github.com/maenmax/kairep@v0.0.0-20210218001208-55bf3df36788/src/golang.org/x/crypto/scrypt/scrypt.go (about) 1 // Copyright 2012 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 // Package scrypt implements the scrypt key derivation function as defined in 6 // Colin Percival's paper "Stronger Key Derivation via Sequential Memory-Hard 7 // Functions" (http://www.tarsnap.com/scrypt/scrypt.pdf). 8 package scrypt // import "golang.org/x/crypto/scrypt" 9 10 import ( 11 "crypto/sha256" 12 "errors" 13 14 "golang.org/x/crypto/pbkdf2" 15 ) 16 17 const maxInt = int(^uint(0) >> 1) 18 19 // blockCopy copies n numbers from src into dst. 20 func blockCopy(dst, src []uint32, n int) { 21 copy(dst, src[:n]) 22 } 23 24 // blockXOR XORs numbers from dst with n numbers from src. 25 func blockXOR(dst, src []uint32, n int) { 26 for i, v := range src[:n] { 27 dst[i] ^= v 28 } 29 } 30 31 // salsaXOR applies Salsa20/8 to the XOR of 16 numbers from tmp and in, 32 // and puts the result into both both tmp and out. 33 func salsaXOR(tmp *[16]uint32, in, out []uint32) { 34 w0 := tmp[0] ^ in[0] 35 w1 := tmp[1] ^ in[1] 36 w2 := tmp[2] ^ in[2] 37 w3 := tmp[3] ^ in[3] 38 w4 := tmp[4] ^ in[4] 39 w5 := tmp[5] ^ in[5] 40 w6 := tmp[6] ^ in[6] 41 w7 := tmp[7] ^ in[7] 42 w8 := tmp[8] ^ in[8] 43 w9 := tmp[9] ^ in[9] 44 w10 := tmp[10] ^ in[10] 45 w11 := tmp[11] ^ in[11] 46 w12 := tmp[12] ^ in[12] 47 w13 := tmp[13] ^ in[13] 48 w14 := tmp[14] ^ in[14] 49 w15 := tmp[15] ^ in[15] 50 51 x0, x1, x2, x3, x4, x5, x6, x7, x8 := w0, w1, w2, w3, w4, w5, w6, w7, w8 52 x9, x10, x11, x12, x13, x14, x15 := w9, w10, w11, w12, w13, w14, w15 53 54 for i := 0; i < 8; i += 2 { 55 u := x0 + x12 56 x4 ^= u<<7 | u>>(32-7) 57 u = x4 + x0 58 x8 ^= u<<9 | u>>(32-9) 59 u = x8 + x4 60 x12 ^= u<<13 | u>>(32-13) 61 u = x12 + x8 62 x0 ^= u<<18 | u>>(32-18) 63 64 u = x5 + x1 65 x9 ^= u<<7 | u>>(32-7) 66 u = x9 + x5 67 x13 ^= u<<9 | u>>(32-9) 68 u = x13 + x9 69 x1 ^= u<<13 | u>>(32-13) 70 u = x1 + x13 71 x5 ^= u<<18 | u>>(32-18) 72 73 u = x10 + x6 74 x14 ^= u<<7 | u>>(32-7) 75 u = x14 + x10 76 x2 ^= u<<9 | u>>(32-9) 77 u = x2 + x14 78 x6 ^= u<<13 | u>>(32-13) 79 u = x6 + x2 80 x10 ^= u<<18 | u>>(32-18) 81 82 u = x15 + x11 83 x3 ^= u<<7 | u>>(32-7) 84 u = x3 + x15 85 x7 ^= u<<9 | u>>(32-9) 86 u = x7 + x3 87 x11 ^= u<<13 | u>>(32-13) 88 u = x11 + x7 89 x15 ^= u<<18 | u>>(32-18) 90 91 u = x0 + x3 92 x1 ^= u<<7 | u>>(32-7) 93 u = x1 + x0 94 x2 ^= u<<9 | u>>(32-9) 95 u = x2 + x1 96 x3 ^= u<<13 | u>>(32-13) 97 u = x3 + x2 98 x0 ^= u<<18 | u>>(32-18) 99 100 u = x5 + x4 101 x6 ^= u<<7 | u>>(32-7) 102 u = x6 + x5 103 x7 ^= u<<9 | u>>(32-9) 104 u = x7 + x6 105 x4 ^= u<<13 | u>>(32-13) 106 u = x4 + x7 107 x5 ^= u<<18 | u>>(32-18) 108 109 u = x10 + x9 110 x11 ^= u<<7 | u>>(32-7) 111 u = x11 + x10 112 x8 ^= u<<9 | u>>(32-9) 113 u = x8 + x11 114 x9 ^= u<<13 | u>>(32-13) 115 u = x9 + x8 116 x10 ^= u<<18 | u>>(32-18) 117 118 u = x15 + x14 119 x12 ^= u<<7 | u>>(32-7) 120 u = x12 + x15 121 x13 ^= u<<9 | u>>(32-9) 122 u = x13 + x12 123 x14 ^= u<<13 | u>>(32-13) 124 u = x14 + x13 125 x15 ^= u<<18 | u>>(32-18) 126 } 127 x0 += w0 128 x1 += w1 129 x2 += w2 130 x3 += w3 131 x4 += w4 132 x5 += w5 133 x6 += w6 134 x7 += w7 135 x8 += w8 136 x9 += w9 137 x10 += w10 138 x11 += w11 139 x12 += w12 140 x13 += w13 141 x14 += w14 142 x15 += w15 143 144 out[0], tmp[0] = x0, x0 145 out[1], tmp[1] = x1, x1 146 out[2], tmp[2] = x2, x2 147 out[3], tmp[3] = x3, x3 148 out[4], tmp[4] = x4, x4 149 out[5], tmp[5] = x5, x5 150 out[6], tmp[6] = x6, x6 151 out[7], tmp[7] = x7, x7 152 out[8], tmp[8] = x8, x8 153 out[9], tmp[9] = x9, x9 154 out[10], tmp[10] = x10, x10 155 out[11], tmp[11] = x11, x11 156 out[12], tmp[12] = x12, x12 157 out[13], tmp[13] = x13, x13 158 out[14], tmp[14] = x14, x14 159 out[15], tmp[15] = x15, x15 160 } 161 162 func blockMix(tmp *[16]uint32, in, out []uint32, r int) { 163 blockCopy(tmp[:], in[(2*r-1)*16:], 16) 164 for i := 0; i < 2*r; i += 2 { 165 salsaXOR(tmp, in[i*16:], out[i*8:]) 166 salsaXOR(tmp, in[i*16+16:], out[i*8+r*16:]) 167 } 168 } 169 170 func integer(b []uint32, r int) uint64 { 171 j := (2*r - 1) * 16 172 return uint64(b[j]) | uint64(b[j+1])<<32 173 } 174 175 func smix(b []byte, r, N int, v, xy []uint32) { 176 var tmp [16]uint32 177 x := xy 178 y := xy[32*r:] 179 180 j := 0 181 for i := 0; i < 32*r; i++ { 182 x[i] = uint32(b[j]) | uint32(b[j+1])<<8 | uint32(b[j+2])<<16 | uint32(b[j+3])<<24 183 j += 4 184 } 185 for i := 0; i < N; i += 2 { 186 blockCopy(v[i*(32*r):], x, 32*r) 187 blockMix(&tmp, x, y, r) 188 189 blockCopy(v[(i+1)*(32*r):], y, 32*r) 190 blockMix(&tmp, y, x, r) 191 } 192 for i := 0; i < N; i += 2 { 193 j := int(integer(x, r) & uint64(N-1)) 194 blockXOR(x, v[j*(32*r):], 32*r) 195 blockMix(&tmp, x, y, r) 196 197 j = int(integer(y, r) & uint64(N-1)) 198 blockXOR(y, v[j*(32*r):], 32*r) 199 blockMix(&tmp, y, x, r) 200 } 201 j = 0 202 for _, v := range x[:32*r] { 203 b[j+0] = byte(v >> 0) 204 b[j+1] = byte(v >> 8) 205 b[j+2] = byte(v >> 16) 206 b[j+3] = byte(v >> 24) 207 j += 4 208 } 209 } 210 211 // Key derives a key from the password, salt, and cost parameters, returning 212 // a byte slice of length keyLen that can be used as cryptographic key. 213 // 214 // N is a CPU/memory cost parameter, which must be a power of two greater than 1. 215 // r and p must satisfy r * p < 2³⁰. If the parameters do not satisfy the 216 // limits, the function returns a nil byte slice and an error. 217 // 218 // For example, you can get a derived key for e.g. AES-256 (which needs a 219 // 32-byte key) by doing: 220 // 221 // dk := scrypt.Key([]byte("some password"), salt, 16384, 8, 1, 32) 222 // 223 // The recommended parameters for interactive logins as of 2009 are N=16384, 224 // r=8, p=1. They should be increased as memory latency and CPU parallelism 225 // increases. Remember to get a good random salt. 226 func Key(password, salt []byte, N, r, p, keyLen int) ([]byte, error) { 227 if N <= 1 || N&(N-1) != 0 { 228 return nil, errors.New("scrypt: N must be > 1 and a power of 2") 229 } 230 if uint64(r)*uint64(p) >= 1<<30 || r > maxInt/128/p || r > maxInt/256 || N > maxInt/128/r { 231 return nil, errors.New("scrypt: parameters are too large") 232 } 233 234 xy := make([]uint32, 64*r) 235 v := make([]uint32, 32*N*r) 236 b := pbkdf2.Key(password, salt, 1, p*128*r, sha256.New) 237 238 for i := 0; i < p; i++ { 239 smix(b[i*128*r:], r, N, v, xy) 240 } 241 242 return pbkdf2.Key(password, b, 1, keyLen, sha256.New), nil 243 }