Class Pbkdf2

java.lang.Object

com.codename1.security.Pbkdf2

public final class Pbkdf2
extends Object

PBKDF2 (RFC 8018) with HMAC-SHA-256 or HMAC-SHA-512: the password hash of key stores and vaults, and with SHA-512 and 2048 iterations the seed of a BIP-39 mnemonic.

A CryptoEngine that derives natively is used when one is installed (every client port installs one). Otherwise the derivation runs in Java, and still costs two hash compressions per iteration: the HMAC key's inner and outer padded blocks are compressed once, up front, and each iteration resumes from those two states with the previous output as its only block. A straightforward HMAC loop re-hashes both padded keys every round, twice the work.

byte[] mnemonicUtf8 = Mnemonic.generate(128).getBytes("UTF-8");
byte[] saltUtf8 = "mnemonic".getBytes("UTF-8");    // "mnemonic" + passphrase
byte[] seed = Pbkdf2.hmacSha512(mnemonicUtf8, saltUtf8, 2048, 64);

Method Summary

Modifier and Type	Method	Description
static byte[]	hmacSha256(byte[] password, byte[] salt, int iterations, int length)	PBKDF2 with HMAC-SHA-256; see hmacSha512(byte[], byte[], int, int) for the parameters.
static byte[]	hmacSha512(byte[] password, byte[] salt, int iterations, int length)	PBKDF2 with HMAC-SHA-512.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

hmacSha512

public static byte[] hmacSha512(byte[] password,
 byte[] salt,
 int iterations,
 int length)

PBKDF2 with HMAC-SHA-512.

Parameters

• password: the password bytes, used as they are (encode text as UTF-8, normalized as the protocol requires, before calling)

• salt: the salt

• iterations: at least 1

• length: how many bytes to derive, at least 1

Throws

• CryptoException: if an argument is null or out of range

hmacSha256

public static byte[] hmacSha256(byte[] password,
 byte[] salt,
 int iterations,
 int length)

PBKDF2 with HMAC-SHA-256; see hmacSha512(byte[], byte[], int, int) for the parameters.