providers: add Argon2 KDF

https://datatracker.ietf.org/doc/rfc9106/

Signed-off-by: Čestmír Kalina <ckalina@redhat.com>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12256)

CHANGES.md

@@ -232,6 +232,11 @@ OpenSSL 3.2
 
    *Hubert Kario*
 
+ * Support for Argon2d, Argon2i, Argon2id KDFs has been added along with
+   basic thread pool implementation for select platforms.
+
+   *Čestmír Kalina*
+
 OpenSSL 3.1
 -----------
 

Configure

@@ -408,6 +408,7 @@ my @dtls = qw(dtls1 dtls1_2);
 my @disablables = (
     "acvp-tests",
     "afalgeng",
+    "argon2",
     "aria",
     "asan",
     "asm",
@@ -669,6 +670,8 @@ my @disable_cascades = (
     "threads"           => [ "thread-pool" ],
     "thread-pool"       => [ "default-thread-pool" ],
 
+    "blake2"            => [ "argon2" ],
+
     "deprecated-3.0"    => [ "engine", "srp" ]
     );
 

apps/list.c

@@ -1286,6 +1286,9 @@ static void list_engines(void)
 static void list_disabled(void)
 {
     BIO_puts(bio_out, "Disabled algorithms:\n");
+#ifdef OPENSSL_NO_ARGON2
+    BIO_puts(bio_out, "ARGON2\n");
+#endif
 #ifdef OPENSSL_NO_ARIA
     BIO_puts(bio_out, "ARIA\n");
 #endif

crypto/err/openssl.txt

@@ -1043,7 +1043,7 @@ PROV_R_INVALID_KDF:232:invalid kdf
 PROV_R_INVALID_KEY:158:invalid key
 PROV_R_INVALID_KEY_LENGTH:105:invalid key length
 PROV_R_INVALID_MAC:151:invalid mac
-PROV_R_INVALID_MEMORY_SIZE:233:invalid memory size
+PROV_R_INVALID_MEMORY_SIZE:235:invalid memory size
 PROV_R_INVALID_MGF1_MD:167:invalid mgf1 md
 PROV_R_INVALID_MODE:125:invalid mode
 PROV_R_INVALID_OUTPUT_LENGTH:217:invalid output length

doc/build.info

@@ -4289,6 +4289,10 @@ DEPEND[html/man7/EVP_CIPHER-SM4.html]=man7/EVP_CIPHER-SM4.pod
 GENERATE[html/man7/EVP_CIPHER-SM4.html]=man7/EVP_CIPHER-SM4.pod
 DEPEND[man/man7/EVP_CIPHER-SM4.7]=man7/EVP_CIPHER-SM4.pod
 GENERATE[man/man7/EVP_CIPHER-SM4.7]=man7/EVP_CIPHER-SM4.pod
+DEPEND[html/man7/EVP_KDF-ARGON2.html]=man7/EVP_KDF-ARGON2.pod
+GENERATE[html/man7/EVP_KDF-ARGON2.html]=man7/EVP_KDF-ARGON2.pod
+DEPEND[man/man7/EVP_KDF-ARGON2.7]=man7/EVP_KDF-ARGON2.pod
+GENERATE[man/man7/EVP_KDF-ARGON2.7]=man7/EVP_KDF-ARGON2.pod
 DEPEND[html/man7/EVP_KDF-HKDF.html]=man7/EVP_KDF-HKDF.pod
 GENERATE[html/man7/EVP_KDF-HKDF.html]=man7/EVP_KDF-HKDF.pod
 DEPEND[man/man7/EVP_KDF-HKDF.7]=man7/EVP_KDF-HKDF.pod
@@ -4773,6 +4777,7 @@ html/man7/EVP_CIPHER-RC4.html \
 html/man7/EVP_CIPHER-RC5.html \
 html/man7/EVP_CIPHER-SEED.html \
 html/man7/EVP_CIPHER-SM4.html \
+html/man7/EVP_KDF-ARGON2.html \
 html/man7/EVP_KDF-HKDF.html \
 html/man7/EVP_KDF-HMAC-DRBG.html \
 html/man7/EVP_KDF-KB.html \
@@ -4904,6 +4909,7 @@ man/man7/EVP_CIPHER-RC4.7 \
 man/man7/EVP_CIPHER-RC5.7 \
 man/man7/EVP_CIPHER-SEED.7 \
 man/man7/EVP_CIPHER-SM4.7 \
+man/man7/EVP_KDF-ARGON2.7 \
 man/man7/EVP_KDF-HKDF.7 \
 man/man7/EVP_KDF-HMAC-DRBG.7 \
 man/man7/EVP_KDF-KB.7 \

