Refactor Rfc2898DeriveBytes to support spans #71888
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Since the managed
Rfc2898DeriveBytes
is used to implement the one-shots on some platforms, this changes the internals of it to better support spans.I took this approach as an alternative to a pure one-shot managed PBKDF2 implementation to use as much existing, battle tested code as possible to increase the chances that it will be taken in time for .NET 7.
I investigated using the native PBKDF2 capabilities for Android and determined that unfortunately Android's APIs are not suitable for our needs for two reasons. First, it requires API Level 26 for SHA2 PBKDF2, which means we would still need the managed fallback since we support older Android versions. Second, it operates entirely on
Char[]
passwords, notByte[]
. We can't feed arbitrary bytes in to Java character arrays.