当前位置：文江博客话题详情

openssl 中是否有任何 C API 可以从给定字符串派生密钥

发布于 2024-11-25 03:41:43 字数 60 浏览 1 评论 0原文

我需要 openssl 库中的 C API 来从给定的字符串派生密钥。我在哪里可以获得这方面的示例源代码？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

江城子 2024-12-02 03:41:43

执行此操作的标准算法是 PBKDF2（基于密码的密钥派生函数版本 2 的缩写）。 OpenSSL 中有一个 PBKDF2 的实现，在 openssl/evp.h 中声明：

int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
                           unsigned char *salt, int saltlen, int iter,
                           int keylen, unsigned char *out);

当您生成新密钥时，您应该使用 openssl/ 中的 RAND_bytes() rand.h 创建盐。 iter 是迭代计数，它应该与您的预期应用程序可以容忍的一样大 - 至少类似于 20,000。

A standard algorithm to do this is PBKDF2 (an acronym for Password-Based Key Derivation Function version 2). There is an implementation of PBKDF2 in OpenSSL, declared in openssl/evp.h:

int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen,
                           unsigned char *salt, int saltlen, int iter,
                           int keylen, unsigned char *out);

When you are generating a new key you should use RAND_bytes() from openssl/rand.h to create the salt. iter is the iteration count, which should be as large as your intended application can tolerate - at least something like 20,000.

回复收藏 0 原文

翻了热茶 2024-12-02 03:41:43

我找到了示例，说明如何从一个密码。该示例可以追溯到 2008 年，据我所知，OpenSSL 中尚未记录该示例。因此，让我发布完整的示例源代码来帮助所有尝试使用 OpenSSL API 的可怜人。

请注意，这不是我的代码，它来自 Marek Marcola！所有的功劳都是他的功劳。

/*
 * Example program on how to derive an encryption key from a password
 * corresponding to the RFC2898 / PBKDF2 standard.
 * Found in a 2008 mailing list posted by Marek Marcola:
 * http://www.mail-archive.com/[email protected]/msg54143.html
 */

#include <string.h>

#include <openssl/x509.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>

int print_hex(unsigned char *buf, int len)
{
    int i;
    int n;

    for(i=0,n=0;i<len;i++){
        if(n > 7){
            printf("\n");
            n = 0;
        }
        printf("0x%02x, ",buf[i]);
        n++;
    }
    printf("\n");

    return(0);
}

int main()
{
    char *pass = "password";
    char *salt = "12340000";
    int ic = 1;
    unsigned char buf[1024];

    ic = 1;
    PKCS5_PBKDF2_HMAC_SHA1(pass, strlen(pass), (unsigned char*)salt, strlen(salt), ic, 32+16, buf);
    printf("PKCS5_PBKDF2_HMAC_SHA1(\"%s\", \"%s\", %d)=\n", pass, salt, ic);
    print_hex(buf, 32+16);

    ic = 1;
    EVP_BytesToKey(EVP_aes_256_cbc(), EVP_sha1(), (unsigned char*)salt, (unsigned char*)pass, strlen(pass), ic, buf, buf+32);
    printf("EVP_BytesToKey(\"%s\", \"%s\", %d)=\n", pass, salt, ic);
    print_hex(buf, 32+16);

    return(0);
}

I found an example on how to generate a key from a password. The example dates from 2008, as far as I can tell this is still undocumented in OpenSSL. So let me post the full example source to help all those poor souls who try to use the OpenSSL API.

Please note that this is NOT my code, it comes from Marek Marcola! All credits are due to him.

/*
 * Example program on how to derive an encryption key from a password
 * corresponding to the RFC2898 / PBKDF2 standard.
 * Found in a 2008 mailing list posted by Marek Marcola:
 * http://www.mail-archive.com/[email protected]/msg54143.html
 */

#include <string.h>

#include <openssl/x509.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>

int print_hex(unsigned char *buf, int len)
{
    int i;
    int n;

    for(i=0,n=0;i<len;i++){
        if(n > 7){
            printf("\n");
            n = 0;
        }
        printf("0x%02x, ",buf[i]);
        n++;
    }
    printf("\n");

    return(0);
}

int main()
{
    char *pass = "password";
    char *salt = "12340000";
    int ic = 1;
    unsigned char buf[1024];

    ic = 1;
    PKCS5_PBKDF2_HMAC_SHA1(pass, strlen(pass), (unsigned char*)salt, strlen(salt), ic, 32+16, buf);
    printf("PKCS5_PBKDF2_HMAC_SHA1(\"%s\", \"%s\", %d)=\n", pass, salt, ic);
    print_hex(buf, 32+16);

    ic = 1;
    EVP_BytesToKey(EVP_aes_256_cbc(), EVP_sha1(), (unsigned char*)salt, (unsigned char*)pass, strlen(pass), ic, buf, buf+32);
    printf("EVP_BytesToKey(\"%s\", \"%s\", %d)=\n", pass, salt, ic);
    print_hex(buf, 32+16);

    return(0);
}

回复收藏 0 原文

~没有更多了~