doc/man7/EVP_KDF-ARGON2.pod

@@ -0,0 +1,192 @@
+=pod
+
+=head1 NAME
+
+EVP_KDF-ARGON2 - The Argon2 EVP KDF implementation
+
+=head1 DESCRIPTION
+
+Support for computing the B<argon2> password-based KDF through the B<EVP_KDF>
+API.
+
+The EVP_KDF-ARGON2 algorithm implements the Argon2 password-based key
+derivation function, as described in IETF RFC 9106.  It is memory-hard in
+the sense that it deliberately requires a significant amount of RAM for efficient
+computation. The intention of this is to render brute forcing of passwords on
+systems that lack large amounts of main memory (such as GPUs or ASICs)
+computationally infeasible.
+
+Argon2d (Argon2i) uses data-dependent (data-independent) memory access and
+primary seek to address trade-off (side-channel) attacks.
+
+Argon2id is a hybrid construction which, in the first two slices of the first
+pass, generates reference addresses data-independently as in Argon2i, whereas
+in later slices and next passess it generates them data-dependently as in
+Argon2d.
+
+Sbox-hardened version Argon2ds is not supported.
+
+For more information, please refer to RFC 9106.
+
+=head2 Supported parameters
+
+The supported parameters are:
+
+=over 4
+
+=item "pass" (B<OSSL_KDF_PARAM_PASSWORD>) <octet string>
+
+=item "salt" (B<OSSL_KDF_PARAM_SALT>) <octet string>
+
+=item "secret" (B<OSSL_KDF_PARAM_SECRET>) <octet string>
+
+=item "iter" (B<OSSL_KDF_PARAM_ITER>) <unsigned integer>
+
+=item "size" (B<OSSL_KDF_PARAM_SIZE>) <unsigned integer>
+
+These parameters work as described in L<EVP_KDF(3)/PARAMETERS>.
+
+Note that RFC 9106 recommends 128 bits salt for most applications, or 64 bits
+salt in the case of space constraints. At least 128 bits output length is
+recommended.
+
+Note that secret (or pepper) is an optional secret data used along the
+password.
+
+=item "threads" (B<OSSL_KDF_PARAM_THREADS>) <unsigned integer>
+
+The number of threads, bounded above by the number of lanes.
+
+This can only be used with built-in thread support. Threading must be
+explicitly enabled. See EXAMPLES section for more information.
+
+=item "ad" (B<OSSL_KDF_PARAM_ARGON2_AD>) <octet string>
+
+Optional associated data, may be used to "tag" a group of keys, or tie them
+to a particular public key, without having to modify salt.
+
+=item "lanes" (B<OSSL_KDF_PARAM_ARGON2_LANES>) <unsigned integer>
+
+Argon2 splits the requested memory size into lanes, each of which is designed
+to be processed in parallel. For example, on a system with p cores, it's
+recommended to use p lanes.
+
+The number of lanes is used to derive the key. It is possible to specify
+more lanes than the number of available computational threads. This is
+especially encouraged if multi-threading is disabled.
+
+=item "memcost" (B<OSSL_KDF_PARAM_ARGON2_MEMCOST>) <unsigned integer>
+
+Memory cost parameter (the number of 1k memory blocks used).
+
+=item "version" (B<OSSL_KDF_PARAM_ARGON2_VERSION>) <unsigned integer>
+
+Argon2 version. Supported values: 0x10, 0x13 (default).
+
+=item "early_clean" (B<OSSL_KDF_PARAM_EARLY_CLEAN>) <unsigned integer>
+
+If set (nonzero), password and secret stored in Argon2 context are zeroed
