diff -up openssl-1.1.1d/crypto/err/openssl.txt.krb5-kdf openssl-1.1.1d/crypto/err/openssl.txt

--- openssl-1.1.1d/crypto/err/openssl.txt.krb5-kdf	2019-11-14 15:07:05.320094521 +0100

+++ openssl-1.1.1d/crypto/err/openssl.txt	2019-11-14 15:07:05.342094129 +0100

@@ -821,6 +821,11 @@ EVP_F_S390X_AES_GCM_CTRL:201:s390x_aes_g

 EVP_F_SCRYPT_ALG:228:scrypt_alg

 EVP_F_UPDATE:173:update

 KDF_F_HKDF_EXTRACT:112:HKDF_Extract

+KDF_F_KBKDF_CTRL:134:kbkdf_ctrl

+KDF_F_KBKDF_CTRL_STR:135:kbkdf_ctrl_str

+KDF_F_KBKDF_DERIVE:136:kbkdf_derive

+KDF_F_KBKDF_NEW:137:kbkdf_new

+KDF_F_KDF_CIPHER2CTRL:138:kdf_cipher2ctrl

 KDF_F_KDF_HKDF_DERIVE:113:kdf_hkdf_derive

 KDF_F_KDF_HKDF_NEW:114:kdf_hkdf_new

 KDF_F_KDF_HKDF_SIZE:115:kdf_hkdf_size

@@ -840,6 +845,8 @@ KDF_F_KDF_SSHKDF_NEW:133:kdf_sshkdf_new

 KDF_F_KDF_TLS1_PRF_CTRL_STR:125:kdf_tls1_prf_ctrl_str

 KDF_F_KDF_TLS1_PRF_DERIVE:126:kdf_tls1_prf_derive

 KDF_F_KDF_TLS1_PRF_NEW:127:kdf_tls1_prf_new

+KDF_F_KRB5KDF:139:KRB5KDF

+KDF_F_KRB5KDF_DERIVE:140:krb5kdf_derive

 KDF_F_PBKDF2_SET_MEMBUF:128:pbkdf2_set_membuf

 KDF_F_PKEY_HKDF_CTRL_STR:103:pkey_hkdf_ctrl_str

 KDF_F_PKEY_HKDF_DERIVE:102:pkey_hkdf_derive

@@ -853,6 +860,9 @@ KDF_F_PKEY_TLS1_PRF_CTRL_STR:100:pkey_tl

 KDF_F_PKEY_TLS1_PRF_DERIVE:101:pkey_tls1_prf_derive

 KDF_F_PKEY_TLS1_PRF_INIT:110:pkey_tls1_prf_init

 KDF_F_SCRYPT_SET_MEMBUF:129:scrypt_set_membuf

+KDF_F_SSKDF_DERIVE:141:sskdf_derive

+KDF_F_SSKDF_NEW:142:sskdf_new

+KDF_F_SSKDF_SIZE:143:sskdf_size

 KDF_F_TLS1_PRF_ALG:111:tls1_prf_alg

 OBJ_F_OBJ_ADD_OBJECT:105:OBJ_add_object

 OBJ_F_OBJ_ADD_SIGID:107:OBJ_add_sigid

@@ -2325,7 +2335,13 @@ EVP_R_UNSUPPORTED_SALT_TYPE:126:unsuppor

 EVP_R_WRAP_MODE_NOT_ALLOWED:170:wrap mode not allowed

 EVP_R_WRONG_FINAL_BLOCK_LENGTH:109:wrong final block length

 EVP_R_XTS_DUPLICATED_KEYS:183:xts duplicated keys

+KDF_R_FAILED_TO_GENERATE_KEY:118:failed to generate key

+KDF_R_INVALID_CIPHER:116:invalid cipher

+KDF_R_INVALID_CONSTANT_LENGTH:119:invalid constant length

 KDF_R_INVALID_DIGEST:100:invalid digest

+KDF_R_INVALID_SEED_LENGTH:117:invalid seed length

+KDF_R_MISSING_CIPHER:120:missing cipher

+KDF_R_MISSING_CONSTANT:121:missing constant

 KDF_R_MISSING_ITERATION_COUNT:109:missing iteration count

 KDF_R_MISSING_KEY:104:missing key

 KDF_R_MISSING_MESSAGE_DIGEST:105:missing message digest

@@ -2340,6 +2356,7 @@ KDF_R_MISSING_XCGHASH:115:missing xcghas

