doc: Add RFC documents

1 files changed, 756 insertions, 0 deletions

diff --git a/doc/rfc/rfc9337.txt b/doc/rfc/rfc9337.txt
new file mode 100644
index 0000000..d67bc87
--- /dev/null
+++ b/doc/rfc/rfc9337.txt
@@ -0,0 +1,756 @@
+
+
+
+
+Independent Submission                                  E. Karelina, Ed.
+Request for Comments: 9337                                      InfoTeCS
+Category: Informational                                    December 2022
+ISSN: 2070-1721
+
+
+        Generating Password-Based Keys Using the GOST Algorithms
+
+Abstract
+
+   This document specifies how to use "PKCS #5: Password-Based
+   Cryptography Specification Version 2.1" (RFC 8018) to generate a
+   symmetric key from a password in conjunction with the Russian
+   national standard GOST algorithms.
+
+   PKCS #5 applies a Pseudorandom Function (PRF) -- a cryptographic
+   hash, cipher, or Hash-Based Message Authentication Code (HMAC) -- to
+   the input password along with a salt value and repeats the process
+   many times to produce a derived key.
+
+   This specification has been developed outside the IETF.  The purpose
+   of publication being to facilitate interoperable implementations that
+   wish to support the GOST algorithms.  This document does not imply
+   IETF endorsement of the cryptographic algorithms used here.
+
+Status of This Memo
+
+   This document is not an Internet Standards Track specification; it is
+   published for informational purposes.
+
+   This is a contribution to the RFC Series, independently of any other
+   RFC stream.  The RFC Editor has chosen to publish this document at
+   its discretion and makes no statement about its value for
+   implementation or deployment.  Documents approved for publication by
+   the RFC Editor are not candidates for any level of Internet Standard;
+   see Section 2 of RFC 7841.
+
+   Information about the current status of this document, any errata,
+   and how to provide feedback on it may be obtained at
+   https://www.rfc-editor.org/info/rfc9337.
+
+Copyright Notice
+
+   Copyright (c) 2022 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents
+   (https://trustee.ietf.org/license-info) in effect on the date of
+   publication of this document.  Please review these documents
+   carefully, as they describe your rights and restrictions with respect
+   to this document.
+
+Table of Contents
+
+   1.  Introduction
+   2.  Conventions Used in This Document
+   3.  Basic Terms and Definitions
+   4.  Algorithm for Generating a Key from a Password
+   5.  Data Encryption
+     5.1.  GOST R 34.12-2015 Data Encryption
+       5.1.1.  Encryption
+       5.1.2.  Decryption
+   6.  Message Authentication
+     6.1.  MAC Generation
+     6.2.  MAC Verification
+   7.  Identifiers and Parameters
+     7.1.  PBKDF2
+     7.2.  PBES2
+     7.3.  Identifier and Parameters of Gost34.12-2015 Encryption
+           Scheme
+     7.4.  PBMAC1
+   8.  Security Considerations
+   9.  IANA Considerations
+   10. References
+     10.1.  Normative References
+     10.2.  Informative References
+   Appendix A.  PBKDF2 HMAC_GOSTR3411 Test Vectors
+   Acknowledgments
+   Author's Address
+
+1.  Introduction
+
+   This document provides a specification of usage of GOST R 34.12-2015
+   encryption algorithms and the GOST R 34.11-2012 hashing functions
+   with PKCS #5.  The methods described in this document are designed to
+   generate key information using the user's password and to protect
+   information using the generated keys.
+
+2.  Conventions Used in This Document
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
+   "OPTIONAL" in this document are to be interpreted as described in
+   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
+   capitals, as shown here.
