Coverage Report

Created: 2020-11-21 08:34

/src/botan/src/lib/pbkdf/argon2/argon2pwhash.cpp
Line
Count
Source (jump to first uncovered line)
1
/**
2
* (C) 2019 Jack Lloyd
3
*
4
* Botan is released under the Simplified BSD License (see license.txt)
5
*/
6
7
#include <botan/argon2.h>
8
#include <botan/exceptn.h>
9
#include <botan/internal/timer.h>
10
#include <algorithm>
11
12
namespace Botan {
13
14
Argon2::Argon2(uint8_t family, size_t M, size_t t, size_t p) :
15
   m_family(family),
16
   m_M(M),
17
   m_t(t),
18
   m_p(p)
19
0
   {}
20
21
void Argon2::derive_key(uint8_t output[], size_t output_len,
22
                        const char* password, size_t password_len,
23
                        const uint8_t salt[], size_t salt_len) const
24
0
   {
25
0
   argon2(output, output_len,
26
0
          password, password_len,
27
0
          salt, salt_len,
28
0
          nullptr, 0,
29
0
          nullptr, 0,
30
0
          m_family, m_p, m_M, m_t);
31
0
   }
32
33
namespace {
34
35
std::string argon2_family_name(uint8_t f)
36
0
   {
37
0
   switch(f)
38
0
      {
39
0
      case 0:
40
0
         return "Argon2d";
41
0
      case 1:
42
0
         return "Argon2i";
43
0
      case 2:
44
0
         return "Argon2id";
45
0
      default:
46
0
         throw Invalid_Argument("Unknown Argon2 parameter");
47
0
      }
48
0
   }
49
50
}
51
52
std::string Argon2::to_string() const
53
0
   {
54
0
   return argon2_family_name(m_family) + "(" +
55
0
      std::to_string(m_M) + "," +
56
0
      std::to_string(m_t) + "," +
57
0
      std::to_string(m_p) + ")";
58
0
  }
59
60
Argon2_Family::Argon2_Family(uint8_t family) : m_family(family)
61
0
   {
62
0
   if(m_family != 0 && m_family != 1 && m_family != 2)
63
0
      throw Invalid_Argument("Unknown Argon2 family identifier");
64
0
   }
65
66
std::string Argon2_Family::name() const
67
0
   {
68
0
   return argon2_family_name(m_family);
69
0
   }
70
71
std::unique_ptr<PasswordHash> Argon2_Family::tune(size_t /*output_length*/,
72
                                                  std::chrono::milliseconds msec,
73
                                                  size_t max_memory) const
74
0
   {
75
0
   const size_t max_kib = (max_memory == 0) ? 256*1024 : max_memory*1024;
76
77
   // Tune with a large memory otherwise we measure cache vs RAM speeds and underestimate
78
   // costs for larger params. Default is 36 MiB, or use 128 for long times.
79
0
   const size_t tune_M = (msec >= std::chrono::milliseconds(500) ? 128 : 36) * 1024;
80
0
   const size_t p = 1;
81
0
   size_t t = 1;
82
83
0
   Timer timer("Argon2");
84
0
   const auto tune_time = BOTAN_PBKDF_TUNING_TIME;
85
86
0
   timer.run_until_elapsed(tune_time, [&]() {
87
0
      uint8_t output[64] = { 0 };
88
0
      argon2(output, sizeof(output), "test", 4, nullptr, 0, nullptr, 0, nullptr, 0, m_family, p, tune_M, t);
89
0
      });
90
91
0
   if(timer.events() == 0 || timer.value() == 0)
92
0
      return default_params();
93
94
0
   size_t M = 4*1024;
95
96
0
   const uint64_t measured_time = timer.value() / (timer.events() * (tune_M / M));
97
98
0
   const uint64_t target_nsec = msec.count() * static_cast<uint64_t>(1000000);
99
100
   /*
101
   * Argon2 scaling rules:
102
   * k*M, k*t, k*p all increase cost by about k
103
   *
104
   * Since we don't even take advantage of p > 1, we prefer increasing
105
   * t or M instead.
106
   *
107
   * If possible to increase M, prefer that.
108
   */
109
110
0
   uint64_t est_nsec = measured_time;
111
112
0
   if(est_nsec < target_nsec && M < max_kib)
113
0
      {
114
0
      const uint64_t desired_cost_increase = (target_nsec + est_nsec - 1) / est_nsec;
115
0
      const uint64_t mem_headroom = max_kib / M;
116
117
0
      const uint64_t M_mult = std::min(desired_cost_increase, mem_headroom);
118
0
      M *= static_cast<size_t>(M_mult);
119
0
      est_nsec *= M_mult;
120
0
      }
121
122
0
   if(est_nsec < target_nsec)
123
0
      {
124
0
      const uint64_t desired_cost_increase = (target_nsec + est_nsec - 1) / est_nsec;
125
0
      t *= static_cast<size_t>(desired_cost_increase);
126
0
      }
127
128
0
   return this->from_params(M, t, p);
129
0
   }
130
131
std::unique_ptr<PasswordHash> Argon2_Family::default_params() const
132
0
   {
133
0
   return this->from_params(128*1024, 1, 1);
134
0
   }
135
136
std::unique_ptr<PasswordHash> Argon2_Family::from_iterations(size_t iter) const
137
0
   {
138
   /*
139
   These choices are arbitrary, but should not change in future
140
   releases since they will break applications expecting deterministic
141
   mapping from iteration count to params
142
   */
143
0
   const size_t M = iter;
144
0
   const size_t t = 1;
145
0
   const size_t p = 1;
146
0
   return this->from_params(M, t, p);
147
0
   }
148
149
std::unique_ptr<PasswordHash> Argon2_Family::from_params(size_t M, size_t t, size_t p) const
150
0
   {
151
0
   return std::unique_ptr<PasswordHash>(new Argon2(m_family, M, t, p));
152
0
   }
153
154
}