<?xmlversion='1.0' encoding='utf-8'?>version="1.0" encoding="UTF-8"?> <!DOCTYPE rfc [ <!ENTITY nbsp " "> <!ENTITY zwsp "​"> <!ENTITY nbhy "‑"> <!ENTITY wj "⁠"> ]><?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?> <?rfc toc="yes"?> <!-- generate a table of contents --> <?rfc tocdepth="4"?> <!-- the number of levels of subsections in ToC. default: 3 --> <?rfc symrefs="yes"?> <!-- use symbolic references tags, i.e, [RFC2119] instead of [1] --> <?rfc sortrefs="yes" ?> <!-- sort the reference entries alphabetically --> <?rfc compact="no" ?> <!-- do start each main section on a new page --><rfc xmlns:xi="http://www.w3.org/2001/XInclude" submissionType="independent" category="info" docName="draft-pkcs5-gost-09" number="9337" ipr="trust200902" tocInclude="true" tocDepth="4" symRefs="true" sortRefs="true" updates="" obsoletes="" xml:lang="en" version="3"> <!-- xml2rfc v2v3 conversion 3.12.10 --> <front> <title abbrev="GOSTPassword-basedPassword-Based Keys"> GeneratingPassword-basedPassword-Based Keys Using the GOST Algorithms </title> <seriesInfoname="Internet-Draft" value="draft-pkcs5-gost-09"/>name="RFC" value="9337"/> <authorfullname="Karelina Ekaterina" initials="E.K."fullname="Ekaterina Karelina" initials="E." role="editor" surname="Karelina"> <organization>InfoTeCS</organization> <address> <postal> <street>2B stroenie 1, ul.Otradnaya </street>Otradnaya</street> <city>Moscow</city> <code>127273</code> <country>Russian Federation</country> </postal><phone>+7 (495) 737-61-92</phone><email>Ekaterina.Karelina@infotecs.ru</email> </address> </author> <dateyear="2022"/> <!--если не указываем число и месяц, они подставляются автоматически--> <area>General</area> <!--как в rfc7748--> <workgroup>Network Working Group</workgroup> <keyword/>year="2022" month="December"/> <keyword>password-based cryptography, derived key, GOST algorithms, pkcs5, gost</keyword> <abstract> <t> This document specifies how to usethe"PKCS #5: Password-Based Cryptography Specificationversion 2.1 (PKCS #5) defined in RFC8018Version 2.1" (RFC 8018) to generate a symmetric key from a password in conjunction with the Russian national standard GOST algorithms. </t> <t> PKCS #5 applies apseudorandom function (aPseudorandom Function (PRF) -- a cryptographic hash, cipher, orHMAC)Hash-Based Message Authentication Code (HMAC) -- to the input password along with a salt value and repeats the process many times to produce a derived key. </t> <t> This specificationishas been developed outside theIETF and is publishedIETF. The purpose of publication being to facilitate interoperable implementations that wish to support the GOST algorithms. This document does not imply IETF endorsement of the cryptographic algorithms usedin this document.here. </t> </abstract> </front> <middle> <section anchor="Introduction"> <name>Introduction</name> <t> This document provides a specification of usage of GOST R 34.12-2015 encryption algorithms and the GOST R 34.11-2012 hashing functions with PKCS #5. The methods described in this document are designed to generate key information using the user's password and to protect information using the generated keys. </t> </section> <section> <name>Conventions Used in This Document</name> <t> The key words"MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY","<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>", "<bcp14>MAY</bcp14>", and"OPTIONAL""<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as described inBCP 14BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they appear in all capitals, as shown here. </t> </section> <section anchor="Definition"> <name>Basic Terms and Definitions</name> <t> Throughout this document, the following notation is used: </t> <table align="center"> <name>Terms and