Password-based key protection
draft-pkcs5-gost-00

Document Type Active Internet-Draft (individual)
Author Karelina Ekaterina 
Last updated 2021-04-30
Stream (None)
Intended RFC status (None)
Formats plain text xml pdf htmlized (tools) htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                   E. Karelina, Ed.
Internet-Draft                                                  InfoTeCS
Intended status: Informational                            April 30, 2021
Expires: November 1, 2021

                     Password-based key protection
                          draft-pkcs5-gost-00

Abstract

   This document supplements [RFC8018].  It contains the specifications
   of the cryptographic algorithms defined by the Russian national
   standards for their implementation of generating general key in the
   password-based schemes.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on November 1, 2021.

Copyright Notice

   Copyright (c) 2021 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Karelina                Expires November 1, 2021                [Page 1]
Internet-Draft              Abbreviated Title                 April 2021

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Conventions Used in This Document . . . . . . . . . . . . . .   2
   3.  Basic Terms and Definitions . . . . . . . . . . . . . . . . .   3
   4.  Algorithm for generating a key from a password  . . . . . . .   4
   5.  Data encryption . . . . . . . . . . . . . . . . . . . . . . .   4
     5.1.  GOST 28147-89 data encryption . . . . . . . . . . . . . .   4
       5.1.1.  Encryption  . . . . . . . . . . . . . . . . . . . . .   4
       5.1.2.  Decryption  . . . . . . . . . . . . . . . . . . . . .   5
     5.2.  GOST R 34.12-2015 data encryption . . . . . . . . . . . .   5
       5.2.1.  Encryption  . . . . . . . . . . . . . . . . . . . . .   6
       5.2.2.  Decryption  . . . . . . . . . . . . . . . . . . . . .   7
   6.  Message Authentication  . . . . . . . . . . . . . . . . . . .   8
     6.1.  The MAC generation  . . . . . . . . . . . . . . . . . . .   8
     6.2.  The MAC verification  . . . . . . . . . . . . . . . . . .   9
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
   8.  Normative References  . . . . . . . . . . . . . . . . . . . .   9
   Appendix A.  Identifiers and parameters . . . . . . . . . . . . .  10
     A.1.  PBKDF2  . . . . . . . . . . . . . . . . . . . . . . . . .  11
     A.2.  PBES2 . . . . . . . . . . . . . . . . . . . . . . . . . .  11
     A.3.  Identifier and parametrs of Gost28147-89 encryption sheme  12
     A.4.  Identifier and parametrs of Gost34.12-2015 encryption
           sheme . . . . . . . . . . . . . . . . . . . . . . . . . .  13
     A.5.  PBMAC1  . . . . . . . . . . . . . . . . . . . . . . . . .  14
   Appendix B.  PBKDF2 HMAC_GOSTR3411 Test Vectors . . . . . . . . .  15
   Appendix C.  Acknowledgments  . . . . . . . . . . . . . . . . . .  17
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  17

1.  Introduction

   This document supplements [RFC8018].  It describes the
   recommendations for using in the information systems with the
   realisations of the GOST 28147-89 and GOST R 34.12-2015 encryption
   algorithms and the GOST R 34.11-2012 hashing functions in public and
   corporate networks to protect non-state information.  The use of the
   GOST 28147-89 encryption algorithm in these mechanisms remains for
   compatibility with existing implementations.  The methods described
   in these recommendations are designed to generate key information
   using the user's password and protect information using the generated
   keys.

2.  Conventions Used in This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in BCP

Karelina                Expires November 1, 2021                [Page 2]
Internet-Draft              Abbreviated Title                 April 2021

   14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

3.  Basic Terms and Definitions

   Throughout this document, the following notations are used:

   P                         a password in Unicode UTF-8
   S                         a random initializing value
   c                         a number of iterations of algorithm, a
                             positive integer
   dkLen                     a length in bytes of derived key, a
                             positive integer
   DK                        a derived key of length dkLen
   B_n                                    a set of all byte row vectors
                             of length n, n >= 0;              if n = 0,
                             then the set B_n consists of an empty
                             string of length 0
   A||C                      a concatenation of two byte strings A, C,
                             i.e., a vector from B_(|A|+|C|), where the
                             left subvector from B_(|A|)              is
                             equal to the vector A and the right
                             subvector from B_(|C|) is equal to the
                             vector C
   \xor                      a bit-wise exclusive-or of two byte strings
                             of the same length
   R^n_r: B_n -> B_r         a truncating a byte string to size r by
                             removing the least significant n-r bytes
   Int(i)                    a four-byte encoding of the integer i =<
                             2^32: (i_1, i_2, i_3, i_4) \in B_4, i = i_1
                             + 2^8 * i_2 + 2^16 * i_3 + 2^24 * i_4
   b[i, j]                   a substring extraction operator: extracts
                             bytes i through j, 0 =< i =< j.
   CEIL(x)                   the smallest integer greater than, or equal
                             to, x

