nx_pbkdf2.nx

pbkdf2.nx -- PBKDF2 password-based key derivation (RFC 8018). Stretches a user password (low-entropy) into a crypto key (high-entropy) by iterating HMAC many times over (password, salt, counter). The iteration count makes brute-force attacks expensive while legitimate derivations pay only a one-time cost. Used for: user-auth password hashing, key wrapping, PKCS#5 v2 PBKDF2 (widely deployed in 1Password / KeePass / LastPass container formats, TLS-PSK). Superseded for new systems by Argon2id (memory-hard; harder to attack with GPUs). Still required for interop with many existing databases + hardware tokens. Algorithm (RFC 8018 §5.2 PBKDF2): For each `dkLen / hash_len` block: U_1 = HMAC(password, salt || counter_as_u32_be) U_i = HMAC(password, U_{i-1}) for i = 2..iterations T_j = U_1 XOR U_2 XOR ... XOR U_iterations Concatenate T_j for the final derived key. Invariants: P1 iterations must be >= 1. OWASP-minimum for SHA-256 is ~600_000 as of 2023. Caller chooses; we don't enforce. P2 dkLen capped at (2^32 - 1) * hash_len. In practice nothing needs more than a handful of blocks; we don't validate. P3 Counter is 1-indexed, big-endian, appended to salt for the U_1 computation. P4 XOR accumulation is in-place to avoid allocating a per- iteration scratch. nx_safety_envelope: intended_use: "PBKDF2 password-based key derivation (RFC 2898 / NIST SP 800-132) -- legacy password hashing; prefer Argon2 for new code" sil_target: SIL3 (password hash; iteration count determines brute-force cost) asil_target: QM dal_target: DAL B