Definitions</name> <thead> <tr> <th>Notation</th> <th>Definition</th> </tr> </thead> <tbody> <tr> <td align="left">P</td> <td align="left">a password encoded as a Unicode UTF-8 string</td> </tr> <tr> <td align="left">S</td> <td align="left">a random initializing value</td> </tr> <tr> <td align="left">c</td> <td align="left">a number of iterations of algorithm, a positive integer</td> </tr> <tr> <td align="left">dkLen</td> <td align="left">a length in octets of derived key, a positive integer</td> </tr> <tr> <td align="left">DK</td> <td align="left">a derived key of length dkLen</td> </tr> <tr> <tdalign="left">B_n</td>align="left">B<sub>n</sub></td> <td align="left"> a set of all octet strings of length n, n >= 0; if n = 0, then the setB_nB<sub>n</sub> consists of an empty string of length 0</td> </tr> <tr> <td align="left">A||C</td> <td align="left">a concatenation of two octet strings A, C, i.e., a vector fromB_(|A|+|C|),B<sub>|A|+|C|</sub>, where the left subvector fromB_(|A|)B<sub>|A|</sub> is equal to the vector A and the right subvector fromB_(|C|)B<sub>|C|</sub> is equal to the vector C: A =(a_(n_1),...,a_1)(a<sub>n<sub>1</sub></sub>,...,a<sub>1</sub>) inB_(n_1)B<sub>n<sub>1</sub></sub> and C =(c_(n_2),..., c_1)(c<sub>n<sub>2</sub></sub>,..., c<sub>1</sub>) inB_(n_2),B<sub>n<sub>2</sub></sub>, res =(a_(n_1),...,a_1,c_(n_2),..., c_1)(a<sub>n<sub>1</sub></sub>,...,a<sub>1</sub>,c<sub>n<sub>2</sub></sub>,..., c<sub>1</sub>) inB_(n_1 + n_2);</td>B<sub>n<sub>1</sub>+n<sub>2</sub></sub>)</td> </tr> <tr> <td align="left">\xor</td> <td align="left">a bit-wise exclusive-or of two octet strings of the same length</td> </tr> <tr> <tdalign="left">MSB^n_r: B_nalign="left">MSB<sup>n</sup><sub>r</sub>: B<sub>n</sub> ->B_r</td>B<sub>r</sub></td> <td align="left">a truncating of an octet string to size r by removing the least significant n-r octets:MSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1) =(a_n,...,a_(n-r+1));MSB<sup>n</sup><sub>r</sub>(a<sub>n</sub>,...,a<sub>n-r+1</sub>,a<sub>n-r</sub>,...,a<sub>1</sub>) =(a<sub>n</sub>,...,a<sub>n-r+1</sub>) </td> </tr> <tr> <tdalign="left">LSB^n_r: B_nalign="left">LSB<sup>n</sup><sub>r</sub>: B<sub>n</sub> ->B_r</td>B<sub>r</sub></td> <td align="left">a truncating ofaan octet string to size r by removing the most significant n-r octets:LSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1) =(a_r,...,a_1)LSB<sup>n</sup><sub>r</sub>(a<sub>n</sub>,...,a<sub>n-r+1</sub>,a<sub>n-r</sub>,...,a<sub>1</sub>) =(a<sub>r</sub>,...,a<sub>1</sub>) </td> </tr> <tr> <td align="left">Int(i)</td> <td align="left">a four-octet encoding of the integer i =<2^32: (i_1, i_2, i_3, i_4)2<sup>32</sup>: (i<sub>1</sub>, i<sub>2</sub>, i<sub>3</sub>, i<sub>4</sub>) inB_4,B<sub>4</sub>, i =i_1i<sub>1</sub> +2^82<sup>8</sup> *i_2i<sub>2</sub> +2^162<sup>16</sup> *i_3i<sub>3</sub> +2^242<sup>24</sup> *i_4</td>i<sub>4</sub></td> </tr> <tr> <td align="left">b[i, j]</td> <td align="left">a substring extractionoperator:operator, extracts octets i through j, 0 =< i =<j.</td>j</td> </tr> <tr> <td align="left">CEIL(x)</td> <td align="left">the smallest integer greaterthan,than or equalto,to x</td> </tr> </tbody> </table> <t> This document uses the following abbreviations and symbols:</t> <table align="center"> <name>Abbreviations and Symbols</name> <thead> <tr><th align="left"/> <th align="left"/><th>Abbreviations and Symbols</th> <th>Definition</th> </tr> </thead> <tbody> <tr> <td align="left">HMAC_GOSTR3411</td> <tdalign="left">Hashed-basedalign="left">Hashed-Based Message Authentication Code. A function for calculating amessage authentication code,Message Authentication Code (MAC) based on the GOST R 34.11-2012 hash function(<xref(see <xref target="RFC6986"/>) with 512-bit output in accordance with <xref target="RFC2104"/>.