-
Notifications
You must be signed in to change notification settings - Fork 5.2k
Implement HKDF with CryptoKit on Apple #119998
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR implements native HKDF (HMAC-based Key Derivation Function) support on Apple platforms using CryptoKit. The implementation provides better performance by leveraging Apple's native cryptographic libraries when available (iOS 14+, tvOS 14+, macOS, Mac Catalyst), while falling back to the existing managed implementation on older platforms.
Key changes:
- Added native CryptoKit HKDF implementation with platform detection
- Enhanced test coverage for previously untested hash algorithms (MD5, SHA-384, SHA-512)
- Refactored shared code by extracting hash algorithm mapping utility
Reviewed Changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 16 comments.
Show a summary per file
File | Description |
---|---|
pal_swiftbindings.swift | Implements HKDF extract, expand, and derive operations using CryptoKit |
pal_swiftbindings.h | Declares native function entry points for HKDF operations |
entrypoints.c | Registers HKDF native functions for P/Invoke |
HKDFTests.cs | Adds comprehensive test cases for MD5, SHA-384, and SHA-512 algorithms |
HKDF.cs | Fixes documentation comment parameter reference |
HKDF.Apple.cs | Provides Apple-specific HKDF implementation with platform detection and fallback |
System.Security.Cryptography.csproj | Updates project file to include Apple HKDF implementation |
Interop.RSA.cs | Removes duplicate hash algorithm mapping function |
Interop.PAL_HashAlgorithm.cs | Centralizes hash algorithm mapping utility function |
Interop.HKDF.cs | Provides managed wrapper for native HKDF P/Invoke calls |
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HKDF.Apple.cs
Outdated
Show resolved
Hide resolved
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Hum. CoreCLR passed, Mono failed. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HKDF.Apple.cs
Show resolved
Hide resolved
Of course I cannot reproduce it... |
src/native/libs/System.Security.Cryptography.Native.Apple/pal_swiftbindings.swift
Outdated
Show resolved
Hide resolved
Draft / NO-MERGE because this has debugging logs for CI since issue cannot be reproduced locally. |
CryptoKit has a native HKDF implementation. For platforms where CryptoKit HKDF is available, this implements the HKDF algorithm using CryptoKit. On platforms where CryptoKit HKDF is not available (< iOS 14) the managed fallback is used.
There was also a notable lack any tests for MD5, SHA-384, and SHA-512. The entire HKDF test suite would pass even if I did not implement those algorithms at all. So lets create some tests while we are here.