+
+3.  Basic Terms and Definitions
+
+   Throughout this document, the following notation is used:
+
+     +==========+====================================================+
+     | Notation | Definition                                         |
+     +==========+====================================================+
+     | P        | a password encoded as a Unicode UTF-8 string       |
+     +----------+----------------------------------------------------+
+     | S        | a random initializing value                        |
+     +----------+----------------------------------------------------+
+     | c        | a number of iterations of algorithm, a positive    |
+     |          | integer                                            |
+     +----------+----------------------------------------------------+
+     | dkLen    | a length in octets of derived key, a positive      |
+     |          | integer                                            |
+     +----------+----------------------------------------------------+
+     | DK       | a derived key of length dkLen                      |
+     +----------+----------------------------------------------------+
+     | B_n      | a set of all octet strings of length n, n >= 0; if |
+     |          | n = 0, then the set B_n consists of an empty       |
+     |          | string of length 0                                 |
+     +----------+----------------------------------------------------+
+     | A||C     | a concatenation of two octet strings A, C, i.e., a |
+     |          | vector from B_(|A|+|C|), where the left subvector  |
+     |          | from B_(|A|) is equal to the vector A and the      |
+     |          | right subvector from B_(|C|) is equal to the       |
+     |          | vector C: A = (a_(n_1),...,a_1) in B_(n_1) and C = |
+     |          | (c_(n_2),..., c_1) in B_(n_2), res =               |
+     |          | (a_(n_1),...,a_1,c_(n_2),..., c_1) in B_(n_1+n_2)) |
+     +----------+----------------------------------------------------+
+     | \xor     | a bit-wise exclusive-or of two octet strings of    |
+     |          | the same length                                    |
+     +----------+----------------------------------------------------+
+     | MSB^n_r: | a truncating of an octet string to size r by       |
+     | B_n ->   | removing the least significant n-r octets:         |
+     | B_r      | MSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1)         |
+     |          | =(a_n,...,a_(n-r+1))                               |
+     +----------+----------------------------------------------------+
+     | LSB^n_r: | a truncating of an octet string to size r by       |
+     | B_n ->   | removing the most significant n-r octets:          |
+     | B_r      | LSB^n_r(a_n,...,a_(n-r+1),a_(n-r),...,a_1)         |
+     |          | =(a_r,...,a_1)                                     |
+     +----------+----------------------------------------------------+
+     | Int(i)   | a four-octet encoding of the integer i =< 2^32:    |
+     |          | (i_1, i_2, i_3, i_4) in B_4, i = i_1 + 2^8 * i_2 + |
+     |          | 2^16 * i_3 + 2^24 * i_4                            |
+     +----------+----------------------------------------------------+
+     | b[i, j]  | a substring extraction operator, extracts octets i |
+     |          | through j, 0 =< i =< j                             |
+     +----------+----------------------------------------------------+
+     | CEIL(x)  | the smallest integer greater than or equal to x    |
+     +----------+----------------------------------------------------+
+
+                       Table 1: Terms and Definitions
+
+   This document uses the following abbreviations and symbols:
+
+    +================+===============================================+
+    | Abbreviations  | Definition                                    |
+    | and Symbols    |                                               |
+    +================+===============================================+
+    | HMAC_GOSTR3411 | Hashed-Based Message Authentication Code.  A  |
+    |                | function for calculating a Message            |
+    |                | Authentication Code (MAC) based on the GOST R |
+    |                | 34.11-2012 hash function (see [RFC6986]) with |
+    |                | 512-bit output in accordance with [RFC2104].  |
+    +----------------+-----------------------------------------------+
+
+                    Table 2: Abbreviations and Symbols
+
+4.  Algorithm for Generating a Key from a Password
+
+   The DK is calculated by means of a key derivation function PBKDF2 (P,
+   S, c, dkLen) (see [RFC8018], Section 5.2) using the HMAC_GOSTR3411
+   function as the PRF:
+
+         DK = PBKDF2 (P, S, c, dkLen).
+
+   The PBKDF2 function is defined as the following algorithm:
+
+   1.  If dkLen > (2^32 - 1) * 64, output "derived key too long" and
+       stop.
+
+   2.  Calculate n = CEIL (dkLen / 64).