</td> </tr> </tbody> </table> </section> <section anchor="Algorithm"> <name>AlgorithmForfor Generating a KeyFromfrom a Password</name> <t> The DKkeyis calculated by means of a key derivation functionPBKDF2(P,PBKDF2 (P, S, c, dkLen) (see <xreftarget="RFC8018"/>, section 5.2target="RFC8018" sectionFormat="comma" section="5.2"/>) using the HMAC_GOSTR3411 function as thePRF pseudo-random function:PRF: </t><ul empty="true" spacing="normal"> <li>DK<t indent="6"> DK =PBKDF2(P,S,c,dkLen).</li> </ul>PBKDF2 (P, S, c, dkLen). </t> <t> The PBKDF2 function is defined as the following algorithm: </t> <ol spacing="normal" type="1"><li> If dkLen >(2^32(2<sup>32</sup> - 1) * 64, output "derived key too long" and stop. </li> <li> Calculate n =CEIL(dkLenCEIL (dkLen / 64). </li> <li> <t> Calculate a set of values for each i from 1 to n: </t> <ul empty="true" spacing="normal"><li>U_1(i)<li>U<sub>1</sub>(i) = HMAC_GOSTR3411 (P, S || INT(i))</li> <li>U_2(i)(i)),</li> <li>U<sub>2</sub>(i) = HMAC_GOSTR3411 (P,U_1(i))</li>U<sub>1</sub>(i)),</li> <li>...</li><li>U_c(i)<li>U<sub>c</sub>(i) = HMAC_GOSTR3411 (P,U_{c-1}(i))</li>U<sub>c-1</sub>(i)),</li> <li>T(i) =U_1(i)U<sub>1</sub>(i) \xorU_2(i)U<sub>2</sub>(i) \xor ... \xorU_c(i)</li>U<sub>c</sub>(i).</li> </ul> </li> <li> <t> Concatenate the octet strings T(i) and extract the first dkLen octets to produce a derived key DK: </t> <ulempty="true"spacing="normal"> <li>DK =MSB^{nMSB<sup>n *64}_dkLen(T(1)||T(2)||...||T(n))</li>64</sup><sub>dkLen</sub>(T(1)||T(2)||...||T(n))</li> </ul> </li> </ol> </section> <section anchor="Encryption"> <name>Data Encryption</name> <section anchor="GOST-34.12-2015"> <name>GOST R 34.12-2015 Data Encryption</name> <t>Data encryption using the DKkeyis carried out in accordance with the PBES2 scheme (see <xreftarget="RFC8018"/>, section 6.2)target="RFC8018" sectionFormat="comma" section="6.2"/>) using GOST R 34.12-2015 in CTR_ACPKM mode (see <xref target="RFC8645"/>).</t> <section anchor="Enc_GOST-34.12-2015"> <name>Encryption</name> <t> The encryption process for PBES2 consists of the following steps: </t> <ol spacing="normal" type="1"><li>Select the random value S of a length from 8 to 32 octets.</li> <li>Select the iteration count c depending on the conditions of use (see <xref target="GostPkcs5"/>). The minimum allowable value for the parameter is 1000.</li> <li>Set the value dkLen = 32.</li> <li> <t>Apply the key derivation function to the password P, the random valueSS, and the iteration count c to produce a derived key DK of length dkLen octets in accordance with the algorithm from <xref target="Algorithm"/>. Generate the sequence T(1) and truncate it to 32 octets,i.e., </t>i.e.,</t> <ulempty="true" spacing="normal">empty="true"> <li>DK =PBKDF2(P,S,c,32)PBKDF2 (P, S, c, 32) =MSB^64_32(T(1)).</li> </ul> </li>MSB<sup>64</sup><sub>32</sub>(T(1)).</li></ul></li> <li> <t>Generate the random value ukm of size n, where n takes a value of 12 or 16octets,octets depending on the selected encryption algorithm: </t> <ulempty="true"spacing="normal"> <li>GOST R 34.12-2015 "Kuznyechik" n = 16 (see <xref target="RFC7801"/>)</li> <li>GOST R 34.12-2015 "Magma" n = 12 (see <xref target="RFC8891"/>)</li> </ul> </li> <li>Set the value S' =ukm[1..n-8]</li>ukm[1..n-8].</li> <li>For the id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm algorithms (see <xreftarget="ParamGost3412-2015"/>)target="ParamGost3412-2015"/>), encrypt the message M with the GOST R 34.12-2015 algorithm with the derived key DK and the random value S' to produce a ciphertext C.