, salt_len, |
28 | 0 | nullptr, 0, |
29 | 0 | nullptr, 0, |
30 | 0 | m_family, m_p, m_M, m_t); |
31 | 0 | } |
32 | | |
33 | | namespace { |
34 | | |
35 | | std::string argon2_family_name(uint8_t f) |
36 | | { |
37 | | switch(f) |
38 | | { |
39 | | case 0: |
40 | | return "Argon2d"; |
41 | | case 1: |
42 | | return "Argon2i"; |
43 | | case 2: |
44 | | return "Argon2id"; |
45 | | default: |
46 | | throw Invalid_Argument("Unknown Argon2 parameter"); |
47 | | } |
48 | | } |
49 | | |
50 | | } |
51 | | |
52 | | std::string Argon2::to_string() const |
53 | 0 | { |
54 | 0 | return argon2_family_name(m_family) + "(" + |
55 | 0 | std::to_string(m_M) + "," + |
56 | 0 | std::to_string(m_t) + "," + |
57 | 0 | std::to_string(m_p) + ")"; |
58 | 0 | } |
59 | | |
60 | | Argon2_Family::Argon2_Family(uint8_t family) : m_family(family) |
61 | 0 | { |
62 | 0 | if(m_family != 0 && m_family != 1 && m_family != 2) |
63 | 0 | throw Invalid_Argument("Unknown Argon2 family identifier"); |
64 | 0 | } |
65 | | |
66 | | std::string Argon2_Family::name() const |
67 | 0 | { |
68 | 0 | return argon2_family_name(m_family); |
69 | 0 | } |
70 | | |
71 | | std::unique_ptr<PasswordHash> Argon2_Family::tune(size_t /*output_length*/, |
72 | | std::chrono::milliseconds msec, |
73 | | size_t max_memory) const |
74 | 0 | { |
75 | 0 | const size_t max_kib = (max_memory == 0) ? 256*1024 : max_memory*1024; |
76 | 0 |
|
77 | 0 | // Tune with a large memory otherwise we measure cache vs RAM speeds and underestimate |
78 | 0 | // costs for larger params |
79 | 0 | const size_t tune_M = 256*1024; // in KiB |
80 | 0 | const size_t p = 1; |
81 | 0 | size_t t = 1; |
82 | 0 |
|
83 | 0 | Timer timer("Argon2"); |
84 | 0 | const auto tune_time = BOTAN_PBKDF_TUNING_TIME; |
85 | 0 |
|
86 | 0 | timer.run_until_elapsed(tune_time, [&]() { |
87 | 0 | uint8_t output[32] = { 0 }; |
88 | 0 | argon2(output, sizeof(output), "test", 4, nullptr, 0, nullptr, 0, nullptr, 0, m_family, p, tune_M, t); |
89 | 0 | }); |
90 | 0 |
|
91 | 0 | if(timer.events() == 0 || timer.value() == 0) |
92 | 0 | return default_params(); |
93 | 0 | |
94 | 0 | size_t M = 4*1024; |
95 | 0 |
|
96 | 0 | const uint64_t measured_time = timer.value() / (timer.events() * (tune_M / M)); |
97 | 0 |
|
98 | 0 | const uint64_t target_nsec = msec.count() * static_cast<uint64_t>(1000000); |
99 | 0 |
|
100 | 0 | /* |
101 | 0 | * Argon2 scaling rules: |
102 | 0 | * k*M, k*t, k*p all increase cost by about k |
103 | 0 | * |
104 | 0 | * Since we don't even take advantage of p > 1, we prefer increasing |
105 | 0 | * t or M instead. |
106 | 0 | * |
107 | 0 | * If possible to increase M, prefer that. |
108 | 0 | */ |
109 | 0 |
|
110 | 0 | uint64_t est_nsec = measured_time; |
111 | 0 |
|
112 | 0 | if(est_nsec < target_nsec && M < max_kib) |
113 | 0 | { |
114 | 0 | const uint64_t desired_cost_increase = (target_nsec + est_nsec - 1) / est_nsec; |
115 | 0 | const uint64_t mem_headroom = max_kib / M; |
116 | 0 |
|
117 | 0 | const uint64_t M_mult = std::min(desired_cost_increase, mem_headroom); |
118 | 0 | M *= static_cast<size_t>(M_mult); |
119 | 0 | est_nsec *= M_mult; |
120 | 0 | } |
121 | 0 |
|
122 | 0 | if(est_nsec < target_nsec) |
123 | 0 | { |
124 | 0 | const uint64_t desired_cost_increase = (target_nsec + est_nsec - 1) / est_nsec; |
125 | 0 | t *= static_cast<size_t>(desired_cost_increase); |
126 | 0 | } |
127 | 0 |
|
128 | 0 | return this->from_params(M, t, p); |
129 | 0 | } |
130 | | |
131 | | std::unique_ptr<PasswordHash> Argon2_Family::default_params() const |
132 | 0 | { |
133 | 0 | return this->from_params(128*1024, 1, 1); |
134 | 0 | } |
135 | | |
136 | | std::unique_ptr<PasswordHash> Argon2_Family::from_iterations(size_t iter) const |
137 | 0 | { |
138 | 0 | /* |
139 | 0 | These choices are arbitrary, but should not change in future |
140 | 0 | releases since they will break applications expecting deterministic |
141 | 0 | mapping from iteration count to params |
142 | 0 | */ |
143 | 0 | const size_t M = iter; |
144 | 0 | const size_t t = 1; |
145 | 0 | const size_t p = 1; |
146 | 0 | return this->from_params(M, t, p); |
147 | 0 | } |
148 | | |
149 | | std::unique_ptr<PasswordHash> Argon2_Family::from_params(size_t M, size_t t, size_t p) const |
150 | 0 | { |
151 | 0 | return std::unique_ptr<PasswordHash>(new Argon2(m_family, M, t, p)); |
152 | 0 | } |
153 | | |
154 | | } |