+early during initial hash computation, as soon as they are not needed.
+Otherwise, they are zeroed along the rest of Argon2 context data on clear,
+free, reset.
+
+This can be useful if, for example, multiple keys with different ad value
+are to be generated from a single password and secret.
+
+=back
+
+=head1 EXAMPLES
+
+This example uses Argon2d with password "1234567890", salt "saltsalt",
+using 2 lanes, 2 threads, and memory cost of 65536:
+
+ #include <string.h>                 /* strlen               */
+ #include <openssl/core_names.h>     /* OSSL_KDF_*           */
+ #include <openssl/params.h>         /* OSSL_PARAM_*         */
+ #include <openssl/thread.h>         /* OSSL_set_max_threads */
+ #include <openssl/kdf.h>            /* EVP_KDF_*            */
+
+ int main(void)
+ {
+     int retval = 1;
+
+     EVP_KDF *kdf = NULL;
+     EVP_KDF_CTX *kctx = NULL;
+     OSSL_PARAM params[6], *p = params;
+
+     /* argon2 params, please refer to RFC9106 for recommended defaults */
+     uint32_t lanes = 2, threads = 2, memcost = 65536;
+     char pwd[] = "1234567890", salt[] = "saltsalt";
+
+     /* derive result */
+     size_t outlen = 128;
+     unsigned char result[outlen];
+
+     /* required if threads > 1 */
+     if (OSSL_set_max_threads(NULL, threads) != 1)
+         goto fail;
+
+     p = params;
+     *p++ = OSSL_PARAM_construct_uint32(OSSL_KDF_PARAM_THREADS, &threads);
+     *p++ = OSSL_PARAM_construct_uint32(OSSL_KDF_PARAM_ARGON2_LANES,
+                                        &lanes);
+     *p++ = OSSL_PARAM_construct_uint32(OSSL_KDF_PARAM_ARGON2_MEMCOST,
+                                        &memcost);
+     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SALT,
+                                              salt,
+                                              strlen((const char *)salt));
+     *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_PASSWORD,
+                                              pwd,
+                                              strlen((const char *)pwd));
+     *p++ = OSSL_PARAM_construct_end();
+
+     if ((kdf = EVP_KDF_fetch(NULL, "ARGON2D", NULL)) == NULL)
+         goto fail;
+     if ((kctx = EVP_KDF_CTX_new(kdf)) == NULL)
+         goto fail;
+     if (EVP_KDF_derive(kctx, &result[0], outlen, params) != 1)
+         goto fail;
+
+     printf("Output = %s\n", OPENSSL_buf2hexstr(result, outlen));
+     retval = 0;
+
+ fail:
+     EVP_KDF_free(kdf);
+     EVP_KDF_CTX_free(kctx);
+     OSSL_set_max_threads(NULL, 0);
+
+     return retval;
+ }
+
+=head1 NOTES
+
+"ARGON2I", "ARGON2D", and "ARGON2ID" are the names for this implementation; it
+can be used with the EVP_KDF_fetch() function.
+
+=head1 CONFORMING TO
+
+RFC 9106 Argon2, see L<https://www.rfc-editor.org/rfc/rfc9106.txt>.
+
+=head1 SEE ALSO
+
+L<EVP_KDF(3)>,
+L<EVP_KDF_CTX_new(3)>,
+L<EVP_KDF_CTX_free(3)>,
+L<EVP_KDF_CTX_set_params(3)>,
+L<EVP_KDF_derive(3)>,
+L<EVP_KDF(3)/PARAMETERS>
+
+=head1 HISTORY
+
+This functionality was added to OpenSSL 3.2.
+
+=head1 COPYRIGHT
+
+Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut

doc/man7/OSSL_PROVIDER-default.pod

@@ -151,6 +151,8 @@ The OpenSSL default provider supports these operations and algorithms:
 
