polymorph_webcrypto_guest/
pbkdf2.rs

1//! `pbkdf2` base-secret import (RFC 8018).
2//!
3//! This module mints no keys and runs no derivation: it imports the
4//! password that [`pbkdf2_sha2`](crate::pbkdf2_sha2) and
5//! [`pbkdf2_sha1`](crate::pbkdf2_sha1) parameterize into
6//! [`DeriveInput`](crate::DeriveInput)s.
7
8use crate::{bindings, DeriveOptions, Error, Password};
9
10/// Import a password.
11///
12/// Empty passwords are accepted — deliberately asymmetric with
13/// [`hkdf::import_ikm`](crate::hkdf::import_ikm), whose material is a
14/// cryptographic secret with no legitimate empty form, where a password is
15/// end-user input the platform also accepts empty. A policy with no grant
16/// enabled fails [`Error::NotPermitted`].
17pub async fn import_password(
18    raw: impl Into<Vec<u8>>,
19    options: DeriveOptions,
20) -> Result<Password, Error> {
21    Ok(Password::from_raw(
22        bindings::pbkdf2::import_password(raw.into(), options.lower()).await?,
23    ))
24}
25
26/// Mint a password from unwrapped bytes, subject to [`import_password`]'s
27/// contract. Consumes the [`UnwrapInput`](crate::UnwrapInput).
28pub async fn unwrap_password(
29    input: crate::UnwrapInput,
30    options: DeriveOptions,
31) -> Result<Password, Error> {
32    Ok(Password::from_raw(
33        bindings::pbkdf2::unwrap_password(input.into_raw(), options.lower()).await?,
34    ))
35}
polymorph_webcrypto_guest/pbkdf2.rs

polymorph_webcrypto_guest/
pbkdf2.rs