   This document uses the following abbreviations and symbols:

   HMAC_GOSTR3411            Hashed-based Message Authentication Code.
                             A function for calculating a message
                             authentication code,              based on
                             the GOST R 34.11-2012 hash function with
                             512-bit output in accordance with
                             [RFC2104].

Karelina                Expires November 1, 2021                [Page 3]
Internet-Draft              Abbreviated Title                 April 2021

4.  Algorithm for generating a key from a password

   The DK key is calculated as a diversification function PBKDF2(P, S,
   c, dkLen) using the HMAC_GOSTR3411 function as the PRF pseudo-random
   function:

      DK = PBKDF2(P,S,c,dkLen).

   The diversification function is calculated using the following
   algorithm:

   1.  If dkLen > (2^32 - 1) * 64, output "derived key too long" and
       stop.

   2.  Calculate n = CEIL(dkLen / 64).

   3.  Calculate a set of values for each i from 1 to n:

          U_1(i) = HMAC_GOSTR3411 (P, S || INT (i))

          U_2(i) = HMAC_GOSTR3411 (P, U_1(i))

          ...

          U_c(i) = HMAC_GOSTR3411 (P, U_{c-1}(i))

          T(i) = U_1(i) \xor U_2(i) \xor ... \xor U_c(i)

   4.  Concatenate the byte strings T(i) and extract the first dkLen
       bytes to produce a derived key DK:

          DK = R^{n * 64}_dkLen(T(1)||T(2)||...||T(n))

5.  Data encryption

5.1.  GOST 28147-89 data encryption

   Data encryption using the DK key is carried out in accordance with
   the PBES2 scheme (see [RFC8018], section 6.2) using GOST 28147-89 in
   the Cipher Feedback Mode (CFB) (see [RFC5830]).

5.1.1.  Encryption

   The encryption process for PBES2 consists of the following steps:

   1.  Select the random value S of length from 8 to 32 bytes.  The
       recommended length is 32 bytes.

Karelina                Expires November 1, 2021                [Page 4]
Internet-Draft              Abbreviated Title                 April 2021

   2.  Select the iteration count c depending on the conditions of use.
       The minimum allowable value for the parameter is 1000, the
       recommended value is 2000.

   3.  Set the value dkLen = 32.

   4.  Apply the key derivation function to the password P, the salt S
       and the iteration count c to produce a derived key DK of length
       dkLen bytes in accordance with the algorithm from Section 4.
       Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK =
       PBKFD2(P,S,c,32) = R^64_32(T(1)).

   5.  Select the random value S^{'} of length from 8 bytes.

   6.  Encrypt the message M with GOST 28147-89 algorithm in CFB mode
       under the derived key DK and the random value S^{'} to produce a
       ciphertext C.

   7.  Save the parameters S, S^{'}, c as algorithm parameters in
       accordance with Appendix A.

5.1.2.  Decryption

   The decryption process for PBES2 consists of the following steps:

   1.  Set the value dkLen = 32.

   2.  Apply the key derivation function to the password P, the salt S
       and the iteration count c to produce a derived key DK of length
       dkLen bytes in accordance with the algorithm from Section 4.
       Generate the sequence T(1) and trunc it to 32 bytes, i.e.,

          DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).

   3.  Decrypt the ciphertext C with GOST 28147-89 algorithm in CFB mode
       under the derived key DK and the random value S^{'} to produce
       the message M.

5.2.  GOST R 34.12-2015 data encryption

   Data encryption using the DK key is carried out in accordance with
   the PBES2 scheme (see [RFC8018], section 6.2) using GOST R 34.12-2015
   in CTR_ACPKM mode (see [RFC8645]).

