[Feature Request] Support for bcrypt_pbkdf as used by OpenSSH/Signify

[patrickfav]

[Feature Request] Support for bcrypt_pbkdf as used by OpenSSH/Signify

[patrickfav]

Hi Peter,

Just to put it into perspective: BKDF is more like a research project, not a well accept or peer reviewed KDF implementation of bcrypt.

That beeing said: Inever heard of bcrypt_pbkdf but from your references:

• pkcs #5 pbkdf2 implementation using the "bcrypt" hash
• The bcrypt hash function is derived from the bcrypt password hashing
• function with the following modifications:
• 1. The input password and salt are preprocessed with SHA512.
• 2. The output length is expanded to 256 bits.
• 3. Subsequently the magic string to be encrypted is lengthened and modifed
• to "OxychromaticBlowfishSwatDynamite"
• 4. The hash function is defined to perform 64 rounds of initial state
• expansion. (More rounds are performed by iterating the hash.)
• Note that this implementation pulls the SHA512 operations into the caller
• as a performance optimization.
• One modification from official pbkdf2. Instead of outputting key material
• linearly, we mix it. pbkdf2 has a known weakness where if one uses it to
• generate (e.g.) 512 bits of key material for use as two 256 bit keys, an
• attacker can merely run once through the outer loop, but the user
• always runs it twice. Shuffling output bytes requires computing the
• entirety of the key material to assemble any subkey. This is something a
• wise caller could do; we just do it for you.

It seems to use quite different defaults/config from "normal" BCrypt. Quickly reading the description, I don't think they use bcrypt, only the key schedule (Eksblowfish). This KDF seems, like my project, more like a homebrew non-standard KDF - but quite different from my proposed way. Therefore I don't see it as feature for this project (and had bad experiences implementing exotic, non-standard protocols see https://github.com/patrickfav/singlestep-kdf which is defined by NIST).

However, I think it would be possible to do with normal effort, just have a look at https://github.com/patrickfav/bcrypt/blob/master/modules/bcrypt/src/main/java/at/favre/lib/crypto/bcrypt/BCryptOpenBSDProtocol.java which should be the raw key schedule. You might need to change the magic string from here https://github.com/patrickfav/bcrypt/blob/009cbd8e301c02bdcaff5b1aad4eedca8b159de0/modules/bcrypt/src/main/java/at/favre/lib/crypto/bcrypt/BCryptOpenBSDProtocol.java#L311 . Just be aware there are hundred ways to introduce subtle bugs.

[p-]

Hi Patrick

Thanks for your detailed response!
I totally understand your points.

I’ve now found a pbkdf java Implementation:

https://github.com/kruton/jbcrypt/blob/e6f0dced403598b8934e61be4300ae6247f7a7fb/jbcrypt/src/main/java/org/mindrot/jbcrypt/BCrypt.java#L639

(A fork of the ominous jbcrypt, with its special coding style)
I might be using that one for now.

Thanks again for the explanations!

[patrickfav]

There is a lib for everything :) Wish you good luck with your project. Cheers!