pkcs5.h
mbedtls/build_info.h
mbedtls/platform_util.h
mbedtls/asn1.h
mbedtls/md.h
mbedtls/cipher.h
stddef.h
stdint.h
mbedtls/asn1.h
mbedtls/bignum.h
mbedtls/build_info.h
mbedtls/check_config.h
mbedtls/cipher.h
mbedtls/config_adjust_legacy_crypto.h
mbedtls/config_adjust_psa_from_legacy.h
mbedtls/config_adjust_psa_superset_legacy.h
mbedtls/config_adjust_ssl.h
mbedtls/config_adjust_x509.h
mbedtls/config_psa.h
mbedtls/mbedtls_config.h
mbedtls/md.h
pkcs5.h
mbedtls/platform_time.h
mbedtls/platform_util.h
mbedtls/private_access.h
psa/crypto_adjust_auto_enabled.h
psa/crypto_adjust_config_dependencies.h
psa/crypto_adjust_config_key_pair_types.h
psa/crypto_adjust_config_synonyms.h
psa/crypto_legacy.h
inttypes.h
limits.h
stddef.h
stdint.h
stdio.h
time.h
MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA
-0x2f80

Bad input parameters to function.

MBEDTLS_ERR_PKCS5_INVALID_FORMAT
-0x2f00

Unexpected ASN.1 data.

MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE
-0x2e80

Requested encryption or digest alg not available.

MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH
-0x2e00

Given private key password does not allow for correct decryption.

MBEDTLS_PKCS5_DECRYPT
MBEDTLS_DECRYPT
MBEDTLS_PKCS5_ENCRYPT
MBEDTLS_ENCRYPT
int MBEDTLS_DEPRECATED int MBEDTLS_DEPRECATED mbedtls_pkcs5_pbes2 (const mbedtls_asn1_buf *pbe_params, int mode, const unsigned char *pwd, size_t pwdlen, const unsigned char *data, size_t datalen, unsigned char *output) mbedtls_pkcs5_pbes2 const mbedtls_asn1_buf * pbe_params int mode const unsigned char * pwd size_t pwdlen const unsigned char * data size_t datalen unsigned char * output

PKCS#5 PBES2 function.

When encrypting, MBEDTLS_CIPHER_PADDING_PKCS7 must be enabled at compile time.

Deprecated

This function is deprecated and will be removed in a future version of the library. Please use mbedtls_pkcs5_pbes2_ext() instead.

When decrypting:

- if MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile time, this function validates the CBC padding and returns MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is invalid. Note that this can help active adversaries attempting to brute-forcing the password. Note also that there is no guarantee that an invalid password will be detected (the chances of a valid padding with a random password are about 1/255).

- if MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile time, this function does not validate the CBC padding.

pbe_params

the ASN.1 algorithm parameters

mode

either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT

pwd

password to use when generating key

pwdlen

length of password

data

data to process

datalen

length of data

output

Output buffer. On success, it contains the encrypted or decrypted data, possibly followed by the CBC padding. On failure, the content is indeterminate. For decryption, there must be enough room for `datalen` bytes. For encryption, there must be enough room for `datalen` + 1 bytes, rounded up to the block size of the block cipher identified by `pbe_params`.

0 on success, or a MBEDTLS_ERR_XXX code if verification fails.

int int mbedtls_pkcs5_pbes2_ext (const mbedtls_asn1_buf *pbe_params, int mode, const unsigned char *pwd, size_t pwdlen, const unsigned char *data, size_t datalen, unsigned char *output, size_t output_size, size_t *output_len) mbedtls_pkcs5_pbes2_ext const mbedtls_asn1_buf * pbe_params int mode const unsigned char * pwd size_t pwdlen const unsigned char * data size_t datalen unsigned char * output size_t output_size size_t * output_len

PKCS#5 PBES2 function.

When decrypting:

- This function validates the CBC padding and returns MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is invalid. Note that this can help active adversaries attempting to brute-forcing the password. Note also that there is no guarantee that an invalid password will be detected (the chances of a valid padding with a random password are about 1/255).

pbe_params

the ASN.1 algorithm parameters

mode

either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT

pwd

password to use when generating key

pwdlen

length of password

data

data to process

datalen

length of data

output

Output buffer. On success, it contains the decrypted data. On failure, the content is indetermidate. For decryption, there must be enough room for `datalen` bytes. For encryption, there must be enough room for `datalen` + 1 bytes, rounded up to the block size of the block cipher identified by `pbe_params`.

output_size

size of output buffer. This must be big enough to accommodate for output plus padding data.

output_len

On success, length of actual data written to the output buffer.