</li> <li> <t>For the id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see <xreftarget="ParamGost3412-2015"/>)target="ParamGost3412-2015"/>), encrypt the message M with the GOST R 34.12-2015 algorithm with the derived key DK and the ukm in accordance with the following steps: </t> <ulempty="true"spacing="normal"> <li><t>- Generate<t>Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm (see <xref target="RFC7836"/>): </t><ul empty="true" spacing="normal"> <li>encryption<t indent="3">encryption keyK(1)</li> <li>MACK(1)</t> <t indent="3">MAC keyK(2).</li> </ul>K(2)</t> <t> Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take thefolowingfollowing values: </t><ul empty="true" spacing="normal"> <li>K_in<t indent="3">K<sub>in</sub> =DK</li> <li>labelDK</t> <t indent="3">label = "kdf tree" (8octets)</li> <li>seed = ukm[n-7..n]</li> <li>Roctets)</t> <t indent="3">seed = ukm[n-7..n]</t> <t indent="3">R =1</li> </ul>1</t> <t> The input string label above is encoded using ASCII((see <xreftarget="RFC0020"/> ).target="RFC0020"/>). </t> </li><li> - Compute<li>Compute the MAC for the message M using the K(2) key in accordance with the GOST R 34.12-2015 algorithm. Append the computed MAC value to the message M: M||MAC.</li><li> - Encrypt<li>Encrypt the resulting octet string with MAC with the GOST R 34.12-2015 algorithm with the derived key K(1) and the random value S' to produce a ciphertext C.</li> </ul> </li> <li>Serialize the parameters S, c, and ukm as algorithm parameters in accordance with <xref target="PBES2"/>.</li> </ol> </section> <section anchor="Dec_GOST-34.12-2015"> <name>Decryption</name> <t> The decryption process for PBES2 consists of the following steps: </t> <ol spacing="normal" type="1"><li>Set the value dkLen = 32.</li> <li>Apply the key derivation function PBKDF2 to the password P, the random valueSS, and the iteration count c to produce a derived key DK of length dkLen octets in accordance with the algorithm from <xref target="Algorithm"/>. Generate the sequence T(1) and truncate it to 32 octets, i.e., DK =PBKFD2(P,S,c,32)PBKFD2 (P, S, c, 32) =MSB^64_32(T(1)).</li>MSB<sup>64</sup><sub>32</sub>(T(1)).</li> <li>Set the value S' = ukm[1..n-8], where n is the size of ukm in octets.</li> <li>For the id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm algorithms (see <xreftarget="ParamGost3412-2015"/>)target="ParamGost3412-2015"/>), decrypt the ciphertext C with the GOST R 34.12-2015 algorithm with the derived key DK and the random value S' to produce the message M.</li> <li> <t>For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see <xreftarget="ParamGost3412-2015"/>)target="ParamGost3412-2015"/>), decrypt the ciphertext C with the GOST R 34.12-2015 algorithm with the derived key DK and the ukm in accordance with the following steps: </t> <ulempty="true"spacing="normal"> <li><t>- Generate<t>Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm: </t><ul empty="true" spacing="normal"> <li>encryption<t indent="3">encryption keyK(1)</li> <li>MACK(1)</t> <t indent="3">MAC keyK(2).</li> </ul>K(2)</t> <t> Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take thefolowingfollowing values: </t><ul empty="true" spacing="normal"> <li>K_in<t indent="3">K<sub>in</sub> =DK</li> <li>labelDK</t> <t indent="3">label = "kdf tree" (8octets)</li> <li>seed = ukm[n-7..n]</li> <li>Roctets)</t> <t indent="3">seed = ukm[n-7..n]</t> <t indent="3">R =1</li> </ul>1</t> <t> The input string label above is encoded using ASCII((see <xreftarget="RFC0020"/> ).target="RFC0020"/>). </t> </li><li> - Decrypt<li>Decrypt the ciphertext C with the GOST R 34.12-2015 algorithm with the derived key K(1) and the random value S' to produce the plaintext. The last k octets of the text are themessage authentication code MAC',MAC, where k depends on the selected encryption algorithm.</li><li> - Compute<li>Compute the MAC for the text[1..m - k] using the K(2) key in accordance with GOST R 34.12-2015 algorithm, where m is the size of text.