Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Define CKD_SHA256_KDF transformation #239

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

hug-dev
Copy link
Member

@hug-dev hug-dev commented Dec 22, 2024

Originally done by @freedge at #213

Define CKD_SHA256_KDF transformation to be used with CKM_ECDH1_DERIVE.

Some HSM with FIPS restriction will refuse to derive keys with CKD_NULL. CKD_SHA256_KDF will do fine though.

Unfortunately this is not implemented on softHSM
(softhsm/SoftHSMv2#599) so I provide no test. This was tested fine against Thales DPOD.

Fix #92

Define CKD_SHA256_KDF transformation to be used with CKM_ECDH1_DERIVE.

Some HSM with FIPS restriction will refuse to derive keys with
CKD_NULL. CKD_SHA256_KDF will do fine though.

Unfortunately this is not implemented on softHSM
(softhsm/SoftHSMv2#599)
so I provide no test. This was tested fine against Thales DPOD.

Signed-off-by: François Rigault <[email protected]>
@hug-dev hug-dev marked this pull request as ready for review December 22, 2024 21:49
Copy link
Collaborator

@wiktor-k wiktor-k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks straightforward enough 👌

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add support for SHA-based KDFs for ECDH
3 participants