Add PBKDF2-HMAC-SHA256

sha256.lua

@@ -10,6 +10,7 @@ local shr = bit32.rshift
 local bxor = bit32.bxor
 local bnot = bit32.bnot
 local band = bit32.band
+local unpack = unpack or table.unpack
 
 local K = {
     0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
@@ -25,26 +26,14 @@ local K = {
     0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
 }
 
---- Hashes data using SHA256.
+local h0 = {
---
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
--- @tparam string data Input bytes.
+    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
--- @treturn string The 32-byte hash value.
+}
---
-local function digest(data)
-    expect(1, data, "string")
 
-    -- Pad input.
+local function compress(h, w)
-    local bitlen = #data * 8
+    local h0, h1, h2, h3, h4, h5, h6, h7 = unpack(h)
-    local padlen = -(#data + 9) % 64
+    local K = K
-    data = data .. "\x80" .. ("\0"):rep(padlen) .. (">I8"):pack(bitlen)
-
-    -- Initialize state.
-    local h0, h1, h2, h3 = 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a
-    local h4, h5, h6, h7 = 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
-
-    -- Digest.
-    for i = 1, #data, 64 do
-        local w = {(">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):unpack(data, i)}
 
     -- Message schedule.
     for j = 17, 64 do
@@ -55,7 +44,7 @@ local function digest(data)
         w[j] = w[j - 16] + s0 + w[j - 7] + s1
     end
 
-        -- Block function.
+    -- Block.
     local a, b, c, d, e, f, g, h = h0, h1, h2, h3, h4, h5, h6, h7
     for j = 1, 64 do
         local s1 = bxor(rol(e, 26), rol(e, 21), rol(e, 7))
@@ -75,19 +64,93 @@ local function digest(data)
         a = temp1 + temp2
     end
 
-        h0 = (h0 + a) % 2 ^ 32
+    return {
-        h1 = (h1 + b) % 2 ^ 32
+        (h0 + a) % 2 ^ 32,
-        h2 = (h2 + c) % 2 ^ 32
+        (h1 + b) % 2 ^ 32,
-        h3 = (h3 + d) % 2 ^ 32
+        (h2 + c) % 2 ^ 32,
-        h4 = (h4 + e) % 2 ^ 32
+        (h3 + d) % 2 ^ 32,
-        h5 = (h5 + f) % 2 ^ 32
+        (h4 + e) % 2 ^ 32,
-        h6 = (h6 + g) % 2 ^ 32
+        (h5 + f) % 2 ^ 32,
-        h7 = (h7 + h) % 2 ^ 32
+        (h6 + g) % 2 ^ 32,
+        (h7 + h) % 2 ^ 32,
+    }
+end
+
+--- Hashes data using SHA256.
+--
+-- @tparam string data Input bytes.
+-- @treturn string The 32-byte hash value.
+--
+local function digest(data)
+    expect(1, data, "string")
+
+    -- Pad input.
+    local bitlen = #data * 8
+    local padlen = -(#data + 9) % 64
+    data = data .. "\x80" .. ("\0"):rep(padlen) .. (">I8"):pack(bitlen)
+
+    -- Digest.
+    local h = h0
+    for i = 1, #data, 64 do
+        h = compress(h, {(">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):unpack(data, i)})
     end
 
-    return (">I4I4I4I4I4I4I4I4"):pack(h0, h1, h2, h3, h4, h5, h6, h7)
+    return (">I4I4I4I4I4I4I4I4"):pack(unpack(h))
+end
+
+--- Hashes a password using PBKDF2-HMAC-SHA256.
+--
+-- @tparam password string The password to hash.
+-- @tparam salt string The password's salt.
+-- @tparam iter number The number of iterations to perform.
+-- @treturn string The 32-byte derived key.
+--
+local function pbkdf2(password, salt, iter)
+    expect(1, password, "string")
+    expect(2, salt, "string")
+    expect(3, iter, "number")
+    assert(iter % 1 == 0, "iteration number must be an integer")
+    assert(iter > 0, "iteration number must be positive")
+
+    -- Pad password.
+    if #password > 64 then password = digest(password) end
+    password = password .. ("\0"):rep(-#password % 64)
+    password = {(">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):unpack(password)}
+
+    -- Compute password blocks.
+    local ikp = {}
+    local okp = {}
+    for i = 1, 16 do
+        ikp[i] = bxor(password[i], 0x36363636)
+        okp[i] = bxor(password[i], 0x5c5c5c5c)
+    end
+
+    local hikp = compress(h0, ikp)
+    local hokp = compress(h0, okp)
+
+    -- 96-byte padding.
+    local pad96 = {2 ^ 31, 0, 0, 0, 0, 0, 0, 0x300}
+
+    -- First iteration.
+    local pre = (">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):pack(unpack(ikp))
+    local hs = {(">I4I4I4I4I4I4I4I4"):unpack(digest(pre .. salt .. "\0\0\0\1"))}
+    for i = 1, 8 do hs[i + 8] = pad96[i] end
+    hs = compress(hokp, hs)
+
+    -- Second iteration onwards.
+    local out = {unpack(hs)}
+    for _ = 2, iter do
+        for i = 1, 8 do hs[i + 8] = pad96[i] end
+        hs = compress(hikp, hs)
+        for i = 1, 8 do hs[i + 8] = pad96[i] end
+        hs = compress(hokp, hs)
+        for i = 1, 8 do out[i] = bxor(out[i], hs[i]) end
+    end
+
+    return (">I4I4I4I4I4I4I4I4"):pack(unpack(out))
 end
 
 return {
     digest = digest,
+    pbkdf2 = pbkdf2,
 }