</li><li> - Compare<li>Compare theoriginal message authentication codecomputing MAC and the receivingmessage authentication code MAC'.MAC. If the sizes or values do not match, the message is distorted.</li> </ul> </li> </ol> </section> </section> </section> <section anchor="Integrity"> <name>Message Authentication</name><t>PBMAC1<t>The PBMAC1 scheme is used for message authentication (see <xreftarget="RFC8018"/>, section 7.1).target="RFC8018" sectionFormat="comma" section="7.1"/>). This schemebasesis based on the HMAC_GOSTR3411 function.</t> <section anchor="MAC_generation"> <name>MAC Generation</name> <t>The MAC generation operation for PBMAC1 consists of the following steps: </t> <ol spacing="normal" type="1"><li>Select the random value S of a length from 8 to 32 octets.</li> <li>Select the iteration count c depending on the conditions of use (see <xref target="GostPkcs5"/>). The minimum allowable value for the parameter is 1000.</li> <li>Set the dkLen to at least 32 octets.ItThe number of octets depends on previous parameter values.</li> <li>Apply the key derivation function to the password P, the random valueSS, and the iteration count c to generate a sequence K of length dkLen octets in accordance with the algorithm from <xref target="Algorithm"/>. </li> <li>Truncate the sequence K to 32 octets to get the derived key DK, i.e., DK =LSB^dkLen_32(K).</li>LSB<sup>dkLen</sup><sub>32</sub>(K).</li> <li>Process the message M with the underlying message authentication scheme with the derived key DK to generate a message authentication code T.</li> <li>Save the parametersS,S and c as algorithm parameters in accordance with <xref target="PBMAC1"/>.</li> </ol> </section> <section anchor="MAC_verification"> <name>MAC Verification</name> <t>The MAC verification operation for PBMAC1 consists of the following steps: </t> <ol spacing="normal" type="1"><li>Set the dkLen to at least 32 octets.ItThe number of octets depends on previous parameter values.</li> <li>Apply the key derivation function to the password P, the random valueSS, and the iteration count c to generate a sequence K of length dkLen octets in accordance with the algorithm from <xref target="Algorithm"/>. </li> <li>Truncate the sequence K to 32 octets to get the derived key DK, i.e., DK =LSB^dkLen_32(K).</li>LSB<sup>dkLen</sup><sub>32</sub>(K).</li> <li>Process the message M with the underlying message authentication scheme with the derived key DK to generate amessage authentication code MAC'.</li>MAC.</li> <li>Compare theoriginal message authentication codecomputing MAC and the receivingmessage authentication code MAC'.MAC. If the sizes or values do not match, the message is distorted. </li> </ol> </section> </section> <section anchor="Ident_Params"> <name>Identifiers and Parameters</name> <t>This section defines the ASN.1 syntax for the key derivation functions, the encryption schemes, the message authentication scheme, and supporting techniques(<xref(see <xref target="RFC8018"/>).</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ rsadsi OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) 113549 } pkcs OBJECT IDENTIFIER ::= { rsadsi 1 } pkcs-5 OBJECT IDENTIFIER ::= { pkcs 5} ]]></artwork>}]]></sourcecode> <section anchor="PBKDF2"> <name>PBKDF2</name> <t>Theobject identifierObject Identifier (OID) id-PBKDF2 identifies the PBKDF2 key derivation function:</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ id-PBKDF2 OBJECT IDENTIFIER ::= { pkcs-5 12} ]]></artwork>}]]></sourcecode> <t>The parameters field associated with this OID in an AlgorithmIdentifierSHALL<bcp14>SHALL</bcp14> have type PBKDF2-params:</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ PBKDF2-params ::= SEQUENCE { salt CHOICE { specified OCTET STRING, otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}} }, iterationCount INTEGER (1000..MAX), keyLength INTEGER (32..MAX) OPTIONAL, prf AlgorithmIdentifier {{PBKDF2-PRFs}}} ]]></artwork>}]]></sourcecode> <t>The fields of type PBKDF2-params have the following meanings: </t> <ulempty="true"spacing="normal"><li>- salt<li>salt contains the random value S in OCTET STRING.