+
+   3.  Calculate a set of values for each i from 1 to n:
+
+          U_1(i) = HMAC_GOSTR3411 (P, S || INT (i)),
+
+          U_2(i) = HMAC_GOSTR3411 (P, U_1(i)),
+
+          ...
+
+          U_c(i) = HMAC_GOSTR3411 (P, U_(c-1)(i)),
+
+          T(i) = U_1(i) \xor U_2(i) \xor ... \xor U_c(i).
+
+   4.  Concatenate the octet strings T(i) and extract the first dkLen
+       octets to produce a derived key DK:
+
+       *  DK = MSB^(n * 64)_dkLen(T(1)||T(2)||...||T(n))
+
+5.  Data Encryption
+
+5.1.  GOST R 34.12-2015 Data Encryption
+
+   Data encryption using the DK is carried out in accordance with the
+   PBES2 scheme (see [RFC8018], Section 6.2) using GOST R 34.12-2015 in
+   CTR_ACPKM mode (see [RFC8645]).
+
+5.1.1.  Encryption
+
+   The encryption process for PBES2 consists of the following steps:
+
+   1.  Select the random value S of a length from 8 to 32 octets.
+
+   2.  Select the iteration count c depending on the conditions of use
+       (see [GostPkcs5]).  The minimum allowable value for the parameter
+       is 1000.
+
+   3.  Set the value dkLen = 32.
+
+   4.  Apply the key derivation function to the password P, the random
+       value S, and the iteration count c to produce a derived key DK of
+       length dkLen octets in accordance with the algorithm from
+       Section 4.  Generate the sequence T(1) and truncate it to 32
+       octets, i.e.,
+
+          DK = PBKDF2 (P, S, c, 32) = MSB^64_32(T(1)).
+
+   5.  Generate the random value ukm of size n, where n takes a value of
+       12 or 16 octets depending on the selected encryption algorithm:
+
+       *  GOST R 34.12-2015 "Kuznyechik" n = 16 (see [RFC7801])
+
+       *  GOST R 34.12-2015 "Magma" n = 12 (see [RFC8891])
+
+   6.  Set the value S' = ukm[1..n-8].
+
+   7.  For the id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-
+       kuznyechik-ctracpkm algorithms (see Section 7.3), encrypt the
+       message M with the GOST R 34.12-2015 algorithm with the derived
+       key DK and the random value S' to produce a ciphertext C.
+
+   8.  For the id-gostr3412-2015-magma-ctracpkm-omac and id-
+       gostr3412-2015-kuznyechik-ctracpkm-omac algorithms (see
+       Section 7.3), encrypt the message M with the GOST R 34.12-2015
+       algorithm with the derived key DK and the ukm in accordance with
+       the following steps:
+
+       *  Generate two keys from the derived key DK using the
+          KDF_TREE_GOSTR3411_2012_256 algorithm (see [RFC7836]):
+
+             encryption key K(1)
+
+             MAC key K(2)
+
+          Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm
+          take the following values:
+
+             K_in = DK
+
+             label = "kdf tree" (8 octets)
+
+             seed = ukm[n-7..n]
+
+             R = 1
+
+          The input string label above is encoded using ASCII (see
+          [RFC0020]).
+
+       *  Compute the MAC for the message M using the K(2) key in
+          accordance with the GOST R 34.12-2015 algorithm.  Append the
+          computed MAC value to the message M: M||MAC.
+
+       *  Encrypt the resulting octet string with MAC with the GOST R
+          34.12-2015 algorithm with the derived key K(1) and the random
+          value S' to produce a ciphertext C.
+
+   9.  Serialize the parameters S, c, and ukm as algorithm parameters in
+       accordance with Section 7.2.
+
+5.1.2.  Decryption
+
+   The decryption process for PBES2 consists of the following steps:
+
+   1.  Set the value dkLen = 32.
