Skip to main content

pbkdf2_salted

krabka_security::scram

Function pbkdf2_salted 

Source 
pub fn pbkdf2_salted(
    password: &[u8],
    mechanism: SaslMechanism,
    iterations: u32,
    salt: &[u8],
) -> Vec<u8> ⓘ
Expand description

Compute the PBKDF2 output for a SCRAM mechanism.

KIP-554 and RFC 5802 call this output the “salted password”. Its length matches scram_hash_len: 32 bytes for SHA-256, 64 bytes for SHA-512.

krabka-client-admin uses this function to populate AlterUserScramCredentialsRequest.upsertions[].salted_password. It does so without leaking the broker-side derive_keys_from_salted machinery or the raw password into the operator. This function panics on a non-SCRAM mechanism.

§Panics

Panics if validated key material has an impossible size or synchronized credential state is poisoned.