PasswordHash.c

Go to the documentation of this file.

 
#include "CryptoInternal.h"
 
VOID
OcHashPasswordSha512 (
  IN  CONST UINT8  *Password,
  IN  UINT32       PasswordSize,
  IN  CONST UINT8  *Salt,
  IN  UINT32       SaltSize,
  OUT UINT8        *Hash
  )
{
  UINT32          Index;
  SHA512_CONTEXT  ShaContext;
 
  ASSERT (Password != NULL);
  ASSERT (Hash != NULL);
 
  Sha512Init (&ShaContext);
  Sha512Update (&ShaContext, Password, PasswordSize);
  Sha512Update (&ShaContext, Salt, SaltSize);
  Sha512Final (&ShaContext, Hash);
  //
  // The hash function is applied iteratively to slow down bruteforce attacks.
  // The iteration count has been chosen to take roughly three seconds on
  // modern hardware.
  //
  for (Index = 0; Index < 5000000; ++Index) {
    Sha512Init (&ShaContext);
    Sha512Update (&ShaContext, Hash, SHA512_DIGEST_SIZE);
    //
    // Password and Salt are re-added into hashing to, in case of a hash
    // collision, again yield a unique hash in the subsequent iteration.
    //
    Sha512Update (&ShaContext, Password, PasswordSize);
    Sha512Update (&ShaContext, Salt, SaltSize);
    Sha512Final (&ShaContext, Hash);
  }
 
  SecureZeroMem (&ShaContext, sizeof (ShaContext));
}
 
BOOLEAN
OcVerifyPasswordSha512 (
  IN CONST UINT8  *Password,
  IN UINT32       PasswordSize,
  IN CONST UINT8  *Salt,
  IN UINT32       SaltSize,
  IN CONST UINT8  *RefHash
  )
{
  BOOLEAN  Result;
  UINT8    VerifyHash[SHA512_DIGEST_SIZE];
 
  ASSERT (Password != NULL);
  ASSERT (RefHash != NULL);
 
  OcHashPasswordSha512 (Password, PasswordSize, Salt, SaltSize, VerifyHash);
  Result = SecureCompareMem (RefHash, VerifyHash, SHA512_DIGEST_SIZE) == 0;
  SecureZeroMem (VerifyHash, SHA512_DIGEST_SIZE);
 
  return Result;
}