+
+   2.  Apply the key derivation function PBKDF2 to the password P, the
+       random value S, and the iteration count c to produce a derived
+       key DK of length dkLen octets in accordance with the algorithm
+       from Section 4.  Generate the sequence T(1) and truncate it to 32
+       octets, i.e., DK = PBKFD2 (P, S, c, 32) = MSB^64_32(T(1)).
+
+   3.  Set the value S' = ukm[1..n-8], where n is the size of ukm in
+       octets.
+
+   4.  For the id-gostr3412-2015-magma-ctracpkm and id-gostr3412-2015-
+       kuznyechik-ctracpkm algorithms (see Section 7.3), decrypt the
+       ciphertext C with the GOST R 34.12-2015 algorithm with the
+       derived key DK and the random value S' to produce the message M.
+
+   5.  For id-gostr3412-2015-magma-ctracpkm-omac and id-gostr3412-2015-
+       kuznyechik-ctracpkm-omac algorithms (see Section 7.3), decrypt
+       the ciphertext C with the GOST R 34.12-2015 algorithm with the
+       derived key DK and the ukm in accordance with the following
+       steps:
+
+       *  Generate two keys from the derived key DK using the
+          KDF_TREE_GOSTR3411_2012_256 algorithm:
+
+             encryption key K(1)
+
+             MAC key K(2)
+
+          Input parameters for the KDF_TREE_GOSTR3411_2012_256 algorithm
+          take the following values:
+
+             K_in = DK
+
+             label = "kdf tree" (8 octets)
+
+             seed = ukm[n-7..n]
+
+             R = 1
+
+          The input string label above is encoded using ASCII (see
+          [RFC0020]).
+
+       *  Decrypt the ciphertext C with the GOST R 34.12-2015 algorithm
+          with the derived key K(1) and the random value S' to produce
+          the plaintext.  The last k octets of the text are the MAC,
+          where k depends on the selected encryption algorithm.
+
+       *  Compute the MAC for the text[1..m - k] using the K(2) key in
+          accordance with GOST R 34.12-2015 algorithm, where m is the
+          size of text.
+
+       *  Compare the computing MAC and the receiving MAC.  If the sizes
+          or values do not match, the message is distorted.
+
+6.  Message Authentication
+
+   The PBMAC1 scheme is used for message authentication (see [RFC8018],
+   Section 7.1).  This scheme is based on the HMAC_GOSTR3411 function.
+
+6.1.  MAC Generation
+
+   The MAC generation operation for PBMAC1 consists of the following
+   steps:
+
+   1.  Select the random value S of a length from 8 to 32 octets.
+
+   2.  Select the iteration count c depending on the conditions of use
+       (see [GostPkcs5]).  The minimum allowable value for the parameter
+       is 1000.
+
+   3.  Set the dkLen to at least 32 octets.  The number of octets
+       depends on previous parameter values.
+
+   4.  Apply the key derivation function to the password P, the random
+       value S, and the iteration count c to generate a sequence K of
+       length dkLen octets in accordance with the algorithm from
+       Section 4.
+
+   5.  Truncate the sequence K to 32 octets to get the derived key DK,
+       i.e., DK = LSB^dkLen_32(K).
+
+   6.  Process the message M with the underlying message authentication
+       scheme with the derived key DK to generate a message
+       authentication code T.
+
+   7.  Save the parameters S and c as algorithm parameters in accordance
+       with Section 7.4.
+
+6.2.  MAC Verification
+
+   The MAC verification operation for PBMAC1 consists of the following
+   steps:
+
+   1.  Set the dkLen to at least 32 octets.  The number of octets
+       depends on previous parameter values.
+
+   2.  Apply the key derivation function to the password P, the random
+       value S, and the iteration count c to generate a sequence K of
+       length dkLen octets in accordance with the algorithm from
+       Section 4.
+
+   3.  Truncate the sequence K to 32 octets to get the derived key DK,
+       i.e., DK = LSB^dkLen_32(K).
+
+   4.  Process the message M with the underlying message authentication
+       scheme with the derived key DK to generate a MAC.