 KDF_R_UNKNOWN_PARAMETER_TYPE:103:unknown parameter type

 KDF_R_VALUE_ERROR:108:value error

 KDF_R_VALUE_MISSING:102:value missing

+KDF_R_WRONG_FINAL_BLOCK_LENGTH:120:wrong final block length

 KDF_R_WRONG_OUTPUT_BUFFER_SIZE:112:wrong output buffer size

 OBJ_R_OID_EXISTS:102:oid exists

 OBJ_R_UNKNOWN_NID:101:unknown nid

diff -up openssl-1.1.1d/crypto/evp/kdf_lib.c.krb5-kdf openssl-1.1.1d/crypto/evp/kdf_lib.c

--- openssl-1.1.1d/crypto/evp/kdf_lib.c.krb5-kdf	2019-11-14 15:07:05.320094521 +0100

+++ openssl-1.1.1d/crypto/evp/kdf_lib.c	2019-11-14 15:07:05.342094129 +0100

@@ -31,6 +31,9 @@ static const EVP_KDF_METHOD *standard_me

     &tls1_prf_kdf_meth,

     &hkdf_kdf_meth,

     &sshkdf_kdf_meth,

+    &kb_kdf_meth,

+    &krb5kdf_kdf_meth,

+    &ss_kdf_meth

 };

 DECLARE_OBJ_BSEARCH_CMP_FN(const EVP_KDF_METHOD *, const EVP_KDF_METHOD *,

diff -up openssl-1.1.1d/include/crypto/evp.h.krb5-kdf openssl-1.1.1d/include/crypto/evp.h

--- openssl-1.1.1d/include/crypto/evp.h.krb5-kdf	2019-11-14 15:07:05.320094521 +0100

+++ openssl-1.1.1d/include/crypto/evp.h	2019-11-14 15:07:05.342094129 +0100

@@ -130,6 +130,9 @@ extern const EVP_KDF_METHOD scrypt_kdf_m

 extern const EVP_KDF_METHOD tls1_prf_kdf_meth;

 extern const EVP_KDF_METHOD hkdf_kdf_meth;

 extern const EVP_KDF_METHOD sshkdf_kdf_meth;

+extern const EVP_KDF_METHOD kb_kdf_meth;

+extern const EVP_KDF_METHOD krb5kdf_kdf_meth;

+extern const EVP_KDF_METHOD ss_kdf_meth;

 struct evp_md_st {

     int type;

diff -up openssl-1.1.1d/crypto/kdf/build.info.krb5-kdf openssl-1.1.1d/crypto/kdf/build.info

--- openssl-1.1.1d/crypto/kdf/build.info.krb5-kdf	2019-11-14 15:07:05.320094521 +0100

+++ openssl-1.1.1d/crypto/kdf/build.info	2019-11-14 15:07:05.342094129 +0100

@@ -1,3 +1,3 @@

 LIBS=../../libcrypto

 SOURCE[../../libcrypto]=\

-        tls1_prf.c kdf_err.c kdf_util.c hkdf.c scrypt.c pbkdf2.c sshkdf.c

+        tls1_prf.c kdf_err.c kdf_util.c hkdf.c scrypt.c pbkdf2.c sshkdf.c kbkdf.c krb5kdf.c sskdf.c

diff -up openssl-1.1.1d/crypto/kdf/kbkdf.c.krb5-kdf openssl-1.1.1d/crypto/kdf/kbkdf.c

--- openssl-1.1.1d/crypto/kdf/kbkdf.c.krb5-kdf	2019-11-14 15:07:05.343094112 +0100

+++ openssl-1.1.1d/crypto/kdf/kbkdf.c	2019-11-18 17:21:58.326635901 +0100

@@ -0,0 +1,540 @@

+/*

+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.

+ * Copyright 2019 Red Hat, Inc.

