密码基础加密规范PKCS #5 v2.1详解

需积分: 10 52 浏览量更新于2024-07-15 收藏 101KB PDF 举报

"PKCS #5 - Password-Based Cryptography Specification Version 2.1" 这篇文档是关于PKCS #5（Public-Key Cryptography Standards）的版本2.1，它提供了密码基础加密的实施建议，涵盖了密钥派生函数、加密方案、消息认证方案以及识别这些技术的ASN.1语法。这个标准由K. Moriarty（EMC）编辑，旨在替代之前的版本2.0（2898），并由B. Kaliski（Verisign）、A. Rusch（RSA）共同参与编写，有效期至2017年3月13日。 PKCS #5的主要目标是为计算机和通信系统中的密码基础加密提供通用的指导。它关注的是利用密码保护敏感信息，如私钥，这在PKCS #8标准中尤为重要。标准设计时考虑了一定的灵活性，以便适应各种应用场景。然而，预计基于这些规范的应用标准和实现配置可能会添加额外的约束条件。该文档不包括基于密码的其他加密技术，如密码实体身份验证和密钥建立协议。对于密码的选择和管理，文档可能没有给出具体的指南，但通常建议使用复杂且难以猜测的密码，并应定期更换以增强安全性。在PKCS #5中，密码派生函数（Key Derivation Function, KDF）用于从用户提供的密码创建加密密钥。这通常涉及一个盐值（salt），它增加了密码的多样性，使得即使相同的密码在不同的系统中也会生成不同的密钥，从而降低彩虹表攻击的风险。加密方案则可能包含对称加密算法，如AES（Advanced Encryption Standard），用于数据的加密和解密。消息认证码（Message Authentication Code, MAC）方案则确保数据的完整性和来源认证，防止数据被篡改。 ASN.1（Abstract Syntax Notation One）是一种标准的数据表示语法，常用于定义和编码复杂的结构化数据，包括在PKCS #5中定义的密码学结构。通过使用ASN.1，不同系统之间可以一致地理解和交换加密信息，增强了互操作性。 PKCS #5是密码学领域的一个重要标准，为基于密码的安全应用提供了标准化的流程和技术，旨在增强数据保护，尤其是在涉及用户密码的场景下。尽管它提供了灵活性，但具体应用时仍需要根据安全需求和环境来调整和强化。

encryption and authentication techniques.

In password-based encryption, the party encrypting a message can gain

assurance that these benefits are realized simply by selecting a

large and sufficiently random salt when deriving an encryption key

from a password. A party generating a message authentication code can

gain such assurance in a similar fashion.

The party decrypting a message or verifying a message authentication

code, however, cannot be sure that a salt supplied by another party

has actually been generated at random. It is possible, for instance,

that the salt may have been copied from another password-based

operation, in an attempt to exploit interactions between multiple

uses of the same key. For instance, suppose two legitimate parties

exchange a encrypted message, where the encryption key is an 80-bit

key derived from a shared password with some salt. An opponent could

take the salt from that encryption and provide it to one of the

parties as though it were for a 40-bit key. If the party reveals the

result of decryption with the 40-bit key, the opponent may be able to

solve for the 40-bit key. In the case that 40-bit key is the first

half of the 80-bit key, the opponent can then readily solve for the

remaining 40 bits of the 80-bit key.

To defend against such attacks, either the interaction between

multiple uses of the same key should be carefully analyzed, or the

salt should contain data that explicitly distinguishes between

different operations. For instance, the salt might have an

additional, non-random octet that specifies whether the derived key

is for encryption, for message authentication, or for some other

operation.

Based on this, the following is recommended for salt selection:

1. If there is no concern about interactions between multiple uses

of the same key (or a prefix of that key) with the password-

based encryption and authentication techniques supported for a

given password, then the salt may be generated at random and

need not be checked for a particular format by the party

receiving the salt. It should be at least eight octets (64

bits) long.

2. Otherwise, the salt should contain data that explicitly

distinguishes between different operations and different key

lengths, in addition to a random part that is at least eight

octets long, and this data should be checked or regenerated by

the party receiving the salt. For instance, the salt could have

an additional non-random octet that specifies the purpose of

the derived key. Alternatively, it could be the encoding of a

structure that specifies detailed information about the derived

key, such as the encryption or authentication technique and a

sequence number among the different keys derived from the

password. The particular format of the additional data is left

to the application.

Note. If a random number generator or pseudorandom generator is not

available, a deterministic alternative for generating the salt (or

the random part of it) is to apply a password-based key derivation

function to the password and the message M to be processed. For

instance, the salt could be computed with a key derivation function

as S = KDF (P, M). This approach is not recommended if the message M

is known to belong to a small message space (e.g., "Yes" or "No"),

however, since then there will only be a small number of possible

salts.

4.2. Iteration Count

An iteration count has traditionally served the purpose of increasing

the cost of producing keys from a password, thereby also increasing

the difficulty of attack. Mathematically, an iteration count of c

will increase the security strength of a password by log2(c)

bits against trial based attacks like brute force or dictionary

attacks.

Choosing a reasonable value for the iteration count depends on

environment and circumstances, and varies from application to

application. This document follows the recommendations made in FIPS

Special Publication 800-132 [

NISTSP132], which says "The iteration

count shall be selected as large as possible, as long as the time

required to generate the key using the entered password is acceptable

for the users. [...] A minimum iteration count of 1,000 is

recommended. For especially critical keys, or for very powerful

systems or systems where user-perceived performance is not critical,

an iteration count of 10,000,000 may be appropriate".

5. Key Derivation Functions

A key derivation function produces a derived key from a base key and

other parameters. In a password-based key derivation function, the

base key is a password and the other parameters are a salt value and

an iteration count, as outlined in

Section 3.

The primary application of the password-based key derivation

functions defined here is in the encryption schemes in

Section 6 and

the message authentication scheme in

Section 7. Other applications

are certainly possible, hence the independent definition of these

functions.

Two functions are specified in this section: PBKDF1 and PBKDF2.

PBKDF2 is recommended for new applications; PBKDF1 is included only

for compatibility with existing applications, and is not recommended

for new applications.

A typical application of the key derivation functions defined here

might include the following steps:

1. Select a salt S and an iteration count c, as outlined in

Section 4.

2. Select a length in octets for the derived key, dkLen.

3. Apply the key derivation function to the password, the salt,

the iteration count and the key length to produce a derived

key.

4. Output the derived key.

Any number of keys may be derived from a password by varying the

salt, as described in

Section 3.

5.1. PBKDF1

PBKDF1 applies a hash function, which shall be MD2 [RFC1319], MD5

剩余30页未读，继续阅读

beebeeyoung

粉丝: 17
资源: 62

密码基础加密规范PKCS #5 v2.1详解

PKCS #5- Password-Based Cryptography Specification Version 2.0.pdf

PKCS_#1_v2.1_RSA_算法标准 英文版

PKCS#11和PKCS#5的区别

pkcs11-helper-1.11-3.el7.x86_64.rpm

openssl 把 pkcs#1 格式的 ec私钥转换为 pkcs#8 格式

PKCS#11/SunPKCS11/IBMEnterpPKCS11

java pkcs#8

pkcs11-tool 命令大全

最新资源

PKCS_#1_v2.1_RSA_算法标准英文版