]> InfoTeCS

2B stroenie 1, ul. Otradnaya Moscow 127273 Russian Federation +7 (495) 737-61-92 Ekaterina.Karelina@infotecs.ru

General Network Working Group This document specifies how to use the Password-Based Cryptography Specification version 2.1 (PKCS #5) defined in to generate password- based keys in conjunction with the Russian national standard GOST algorithms. PKCS #5 applies a pseudorandom function (a cryptographic hash, cipher, or HMAC) to the input password along with a salt value and repeats the process many times to produce a derived key. This specification is developed outside the IETF and is published to facilitate interoperable implementations that wish to support the GOST algorithms. This document does not imply IETF endorsement of the cryptographic algorithms used in this document.

Introduction This document supplements . It provides a specification of usage of GOST R 34.12-2015 encryption algorithms and the GOST R 34.11-2012 hashing functions in the information systems. The methods described in this document are designed to generate key information using the user's password and protect information using the generated keys.

Conventions Used in This Document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Basic Terms and Definitions Throughout this document, the following notations are used:

P	a password encoded as a Unicode UTF-8 string
S	a random initializing value
c	a number of iterations of algorithm, a positive integer
dkLen	a length in octets of derived key, a positive integer
DK	a derived key of length dkLen
B_n	a set of all octet strings of length n, n >= 0; if n = 0, then the set B_n consists of an empty string of length 0
A||C	a concatenation of two octet strings A, C, i.e., a vector from B_(|A|+|C|), where the left subvector from B_(|A|) is equal to the vector A and the right subvector from B_(|C|) is equal to the vector C: A = (a_(n_1),...,a_1) in B_(n_1) and C = (c_(n_2),..., c_1) in B_(n_2), res = (a_(n_1),...,a_1,c_(n_2),..., c_1) in B_(n_1 + n_2);
\xor	a bit-wise exclusive-or of two octet strings of the same length
MSB^n_r: B_n -> B_r	a truncating of an octet string to size r by removing the least significant n-r octets: MSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1) =(a_n,...,a_(n-r+1));
LSB^n_r: B_n -> B_r	a truncating of a octet string to size r by removing the most significant n-r octets: LSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1) =(a_r,...,a_1)
Int(i)	a four-octet encoding of the integer i =< 2^32: (i_1, i_2, i_3, i_4) in B_4, i = i_1 + 2^8 * i_2 + 2^16 * i_3 + 2^24 * i_4
b[i, j]	a substring extraction operator: extracts octets i through j, 0 =< i =< j.
CEIL(x)	the smallest integer greater than, or equal to, x

This document uses the following abbreviations and symbols:

HMAC_GOSTR3411	Hashed-based Message Authentication Code. A function for calculating a message authentication code, based on the GOST R 34.11-2012 hash function () with 512-bit output in accordance with .

Algorithm For Generating a Key From a Password The DK key is calculated by means of a key derivation function PBKDF2(P, S, c, dkLen) , section 5.2 using the HMAC_GOSTR3411 function as the PRF pseudo-random function:

• DK = PBKDF2(P,S,c,dkLen).

The PBKDF2 function is defined as the following algorithm:

1. If dkLen > (2^32 - 1) * 64, output "derived key too long" and stop.
2. Calculate n = CEIL(dkLen / 64).
3. Calculate a set of values for each i from 1 to n:
   • U_1(i) = HMAC_GOSTR3411 (P, S || INT (i))
   • U_2(i) = HMAC_GOSTR3411 (P, U_1(i))
   • ...
   • U_c(i) = HMAC_GOSTR3411 (P, U_{c-1}(i))
   • T(i) = U_1(i) \xor U_2(i) \xor ... \xor U_c(i)
4. Concatenate the octet strings T(i) and extract the first dkLen octets to produce a derived key DK:
   • DK = MSB^{n * 64}_dkLen(T(1)||T(2)||...||T(n))

Data Encryption

GOST R 34.12-2015 Data Encryption Data encryption using the DK key is carried out in accordance with the PBES2 scheme (see , section 6.2) using GOST R 34.12-2015 in CTR_ACPKM mode (see ).