+ *

+ * Licensed under the Apache License 2.0 (the "License").  You may not use

+ * this file except in compliance with the License.  You can obtain a copy

+ * in the file LICENSE in the source distribution or at

+ * https://www.openssl.org/source/license.html

+ */

+

+/*

+ * This implements https://csrc.nist.gov/publications/detail/sp/800-108/final

+ * section 5.1 ("counter mode") and section 5.2 ("feedback mode") in both HMAC

+ * and CMAC.  That document does not name the KDFs it defines; the name is

+ * derived from

+ * https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Key-Derivation

+ *

+ * Note that section 5.3 ("double-pipeline mode") is not implemented, though

+ * it would be possible to do so in the future.

+ *

+ * These versions all assume the counter is used.  It would be relatively

+ * straightforward to expose a configuration handle should the need arise.

+ *

+ * Variable names attempt to match those of SP800-108.

+ */

+

+#include <stdarg.h>

+#include <stdlib.h>

+#include <string.h>

+

+#include <openssl/evp.h>

+#include <openssl/hmac.h>

+#include <openssl/cmac.h>

+#include <openssl/kdf.h>

+

+#include "internal/numbers.h"

+#include "internal/cryptlib.h"

+#include "crypto/evp.h"

+#include "kdf_local.h"

+

+#include "e_os.h"

+

+#ifdef MIN

+# undef MIN

+#endif

+#define MIN(a, b) ((a) < (b)) ? (a) : (b)

+

+typedef struct {

+    int mac_type;

+    union {

+        HMAC_CTX *hmac;

+        CMAC_CTX *cmac;

+    } m;

+} MAC_CTX;

+

+/* Our context structure. */

+struct evp_kdf_impl_st {

+    int mode;

+

+    MAC_CTX *ctx_init;

+

+    const EVP_CIPHER *cipher;

+    const EVP_MD *md;

+

+    /* Names are lowercased versions of those found in SP800-108. */

+    unsigned char *ki;

+    size_t ki_len;

+    unsigned char *label;

+    size_t label_len;

+    unsigned char *context;

+    size_t context_len;

+    unsigned char *iv;

+    size_t iv_len;

+};

+

+static MAC_CTX *EVP_MAC_CTX_new(int mac_type)

+{

+    MAC_CTX *ctx;

+

+    ctx = OPENSSL_zalloc(sizeof(*ctx));

+    if (ctx == NULL)

+        return NULL;

+

+    ctx->mac_type = mac_type;

+    if (mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

+        if ((ctx->m.hmac = HMAC_CTX_new()) == NULL)

+            goto err;

+    } else {

+        if ((ctx->m.cmac = CMAC_CTX_new()) == NULL)

+            goto err;

+    }

+    return ctx;

+

+err:

+    OPENSSL_free(ctx);

+    return NULL;

+}

+

+static void EVP_MAC_CTX_free(MAC_CTX *ctx)

+{

+    if (ctx == NULL)

+        return;

+

+    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC)

+        HMAC_CTX_free(ctx->m.hmac);

+    else

+        CMAC_CTX_free(ctx->m.cmac);

+    OPENSSL_free(ctx);

+}

+

+static MAC_CTX *EVP_MAC_CTX_dup(MAC_CTX *sctx)

+{

+    MAC_CTX *ctx;

+

+    ctx = OPENSSL_zalloc(sizeof(*sctx));

+    if (ctx == NULL)

+        return NULL;

+

+    ctx->mac_type = sctx->mac_type;

+    if (sctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

+        if ((ctx->m.hmac = HMAC_CTX_new()) == NULL

+            || HMAC_CTX_copy(ctx->m.hmac, sctx->m.hmac) <= 0)

+            goto err;

+    } else {

+        if ((ctx->m.cmac = CMAC_CTX_new()) == NULL

+            || CMAC_CTX_copy(ctx->m.cmac, sctx->m.cmac) <= 0)

+            goto err;

+    }

+    return ctx;

+

+err:

+    EVP_MAC_CTX_free(ctx);

+    return NULL;

+}

+

+static size_t EVP_MAC_size(MAC_CTX *ctx)

+{

+    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

+        const EVP_MD *md;

