Skip to content

Add PBKDF2 in FIPS for password hashing #134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
LinuxJedi wants to merge 1 commit into from
Closed

Add PBKDF2 in FIPS for password hashing #134

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5715,17 +5715,22 @@ int WP11_Slot_HasSession(WP11_Slot* slot)
* -ve on failure.
*/
static int HashPIN(char* pin, int pinLen, byte* seed, int seedLen, byte* hash,
int hashLen)
int hashLen, WP11_Slot* slot)
{
#ifdef HAVE_SCRYPT
#ifdef HAVE_FIPS
Copy link
Collaborator

@dgarske dgarske Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding a new macro for force this mode as well... There are many embedded systems that would prefer this as scrypt is a memory hog (like 1 MB).

return wc_PBKDF2_ex(hash, (byte*)pin, pinLen, seed, seedLen,
PBKDF2_ITERATIONS, hashLen, WC_SHA256, NULL, slot->devId);
#elif defined(HAVE_SCRYPT)
/* Convert PIN into secret using scrypt algorithm. */
(void)slot;
return wc_scrypt(hash, (byte*)pin, pinLen, seed, seedLen,
WP11_HASH_PIN_COST, WP11_HASH_PIN_BLOCKSIZE,
WP11_HASH_PIN_PARALLEL, hashLen);
#elif !defined(NO_SHA256)
/* fallback to simple SHA2-256 hash of pin */
(void)seed;
(void)seedLen;
(void)slot;
XMEMSET(hash, 0, hashLen);
return wc_Sha256Hash((const byte*)pin, pinLen, hash);
#else
Expand All @@ -5735,6 +5740,7 @@ static int HashPIN(char* pin, int pinLen, byte* seed, int seedLen, byte* hash,
(void)seedLen;
(void)hash;
(void)hashLen;
(void)slot;
return NOT_COMPILED_IN;
#endif
}
Expand Down Expand Up @@ -5800,7 +5806,7 @@ int WP11_Slot_CheckSOPin(WP11_Slot* slot, char* pin, int pinLen)

/* Costly Operation done out of lock. */
ret = HashPIN(pin, pinLen, token->soPinSeed, sizeof(token->soPinSeed),
hash, sizeof(hash));
hash, sizeof(hash), slot);

WP11_Lock_LockRO(&slot->lock);
}
Expand Down Expand Up @@ -5840,7 +5846,7 @@ int WP11_Slot_CheckUserPin(WP11_Slot* slot, char* pin, int pinLen)

/* Costly Operation done out of lock. */
ret = HashPIN(pin, pinLen, token->userPinSeed,
sizeof(token->userPinSeed), hash, sizeof(hash));
sizeof(token->userPinSeed), hash, sizeof(hash), slot);

WP11_Lock_LockRO(&slot->lock);
}
Expand Down Expand Up @@ -6004,7 +6010,7 @@ int WP11_Slot_UserLogin(WP11_Slot* slot, char* pin, int pinLen)
#ifndef WOLFPKCS11_NO_STORE
if (ret == 0) {
ret = HashPIN(pin, pinLen, token->seed, sizeof(token->seed),
token->key, sizeof(token->key));
token->key, sizeof(token->key), slot);
}
#endif
WP11_Lock_LockRW(&slot->lock);
Expand Down Expand Up @@ -6076,7 +6082,7 @@ int WP11_Slot_SetSOPin(WP11_Slot* slot, char* pin, int pinLen)
/* Costly Operation done out of lock. */
ret = HashPIN(pin, pinLen, token->soPinSeed,
sizeof(token->soPinSeed), token->soPin,
sizeof(token->soPin));
sizeof(token->soPin), slot);
WP11_Lock_LockRW(&slot->lock);
}
if (ret == 0) {
Expand Down Expand Up @@ -6125,11 +6131,11 @@ int WP11_Slot_SetUserPin(WP11_Slot* slot, char* pin, int pinLen)
token->userPinEmpty = 0;
ret = HashPIN(pin, pinLen, token->userPinSeed,
sizeof(token->userPinSeed), token->userPin,
sizeof(token->userPin));
sizeof(token->userPin), slot);
#ifndef WOLFPKCS11_NO_STORE
if (ret == 0) {
ret = HashPIN(pin, pinLen, token->seed, sizeof(token->seed),
token->key, sizeof(token->key));
token->key, sizeof(token->key), slot);
}
#endif
WP11_Lock_LockRW(&slot->lock);
Expand Down
5 changes: 5 additions & 0 deletions wolfpkcs11/internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,11 @@ extern "C" {
#define NO_MD5
#endif

/* FIPS has no scrypt and SHA256 is not strong enough */
#if defined(HAVE_FIPS)
Copy link
Collaborator

@dgarske dgarske Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change to #ifndef PBKDF2_ITERATIONS.

#define PBKDF2_ITERATIONS 600000
#endif

#ifdef WOLFPKCS11_NO_MD5
#undef NO_MD5
#define NO_MD5
Expand Down
Loading