crypto::pbkdf2
PBKDF2-HMAC-SHA1, from RFC 2898, and the WPA passphrase mapping on top.
This is the first thing that happens when FlintOS joins a WPA2-PSK
network: the passphrase and the SSID become the 256-bit pairwise master
key. IEEE 802.11i fixes the parameters — HMAC-SHA1, 4096 iterations, the
SSID as salt, a 32-byte output — so [wpa_psk] wires those in and the
caller supplies only the two secrets.
It is deliberately, specified-ly slow: 4096 iterations is the cost that makes a passphrase guess expensive. On the ESP32 that is a few hundred milliseconds, paid once per association, and the SHA accelerator (#33) is what brings it down to esp-idf’s timing.
Functions
Section titled “Functions”pbkdf2_sha1
Section titled “pbkdf2_sha1”fn pbkdf2_sha1(password: &[u8], salt: &[u8], iterations: u32, out: &mut [u8])PBKDF2 with HMAC-SHA1 as the PRF (RFC 2898 §5.2).
Fills out with as many derived bytes as it is long, running iterations
of HMAC-SHA1 per 20-byte output block. iterations must be at least 1.
wpa_psk
Section titled “wpa_psk”fn wpa_psk(passphrase: &[u8], ssid: &[u8]) -> [u8; 32]The 802.11i passphrase mapping: PMK = PBKDF2(passphrase, ssid, 4096, 256).
The one call the supplicant makes to turn what the user typed into the key the handshake proves knowledge of. SSID is the salt exactly as given — bytes, not a string, because an SSID is not required to be UTF-8.