+

+        if (ctx->m.hmac == NULL)

+            return 0;

+        if ((md = HMAC_CTX_get_md(ctx->m.hmac)) == NULL)

+            return 0;

+        return (size_t)EVP_MD_size(md);

+    } else {

+        const EVP_CIPHER_CTX *cctx;

+

+        if (ctx->m.cmac == NULL)

+            return 0;

+        if ((cctx = CMAC_CTX_get0_cipher_ctx(ctx->m.cmac)) == NULL)

+            return 0;

+        return EVP_CIPHER_CTX_block_size(cctx);

+    }

+}

+

+static int EVP_MAC_update(MAC_CTX *ctx, const unsigned char *data,

+                          size_t datalen)

+{

+    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC)

+        return HMAC_Update(ctx->m.hmac, data, datalen);

+    else

+        return CMAC_Update(ctx->m.cmac, data, datalen);

+}

+

+static int EVP_MAC_final(MAC_CTX *ctx, unsigned char *out,

+                         size_t *outl, size_t outsize)

+{

+    if (outsize != EVP_MAC_size(ctx))

+        /* we do not cope with anything else */

+        return 0;

+

+    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

+        unsigned int intsize = (unsigned int)outsize;

+        int ret;

+

+        ret = HMAC_Final(ctx->m.hmac, out, &intsize);

+        if (outl != NULL)

+            *outl = intsize;

+        return ret;

+    } else {

+        size_t size = outsize;

+        int ret;

+

+        ret = CMAC_Final(ctx->m.cmac, out, &size);

+        if (outl != NULL)

+            *outl = size;

+        return ret;

+    }

+}

+

+static int evp_mac_init(MAC_CTX *ctx, const EVP_MD *md,

+                        const EVP_CIPHER *cipher, unsigned char *key, size_t keylen)

+{

+    if (ctx->mac_type == EVP_KDF_KB_MAC_TYPE_HMAC) {

+        if (md == NULL)

+            return 0;

+        return HMAC_Init_ex(ctx->m.hmac, key, (int)keylen, md, NULL);

+    } else {

+        if (cipher == NULL)

+            return 0;

+        return CMAC_Init(ctx->m.cmac, key, keylen, cipher, NULL);

+    }

+}

+

+static void kbkdf_reset(EVP_KDF_IMPL *ctx);

+

+/* Not all platforms have htobe32(). */

+static uint32_t be32(uint32_t host)

+{

+    uint32_t big = 0;

+    const union {

+        long one;

+        char little;

+    } is_endian = { 1 };

+

+    if (!is_endian.little)

+        return host;

+

+    big |= (host & 0xff000000) >> 24;

+    big |= (host & 0x00ff0000) >> 8;

+    big |= (host & 0x0000ff00) << 8;

+    big |= (host & 0x000000ff) << 24;

+    return big;

+}

+

+static EVP_KDF_IMPL *kbkdf_new(void)

+{

+    EVP_KDF_IMPL *ctx;

+

+    ctx = OPENSSL_zalloc(sizeof(*ctx));

+    if (ctx == NULL) {

+        KDFerr(KDF_F_KBKDF_NEW, ERR_R_MALLOC_FAILURE);

+        return NULL;

+    }

+

+    return ctx;

+}

+

+static void kbkdf_free(EVP_KDF_IMPL *ctx)

+{

+    kbkdf_reset(ctx);

+    OPENSSL_free(ctx);

+}

+

+static void kbkdf_reset(EVP_KDF_IMPL *ctx)

+{

+    EVP_MAC_CTX_free(ctx->ctx_init);

+    OPENSSL_clear_free(ctx->context, ctx->context_len);

+    OPENSSL_clear_free(ctx->label, ctx->label_len);

+    OPENSSL_clear_free(ctx->ki, ctx->ki_len);

+    OPENSSL_clear_free(ctx->iv, ctx->iv_len);

+    memset(ctx, 0, sizeof(*ctx));

+}

+

+/* SP800-108 section 5.1 or section 5.2 depending on mode. */

+static int derive(MAC_CTX *ctx_init, int mode, unsigned char *iv,

+                  size_t iv_len, unsigned char *label, size_t label_len,

+                  unsigned char *context, size_t context_len,

+                  unsigned char *k_i, size_t h, uint32_t l, unsigned char *ko,

+                  size_t ko_len)