Encryption The encryption process for PBES2 consists of the following steps:

1. Select the random value S of length from 8 to 32 octets.
2. Select the iteration count c depending on the conditions of use. The minimum allowable value for the parameter is 1000.
3. Set the value dkLen = 32.
4. Apply the key derivation function to the password P, the random value S and the iteration count c to produce a derived key DK of length dkLen octets in accordance with the algorithm from . Generate the sequence T(1) and truncate it to 32 octets, i.e.,
   • DK = PBKDF2(P,S,c,32) = MSB^64_32(T(1)).
5. Generate the random value ukm of size n, where n takes a value of 12 or 16 octets, depending on the selected encryption algorithm:
   • GOST R 34.12-2015 "Kuznyechik" n = 16 (see )
   • GOST R 34.12-2015 "Magma" n = 12 (see )
6. Set the value S' = ukm[1..n-8]
7. For id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm algorithms (see ) encrypt the message M with GOST R 34.12-2015 algorithm with the derived key DK and the random value S' to produce a ciphertext C.
8. For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see ) encrypt the message M with GOST R 34.12-2015 algorithm with the derived key DK and the ukm in accordance with the following steps:
   • - Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm (see ):
     • encryption key K(1)
     • MAC key K(2).
     Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take the folowing values:
     • K_in = DK
     • label = "kdf tree" (8 octets)
     • seed = ukm[n-7..n]
     • R = 1
     The input string label above is encoded using ASCII ( ).
   • - Compute MAC for the message M using the K(2) key in accordance with GOST R 34.12-2015 algorithm. Append the computed MAC value to the message M: M||MAC.
   • - Encrypt the resulting octet string with MAC with GOST R 34.12-2015 algorithm with the derived key K(1) and the random value S' to produce a ciphertext C.
9. Serialize the parameters S, c, ukm as algorithm parameters in accordance with .

Decryption The decryption process for PBES2 consists of the following steps:

1. Set the value dkLen = 32.
2. Apply the key derivation function PBKDF2 to the password P, the random value S and the iteration count c to produce a derived key DK of length dkLen octets in accordance with the algorithm from . Generate the sequence T(1) and truncate it to 32 octets, i.e., DK = PBKFD2(P,S,c,32) = MSB^64_32(T(1)).
3. Set the value S' = ukm[1..n-8], where n is the size of ukm in octets.
4. For id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-kuznyechik-ctracpkm algorithms (see ) decrypt the ciphertext C with GOST R 34.12-2015 algorithm with the derived key DK and the random value S' to produce the message M.
5. For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see ) decrypt the ciphertext C with GOST R 34.12-2015 algorithm with the derived key DK and the ukm in accordance with the following steps:
   • - Generate two keys from the derived key DK using the KDF_TREE_GOSTR3411_2012_256 algorithm:
     • encryption key K(1)
     • MAC key K(2).
     Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm take the folowing values:
     • K_in = DK
     • label = "kdf tree" (8 octets)
     • seed = ukm[n-7..n]
     • R = 1
     The input string label above is encoded using ASCII ( ).
   • - Decrypt the ciphertext C with GOST R 34.12-2015 algorithm with the derived key K(1) and the random value S' to produce the plaintext. The last k octets of the text are the message authentication code MAC', where k depends on the selected encryption algorithm.
   • - Compute MAC for the text[1..m - k] using the K(2) key in accordance with GOST R 34.12-2015 algorithm, where m is the size of text.
   • - Compare the original message authentication code MAC and the receiving message authentication code MAC'. If the sizes or values do not match, the message is distorted.

Message Authentication PBMAC1 scheme is used for message authentication (see , section 7.1). This scheme bases on the HMAC_GOSTR3411 function.