 =item HMAC-DRBG, see L<EVP_KDF-HMAC-DRBG(7)>
 
+=item ARGON2, see L<EVP_KDF-ARGON2(7)>
+
 =back
 
 =head2 Key Exchange

include/openssl/core_names.h

@@ -233,6 +233,12 @@ extern "C" {
 #define OSSL_KDF_PARAM_X942_USE_KEYBITS     "use-keybits"
 #define OSSL_KDF_PARAM_HMACDRBG_ENTROPY     "entropy"
 #define OSSL_KDF_PARAM_HMACDRBG_NONCE       "nonce"
+#define OSSL_KDF_PARAM_THREADS        "threads"     /* uint32_t */
+#define OSSL_KDF_PARAM_EARLY_CLEAN    "early_clean" /* uint32_t */
+#define OSSL_KDF_PARAM_ARGON2_AD      "ad"          /* octet string */
+#define OSSL_KDF_PARAM_ARGON2_LANES   "lanes"       /* uint32_t */
+#define OSSL_KDF_PARAM_ARGON2_MEMCOST "memcost"     /* uint32_t */
+#define OSSL_KDF_PARAM_ARGON2_VERSION "version"     /* uint32_t */
 
 /* Known KDF names */
 #define OSSL_KDF_NAME_HKDF           "HKDF"

include/openssl/proverr.h

@@ -68,7 +68,7 @@
 # define PROV_R_INVALID_KEY                               158
 # define PROV_R_INVALID_KEY_LENGTH                        105
 # define PROV_R_INVALID_MAC                               151
-# define PROV_R_INVALID_MEMORY_SIZE                       233
+# define PROV_R_INVALID_MEMORY_SIZE                       235
 # define PROV_R_INVALID_MGF1_MD                           167
 # define PROV_R_INVALID_MODE                              125
 # define PROV_R_INVALID_OUTPUT_LENGTH                     217

providers/defltprov.c

@@ -355,6 +355,11 @@ static const OSSL_ALGORITHM deflt_kdfs[] = {
     { PROV_NAMES_KRB5KDF, "provider=default", ossl_kdf_krb5kdf_functions },
     { PROV_NAMES_HMAC_DRBG_KDF, "provider=default",
       ossl_kdf_hmac_drbg_functions },
+#ifndef OPENSSL_NO_ARGON2
+    { PROV_NAMES_ARGON2I, "provider=default", ossl_kdf_argon2i_functions },
+    { PROV_NAMES_ARGON2D, "provider=default", ossl_kdf_argon2d_functions },
+    { PROV_NAMES_ARGON2ID, "provider=default", ossl_kdf_argon2id_functions },
+#endif
     { NULL, NULL, NULL }
 };
 

providers/implementations/include/prov/implementations.h

@@ -280,6 +280,11 @@ extern const OSSL_DISPATCH ossl_kdf_kbkdf_functions[];
 extern const OSSL_DISPATCH ossl_kdf_x942_kdf_functions[];
 extern const OSSL_DISPATCH ossl_kdf_krb5kdf_functions[];
 extern const OSSL_DISPATCH ossl_kdf_hmac_drbg_functions[];
+#ifndef OPENSSL_NO_ARGON2
+extern const OSSL_DISPATCH ossl_kdf_argon2i_functions[];
+extern const OSSL_DISPATCH ossl_kdf_argon2d_functions[];
+extern const OSSL_DISPATCH ossl_kdf_argon2id_functions[];
+#endif
 