+{

+    int ret = 0;

+    MAC_CTX *ctx = NULL;

+    size_t written = 0, to_write, k_i_len = iv_len;

+    const unsigned char zero = 0;

+    uint32_t counter, i;

+

+    /* Setup K(0) for feedback mode. */

+    if (iv_len > 0)

+        memcpy(k_i, iv, iv_len);

+

+    for (counter = 1; written < ko_len; counter++) {

+        i = be32(counter);

+

+        ctx = EVP_MAC_CTX_dup(ctx_init);

+        if (ctx == NULL)

+            goto done;

+

+        /* Perform feedback, if appropriate. */

+        if (mode == EVP_KDF_KB_MODE_FEEDBACK && !EVP_MAC_update(ctx, k_i, k_i_len))

+            goto done;

+

+        if (!EVP_MAC_update(ctx, (unsigned char *)&i, 4)

+            || !EVP_MAC_update(ctx, label, label_len)

+            || !EVP_MAC_update(ctx, &zero, 1)

+            || !EVP_MAC_update(ctx, context, context_len)

+            || !EVP_MAC_update(ctx, (unsigned char *)&l, 4)

+            || !EVP_MAC_final(ctx, k_i, NULL, h))

+            goto done;

+

+        to_write = ko_len - written;

+        memcpy(ko + written, k_i, MIN(to_write, h));

+        written += h;

+

+        k_i_len = h;

+        EVP_MAC_CTX_free(ctx);

+        ctx = NULL;

+    }

+

+    ret = 1;

+done:

+    EVP_MAC_CTX_free(ctx);

+    return ret;

+}

+

+static int kbkdf_derive(EVP_KDF_IMPL *ctx, unsigned char *key, size_t keylen)

+{

+    int ret = 0;

+    unsigned char *k_i = NULL;

+    uint32_t l = be32(keylen * 8);

+    size_t h = 0;

+

+    /* label, context, and iv are permitted to be empty.  Check everything

+     * else. */

+    if (ctx->ctx_init == NULL

+        || evp_mac_init(ctx->ctx_init, ctx->md, ctx->cipher, ctx->ki, ctx->ki_len) <= 0) {

+        if (ctx->ki_len == 0 || ctx->ki == NULL) {

+            KDFerr(KDF_F_KBKDF_DERIVE, KDF_R_MISSING_KEY);

+            return 0;

+        }

+        /* Could either be missing MAC or missing message digest or missing

+         * cipher - arbitrarily, I pick this one. */

+        KDFerr(KDF_F_KBKDF_DERIVE, KDF_R_MISSING_PARAMETER);

+        return 0;

+    }

+

+    h = EVP_MAC_size(ctx->ctx_init);

+    if (h == 0)

+        goto done;

+    if (ctx->iv_len != 0 && ctx->iv_len != h) {

+        KDFerr(KDF_F_KBKDF_DERIVE, KDF_R_INVALID_SEED_LENGTH);

+        goto done;

+    }

+

+    k_i = OPENSSL_zalloc(h);

+    if (k_i == NULL)

+        goto done;

+

+    ret = derive(ctx->ctx_init, ctx->mode, ctx->iv, ctx->iv_len, ctx->label,

+                 ctx->label_len, ctx->context, ctx->context_len, k_i, h, l,

+                 key, keylen);

+done:

+    if (ret != 1)

+        OPENSSL_cleanse(key, keylen);

+    OPENSSL_clear_free(k_i, h);

+    return ret;

+}

+

+static size_t kbkdf_size(EVP_KDF_IMPL *ctx)

+{

+    return UINT32_MAX/8;

+}

+

+static int kbkdf_parse_buffer_arg(unsigned char **dst, size_t *dst_len,

+                                       va_list args)

+{

+    const unsigned char *p;

+    size_t len;

+

+    p = va_arg(args, const unsigned char *);

+    len = va_arg(args, size_t);

+    OPENSSL_clear_free(*dst, *dst_len);