</li><li>- iterationCount<li>iterationCount specifies the iteration count c.</li><li>- keyLength<li>keyLength is the length of the derived key in octets. It is an optional field for the PBES2shemescheme since it is always 32 octets. ItMUST<bcp14>MUST</bcp14> be present for the PBMAC1shemescheme andMUST<bcp14>MUST</bcp14> be at least 32 octets since the HMAC_GOSTR3411 function has a variable key size.</li><li>- prf<li>prf identifies the pseudorandom function. The identifier valueMUST<bcp14>MUST</bcp14> beid-tc26-hmac-gost-3411-12-512,id-tc26-hmac-gost-3411-12-512 and the parameters value must be NULL:</li> </ul><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ id-tc26-hmac-gost-3411-12-512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) reg7(7) tk26(1) algorithms(1) hmac(4) 512(2)} ]]></artwork>}]]></sourcecode> </section> <section anchor="PBES2"> <name>PBES2</name> <t>Theobject identifierOID id-PBES2 identifies the PBES2 encryption scheme:</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ id-PBES2 OBJECT IDENTIFIER ::= { pkcs-5 13} ]]></artwork>}]]></sourcecode> <t>The parameters field associated with this OID in an AlgorithmIdentifierSHALL<bcp14>SHALL</bcp14> have type PBES2-params:</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ PBES2-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier { { PBES2-KDFs } }, encryptionScheme AlgorithmIdentifier { { PBES2-Encs } }} ]]></artwork>}]]></sourcecode> <t>The fields of type PBES2-params have the following meanings: </t> <ulempty="true"spacing="normal"><li>- keyDerivationFunc<li>keyDerivationFunc identifies the key derivation function in accordance with <xref target="PBKDF2"/>.</li><li>- encryptionScheme<li>encryptionScheme identifies the encryption scheme in accordance with <xref target="ParamGost3412-2015"/>.</li> </ul> </section> <section anchor="ParamGost3412-2015"> <name>Identifier and Parameters of Gost34.12-2015 Encryption Scheme</name> <t>The Gost34.12-2015 encryption algorithm identifierSHALL<bcp14>SHALL</bcp14> take one of the following values:</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ id-gostr3412-2015-magma-ctracpkm OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-magma(1) mode-ctracpkm(1)} ]]></artwork> <t>In case of use}]]></sourcecode> <t>When the id-gostr3412-2015-magma-ctracpkm identifier is used, the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with <xref target="RFC8645"/>. The block size is 64bits,bits and the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ id-gostr3412-2015-magma-ctracpkm-omac OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-magma(1) mode-ctracpkm-omac(2)} ]]></artwork> <t>In case of use}]]></sourcecode> <t>When the id-gostr3412-2015-magma-ctracpkm-omac identifier is used, the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with <xreftarget="RFC8645"/>,target="RFC8645"/> and the MAC is computed by the GOST R 34.12-2015 Magma cipher in MAC mode (MAC size is 64 bits). The block size is 64bits,bits and the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.</t><artwork><![CDATA[<sourcecode type="asm.1"><![CDATA[ id-gostr3412-2015-kuznyechik-ctracpkm OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-kuznyechik(2) mode-ctracpkm(1)} ]]></artwork> <t>In case of use}]]></sourcecode> <t>When the id-gostr3412-2015-kuznyechik-ctracpkm identifier is used, the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with <xref target="RFC8645"/>. The block size is 128bits,bits and the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.