Karelina                Expires November 1, 2021                [Page 5]
Internet-Draft              Abbreviated Title                 April 2021

5.2.1.  Encryption

   The encryption process for PBES2 consists of the following steps:

   1.  Select the random value S of length from 8 to 32 bytes.  The
       recommended length is 32 bytes.

   2.  Select the iteration count c depending on the conditions of use.
       The minimum allowable value for the parameter is 1000, the
       recommended value is 2000.

   3.  Set the value dkLen = 32.

   4.  Apply the key derivation function to the password P, the salt S
       and the iteration count c to produce a derived key DK of length
       dkLen bytes in accordance with the algorithm from Section 4.
       Generate the sequence T(1) and trunc it to 32 bytes, i.e.,

          DK = PBKFD2(P,S,c,32) = R^64_32(T(1)).

   5.  Generate the value ukm of size n, where n takes a value of 12 or
       16 bytes, depending on the selected encryption algorithm:

          GOST R 34.12-2015 "Kuznyechik" n = 16 (see [RFC7801])

          GOST R 34.12-2015 "Magma" n = 12 (see [RFC8891])

   6.  Set the value S^{'} = ukm[1..n-8]

   7.  For id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-
       kuznyechik-ctracpkm algorithms (see Appendix A.4) encrypt the
       message M with GOST R 34.12-2015 algorithm under the derived key
       DK and the random value S^{'} to produce a ciphertext C.

   8.  For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-
       kuznyechik-ctracpkm-omac algorithms (see Appendix A.4) encrypt
       the message M with GOST R 34.12-2015 algorithm under the derived
       key DK and the ukm in accordance with the following steps:

          - Generate two keys from the derived key DK using the
          KDF_TREE_GOSTR3411_2012_256 algorithm (see [RFC7836]):

             encryption key K(1)

             MAC key K(2).

          Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm
          takes the folowing values:

Karelina                Expires November 1, 2021                [Page 6]
Internet-Draft              Abbreviated Title                 April 2021

             K_in = DK

             label = "kdf tree"

             seed = ukm[n-7..n]

             R = 1

          - Compute MAC for the message M using the K(2) key.  Append to
          the end of the message M the computing MAC value.

          - Encrypt the resulting byte string with MAC with GOST R
          34.12-2015 algorithm under the derived key K(1) and the random
          value S^{'} to produce a ciphertext C.

   9.  Save the parameters S, c, ukm as algorithm parameters in
       accordance with Appendix A.

5.2.2.  Decryption

   The decryption process for PBES2 consists of the following steps:

   1.  Set the value dkLen = 32.

   2.  Apply the key derivation function to the password P, the salt S
       and the iteration count c to produce a derived key DK of length
       dkLen bytes in accordance with the algorithm from Section 4.
       Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK =
       PBKFD2(P,S,c,32) = R^64_32(T(1)).

   3.  Set the value S^{'} = ukm[1..n-8], where n is the size of ukm in
       bytes.

   4.  For id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-
       kuznyechik-ctracpkm algorithms (see Appendix A.4) decrypt the
       ciphertext C with GOST R 34.12-2015 algorithm under the derived
       key DK and the random value S^{'} to produce the message M.

   5.  For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-
       kuznyechik-ctracpkm-omac algorithms (see Appendix A.4) decrypt
       the ciphertext C with GOST R 34.12-2015 algorithm under the
       derived key DK and the ukm in accordance with the following
       steps:

          - Generate two keys from the derived key DK using the
          KDF_TREE_GOSTR3411_2012_256 algorithm:

             encryption key K(1)

Karelina                Expires November 1, 2021                [Page 7]
Internet-Draft              Abbreviated Title                 April 2021

             MAC key K(2).

          Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm
          takes the folowing values:

             K_in = DK

             label = "kdf tree"

             seed = ukm[n-7..n]

             R = 1

          - Decrypt the ciphertext C with GOST R 34.12-2015 algorithm
          under the derived key K(1) and the random value S^{'} to
          produce the text.  The last k bytes of the text are the mac,
          where k depends on the selected encryption algorithm.

          - Compute MAC for the text[1..m - k] using the K(2) key, where
          m is the size of text.

          - Compare the original mac and the receiving MAC.  If the
          sizes or values do not match, the message is distorted.

6.  Message Authentication

   PBMAC1 scheme is used for message authentication (see [RFC8018].
   This scheme bases on the HMAC_GOSTR3411 function with the key DK =
   PBKDF2 (P, S, c, 32).

