Source: s2k.go in package golang.org/x/crypto/openpgp/s2k

Package s2k implements the various OpenPGP string-to-key transforms as specified in RFC 4800 section 3.7.1.

package s2k // import "golang.org/x/crypto/openpgp/s2k"

import (
	"crypto"
	"hash"
	"io"
	"strconv"

	"golang.org/x/crypto/openpgp/errors"
)

Config collects configuration parameters for s2k key-stretching transformatioms. A nil *Config is valid and results in all default values. Currently, Config is used only by the Serialize function in this package.

Hash is the default hash function to be used. If nil, SHA1 is used.

S2KCount is only used for symmetric encryption. It determines the strength of the passphrase stretching when the said passphrase is hashed to produce a key. S2KCount should be between 1024 and 65011712, inclusive. If Config is nil or S2KCount is 0, the value 65536 used. Not all values in the above range can be represented. S2KCount will be rounded up to the next representable value if it cannot be encoded exactly. When set, it is strongly encrouraged to use a value that is at least 65536. See RFC 4880 Section 3.7.1.3.

	S2KCount int
}

func (c *Config) hash() crypto.Hash {

SHA1 is the historical default in this package.

		return crypto.SHA1
	}

	return c.Hash
}

func (c *Config) encodedCount() uint8 {
	if c == nil || c.S2KCount == 0 {
		return 96 // The common case. Correspoding to 65536
	}

	i := c.S2KCount

Behave like GPG. Should we make 65536 the lowest value used?

	case i < 1024:
		i = 1024
	case i > 65011712:
		i = 65011712
	}

	return encodeCount(i)
}

encodeCount converts an iterative "count" in the range 1024 to 65011712, inclusive, to an encoded count. The return value is the octet that is actually stored in the GPG file. encodeCount panics if i is not in the above range (encodedCount above takes care to pass i in the correct range). See RFC 4880 Section 3.7.7.1.

func encodeCount(i int) uint8 {
	if i < 1024 || i > 65011712 {
		panic("count arg i outside the required range")
	}

	for encoded := 0; encoded < 256; encoded++ {
		count := decodeCount(uint8(encoded))
		if count >= i {
			return uint8(encoded)
		}
	}

	return 255
}

decodeCount returns the s2k mode 3 iterative "count" corresponding to the encoded octet c.

func decodeCount(c uint8) int {
	return (16 + int(c&15)) << (uint32(c>>4) + 6)
}

Simple writes to out the result of computing the Simple S2K function (RFC 4880, section 3.7.1.1) using the given hash and input passphrase.

func Simple(out []byte, h hash.Hash, in []byte) {
	Salted(out, h, in, nil)
}

var zero [1]byte

Salted writes to out the result of computing the Salted S2K function (RFC 4880, section 3.7.1.2) using the given hash, input passphrase and salt.

func Salted(out []byte, h hash.Hash, in []byte, salt []byte) {
	done := 0
	var digest []byte

	for i := 0; done < len(out); i++ {
		h.Reset()
		for j := 0; j < i; j++ {
			h.Write(zero[:])
		}
		h.Write(salt)
		h.Write(in)
		digest = h.Sum(digest[:0])
		n := copy(out[done:], digest)
		done += n
	}
}

Iterated writes to out the result of computing the Iterated and Salted S2K function (RFC 4880, section 3.7.1.3) using the given hash, input passphrase, salt and iteration count.

func Iterated(out []byte, h hash.Hash, in []byte, salt []byte, count int) {
	combined := make([]byte, len(in)+len(salt))
	copy(combined, salt)
	copy(combined[len(salt):], in)

	if count < len(combined) {
		count = len(combined)
	}

	done := 0
	var digest []byte
	for i := 0; done < len(out); i++ {
		h.Reset()
		for j := 0; j < i; j++ {
			h.Write(zero[:])
		}
		written := 0
		for written < count {
			if written+len(combined) > count {
				todo := count - written
				h.Write(combined[:todo])
				written = count
			} else {
				h.Write(combined)
				written += len(combined)
			}
		}
		digest = h.Sum(digest[:0])
		n := copy(out[done:], digest)
		done += n
	}
}

Parse reads a binary specification for a string-to-key transformation from r and returns a function which performs that transform.

func Parse(r io.Reader) (f func(out, in []byte), err error) {
	var buf [9]byte

	_, err = io.ReadFull(r, buf[:2])
	if err != nil {
		return
	}

	hash, ok := HashIdToHash(buf[1])
	if !ok {
		return nil, errors.UnsupportedError("hash for S2K function: " + strconv.Itoa(int(buf[1])))
	}
	if !hash.Available() {
		return nil, errors.UnsupportedError("hash not available: " + strconv.Itoa(int(hash)))
	}
	h := hash.New()

	switch buf[0] {
	case 0:
		f := func(out, in []byte) {
			Simple(out, h, in)
		}
		return f, nil
	case 1:
		_, err = io.ReadFull(r, buf[:8])
		if err != nil {
			return
		}
		f := func(out, in []byte) {
			Salted(out, h, in, buf[:8])
		}
		return f, nil
	case 3:
		_, err = io.ReadFull(r, buf[:9])
		if err != nil {
			return
		}
		count := decodeCount(buf[8])
		f := func(out, in []byte) {
			Iterated(out, h, in, buf[:8], count)
		}
		return f, nil
	}

	return nil, errors.UnsupportedError("S2K function")
}

Serialize salts and stretches the given passphrase and writes the resulting key into key. It also serializes an S2K descriptor to w. The key stretching can be configured with c, which may be nil. In that case, sensible defaults will be used.

func Serialize(w io.Writer, key []byte, rand io.Reader, passphrase []byte, c *Config) error {
	var buf [11]byte
	buf[0] = 3 /* iterated and salted */
	buf[1], _ = HashToHashId(c.hash())
	salt := buf[2:10]
	if _, err := io.ReadFull(rand, salt); err != nil {
		return err
	}
	encodedCount := c.encodedCount()
	count := decodeCount(encodedCount)
	buf[10] = encodedCount
	if _, err := w.Write(buf[:]); err != nil {
		return err
	}

	Iterated(key, c.hash().New(), passphrase, salt, count)
	return nil
}

hashToHashIdMapping contains pairs relating OpenPGP's hash identifier with Go's crypto.Hash type. See RFC 4880, section 9.4.

var hashToHashIdMapping = []struct {
	id   byte
	hash crypto.Hash
	name string
}{
	{1, crypto.MD5, "MD5"},
	{2, crypto.SHA1, "SHA1"},
	{3, crypto.RIPEMD160, "RIPEMD160"},
	{8, crypto.SHA256, "SHA256"},
	{9, crypto.SHA384, "SHA384"},
	{10, crypto.SHA512, "SHA512"},
	{11, crypto.SHA224, "SHA224"},
}

HashIdToHash returns a crypto.Hash which corresponds to the given OpenPGP hash id.

func HashIdToHash(id byte) (h crypto.Hash, ok bool) {
	for _, m := range hashToHashIdMapping {
		if m.id == id {
			return m.hash, true
		}
	}
	return 0, false
}

HashIdToString returns the name of the hash function corresponding to the given OpenPGP hash id.

func HashIdToString(id byte) (name string, ok bool) {
	for _, m := range hashToHashIdMapping {
		if m.id == id {
			return m.name, true
		}
	}

	return "", false
}

HashIdToHash returns an OpenPGP hash id which corresponds the given Hash.

func HashToHashId(h crypto.Hash) (id byte, ok bool) {
	for _, m := range hashToHashIdMapping {
		if m.hash == h {
			return m.id, true
		}
	}
	return 0, false