0 on success, or a MBEDTLS_ERR_XXX code if parsing or decryption fails.

int int mbedtls_pkcs5_pbkdf2_hmac_ext (mbedtls_md_type_t md_type, const unsigned char *password, size_t plen, const unsigned char *salt, size_t slen, unsigned int iteration_count, uint32_t key_length, unsigned char *output) mbedtls_pkcs5_pbkdf2_hmac_ext mbedtls_md_type_t md_type const unsigned char * password size_t plen const unsigned char * salt size_t slen unsigned int iteration_count uint32_t key_length unsigned char * output

PKCS#5 PBKDF2 using HMAC without using the HMAC context.

md_type

Hash algorithm used

password

Password to use when generating key

plen

Length of password

salt

Salt to use when generating key

slen

Length of salt

iteration_count

Iteration count

key_length

Length of generated key in bytes

output

Generated key. Must be at least as big as key_length

0 on success, or a MBEDTLS_ERR_XXX code if verification fails.

int MBEDTLS_DEPRECATED int MBEDTLS_DEPRECATED mbedtls_pkcs5_pbkdf2_hmac (mbedtls_md_context_t *ctx, const unsigned char *password, size_t plen, const unsigned char *salt, size_t slen, unsigned int iteration_count, uint32_t key_length, unsigned char *output) mbedtls_pkcs5_pbkdf2_hmac mbedtls_md_context_t * ctx const unsigned char * password size_t plen const unsigned char * salt size_t slen unsigned int iteration_count uint32_t key_length unsigned char * output

PKCS#5 PBKDF2 using HMAC.

Deprecated

Superseded by mbedtls_pkcs5_pbkdf2_hmac_ext().

ctx

Generic HMAC context

password

Password to use when generating key

plen

Length of password

salt

Salt to use when generating key

slen

Length of salt

iteration_count

Iteration count

key_length

Length of generated key in bytes

output

Generated key. Must be at least as big as key_length

0 on success, or a MBEDTLS_ERR_XXX code if verification fails.

int int mbedtls_pkcs5_self_test (int verbose) mbedtls_pkcs5_self_test int verbose

Checkup routine.

0 if successful, or 1 if the test failed

PKCS#5 functions.

Mathias Olsson mathias@kompetensum.com

    /*
    *CopyrightTheMbedTLSContributors
    *SPDX-License-Identifier:Apache-2.0ORGPL-2.0-or-later
    */
    #ifndefMBEDTLS_PKCS5_H
    #defineMBEDTLS_PKCS5_H

    #include"mbedtls/build_info.h"
    #include"mbedtls/platform_util.h"

    #include"mbedtls/asn1.h"
    #include"mbedtls/md.h"
    #include"mbedtls/cipher.h"

    #include<stddef.h>
    #include<stdint.h>

    #defineMBEDTLS_ERR_PKCS5_BAD_INPUT_DATA-0x2f80
    #defineMBEDTLS_ERR_PKCS5_INVALID_FORMAT-0x2f00
    #defineMBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE-0x2e80
    #defineMBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH-0x2e00

    #defineMBEDTLS_PKCS5_DECRYPTMBEDTLS_DECRYPT
    #defineMBEDTLS_PKCS5_ENCRYPTMBEDTLS_ENCRYPT

    #ifdef__cplusplus
    extern"C"{
    #endif

    #ifdefined(MBEDTLS_ASN1_PARSE_C)&&defined(MBEDTLS_CIPHER_C)

    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    intMBEDTLS_DEPRECATEDmbedtls_pkcs5_pbes2(constmbedtls_asn1_buf*pbe_params,intmode,
    constunsignedchar*pwd,size_tpwdlen,
    constunsignedchar*data,size_tdatalen,
    unsignedchar*output);
    #endif/*MBEDTLS_DEPRECATED_REMOVED*/

    #ifdefined(MBEDTLS_CIPHER_PADDING_PKCS7)

    intmbedtls_pkcs5_pbes2_ext(constmbedtls_asn1_buf*pbe_params,intmode,
    constunsignedchar*pwd,size_tpwdlen,
    constunsignedchar*data,size_tdatalen,
    unsignedchar*output,size_toutput_size,
    size_t*output_len);

    #endif/*MBEDTLS_CIPHER_PADDING_PKCS7*/

    #endif/*MBEDTLS_ASN1_PARSE_C&&MBEDTLS_CIPHER_C*/

    intmbedtls_pkcs5_pbkdf2_hmac_ext(mbedtls_md_type_tmd_type,
    constunsignedchar*password,
    size_tplen,constunsignedchar*salt,size_tslen,
    unsignedintiteration_count,
    uint32_tkey_length,unsignedchar*output);

    #ifdefined(MBEDTLS_MD_C)
    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    intMBEDTLS_DEPRECATEDmbedtls_pkcs5_pbkdf2_hmac(mbedtls_md_context_t*ctx,
    constunsignedchar*password,
    size_tplen,
    constunsignedchar*salt,
    size_tslen,
    unsignedintiteration_count,
    uint32_tkey_length,
    unsignedchar*output);
    #endif/*!MBEDTLS_DEPRECATED_REMOVED*/
    #endif/*MBEDTLS_MD_C*/
    #ifdefined(MBEDTLS_SELF_TEST)

    intmbedtls_pkcs5_self_test(intverbose);

    #endif/*MBEDTLS_SELF_TEST*/

    #ifdef__cplusplus
    }
    #endif

    #endif/*pkcs5.h*/