6.1.  The MAC generation

   The MAC generation operation for PBMAC1 consists of the following
   steps:

   1.  Select the random value S of length from 8 to 32 bytes.  The
       recommended length is 32 bytes.

   2.  Select the iteration count c depending on the conditions of use.
       The minimum allowable value for the parameter is 1000, the
       recommended value is 2000.

   3.  Set the dkLen at least 32 bytes.  It depend on the selected key
       generation scheme.

   4.  Apply the key derivation function to the password P, the salt S
       and the iteration count c to produce a derived key DK of length
       dkLen bytes in accordance with the algorithm from Section 4.

Karelina                Expires November 1, 2021                [Page 8]
Internet-Draft              Abbreviated Title                 April 2021

       Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK =
       PBKFD2(P,S,c,32) = R^64_32(T(1)).

   5.  Process the message M with the underlying message authentication
       scheme under the derived key DK to generate a message
       authentication code T.

   6.  Save the parameters S, c, ukm as algorithm parameters in
       accordance with Appendix A.

6.2.  The MAC verification

   The MAC verification operation for PBMAC1 consists of the following
   steps:

   1.  Set the dkLen at least 32 bytes.  It depend on the selected key
       generation scheme.

   2.  Apply the key derivation function to the password P, the salt S
       and the iteration count c to produce a derived key DK of length
       dkLen bytes in accordance with the algorithm from Section 4.
       Generate the sequence T(1) and trunc it to 32 bytes, i.e., DK =
       PBKFD2(P,S,c,32) = R^64_32(T(1)).

   3.  Process the message M with the underlying message authentication
       scheme under the derived key DK to generate a message
       authentication code T^{'}.

   4.  Compare the original message authentication code T and the
       receiving message authentication code T^{'}. If the sizes or
       values do not match, the message is distorted.

7.  Security Considerations

   The focus of this document is security; hence security considerations
   permeate this specification.

8.  Normative References

   [RFC2104]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
              Hashing for Message Authentication", RFC 2104,
              DOI 10.17487/RFC2104, February 1997,
              <https://www.rfc-editor.org/info/rfc2104>.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

Karelina                Expires November 1, 2021                [Page 9]
Internet-Draft              Abbreviated Title                 April 2021

   [RFC5830]  Dolmatov, V., Ed., "GOST 28147-89: Encryption, Decryption,
              and Message Authentication Code (MAC) Algorithms",
              RFC 5830, DOI 10.17487/RFC5830, March 2010,
              <https://www.rfc-editor.org/info/rfc5830>.

   [RFC6070]  Josefsson, S., "PKCS #5: Password-Based Key Derivation
              Function 2 (PBKDF2) Test Vectors", RFC 6070,
              DOI 10.17487/RFC6070, January 2011,
              <https://www.rfc-editor.org/info/rfc6070>.

   [RFC7801]  Dolmatov, V., Ed., "GOST R 34.12-2015: Block Cipher
              "Kuznyechik"", RFC 7801, DOI 10.17487/RFC7801, March 2016,
              <https://www.rfc-editor.org/info/rfc7801>.

   [RFC7836]  Smyshlyaev, S., Ed., Alekseev, E., Oshkin, I., Popov, V.,
              Leontiev, S., Podobaev, V., and D. Belyavsky, "Guidelines
              on the Cryptographic Algorithms to Accompany the Usage of
              Standards GOST R 34.10-2012 and GOST R 34.11-2012",
              RFC 7836, DOI 10.17487/RFC7836, March 2016,
              <https://www.rfc-editor.org/info/rfc7836>.

   [RFC8018]  Moriarty, K., Ed., Kaliski, B., and A. Rusch, "PKCS #5:
              Password-Based Cryptography Specification Version 2.1",
              RFC 8018, DOI 10.17487/RFC8018, January 2017,
              <https://www.rfc-editor.org/info/rfc8018>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8645]  Smyshlyaev, S., Ed., "Re-keying Mechanisms for Symmetric
              Keys", RFC 8645, DOI 10.17487/RFC8645, August 2019,
              <https://www.rfc-editor.org/info/rfc8645>.

   [RFC8891]  Dolmatov, V., Ed. and D. Baryshkov, "GOST R 34.12-2015:
              Block Cipher "Magma"", RFC 8891, DOI 10.17487/RFC8891,
              September 2020, <https://www.rfc-editor.org/info/rfc8891>.