 /* RNGs */
 extern const OSSL_DISPATCH ossl_test_rng_functions[];

providers/implementations/include/prov/names.h

@@ -279,6 +279,9 @@
 #define PROV_DESCS_SCRYPT_SIGN "OpenSSL SCRYPT via EVP_PKEY implementation"
 #define PROV_NAMES_KRB5KDF "KRB5KDF"
 #define PROV_NAMES_HMAC_DRBG_KDF "HMAC-DRBG-KDF"
+#define PROV_NAMES_ARGON2I "ARGON2I"
+#define PROV_NAMES_ARGON2D "ARGON2D"
+#define PROV_NAMES_ARGON2ID "ARGON2ID"
 
 /*-
  * MACs

providers/implementations/kdfs/build.info

@@ -14,6 +14,7 @@ $SCRYPT_GOAL=../../libdefault.a
 $SSHKDF_GOAL=../../libdefault.a ../../libfips.a
 $X942KDF_GOAL=../../libdefault.a ../../libfips.a
 $HMAC_DRBG_KDF_GOAL=../../libdefault.a
+$ARGON2_GOAL=../../libdefault.a
 
 SOURCE[$TLS1_PRF_GOAL]=tls1_prf.c
 
@@ -42,3 +43,4 @@ SOURCE[$X942KDF_GOAL]=x942kdf.c
 DEPEND[x942kdf.o]=../../common/include/prov/der_wrap.h
 
 SOURCE[$HMAC_DRBG_KDF_GOAL]=hmacdrbg_kdf.c
+SOURCE[$ARGON2_GOAL]=argon2.c

test/evp_test.c

@@ -2785,6 +2785,48 @@ static int kdf_test_ctrl(EVP_TEST *t, EVP_KDF_CTX *kctx,
         goto end;
     }
 
+    if (strcmp(name, "lanes") == 0
+        && OSSL_PARAM_locate_const(defs, name) == NULL) {
+        TEST_info("skipping, setting 'lanes' is unsupported");
+        t->skip = 1;
+        goto end;
+    }
+
+    if (strcmp(name, "iter") == 0
+        && OSSL_PARAM_locate_const(defs, name) == NULL) {
+        TEST_info("skipping, setting 'iter' is unsupported");
+        t->skip = 1;
+        goto end;
+    }
+
+    if (strcmp(name, "memcost") == 0
+        && OSSL_PARAM_locate_const(defs, name) == NULL) {
+        TEST_info("skipping, setting 'memcost' is unsupported");
+        t->skip = 1;
+        goto end;
+    }
+
+    if (strcmp(name, "secret") == 0
+        && OSSL_PARAM_locate_const(defs, name) == NULL) {
+        TEST_info("skipping, setting 'secret' is unsupported");
+        t->skip = 1;
+        goto end;
+    }
+
+    if (strcmp(name, "pass") == 0
+        && OSSL_PARAM_locate_const(defs, name) == NULL) {
+        TEST_info("skipping, setting 'pass' is unsupported");
+        t->skip = 1;
+        goto end;
+    }
+
+    if (strcmp(name, "ad") == 0
+        && OSSL_PARAM_locate_const(defs, name) == NULL) {
+        TEST_info("skipping, setting 'ad' is unsupported");
+        t->skip = 1;
+        goto end;
+    }
+
     rv = OSSL_PARAM_allocate_from_text(kdata->p, defs, name, p,
                                        p != NULL ? strlen(p) : 0, NULL);
     *++kdata->p = OSSL_PARAM_construct_end();
@@ -4156,6 +4198,10 @@ static int is_kdf_disabled(const char *name)
 #ifdef OPENSSL_NO_SCRYPT
     if (HAS_CASE_SUFFIX(name, "SCRYPT"))
         return 1;
+#endif
+#ifdef OPENSSL_NO_ARGON2
+    if (HAS_CASE_SUFFIX(name, "ARGON2"))
+        return 1;
 #endif
     return 0;
 }

test/recipes/30-test_evp.t

@@ -29,6 +29,7 @@ my $no_ec = disabled("ec");
 my $no_ec2m = disabled("ec2m");
 my $no_sm2 = disabled("sm2");
 my $no_siv = disabled("siv");
+my $no_argon2 = disabled("argon2");
 