+    if (len == 0) {

+        *dst = NULL;

+        *dst_len = 0;

+        return 1;

+    }

+

+    *dst = OPENSSL_memdup(p, len);

+    if (*dst == NULL)

+        return 0;

+

+    *dst_len = len;

+    return 1;

+}

+

+static int kbkdf_ctrl(EVP_KDF_IMPL *ctx, int cmd, va_list args)

+{

+    int t;

+

+    switch (cmd) {

+    case EVP_KDF_CTRL_SET_MD:

+        ctx->md = va_arg(args, const EVP_MD *);

+        if (ctx->md == NULL)

+            return 0;

+

+        return 1;

+

+    case EVP_KDF_CTRL_SET_CIPHER:

+        ctx->cipher = va_arg(args, const EVP_CIPHER *);

+        if (ctx->cipher == NULL)

+            return 0;

+

+        return 1;

+

+    case EVP_KDF_CTRL_SET_KEY:

+        return kbkdf_parse_buffer_arg(&ctx->ki,

+                                      &ctx->ki_len, args);

+

+    case EVP_KDF_CTRL_SET_SALT:

+        return kbkdf_parse_buffer_arg(&ctx->label,

+                                           &ctx->label_len, args);

+

+    case EVP_KDF_CTRL_SET_KB_INFO:

+        return kbkdf_parse_buffer_arg(&ctx->context,

+                                           &ctx->context_len, args);

+

+    case EVP_KDF_CTRL_SET_KB_SEED:

+        return kbkdf_parse_buffer_arg(&ctx->iv,

+                                           &ctx->iv_len, args);

+

+    case EVP_KDF_CTRL_SET_KB_MODE:

+        t = va_arg(args, int);

+        if (t != EVP_KDF_KB_MODE_COUNTER && t != EVP_KDF_KB_MODE_FEEDBACK ) {

+            KDFerr(KDF_F_KBKDF_CTRL, KDF_R_VALUE_ERROR);

+            return 0;

+        }

+        ctx->mode = t;

+        return 1;

+

+    case EVP_KDF_CTRL_SET_KB_MAC_TYPE:

+        t = va_arg(args, int);

+        if (t != EVP_KDF_KB_MAC_TYPE_HMAC && t != EVP_KDF_KB_MAC_TYPE_CMAC ) {

+            KDFerr(KDF_F_KBKDF_CTRL, KDF_R_VALUE_ERROR);

+            return 0;

+        }

+

+        if (ctx->ctx_init != NULL) {

+            EVP_MAC_CTX_free(ctx->ctx_init);

+        }

+        ctx->ctx_init = EVP_MAC_CTX_new(t);

+        if (ctx->ctx_init == NULL) {

+            KDFerr(KDF_F_KBKDF_CTRL, ERR_R_MALLOC_FAILURE);

+            return 0;

+        }

+        return 1;

+

+    default:

+        return -2;

+

+    }

+}

+

+static int kbkdf_ctrl_str(EVP_KDF_IMPL *ctx, const char *type,

+                               const char *value)

+{

+    if (value == NULL) {

+        KDFerr(KDF_F_KDF_SSHKDF_CTRL_STR, KDF_R_VALUE_MISSING);

+        return 0;

+    }

+

+    if (strcmp(type, "digest") == 0)

+        return kdf_md2ctrl(ctx, kbkdf_ctrl, EVP_KDF_CTRL_SET_MD, value);

+    /* alias, for historical reasons */

+    if (strcmp(type, "md") == 0)

+        return kdf_md2ctrl(ctx, kbkdf_ctrl, EVP_KDF_CTRL_SET_MD, value);

+

+    if (strcmp(type, "cipher") == 0)

+        return kdf_cipher2ctrl(ctx, kbkdf_ctrl, EVP_KDF_CTRL_SET_CIPHER, value);

+

+    if (strcmp(type, "key") == 0)

+        return kdf_str2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_KEY, value);

+

+    if (strcmp(type, "hexkey") == 0)

+        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_KEY, value);

+

+    if (strcmp(type, "salt") == 0)

+        return kdf_str2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_SALT, value);

+

+    if (strcmp(type, "hexsalt") == 0)

