Struct FipsPbkdf2

Source

pub struct FipsPbkdf2<H: Hash + Fips> { /* private fields */ }

Expand description

A wrapper type enforcing FIPS compliance for PBKDF2 operations.

The FipsPbkdf2 type ensures that PBKDF2 operations are performed using FIPS-compliant hash functions and salts at the type level.

If the allow-non-fips flag is disabled, the constraints the FipsPbkdf2 struct enforces are equivalent to that of the pbkdf2 and pbkdf2_into functions alone.

This type implements this crate’s Fips marker type.

§Examples

use wolf_crypto::kdf::FipsPbkdf2;
use wolf_crypto::hash::Sha256;
use wolf_crypto::kdf::Iters;

let password = b"my password";
let salt = [42; 16];
let iters = Iters::new(100_000).unwrap();

let key = FipsPbkdf2::<Sha256>::array::<32>(password, salt, iters).unwrap();
assert_eq!(key.len(), 32);

let salt = [3; 8]; // won't compile! must be at least 16 bytes for FIPS compliance.

FipsPbkdf2::<Sha256>::into(password, salt, iters, &mut out_key).unwrap();

Implementations§

Source §

impl<H: Hash + Fips> FipsPbkdf2<H>

Source

pub fn array<const KL: usize>( password: &[u8], salt: impl Salt<Min16>, iters: Iters, ) -> Result<[u8; KL], Unspecified>

Performs PBKDF2 and returns the result as a fixed-size array.

§Arguments

password - The password to use for the key derivation.
salt - The salt to use for key derivation.
iters - The number of times to process the hash.

§Errors

The length of the password was greater than i32::MAX.
The length of the salt was greater than i32::MAX.
The number of iters was greater than i32::MAX.
The KL generic was greater than i32::MAX.
The KL generic was less than FIPS_MIN_KEY (14 bytes).

§Example

use wolf_crypto::kdf::{FipsPbkdf2, Sha256, Iters};

type Sha256Pbkdf2 = FipsPbkdf2<Sha256>;

let password = b"my secret password";
let salt = [42; 16];
let iters = Iters::new(600_000).unwrap();

let key = Sha256Pbkdf2::array::<32>(password, salt, iters).unwrap();
assert_eq!(key.len(), 32);

Source

pub fn into( password: &[u8], salt: impl Salt<Min16>, iters: Iters, out_key: &mut [u8], ) -> Result<(), Unspecified>

Performs PBKDF2 and writes the result into the provided out_key buffer.

§Arguments

password - The password to use for the key derivation.
salt - The salt to use for key derivation.
iters - The number of times to process the hash.
out_key - The buffer to write the generated key into.

§Errors

The length of the password was greater than i32::MAX.
The length of the salt was greater than i32::MAX.
The number of iters was greater than i32::MAX.
The length of the out_key was greater than i32::MAX.
The length of the out_key was less than FIPS_MIN_KEY (14 bytes).

§Example

use wolf_crypto::kdf::{FipsPbkdf2, Sha256, Iters};

type Sha256Pbkdf2 = FipsPbkdf2<Sha256>;

let password = b"my secret password";
let salt = [42; 16];
let iters = Iters::new(600_000).unwrap();
let mut out_key = [0u8; 32];

Sha256Pbkdf2::into(password, salt, iters, out_key.as_mut_slice()).unwrap();