 # Default config depends on if the legacy module is built or not
 my $defaultcnf = $no_legacy ? 'default.cnf' : 'default-and-legacy.cnf';
@@ -126,6 +127,7 @@ push @defltfiles, qw(evppkey_dsa_rfc6979.txt) unless $no_dsa;
 push @defltfiles, qw(evppkey_sm2.txt) unless $no_sm2;
 push @defltfiles, qw(evpciph_aes_gcm_siv.txt) unless $no_siv;
 push @defltfiles, qw(evpciph_aes_siv.txt) unless $no_siv;
+push @defltfiles, qw(evpkdf_argon2.txt) unless $no_argon2;
 
 plan tests =>
     + (scalar(@configs) * scalar(@files))

test/recipes/30-test_evp_data/evpkdf_argon2.txt

@@ -0,0 +1,168 @@
+Title = Argon2 tests (from rfc 9106 and others)
+
+KDF = ARGON2D
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.secret = hexsecret:0303030303030303
+Ctrl.pass = hexpass:0101010101010101010101010101010101010101010101010101010101010101
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Ctrl.ad = hexad:040404040404040404040404
+Output = 512B391B6F1162975371D30919734294F868E3BE3984F3C1A13A4DB9FABE4ACB
+
+KDF = ARGON2D
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.secret = hexsecret:0303030303030303
+Ctrl.pass = hexpass:0101010101010101010101010101010101010101010101010101010101010101
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Ctrl.ad = hexad:040404040404040404040404
+Ctrl.early_clean = early_clean:1
+Output = 512B391B6F1162975371D30919734294F868E3BE3984F3C1A13A4DB9FABE4ACB
+
+KDF = ARGON2I
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.secret = hexsecret:0303030303030303
+Ctrl.pass = hexpass:0101010101010101010101010101010101010101010101010101010101010101
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Ctrl.ad = hexad:040404040404040404040404
+Output = C814D9D1DC7F37AA13F0D77F2494BDA1C8DE6B016DD388D29952A4C4672B6CE8
+
+KDF = ARGON2ID
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.secret = hexsecret:0303030303030303
+Ctrl.pass = hexpass:0101010101010101010101010101010101010101010101010101010101010101
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Ctrl.ad = hexad:040404040404040404040404
+Output = 0D640DF58D78766C08C037A34A8B53C9D01EF0452D75B65EB52520E96B01E659
+
+KDF = ARGON2D
+Ctrl.pass = hexpass:31323334353637383930
+Ctrl.salt = hexsalt:73616C7473616C74
+Output = D16AD773B1C6400D3193BC3E66271603E9DE72BACE20AF3F89C236F5434CDEC99072DDFC6B9C77EA9F386C0E8D7CB0C37CEC6EC3277A22C92D5BE58EF67C7EAA
+
+KDF = ARGON2ID
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Output = 0A34F1ABDE67086C82E785EAF17C68382259A264F4E61B91CD2763CB75AC189A
+
+KDF = ARGON2D
+Ctrl.pass = hexpass:31323334353637383930
+Ctrl.salt = hexsalt:73616C7473616C74
+Output = D16AD773B1C6400D3193BC3E66271603E9DE72BACE20AF3F89C236F5434CDEC99072DDFC6B9C77EA9F386C0E8D7CB0C37CEC6EC3277A22C92D5BE58EF67C7EAA
+
+KDF = ARGON2D
+Ctrl.lanes = lanes:2
+Ctrl.memcost = memcost:65536
+Ctrl.pass = hexpass:31323334353637383930
+Ctrl.salt = hexsalt:73616C7473616C74
+Output = 5CA0AB135DE1241454840172696C301C7B8FD99A788CD11CF9699044CADF7FCA0A6E3762CB3043A71ADF6553DB3FD7925101B0CCF8868B098492A4ADDB2486BC
