RUST-1996 SCRAM-SHA-256 FIPS Compliance

Cargo.toml

@@ -73,12 +73,14 @@ in-use-encryption-unstable = ["in-use-encryption"]
 tracing-unstable = ["dep:tracing", "dep:log", "bson3?/serde_json-1"]
 
 [dependencies]
+aws-lc-rs = { version = "1.0.0", features = ["bindgen"] }
 base64 = "0.13.0"
 bitflags = "1.1.0"
 chrono = { version = "0.4.7", default-features = false, features = [
     "clock",
     "std",
 ] }
+cmake = "0.1.0"
 derive_more = "0.99.17"
 derive-where = "1.2.7"
 flate2 = { version = "1.0", optional = true }
@@ -125,7 +127,6 @@ optional = true
 default-features = false
 features = ["default-https-client", "rt-tokio"]
 
-
 [dependencies.aws-credential-types]
 version = "1.2.4"
 optional = true

src/client/auth/scram.rs

@@ -6,8 +6,9 @@ use std::{
     str,
 };
 
+use aws_lc_rs;
 use hmac::{
-    digest::{Digest, FixedOutput, KeyInit},
+    digest::{Digest, KeyInit},
     Hmac,
     Mac,
 };
@@ -301,8 +302,20 @@ impl ScramVersion {
     /// The "h_i" function as defined in the SCRAM RFC.
     fn h_i(&self, str: &str, salt: &[u8], iterations: u32) -> Vec<u8> {
         match self {
-            ScramVersion::Sha1 => h_i::<Hmac<Sha1>>(str, salt, iterations, 160 / 8),
-            ScramVersion::Sha256 => h_i::<Hmac<Sha256>>(str, salt, iterations, 256 / 8),
+            ScramVersion::Sha1 => h_i_with_hmac(
+                aws_lc_rs::pbkdf2::PBKDF2_HMAC_SHA1,
+                str,
+                salt,
+                iterations,
+                160 / 8,
+            ),
+            ScramVersion::Sha256 => h_i_with_hmac(
+                aws_lc_rs::pbkdf2::PBKDF2_HMAC_SHA256,
+                str,
+                salt,
+                iterations,
+                256 / 8,
+            ),
         }
     }
 
@@ -374,14 +387,21 @@ fn hash<D: Digest>(val: &[u8]) -> Vec<u8> {
     hash.finalize().to_vec()
 }
 
-fn h_i<M: KeyInit + FixedOutput + Mac + Sync + Clone>(
+fn h_i_with_hmac(
+    algo: aws_lc_rs::pbkdf2::Algorithm,
     str: &str,
     salt: &[u8],
     iterations: u32,
     output_size: usize,
 ) -> Vec<u8> {
     let mut buf = vec![0u8; output_size];
-    pbkdf2::pbkdf2::<M>(str.as_bytes(), salt, iterations, buf.as_mut_slice());
+    aws_lc_rs::pbkdf2::derive(
+        algo,
+        std::num::NonZero::new(iterations).unwrap(),
+        salt,
+        str.as_bytes(),
+        &mut buf,
+    );
     buf
 }