MAC Generation The MAC generation operation for PBMAC1 consists of the following steps:

1. Select the random value S of length from 8 to 32 octets.
2. Select the iteration count c depending on the conditions of use. The minimum allowable value for the parameter is 1000.
3. Set the dkLen to at least 32 octets. It depends on previous parameter values.
4. Apply the key derivation function to the password P, the random value S and the iteration count c to generate a sequence K of length dkLen octets in accordance with the algorithm from .
5. Truncate the sequence K to 32 octets to get the derived key DK, i.e., DK = LSB^dkLen_32(K).
6. Process the message M with the underlying message authentication scheme with the derived key DK to generate a message authentication code T.
7. Save the parameters S, c as algorithm parameters in accordance with .

MAC Verification The MAC verification operation for PBMAC1 consists of the following steps:

1. Set the dkLen to at least 32 octets. It depends on previous parameter values.
2. Apply the key derivation function to the password P, the random value S and the iteration count c to generate a sequence K of length dkLen octets in accordance with the algorithm from .
3. Truncate the sequence K to 32 octets to get the derived key DK, i.e., DK = LSB^dkLen_32(K).
4. Process the message M with the underlying message authentication scheme with the derived key DK to generate a message authentication code MAC'.
5. Compare the original message authentication code MAC and the receiving message authentication code MAC'. If the sizes or values do not match, the message is distorted.

Security Considerations This entire document is about security. For information on security considerations for password-based cryptography see . Conforming applications MUST use unique values for ukm and S. It is RECOMMENDED to use the value of parameter c equal to 2000 for generating the derived key in PBKDF2 algorithm. It is RECOMMENDED to use the value of parameter S equal to 32 octets for generating the derived key in PBKDF2 algorithm. It is RECOMMENDED to use the exact algorithm parameters in symmetric algorithms "Magma" and "Kuznyechik". They are defined in .

IANA Considerations This document makes no requests for IANA action.

References In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document provides recommendations for the implementation of password-based cryptography, covering key derivation functions, encryption schemes, message authentication schemes, and ASN.1 syntax identifying the techniques. This document represents a republication of PKCS #5 v2.1 from RSA Laboratories' Public-Key Cryptography Standards (PKCS) series. By publishing this RFC, change control is transferred to the IETF. This document also obsoletes RFC 2898. This document describes HMAC, a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, e.g., MD5, SHA-1, in combination with a secret shared key. The cryptographic strength of HMAC depends on the properties of the underlying hash function. This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind A certain maximum amount of data can be safely encrypted when encryption is performed under a single key. This amount is called the "key lifetime". This specification describes a variety of methods for increasing the lifetime of symmetric keys. It provides two types of re-keying mechanisms based on hash functions and block ciphers that can be used with modes of operations such as CTR, GCM, CBC, CFB, and OMAC. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. This document is intended to be a source of information about the Russian Federal standard GOST R 34.12-2015 describing the block cipher with a block length of n=128 bits and a key length of k=256 bits, which is also referred to as "Kuznyechik". This algorithm is one of the set of Russian cryptographic standard algorithms (called GOST algorithms). In addition to a new cipher with a block length of n=128 bits (referred to as "Kuznyechik" and described in RFC 7801), Russian Federal standard GOST R 34.12-2015 includes an updated version of the block cipher with a block length of n=64 bits and key length of k=256 bits, which is also referred to as "Magma". The algorithm is an updated version of an older block cipher with a block length of n=64 bits described in GOST 28147-89 (RFC 5830). This document is intended to be a source of information about the updated version of the 64-bit cipher. It may facilitate the use of the block cipher in Internet applications by providing information for developers and users of the GOST 64-bit cipher with the revised version of the cipher for encryption and decryption. The purpose of this document is to make the specifications of the cryptographic algorithms defined by the Russian national standards GOST R 34.10-2012 and GOST R 34.11-2012 available to the Internet community for their implementation in the cryptographic protocols based on the accompanying algorithms. These specifications define the pseudorandom functions, the key agreement algorithm based on the Diffie-Hellman algorithm and a hash function, the parameters of elliptic curves, the key derivation functions, and the key export functions. This document is intended to be a source of information about the Russian Federal standard hash function (GOST R 34.11-2012), which is one of the Russian cryptographic standard algorithms (called GOST algorithms). This document updates RFC 5831. This document contains test vectors for the Public-Key Cryptography Standards (PKCS) #5 Password-Based Key Derivation Function 2 (PBKDF2) with the Hash-based Message Authentication Code (HMAC) Secure Hash Algorithm (SHA-1) pseudorandom function. This document is not an Internet Standards Track specification; it is published for informational purposes.

