Is there any C API in openssl to get the key from a given string

Question

I need the C API in the openssl library to get the key from a given string. Where can I get the source code for this?

Answer 1

The standard algorithm for this is PBKDF2 (abbreviation for key derivation function based on password version 2). OpenSSL implements the PBKDF2 implementation declared in openssl/evp.h :

 int PKCS5_PBKDF2_HMAC_SHA1(const char *pass, int passlen, unsigned char *salt, int saltlen, int iter, int keylen, unsigned char *out); 

When you create a new key, you must use RAND_bytes() from openssl/rand.h to create the salt. iter is an iteration counter that should be as large as your intended application can tolerate - at least something like 20,000.

Answer 2

I found an example on how to generate a key from a password. The example dates back to 2008, as far as I can tell, this is still undocumented in OpenSSL. So let me post a complete source example to help all those poor souls trying to use the OpenSSL API.

Please note that this is NOT my code, it comes from Marek Markola! All loans belong to him.

 /* * Example program on how to derive an encryption key from a password * corresponding to the RFC2898 / PBKDF2 standard. * Found in a 2008 mailing list posted by Marek Marcola: * http://www.mail-archive.com/ [e-mail] /msg54143.html */ #include <string.h> #include <openssl/x509.h> #include <openssl/evp.h> #include <openssl/hmac.h> int print_hex(unsigned char *buf, int len) { int i; int n; for(i=0,n=0;i<len;i++){ if(n > 7){ printf("\n"); n = 0; } printf("0x%02x, ",buf[i]); n++; } printf("\n"); return(0); } int main() { char *pass = "password"; char *salt = "12340000"; int ic = 1; unsigned char buf[1024]; ic = 1; PKCS5_PBKDF2_HMAC_SHA1(pass, strlen(pass), (unsigned char*)salt, strlen(salt), ic, 32+16, buf); printf("PKCS5_PBKDF2_HMAC_SHA1(\"%s\", \"%s\", %d)=\n", pass, salt, ic); print_hex(buf, 32+16); ic = 1; EVP_BytesToKey(EVP_aes_256_cbc(), EVP_sha1(), (unsigned char*)salt, (unsigned char*)pass, strlen(pass), ic, buf, buf+32); printf("EVP_BytesToKey(\"%s\", \"%s\", %d)=\n", pass, salt, ic); print_hex(buf, 32+16); return(0); }