Appendix A.  Identifiers and parameters

   This section defines ASN.1 syntax for the key derivation functions,
   the encryption schemes, the message authentication scheme, and
   supporting techniques ([RFC8018]).

   rsadsi OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) 113549 }
   pkcs OBJECT IDENTIFIER ::= { rsadsi 1 }
   pkcs-5 OBJECT IDENTIFIER ::= { pkcs 5 }

Karelina                Expires November 1, 2021               [Page 10]
Internet-Draft              Abbreviated Title                 April 2021

A.1.  PBKDF2

   The object identifier id-PBKDF2 identifies the PBKDF2 key derivation
   function:

   id-PBKDF2 OBJECT IDENTIFIER ::= { pkcs-5 12 }

   The parameters field associated with this OID in an
   AlgorithmIdentifier shall have type PBKDF2-params:

   PBKDF2-params ::= SEQUENCE
   {
       salt            CHOICE
       {
           specified       OCTET STRING,
           otherSource     AlgorithmIdentifier {{PBKDF2- SaltSources}}
       },
       iterationCount  INTEGER (1000..MAX),
       keyLength       INTEGER (32..MAX) OPTIONAL,
       prf             AlgorithmIdentifier {{PBKDF2-PRFs}}
   }

   The fields of type PBKDF2-params have the following meanings:

      - salt contains the random value S in OCTET STRING.

      - iterationCount specifies the iteration count c.

      - keyLength is the length of the derived key in bytes.  It is
      optional field for PBES2 sheme since it is always 32 bytes.  It
      must be present for PBMAC1 sheme and must be at least 32 bytes
      since the HMAC_GOSTR3411 function has a variable key size.

      - prf identifies the pseudorandom function.  The identifier value
      must be id-tc26-hmac-gost-3411-12-512, the parameters value must
      be NULL:

   id-tc26-hmac-gost-3411-12-512 OBJECT IDENTIFIER ::=
   {
       iso(1) member-body(2) ru(643) reg7(7)
       tk26(1) algorithms(1) hmac(4) 512(2)
   }

A.2.  PBES2

   The object identifier id-PBES2 identifies the PBES2 encryption
   scheme:

Karelina                Expires November 1, 2021               [Page 11]
Internet-Draft              Abbreviated Title                 April 2021

   id-PBES2 OBJECT IDENTIFIER ::= { pkcs-5 13 }

   The parameters field associated with this OID in an
   AlgorithmIdentifier shall have type PBES2-params:

   PBES2-params ::= SEQUENCE
   {
       keyDerivationFunc   AlgorithmIdentifier { { PBES2-KDFs } },
       encryptionScheme    AlgorithmIdentifier { { PBES2-Encs } }
   }

   The fields of type PBES2-params have the following meanings:

      - keyDerivationFunc identifies the key derivation function in
      accordance with Appendix A.1.

      - encryptionScheme identifies the encryption scheme in accordance
      with Appendix A.3, Appendix A.4.

A.3.  Identifier and parametrs of Gost28147-89 encryption sheme

   The GOST 28147-89 encryption algorithm identifier should take the
   following value:

   id-Gost28147-89 OBJECT IDENTIFIER ::=
   {
       iso(1) member-body(2) ru(643) rans(2)
       cryptopro(2) gost28147-89(21)
   }

   The parameters field associated with this OID in an
   AlgorithmIdentifier shall have type Gost28147-89-Parameters:

   Gost28147-89-Parameters ::= SEQUENCE
   {
       iv                      Gost28147-89-IV,
       encryptionParamSet      OBJECT IDENTIFIER
   }
   Gost28147-89-IV ::= OCTET STRING (SIZE (8))

   The fields of type Gost28147-89-Parameters have the following
   meanings:

      - iv contains the random value S^{'} in OCTET STRING.

      - encryptionParamSet identifies the substitution block for
      encryption.  For PBES2 sheme it is recommended to use the set of
      substitutions described in [RFC7836].  The OID of this block is:

Karelina                Expires November 1, 2021               [Page 12]
Internet-Draft              Abbreviated Title                 April 2021

   id-tc26-gost-28147-param-Z OBJECT IDENTIFIER ::=
   {
       iso(1) member-body(2) ru(643) rosstandart(7)
       tc26(1) constants(2) cipher(5) gost28147(1) paramZ(1)
   }