Identifiers and Parameters This section defines ASN.1 syntax for the key derivation functions, the encryption schemes, the message authentication scheme, and supporting techniques ().

PBKDF2 The object identifier id-PBKDF2 identifies the PBKDF2 key derivation function: The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type PBKDF2-params: The fields of type PBKDF2-params have the following meanings:

• - salt contains the random value S in OCTET STRING.
• - iterationCount specifies the iteration count c.
• - keyLength is the length of the derived key in octets. It is optional field for PBES2 sheme since it is always 32 octets. It MUST be present for PBMAC1 sheme and MUST be at least 32 octets since the HMAC_GOSTR3411 function has a variable key size.
• - prf identifies the pseudorandom function. The identifier value MUST be id-tc26-hmac-gost-3411-12-512, the parameters value must be NULL:

PBES2 The object identifier id-PBES2 identifies the PBES2 encryption scheme: The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type PBES2-params: The fields of type PBES2-params have the following meanings:

• - keyDerivationFunc identifies the key derivation function in accordance with .
• - encryptionScheme identifies the encryption scheme in with .

Identifier and Parameters of Gost34.12-2015 Encryption Scheme The Gost34.12-2015 encryption algorithm identifier SHALL take one of the following values: In case of use id-gostr3412-2015-magma-ctracpkm identifier the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with . The block size is 64 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime. In case of use id-gostr3412-2015-magma-ctracpkm-omac identifier the data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode in accordance with , and MAC is computed by the GOST R 34.12-2015 Magma cipher in MAC mode (MAC size is 64 bits). The block size is 64 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime. In case of use id-gostr3412-2015-kuznyechik-ctracpkm identifier the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with . The block size is 128 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime. In case of use id-gostr3412-2015-kuznyechik-ctracpkm-omac identifier the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in CTR_ACPKM mode in accordance with , and MAC is computed by the GOST R 34.12-2015 Kuznyechik cipher in MAC mode (MAC size is 128 bits). The block size is 128 bits, the section size is fixed within a specific protocol based on the requirements of the system capacity and the key lifetime. The parameters field in an AlgorithmIdentifier SHALL have type Gost3412-15-Encryption-Parameters: The field of type Gost3412-15-Encryption-Parameters have the following meanings:

• - ukm MUST be present and MUST contain n octets. Its value depends on the selected encryption algorithm:
  • GOST R 34.12-2015 "Kuznyechik" n = 16 (see )
  • GOST R 34.12-2015 "Magma" n = 12 (see )

PBMAC1 The object identifier id-PBMAC1 identifies the PBMAC1 message authentication scheme: The parameters field associated with this OID in an AlgorithmIdentifier SHALL have type PBMAC1-params: The fields of type PBMAC1-params have the following meanings:

• - keyDerivationFunc is identifier and parameters of key derivation function in accordance with
• - messageAuthScheme is identifier and parameters of HMAC_GOSTR3411 algorithm.

PBKDF2 HMAC_GOSTR3411 Test Vectors These test vectors are formed by analogy with test vectors from . The input strings below are encoded using ASCII ( ). The sequence "\0" (without quotation marks) means a literal ASCII NULL value (1 octet). "DK" refers to the Derived Key.