fscrypt/
hkdf.rs

1// Copyright 2025 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4use hmac::{KeyInit, Mac};
5
6// Fscrypt tacks a prefix onto the 'info' field in HKDF used for different purposes.
7// This prefix is built from one of the following context.
8pub const HKDF_CONTEXT_KEY_IDENTIFIER: u8 = 1;
9pub const HKDF_CONTEXT_PER_FILE_ENC_KEY: u8 = 2;
10pub const HKDF_CONTEXT_IV_INO_LBLK_64_KEY: u8 = 4;
11pub const HKDF_CONTEXT_DIRHASH_KEY: u8 = 5;
12pub const HKDF_CONTEXT_IV_INO_LBLK_32_KEY: u8 = 6;
13pub const HKDF_CONTEXT_INODE_HASH_KEY: u8 = 7;
14
15/// An fscrypt compatible implementation of HKDF (HKDF-extract + HKDF-expand)
16/// This is just regular HKDF but with 'info' prefixed.
17/// `context` is an fscrypt special.
18pub fn fscrypt_hkdf<const L: usize>(
19    initial_key_material: &[u8],
20    info: &[u8],
21    context: u8,
22) -> [u8; L] {
23    let mut out = [0u8; L];
24    let mut fscrypt_info = Vec::with_capacity(9 + info.len());
25    fscrypt_info.extend_from_slice(b"fscrypt\0");
26    fscrypt_info.push(context);
27    debug_assert_eq!(fscrypt_info.len(), 9);
28    fscrypt_info.extend_from_slice(info);
29    hkdf::<L>(initial_key_material, &fscrypt_info, &mut out);
30    out
31}
32
33/// Standard HKDF implementation. See https://datatracker.ietf.org/doc/html/rfc5869
34/// Note that we assume an all-zero seed for PRK.
35/// `initial_key_material` is the data being hashed.
36/// `info` is optional context (can be zero length string)
37/// `out` is populated with the result.
38pub fn hkdf<const L: usize>(initial_key_material: &[u8], info: &[u8], out: &mut [u8; L]) {
39    const HASH_LEN: usize = 64;
40    // HKDF-extract
41    let mut hmac = hmac::Hmac::<sha2::Sha512>::new_from_slice(&[0; HASH_LEN]).unwrap();
42    hmac.update(initial_key_material);
43    let prk = hmac.finalize().into_bytes();
44    // HKDF-expand
45    let mut last = [].as_slice();
46    let mut out = out.as_mut_slice();
47    let mut i = 1;
48    loop {
49        let mut hmac = hmac::Hmac::<sha2::Sha512>::new_from_slice(&prk).unwrap();
50        hmac.update(&last);
51        hmac.update(&info);
52        hmac.update(&[i as u8]);
53        let val = hmac.finalize().into_bytes();
54        if out.len() < HASH_LEN {
55            out.copy_from_slice(&val.as_slice()[..out.len()]);
56            break;
57        }
58        out[..HASH_LEN].copy_from_slice(&val.as_slice());
59        (last, out) = out.split_at_mut(HASH_LEN);
60        i += 1;
61    }
62}
fscrypt/hkdf.rs

fscrypt/
hkdf.rs