</t><artwork><![CDATA[<sourcecode type="asm.1"><![CDATA[ id-gostr3412-2015-kuznyechik-ctracpkm-omac OBJECT IDENTIFIER ::= { iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) algorithms(1) cipher(5) gostr3412-2015-kuznyechik(2) mode-ctracpkm-omac(2)} ]]></artwork> <t>In case of use}]]></sourcecode> <t>When the id-gostr3412-2015-kuznyechik-ctracpkm-omac identifier is used, the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with <xreftarget="RFC8645"/>,target="RFC8645"/> and MAC is computed by the GOST R 34.12-2015 Kuznyechik cipher in MAC mode (MAC size is 128 bits). The block size is 128bits,bits and the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime.</t> <t>The parameters field in an AlgorithmIdentifierSHALL<bcp14>SHALL</bcp14> have type Gost3412-15-Encryption-Parameters:</t><artwork><![CDATA[<sourcecode type="asm.1"><![CDATA[ Gost3412-15-Encryption-Parameters ::= SEQUENCE { ukm OCTET STRING} ]]></artwork>}]]></sourcecode> <t>The field of type Gost3412-15-Encryption-Parameters have the following meanings: </t> <ulempty="true"spacing="normal"> <li><t>- ukm MUST<t>ukm <bcp14>MUST</bcp14> be present andMUST<bcp14>MUST</bcp14> contain n octets. Its value depends on the selected encryption algorithm: </t> <ulempty="true"spacing="normal"> <li>GOST R 34.12-2015 "Kuznyechik" n = 16 (see <xref target="RFC7801"/>)</li> <li>GOST R 34.12-2015 "Magma" n = 12 (see <xref target="RFC8891"/>)</li> </ul> </li> </ul> </section> <section anchor="PBMAC1"> <name>PBMAC1</name> <t>Theobject identifierOID id-PBMAC1 identifies the PBMAC1 message authentication scheme:</t><artwork><![CDATA[<sourcecode type="asm.1"><![CDATA[ id-PBMAC1 OBJECT IDENTIFIER ::= { pkcs-5 14} ]]></artwork>}]]></sourcecode> <t>The parameters field associated with this OID in an AlgorithmIdentifierSHALL<bcp14>SHALL</bcp14> have type PBMAC1-params:</t><artwork><![CDATA[<sourcecode type="asm.1"><![CDATA[ PBMAC1-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier { { PBMAC1-KDFs } }, messageAuthScheme AlgorithmIdentifier { { PBMAC1-MACs } }} ]]></artwork>}]]></sourcecode> <t>The fields of type PBMAC1-params have the following meanings: </t> <ulempty="true"spacing="normal"><li>- keyDerivationFunc<li>keyDerivationFunc is the identifier and parameters of key derivation function in accordance with <xreftarget="PBKDF2"/>target="PBKDF2"/>. </li><li>- messageAuthScheme<li>messageAuthScheme is the identifier and parameters of the HMAC_GOSTR3411 algorithm.</li> </ul> </section> </section> <section anchor="Security"> <name>Security Considerations</name> <t>For information on security considerations for password-basedcryptographycryptography, see <xref target="RFC8018"/>.</t> <t>Conforming applicationsMUST<bcp14>MUST</bcp14> use unique values for ukm and S in order to avoid the encryption of different data on the same keys with the same initialization vector.</t> <t>It isRECOMMENDED<bcp14>RECOMMENDED</bcp14> that parameter S consist of at least 32 octets ofpseudo-randompseudorandom data in order to reduce the probability of collisions of keys generated from the same password.</t> </section> <section anchor="IANA_Considerations"> <name>IANA Considerations</name> <t>This documentmakeshas norequests forIANAaction.</t>actions.</t> </section> </middle> <back> <references> <name>References</name> <references> <name>Normative References</name> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.0020.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8018.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2104.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8645.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7801.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8891.