A.4.  Identifier and parametrs of Gost34.12-2015 encryption sheme

   The Gost34.12-2015 encryption algorithm identifier SHOULD take one of
   the following values:

   id-gostr3412-2015-magma-ctracpkm OBJECT IDENTIFIER ::=
   {
       iso(1) member-body(2) ru(643) rosstandart(7)
       tc26(1) algorithms(1) cipher(5)
       gostr3412-2015-magma(1) mode-ctracpkm(1)
   }

   In case of use id-gostr3412-2015-magma-ctracpkm identifier the data
   is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM mode
   in accordance with [RFC8645].  The length of gamma block s is 64
   bits, the section size is fixed within a specific protocol based on
   the requirements of the system capacity and the key lifetime.

   id-gostr3412-2015-magma-ctracpkm-omac OBJECT IDENTIFIER ::=
   {
       iso(1) member-body(2) ru(643) rosstandart(7)
       tc26(1) algorithms(1) cipher(5)
       gostr3412-2015-magma(1) mode-ctracpkm-omac(2)
   }

   In case of use id-gostr3412-2015-magma-ctracpkm-omac identifier the
   data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM
   mode in accordance with [RFC8645], and MAC is computed by the GOST R
   34.12-2015 Magma cipher in MAC mode (MAC size is 64 bits).  The
   length of gamma block s is 64 bits, the section size is fixed within
   a specific protocol based on the requirements of the system capacity
   and the key lifetime.

   id-gostr3412-2015-kuznyechik-ctracpkm OBJECT IDENTIFIER ::=
   {
       iso(1) member-body(2) ru(643) rosstandart(7)
       tc26(1) algorithms(1) cipher(5)
       gostr3412-2015-kuznyechik(2) mode-ctracpkm(1)
   }

   In case of use id-gostr3412-2015-kuznyechik-ctracpkm identifier the
   data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in

Karelina                Expires November 1, 2021               [Page 13]
Internet-Draft              Abbreviated Title                 April 2021

   CTR_ACPKM mode in accordance with [RFC8645].  The length of gamma
   block s is 128 bits, the section size is fixed within a specific
   protocol based on the requirements of the system capacity and the key
   lifetime.

   id-gostr3412-2015-kuznyechik-ctracpkm-omac OBJECT IDENTIFIER ::=
   {
       iso(1) member-body(2) ru(643) rosstandart(7)
       tc26(1) algorithms(1) cipher(5)
       gostr3412-2015-kuznyechik(2) mode-ctracpkm-omac(2)
   }

   In case of use id-gostr3412-2015-kuznyechik-ctracpkm-omac identifier
   the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in
   CTR_ACPKM mode in accordance with [RFC8645], and MAC is computed by
   the GOST R 34.12-2015 Kuznyechik cipher in MAC mode (MAC size is 128
   bits).  The length of gamma block s is 128 bits, the section size is
   fixed within a specific protocol based on the requirements of the
   system capacity and the key lifetime.

   The parameters field in an AlgorithmIdentifier shall have type
   Gost3412-15-Encryption-Parameters:

   Gost3412-15-Encryption-Parameters ::= SEQUENCE
   {
       ukm OCTET STRING
   }

   The field of type Gost3412-15-Encryption-Parameters have the
   following meanings:

      - ukm must be present and must contain n bytes.  It's value
      depends on the selected encryption algorithm:

         GOST R 34.12-2015 "Kuznyechik" n = 16 (see [RFC7801])

         GOST R 34.12-2015 "Magma" n = 12 (see [RFC8891])

A.5.  PBMAC1

   The object identifier id-PBMAC1 identifies the PBMAC1 message
   authentication scheme:

   id-PBMAC1 OBJECT IDENTIFIER ::= { pkcs-5 14 }

   The parameters field associated with this OID in an
   AlgorithmIdentifier shall have type PBMAC1-params:

Karelina                Expires November 1, 2021               [Page 14]
Internet-Draft              Abbreviated Title                 April 2021

   PBMAC1-params ::=  SEQUENCE
   {
       keyDerivationFunc AlgorithmIdentifier { { PBMAC1-KDFs } },
       messageAuthScheme AlgorithmIdentifier { { PBMAC1-MACs } }
   }

   The fields of type PBMAC1-params have the following meanings:

      - keyDerivationFunc is identifier and parameters of key
      diversification function in accordance with Appendix A.1

      - messageAuthScheme is identifier and parameters of HMAC_GOSTR3411
      algorithm.

