Bouncy Castle C＃中的PBKDF2

我正在弄乱C＃Bouncy Castle API以找到如何进行PBKDF2密钥派生。

我现在真的很无能为力。

我尝试通过Pkcs5S2ParametersGenerator.cs和PBKDF2Params.cs文件阅读，但我真的无法弄清楚如何做到这一点。

根据我迄今为止所做的研究，PBKDF2需要一个字符串（或char []），它是密码，盐和迭代计数。

到目前为止，迄今为止最有希望和最明显的是PBKDF2Params和Pkcs5S2ParametersGenerator。

这些似乎都不接受字符串或char []。

有没有人用C＃做过这个或有任何线索？ 或者也许有人用Java实现了BouncyCastle并可以提供帮助？

提前很多:)

更新：我在Bouncy Castle找到了如何做到这一点。 看下面的答案:)

经过几个小时的代码后，我发现最简单的方法是在Pkcs5S2ParametersGenerator.cs中获取代码的一部分并创建我自己的类，当然使用其他BouncyCastle API。 这与Dot Net Compact Framework（Windows Mobile）完美配合。 这相当于Rfc2898DeriveBytes类，它不存在于Dot Net Compact Framework 2.0 / 3.5中。 好吧，也许不是完全等同但是做的工作:)

这是PKCS5 / PKCS＃5

使用的PRF（伪随机函数）将是HMAC-SHA1

首先，第一件事。 从http://www.bouncycastle.org/csharp/下载Bouncy Castle编译程序集，添加BouncyCastle.Crypto.dll作为项目的参考。

之后使用下面的代码创建新的类文件。 

 using System; using Org.BouncyCastle.Crypto; using Org.BouncyCastle.Crypto.Parameters; using Org.BouncyCastle.Crypto.Digests; using Org.BouncyCastle.Crypto.Macs; using Org.BouncyCastle.Math; using Org.BouncyCastle.Security; namespace PBKDF2_PKCS5 { class PBKDF2 { private readonly IMac hMac = new HMac(new Sha1Digest()); private void F( byte[] P, byte[] S, int c, byte[] iBuf, byte[] outBytes, int outOff) { byte[] state = new byte[hMac.GetMacSize()]; ICipherParameters param = new KeyParameter(P); hMac.Init(param); if (S != null) { hMac.BlockUpdate(S, 0, S.Length); } hMac.BlockUpdate(iBuf, 0, iBuf.Length); hMac.DoFinal(state, 0); Array.Copy(state, 0, outBytes, outOff, state.Length); for (int count = 1; count != c; count++) { hMac.Init(param); hMac.BlockUpdate(state, 0, state.Length); hMac.DoFinal(state, 0); for (int j = 0; j != state.Length; j++) { outBytes[outOff + j] ^= state[j]; } } } private void IntToOctet( byte[] Buffer, int i) { Buffer[0] = (byte)((uint)i >> 24); Buffer[1] = (byte)((uint)i >> 16); Buffer[2] = (byte)((uint)i >> 8); Buffer[3] = (byte)i; } // Use this function to retrieve a derived key. // dkLen is in octets, how much bytes you want when the function to return. // mPassword is the password converted to bytes. // mSalt is the salt converted to bytes // mIterationCount is the how much iterations you want to perform. public byte[] GenerateDerivedKey( int dkLen, byte[] mPassword, byte[] mSalt, int mIterationCount ) { int hLen = hMac.GetMacSize(); int l = (dkLen + hLen - 1) / hLen; byte[] iBuf = new byte[4]; byte[] outBytes = new byte[l * hLen]; for (int i = 1; i <= l; i++) { IntToOctet(iBuf, i); F(mPassword, mSalt, mIterationCount, iBuf, outBytes, (i - 1) * hLen); } //By this time outBytes will contain the derived key + more bytes. // According to the PKCS #5 v2.0: Password-Based Cryptography Standard (www.truecrypt.org/docs/pkcs5v2-0.pdf) // we have to "extract the first dkLen octets to produce a derived key". //I am creating a byte array with the size of dkLen and then using //Buffer.BlockCopy to copy ONLY the dkLen amount of bytes to it // And finally returning it :D byte[] output = new byte[dkLen]; Buffer.BlockCopy(outBytes, 0, output, 0, dkLen); return output; } } }

那么如何使用这个function呢？ 简单！ :)这是一个非常简单的示例，其中密码和salt由用户提供。 

 private void cmdDeriveKey_Click(object sender, EventArgs e) { byte[] salt = ASCIIEncoding.UTF8.GetBytes(txtSalt.Text); PBKDF2 passwordDerive = new PBKDF2(); // I want the key to be used for AES-128, thus I want the derived key to be // 128 bits. Thus I will be using 128/8 = 16 for dkLen (Derived Key Length) . //Similarly if you wanted a 256 bit key, dkLen would be 256/8 = 32. byte[] result = passwordDerive.GenerateDerivedKey(16, ASCIIEncoding.UTF8.GetBytes(txtPassword.Text), salt, 1000); //result would now contain the derived key. Use it for whatever cryptographic purpose now :) //The following code is ONLY to show the derived key in a Textbox. string x = ""; for (int i = 0; i < result.Length; i++) { x += result[i].ToString("X"); } txtResult.Text = x; }

如何检查这是否正确？ 有一个PBKDF2的在线JavaScript实现http://anandam.name/pbkdf2/

我得到了一致的结果:)请报告是否有人得到错误的结果:)

希望这有助于某人:)

更新：确认使用此处提供的测试向量

http://tools.ietf.org/html/draft-josefsson-pbkdf2-test-vectors-00

更新：或者，对于盐，我们可以使用RNGCryptoServiceProvider 。 确保引用System.Security.Cryptography命名空间。 

 RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider(); byte[] salt = new byte[16]; rng.GetBytes(salt);

我自己就遇到了这个问题，并找到了一种更直接的方法。 至少从Bouncy Castle 1.7开始，你可以这样做（在VB中使用Org.BouncyCastle.Crypto）： 

 Dim bcKeyDer As New Generators.Pkcs5S2ParametersGenerator() bcKeyDer.Init(password, salt, keyIterations) Dim bcparam As Parameters.KeyParameter = bcKeyDer.GenerateDerivedParameters("aes256", 256) Dim key1() As Byte = bcparam.GetKey()

我已经针对.Net的System.Security.Cryptography进行了测试，它确实有效！

Interesting Posts