Porting of HKDF changes from server.

crypto/hkdf.cc

+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "crypto/hkdf.h"
+
+#include "base/logging.h"
+#include "crypto/hmac.h"
+
+namespace crypto {
+
+const size_t kSHA256HashLength = 32;
+
+HKDF::HKDF(const base::StringPiece& secret,
+           const base::StringPiece& salt,
+           const base::StringPiece& info,
+           size_t key_bytes_to_generate,
+           size_t iv_bytes_to_generate) {
+  // https://tools.ietf.org/html/rfc5869#section-2.2
+  base::StringPiece actual_salt = salt;

[Ryan Sleevi, 2013/02/21 17:48:31]

BUG? You're not actually making a copy here - you're mutating |salt| directly. 

[agl, 2013/02/21 18:16:11]

I don't think that |actual_salt| / |salt| is ever mutated. |actual_salt| is just
a fat pointer that either points to the argument, or to a zero block.

[Ryan Sleevi, 2013/02/21 19:30:44]

Ah right, parsing error on my part.

+  char zeros[kSHA256HashLength];

[Ryan Sleevi, 2013/02/21 17:48:31]

Just do

char zeros = {0};

[agl, 2013/02/21 18:16:11]

I don't really care, but I try to avoid using these odd corners of the language
where possible.

[Ryan Sleevi, 2013/02/21 19:30:44]

fair enough

+  if (actual_salt.empty()) {
+    // If salt is not given, HashLength zeros are used.
+    memset(zeros, 0, sizeof(zeros));
+    actual_salt.set(zeros, sizeof(zeros));
+  }
+
+  HMAC prk_hmac(HMAC::SHA256);

[Ryan Sleevi, 2013/02/21 17:48:31]

naming: prk (while used in RFC 5869 heavily), is not an obvious abbreviation
(it's only expanded as "pseudorandom key" once in 5869)

[agl, 2013/02/21 18:16:11]

Any better suggestions than the RFC's naming?

[Ryan Sleevi, 2013/02/21 19:30:44]

We've used spec-related variable names before, but we've made sure to spell out
their meaning (and why they're named inconsistently)

// Perform the Extract step to transform the input key and
// salt into the pseudorandom key (PRK) used for Expand.
HMAC prk_hmac(HMAC::SHA256);

[ramant (doing other things), 2013/02/21 22:46:59]

Done.

+  bool result = prk_hmac.Init(actual_salt);
+  DCHECK(result);
+
+  uint8 prk[kSHA256HashLength];
+  DCHECK_EQ(sizeof(prk), prk_hmac.DigestLength());
+  result = prk_hmac.Sign(secret, prk, sizeof(prk));
+  DCHECK(result);
+
+  // https://tools.ietf.org/html/rfc5869#section-2.3

[Ryan Sleevi, 2013/02/21 19:30:44]

// https://tools.ietf.org/html/rfc5869#section-2.3
// Perform the Expand phase to turn the pseudorandom key
// and info into the output keying material.

[ramant (doing other things), 2013/02/21 22:46:59]

Done.

+  const size_t material_length =
+      2*key_bytes_to_generate + 2*iv_bytes_to_generate;
+  const size_t n = (material_length + kSHA256HashLength-1) /
+                   kSHA256HashLength;
+  DCHECK_LT(n, 256u);
+
+  output_.resize(n * kSHA256HashLength);
+  base::StringPiece previous;
+
+  scoped_array<char> buf(new char[kSHA256HashLength + info.size() + 1]);

[Ryan Sleevi, 2013/02/21 17:48:31]

scoped_array is deprecated - use scoped_ptr with the appropriate deleter

[ramant (doing other things), 2013/02/21 22:46:59]

Done.

+  uint8 digest[kSHA256HashLength];
+
+  HMAC hmac(HMAC::SHA256);
+  result = hmac.Init(prk, sizeof(prk));
+  DCHECK(result);
+
+  for (size_t i = 0; i < n; i++) {
+    memcpy(buf.get(), previous.data(), previous.size());
+    size_t j = previous.size();
+    memcpy(buf.get() + j, info.data(), info.size());
+    j += info.size();
+    buf[j++] = i + 1;
+
+    result = hmac.Sign(base::StringPiece(buf.get(), j), digest, sizeof(digest));
+    DCHECK(result);
+
+    memcpy(&output_[i*sizeof(digest)], digest, sizeof(digest));
+    previous = base::StringPiece(reinterpret_cast<char*>(digest),
+                                 sizeof(digest));
+  }
+
+  size_t j = 0;
+  client_write_key_ = base::StringPiece(reinterpret_cast<char *>(&output_[j]),
+                                        key_bytes_to_generate);
+  j += key_bytes_to_generate;
+  server_write_key_ = base::StringPiece(reinterpret_cast<char *>(&output_[j]),
+                                        key_bytes_to_generate);
+  j += key_bytes_to_generate;
+  client_write_iv_ = base::StringPiece(reinterpret_cast<char *>(&output_[j]),
+                                       iv_bytes_to_generate);
+  j += iv_bytes_to_generate;
+  server_write_iv_ = base::StringPiece(reinterpret_cast<char *>(&output_[j]),
+                                       iv_bytes_to_generate);
+}
+
+HKDF::~HKDF() {
+}
+
+}  // namespace crypto