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7836.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6986.xml"/><xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6070.xml"/><reference anchor="GostPkcs5"> <front> <title>Information technology. Cryptographic Data Security. Password-based key security.</title> <author initials="A." surname="Potashnikov" fullname="A. Potashnikov"> <organization/> </author> <author initials="E." surname="Karelina" fullname="E. Karelina"> <organization/> </author> <author initials="S." surname="Pianov" fullname="S. Pianov"> <organization/> </author> <author initials="A."surname="Davletshina"surname="Naumenko" fullname="A.Davletshina">Naumenko"> <organization/> </author> </front> <refcontent>R1323565.1.xxx-2022 (work in progress).1323565.1.040-2022. Federal Agency on Technical Regulating and Metrology (In Russian)</refcontent> </reference> </references> <references> <name>Informative References</name> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6070.xml"/> </references> </references> <section anchor="Example"> <name>PBKDF2 HMAC_GOSTR3411 Test Vectors</name> <t>These test vectors are formed by analogy with test vectors from <xref target="RFC6070"/>. The input strings below are encoded using ASCII((see <xreftarget="RFC0020"/> ).target="RFC0020"/>). The sequence "\0" (without quotation marks) means a literal ASCII NULL value (1 octet). "DK" refers to theDerived Key.</t> <artwork><![CDATA[derived key.</t> <sourcecode type=""><![CDATA[ Input: P = "password" (8 octets) S = "salt" (4 octets) c = 1 dkLen = 64 Output: DK = 64 77 0a f7 f7 48 c3 b1 c9 ac 83 1d bc fd 85 c2 61 11 b3 0a 8a 65 7d dc 30 56 b8 0c a7 3e 04 0d 28 54 fd 36 81 1f 6d 82 5c c4 ab 66 ec 0a 68 a4 90 a9 e5 cf 51 56 b3 a2 b7 ee cd db f9 a1 6b 47 Input: P = "password" (8 octets) S = "salt" (4 octets) c = 2 dkLen = 64 Output: DK = 5a 58 5b af df bb 6e 88 30 d6 d6 8a a3 b4 3a c0 0d 2e 4a eb ce 01 c9 b3 1c 2c ae d5 6f 02 36 d4 d3 4b 2b 8f bd 2c 4e 89 d5 4d 46 f5 0e 47 d4 5b ba c3 01 57 17 43 11 9e 8d 3c 42 ba 66 d3 48 de Input: P = "password" (8 octets) S = "salt" (4 octets) c = 4096 dkLen = 64 Output: DK = e5 2d eb 9a 2d 2a af f4 e2 ac 9d 47 a4 1f 34 c2 03 76 59 1c 67 80 7f 04 77 e3 25 49 dc 34 1b c7 86 7c 09 84 1b 6d 58 e2 9d 03 47 c9 96 30 1d 55 df 0d 34 e4 7c f6 8f 4e 3c 2c da f1 d9 ab 86 c3 Input: P = "password" (8 octets) S = "salt" (4 octets) c = 16777216 dkLen = 64 Output: DK = 49 e4 84 3b ba 76 e3 00 af e2 4c 4d 23 dc 73 92 de f1 2f 2c 0e 24 41 72 36 7c d7 0a 89 82 ac 36 1a db 60 1c 7e 2a 31 4e 8c b7 b1 e9 df 84 0e 36 ab 56 15 be 5d 74 2b 6c f2 03 fb 55 fd c4 80 71 Input: P = "passwordPASSWORDpassword" (24 octets) S = "saltSALTsaltSALTsaltSALTsaltSALTsalt" (36 octets) c = 4096 dkLen = 100 Output: DK = b2 d8 f1 24 5f c4 d2 92 74 80 20 57 e4 b5 4e 0a 07 53 aa 22 fc 53 76 0b 30 1c f0 08 67 9e 58 fe 4b ee 9a dd ca e9 9b a2 b0 b2 0f 43 1a 9c 5e 50 f3 95 c8 93 87 d0 94 5a ed ec a6 eb 40 15 df c2 bd 24 21 ee 9b b7 11 83 ba 88 2c ee bf ef 25 9f 33 f9 e2 7d c6 17 8c b8 9d c3 74 28 cf 9c c5 2a 2b aa 2d 3a Input: P = "pass\0word" (9 octets) S = "sa\0lt" (5 octets) c = 4096 dkLen = 64 Output: DK = 50 df 06 28 85 b6 98 01 a3 c1 02 48 eb 0a 27 ab 6e 52 2f fe b2 0c 99 1c 66 0f 00 14 75 d7 3a 4e 16 7f 78 2c 18 e9 7e 92 97 6d 9c 1d 97 08 31 ea 78 cc b8 79 f6 70 68 cd ac 19 10 74 08 44 e830 ]]></artwork>30]]></sourcecode> </section> <section anchor="Acknowledgments" numbered="false"> <name>Acknowledgments</name> <t>The author thanks <contact fullname="Potashnikov Alexander"/>, <contact fullname="Pianov Semen"/>, <contact fullname="Davletshina Alexandra"/>, <contact fullname="Belyavsky Dmitry"/>, and <contact fullname="Smyslov Valery"/> for their careful readings and useful comments.</t> </section> </back> </rfc>