+        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_SALT, value);

+

+    if (strcmp(type, "info") == 0)

+        return kdf_str2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_KB_INFO, value);

+

+    if (strcmp(type, "hexinfo") == 0)

+        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_KB_INFO, value);

+

+    if (strcmp(type, "seed") == 0)

+        return kdf_str2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_KB_SEED, value);

+

+    if (strcmp(type, "hexseed") == 0)

+        return kdf_hex2ctrl(ctx, kbkdf_ctrl,

+                            EVP_KDF_CTRL_SET_KB_SEED, value);

+

+    if (strcmp(type, "mode") == 0) {

+        int mode;

+

+        if (strcasecmp(value, "counter") == 0) {

+            mode = EVP_KDF_KB_MODE_COUNTER;

+        } else if (strcasecmp(value, "feedback") == 0) {

+            mode = EVP_KDF_KB_MODE_FEEDBACK;

+        } else {

+            KDFerr(KDF_F_KBKDF_CTRL_STR, KDF_R_VALUE_ERROR);

+            return 0;

+        }

+

+        return call_ctrl(kbkdf_ctrl, ctx, EVP_KDF_CTRL_SET_KB_MODE,

+                         mode);

+    }

+

+    if (strcmp(type, "mac_type") == 0) {

+        int mac_type;

+

+        if (strcasecmp(value, "hmac") == 0) {

+            mac_type = EVP_KDF_KB_MAC_TYPE_HMAC;

+        } else if (strcasecmp(value, "cmac") == 0) {

+            mac_type = EVP_KDF_KB_MAC_TYPE_CMAC;

+        } else {

+            KDFerr(KDF_F_KBKDF_CTRL_STR, KDF_R_VALUE_ERROR);

+            return 0;

+        }

+

+        return call_ctrl(kbkdf_ctrl, ctx, EVP_KDF_CTRL_SET_KB_MAC_TYPE,

+                         mac_type);

+    }

+

+    KDFerr(KDF_F_KBKDF_CTRL_STR, KDF_R_UNKNOWN_PARAMETER_TYPE);

+    return -2;

+}

+

+const EVP_KDF_METHOD kb_kdf_meth = {

+    EVP_KDF_KB,

+    kbkdf_new,

+    kbkdf_free,

+    kbkdf_reset,

+    kbkdf_ctrl,

+    kbkdf_ctrl_str,

+    kbkdf_size,

+    kbkdf_derive,

+};

+

diff -up openssl-1.1.1d/crypto/kdf/kdf_err.c.krb5-kdf openssl-1.1.1d/crypto/kdf/kdf_err.c

--- openssl-1.1.1d/crypto/kdf/kdf_err.c.krb5-kdf	2019-11-14 15:07:05.320094521 +0100

+++ openssl-1.1.1d/crypto/kdf/kdf_err.c	2019-11-14 15:07:05.343094112 +0100

@@ -15,6 +15,11 @@

 static const ERR_STRING_DATA KDF_str_functs[] = {

     {ERR_PACK(ERR_LIB_KDF, KDF_F_HKDF_EXTRACT, 0), "HKDF_Extract"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_KBKDF_CTRL, 0), "kbkdf_ctrl"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_KBKDF_CTRL_STR, 0), "kbkdf_ctrl_str"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_KBKDF_DERIVE, 0), "kbkdf_derive"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_KBKDF_NEW, 0), "kbkdf_new"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_CIPHER2CTRL, 0), "kdf_cipher2ctrl"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_HKDF_DERIVE, 0), "kdf_hkdf_derive"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_HKDF_NEW, 0), "kdf_hkdf_new"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_HKDF_SIZE, 0), "kdf_hkdf_size"},

@@ -41,6 +46,8 @@ static const ERR_STRING_DATA KDF_str_fun

     {ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_TLS1_PRF_DERIVE, 0),

      "kdf_tls1_prf_derive"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_KDF_TLS1_PRF_NEW, 0), "kdf_tls1_prf_new"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_KRB5KDF, 0), "KRB5KDF"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_KRB5KDF_DERIVE, 0), "krb5kdf_derive"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_PBKDF2_SET_MEMBUF, 0), "pbkdf2_set_membuf"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_HKDF_CTRL_STR, 0), "pkey_hkdf_ctrl_str"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_HKDF_DERIVE, 0), "pkey_hkdf_derive"},