+
+KDF = ARGON2I
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.pass = hexpass:0101010101010101010101010101010101010101010101010101010101010101
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Output = A9A7510E6DB4D588BA3414CD0E094D480D683F97B9CCB612A544FE8EF65BA8E0
+
+KDF = ARGON2ID
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.pass = hexpass:0101010101010101010101010101010101010101010101010101010101010101
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Output = 03AAB965C12001C9D7D0D2DE33192C0494B684BB148196D73C1DF1ACAF6D0C2E
+
+KDF = ARGON2D
+Threads = 2
+Ctrl.threads = threads:2
+Ctrl.lanes = lanes:2
+Ctrl.memcost = memcost:65536
+Ctrl.pass = pass:1234567890
+Ctrl.salt = hexsalt:73616C7473616C74
+Output = A86C83A19F0B234ECBA8C275D16D059153F961E4C39EC9B1BE98B3E73D791789363682443AD594334048634E91C493AFFED0BC29FD329A0E553C00149D6DB19AF4E4A354AEC14DBD575D78BA87D4A4BC4746666E7A4E6EE1572BBFFC2EBA308A2D825CB7B41FDE3A95D5CFF0DFA2D0FDD636B32AEA8B4A3C532742D330BD1B90
+
+KDF = ARGON2ID
+Threads = 2
+Ctrl.threads = threads:2
+Ctrl.lanes = lanes:4
+Ctrl.iter = iter:3
+Ctrl.memcost = memcost:32
+Ctrl.pass = hexpass:0101010101010101010101010101010101010101010101010101010101010101
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Output = 03AAB965C12001C9D7D0D2DE33192C0494B684BB148196D73C1DF1ACAF6D0C2E
+
+# Expected fail on condition violation: m_cost < 8 * lanes
+
+KDF = ARGON2D
+Ctrl.lanes = lanes:100
+Ctrl.memcost = memcost:799
+Ctrl.salt = hexsalt:02020202020202020202020202020202
+Output = 03AAB965C12001C9D7D0D2DE33192C0494B684BB148196D73C1DF1ACAF6D0C2E
+Result = KDF_DERIVE_ERROR
+
+# Expected fail on condition violation: m_cost < 2 * syncpoints = 8
+
+KDF = ARGON2D
+Ctrl.memcost = memcost:7
+Ctrl.pass = hexpass:31323334353637383930
+Ctrl.salt = hexsalt:73616C7473616C74
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: threads > avail threads
+
+KDF = ARGON2D
+Ctrl.threads = threads:2
+Ctrl.lanes = lanes:2
+Ctrl.memcost = memcost:65536
+Ctrl.pass = hexpass:31323334353637383930
+Ctrl.salt = hexsalt:73616C7473616C74
+Result = KDF_DERIVE_ERROR
+
+# Expected fail on condition violation: lanes >= 1
+KDF = ARGON2D
+Ctrl.lanes = lanes:0
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: lanes <= 0xFFFFFF
+KDF = ARGON2D
+Ctrl.lanes = lanes:0x1000000
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: threads >= 1
+KDF = ARGON2D
+Ctrl.lanes = threads:0
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: threads <= 0xFFFFFF
+KDF = ARGON2D
+Ctrl.lanes = threads:0x1000000
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: outlen >= 4
+KDF = ARGON2D
+Ctrl.size = size:3
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: iter >= 1
+KDF = ARGON2D
+Ctrl.iter = iter:0
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: saltlen > 8
+KDF = ARGON2D
+Ctrl.salt = hexsalt:0202
+Result = KDF_CTRL_ERROR
+
+# Expected fail on condition violation: invalid version
+KDF = ARGON2D
+Ctrl.version = version:1
+Result = KDF_CTRL_ERROR