Appendix B.  PBKDF2 HMAC_GOSTR3411 Test Vectors

   These test vectors are formed by analogy with test vectors from
   [RFC6070].  The input strings below are encoded using ASCII.  The
   sequence "\0" (without quotation marks) means a literal ASCII NULL
   value (1 octet).  "DK" refers to the Derived Key.

   Input:
       P = "password" (8 octets)
       S = "salt" (4 octets)
       c = 1
       dkLen = 64

   Output:
       DK = 64 77 0a f7 f7 48 c3 b1 c9 ac 83 1d bc fd 85 c2
            61 11 b3 0a 8a 65 7d dc 30 56 b8 0c a7 3e 04 0d
            28 54 fd 36 81 1f 6d 82 5c c4 ab 66 ec 0a 68 a4
            90 a9 e5 cf 51 56 b3 a2 b7 ee cd db f9 a1 6b 47

   Input:
       P = "password" (8 octets)
       S = "salt" (4 octets)
       c = 2
       dkLen = 64

   Output:
       DK = 5a 58 5b af df bb 6e 88 30 d6 d6 8a a3 b4 3a c0
            0d 2e 4a eb ce 01 c9 b3 1c 2c ae d5 6f 02 36 d4
            d3 4b 2b 8f bd 2c 4e 89 d5 4d 46 f5 0e 47 d4 5b
            ba c3 01 57 17 43 11 9e 8d 3c 42 ba 66 d3 48 de

   Input:
       P = "password" (8 octets)
       S = "salt" (4 octets)

Karelina                Expires November 1, 2021               [Page 15]
Internet-Draft              Abbreviated Title                 April 2021

       c = 4096
       dkLen = 64

   Output:
       DK = e5 2d eb 9a 2d 2a af f4 e2 ac 9d 47 a4 1f 34 c2
            03 76 59 1c 67 80 7f 04 77 e3 25 49 dc 34 1b c7
            86 7c 09 84 1b 6d 58 e2 9d 03 47 c9 96 30 1d 55
            df 0d 34 e4 7c f6 8f 4e 3c 2c da f1 d9 ab 86 c3

   Input:
       P = "password" (8 octets)
       S = "salt" (4 octets)
       c = 16777216
       dkLen = 64

   Output:
       DK = 49 e4 84 3b ba 76 e3 00 af e2 4c 4d 23 dc 73 92
            de f1 2f 2c 0e 24 41 72 36 7c d7 0a 89 82 ac 36
            1a db 60 1c 7e 2a 31 4e 8c b7 b1 e9 df 84 0e 36
            ab 56 15 be 5d 74 2b 6c f2 03 fb 55 fd c4 80 71

   Input:
       P = "passwordPASSWORDpassword" (24 octets)
       S = "saltSALTsaltSALTsaltSALTsaltSALTsalt" (36 octets)
       c = 4096
       dkLen = 100

   Output:
       DK = b2 d8 f1 24 5f c4 d2 92 74 80 20 57 e4 b5 4e 0a
            07 53 aa 22 fc 53 76 0b 30 1c f0 08 67 9e 58 fe
            4b ee 9a dd ca e9 9b a2 b0 b2 0f 43 1a 9c 5e 50
            f3 95 c8 93 87 d0 94 5a ed ec a6 eb 40 15 df c2
            bd 24 21 ee 9b b7 11 83 ba 88 2c ee bf ef 25 9f
            33 f9 e2 7d c6 17 8c b8 9d c3 74 28 cf 9c c5 2a
            2b aa 2d 3a

   Input:
       P = "pass\0word" (9 octets)
       S = "sa\0lt" (5 octets)
       c = 4096
       dkLen = 64

   Output:
       DK = 50 df 06 28 85 b6 98 01 a3 c1 02 48 eb 0a 27 ab
            6e 52 2f fe b2 0c 99 1c 66 0f 00 14 75 d7 3a 4e
            16 7f 78 2c 18 e9 7e 92 97 6d 9c 1d 97 08 31 ea
            78 cc b8 79 f6 70 68 cd ac 19 10 74 08 44 e8 30

Karelina                Expires November 1, 2021               [Page 16]
Internet-Draft              Abbreviated Title                 April 2021

Appendix C.  Acknowledgments

Author's Address

   Karelina Ekaterina (editor)
   InfoTeCS
   2B stroenie 1, ul. Otradnaya
   Moscow  127273
   Russian Federation

   Phone: +7 (495) 737-61-92
   Email: Ekaterina.Karelina@infotecs.ru

Karelina                Expires November 1, 2021               [Page 17]