CryptoPkg: Add PKCS5 PBKDF2 interface for password derivation.

[mirror_edk2.git] / CryptoPkg / Include / Library / BaseCryptLib.h

diff --git a/CryptoPkg/Include/Library/BaseCryptLib.h b/CryptoPkg/Include/Library/BaseCryptLib.h
index 9693793da3f0a3dd8e4200ea7116f905f4da8371..67837aec1dd284ff93bb3eab406d60fa490e64f5 100644 (file)
--- a/CryptoPkg/Include/Library/BaseCryptLib.h
+++ b/CryptoPkg/Include/Library/BaseCryptLib.h
@@ -2210,6 +2210,46 @@ X509GetTBSCert (
   OUT UINTN        *TBSCertSize\r
   );\r
 \r
+/**\r
+  Derives a key from a password using a salt and iteration count, based on PKCS#5 v2.0\r
+  password based encryption key derivation function PBKDF2, as specified in RFC 2898.\r
+\r
+  If Password or Salt or OutKey is NULL, then return FALSE.\r
+  If the hash algorithm could not be determined, then return FALSE.\r
+  If this interface is not supported, then return FALSE.\r
+\r
+  @param[in]  PasswordLength  Length of input password in bytes.\r
+  @param[in]  Password        Pointer to the array for the password.\r
+  @param[in]  SaltLength      Size of the Salt in bytes.\r
+  @param[in]  Salt            Pointer to the Salt.\r
+  @param[in]  IterationCount  Number of iterations to perform. Its value should be\r
+                              greater than or equal to 1.\r
+  @param[in]  DigestSize      Size of the message digest to be used (eg. SHA256_DIGEST_SIZE).\r
+                              NOTE: DigestSize will be used to determine the hash algorithm.\r
+                                    Only SHA1_DIGEST_SIZE or SHA256_DIGEST_SIZE is supported.\r
+  @param[in]  KeyLength       Size of the derived key buffer in bytes.\r
+  @param[out] OutKey          Pointer to the output derived key buffer.\r
+\r
+  @retval  TRUE   A key was derived successfully.\r
+  @retval  FALSE  One of the pointers was NULL or one of the sizes was too large.\r
+  @retval  FALSE  The hash algorithm could not be determined from the digest size.\r
+  @retval  FALSE  The key derivation operation failed.\r
+  @retval  FALSE  This interface is not supported.\r
+\r
+**/\r
+BOOLEAN\r
+EFIAPI\r
+Pkcs5HashPassword (\r
+  IN  UINTN        PasswordLength,\r
+  IN  CONST CHAR8  *Password,\r
+  IN  UINTN        SaltLength,\r
+  IN  CONST UINT8  *Salt,\r
+  IN  UINTN        IterationCount,\r
+  IN  UINTN        DigestSize,\r
+  IN  UINTN        KeyLength,\r
+  OUT UINT8        *OutKey\r
+  );\r
+\r
 /**\r
   Get the signer's certificates from PKCS#7 signed data as described in "PKCS #7:\r
   Cryptographic Message Syntax Standard". The input signed data could be wrapped\r