polymorph_webcrypto_guest/pbkdf2_sha2.rs
1//! `pbkdf2-sha2` derivation parameterization (RFC 8018 over
2//! HMAC-SHA-2).
3//!
4//! This module mints no keys: `prepare` yields a
5//! [`DeriveInput`](crate::DeriveInput), consumed through
6//! [`DeriveInput::derive_bits`](crate::DeriveInput::derive_bits) or a
7//! target interface's `derive_key`.
8
9use crate::{bindings, DeriveInput, Error, Password};
10
11pub use crate::bindings::sha2::Sha2Variant;
12
13/// Parameterize a PBKDF2 derivation over an imported password.
14///
15/// `salt` should be a per-password random value (RFC 8018 recommends at
16/// least 8 bytes; NIST SP 800-132 at least 16). `iterations` is the work
17/// factor — choose it as high as the deployment tolerates; a zero count
18/// fails [`Error::Other`]. The grants are copied from `input`.
19pub async fn prepare(
20 variant: Sha2Variant,
21 input: &Password,
22 salt: impl Into<Vec<u8>>,
23 iterations: u32,
24) -> Result<DeriveInput, Error> {
25 Ok(DeriveInput::from_raw(
26 bindings::pbkdf2_sha2::prepare(variant, input.as_raw(), salt.into(), iterations).await?,
27 ))
28}