mbedtls_pkcs5_pbes2_ext() function

PKCS#5 PBES2 function \warning When decrypting: - This function validates the CBC padding and returns #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is invalid. Note that this can help active adversaries attempting to brute-forcing the password. Note also that there is no guarantee that an invalid password will be detected (the chances of a valid padding with a random password are about 1/255).

Syntax

Show:

Summary

Declaration

Definition

from pkcs5.h:125

int mbedtls_pkcs5_pbes2_ext(const mbedtls_asn1_buf *pbe_params, int mode, const unsigned char *pwd, size_t pwdlen, const unsigned char *data, size_t datalen, unsigned char *output, size_t output_size, size_t *output_len);

Implemented in pkcs5.c:129

Arguments

Argument

Declared as

Description

pbe_params

const mbedtls_asn1_buf *

the ASN.1 algorithm parameters

mode

int

either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT

pwd

const unsigned char *

password to use when generating key

pwdlen

size_t

length of password

data

const unsigned char *

data to process

datalen

size_t

length of data

output

unsigned char *

Output buffer. On success, it contains the decrypted data. On failure, the content is indetermidate. For decryption, there must be enough room for \p datalen bytes. For encryption, there must be enough room for \p datalen + 1 bytes, rounded up to the block size of the block cipher identified by \p pbe_params.

output_size

size_t

size of output buffer. This must be big enough to accommodate for output plus padding data.

output_len

size_t *

On success, length of actual data written to the output buffer.