@@ -59,12 +66,22 @@ static const ERR_STRING_DATA KDF_str_fun

      "pkey_tls1_prf_derive"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_PKEY_TLS1_PRF_INIT, 0), "pkey_tls1_prf_init"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_SCRYPT_SET_MEMBUF, 0), "scrypt_set_membuf"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_SSKDF_DERIVE, 0), "sskdf_derive"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_SSKDF_NEW, 0), "sskdf_new"},

+    {ERR_PACK(ERR_LIB_KDF, KDF_F_SSKDF_SIZE, 0), "sskdf_size"},

     {ERR_PACK(ERR_LIB_KDF, KDF_F_TLS1_PRF_ALG, 0), "tls1_prf_alg"},

     {0, NULL}

 };

 static const ERR_STRING_DATA KDF_str_reasons[] = {

+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_FAILED_TO_GENERATE_KEY),

+    "failed to generate key"},

+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_INVALID_CIPHER), "invalid cipher"},

+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_INVALID_CONSTANT_LENGTH), "invalid constant length"},

     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_INVALID_DIGEST), "invalid digest"},

+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_INVALID_SEED_LENGTH), "invalid seed length"},

+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_CIPHER), "missing cipher"},

+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_CONSTANT), "missing constant"},

     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_ITERATION_COUNT),

     "missing iteration count"},

     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_KEY), "missing key"},

@@ -82,6 +99,8 @@ static const ERR_STRING_DATA KDF_str_rea

     "unknown parameter type"},

     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_VALUE_ERROR), "value error"},

     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_VALUE_MISSING), "value missing"},

+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_WRONG_FINAL_BLOCK_LENGTH),

+    "wrong final block length"},

     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_WRONG_OUTPUT_BUFFER_SIZE),

     "wrong output buffer size"},

     {0, NULL}

diff -up openssl-1.1.1d/crypto/kdf/kdf_local.h.krb5-kdf openssl-1.1.1d/crypto/kdf/kdf_local.h

--- openssl-1.1.1d/crypto/kdf/kdf_local.h.krb5-kdf	2019-11-14 15:07:05.313094646 +0100

+++ openssl-1.1.1d/crypto/kdf/kdf_local.h	2019-11-14 15:07:05.344094093 +0100

@@ -19,4 +19,6 @@ int kdf_hex2ctrl(EVP_KDF_IMPL *impl,

 int kdf_md2ctrl(EVP_KDF_IMPL *impl,

                 int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),

                 int cmd, const char *md_name);

-

+int kdf_cipher2ctrl(EVP_KDF_IMPL *impl,

+                    int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),

+                    int cmd, const char *cipher_name);

diff -up openssl-1.1.1d/crypto/kdf/kdf_util.c.krb5-kdf openssl-1.1.1d/crypto/kdf/kdf_util.c

--- openssl-1.1.1d/crypto/kdf/kdf_util.c.krb5-kdf	2019-11-14 15:07:05.313094646 +0100

+++ openssl-1.1.1d/crypto/kdf/kdf_util.c	2019-11-14 15:07:05.344094093 +0100

@@ -71,3 +71,16 @@ int kdf_md2ctrl(EVP_KDF_IMPL *impl,

     return call_ctrl(ctrl, impl, cmd, md);

 }

+/* Pass a cipher to a ctrl */

+int kdf_cipher2ctrl(EVP_KDF_IMPL *impl,

+                    int (*ctrl)(EVP_KDF_IMPL *impl, int cmd, va_list args),

+                    int cmd, const char *cipher_name)

+{

+    const EVP_CIPHER *cipher;

+

+    if (cipher_name == NULL || (cipher = EVP_get_cipherbyname(cipher_name)) == NULL) {

+        KDFerr(KDF_F_KDF_CIPHER2CTRL, KDF_R_INVALID_CIPHER);

+        return 0;

+    }

+    return call_ctrl(ctrl, impl, cmd, cipher);