+
+   5.  Compare the computing MAC and the receiving MAC.  If the sizes or
+       values do not match, the message is distorted.
+
+7.  Identifiers and Parameters
+
+   This section defines the ASN.1 syntax for the key derivation
+   functions, the encryption schemes, the message authentication scheme,
+   and supporting techniques (see [RFC8018]).
+
+   rsadsi OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) 113549 }
+   pkcs OBJECT IDENTIFIER ::= { rsadsi 1 }
+   pkcs-5 OBJECT IDENTIFIER ::= { pkcs 5 }
+
+7.1.  PBKDF2
+
+   The Object Identifier (OID) id-PBKDF2 identifies the PBKDF2 key
+   derivation function:
+
+   id-PBKDF2 OBJECT IDENTIFIER ::= { pkcs-5 12 }
+
+   The parameters field associated with this OID in an
+   AlgorithmIdentifier SHALL have type PBKDF2-params:
+
+   PBKDF2-params ::= SEQUENCE
+   {
+       salt            CHOICE
+       {
+           specified       OCTET STRING,
+           otherSource     AlgorithmIdentifier {{PBKDF2-SaltSources}}
+       },
+       iterationCount  INTEGER (1000..MAX),
+       keyLength       INTEGER (32..MAX) OPTIONAL,
+       prf             AlgorithmIdentifier {{PBKDF2-PRFs}}
+   }
+
+   The fields of type PBKDF2-params have the following meanings:
+
+   *  salt contains the random value S in OCTET STRING.
+
+   *  iterationCount specifies the iteration count c.
+
+   *  keyLength is the length of the derived key in octets.  It is an
+      optional field for the PBES2 scheme since it is always 32 octets.
+      It MUST be present for the PBMAC1 scheme and MUST be at least 32
+      octets since the HMAC_GOSTR3411 function has a variable key size.
+
+   *  prf identifies the pseudorandom function.  The identifier value
+      MUST be id-tc26-hmac-gost-3411-12-512 and the parameters value
+      must be NULL:
+
+   id-tc26-hmac-gost-3411-12-512 OBJECT IDENTIFIER ::=
+   {
+       iso(1) member-body(2) ru(643) reg7(7)
+       tk26(1) algorithms(1) hmac(4) 512(2)
+   }
+
+7.2.  PBES2
+
+   The OID id-PBES2 identifies the PBES2 encryption scheme:
+
+   id-PBES2 OBJECT IDENTIFIER ::= { pkcs-5 13 }
+
+   The parameters field associated with this OID in an
+   AlgorithmIdentifier SHALL have type PBES2-params:
+
+   PBES2-params ::= SEQUENCE
+   {
+       keyDerivationFunc   AlgorithmIdentifier { { PBES2-KDFs } },
+       encryptionScheme    AlgorithmIdentifier { { PBES2-Encs } }
+   }
+
+   The fields of type PBES2-params have the following meanings:
+
+   *  keyDerivationFunc identifies the key derivation function in
+      accordance with Section 7.1.
+
+   *  encryptionScheme identifies the encryption scheme in accordance
+      with Section 7.3.
+
+7.3.  Identifier and Parameters of Gost34.12-2015 Encryption Scheme
+
+   The Gost34.12-2015 encryption algorithm identifier SHALL take one of
+   the following values:
+
+   id-gostr3412-2015-magma-ctracpkm OBJECT IDENTIFIER ::=
+   {
+       iso(1) member-body(2) ru(643) rosstandart(7)
+       tc26(1) algorithms(1) cipher(5)
+       gostr3412-2015-magma(1) mode-ctracpkm(1)
+   }
+
+   When the id-gostr3412-2015-magma-ctracpkm identifier is used, the
+   data is encrypted by the GOST R 34.12-2015 Magma cipher in CTR_ACPKM
+   mode in accordance with [RFC8645].  The block size is 64 bits and the
+   section size is fixed within a specific protocol based on the
+   requirements of the system capacity and the key lifetime.
+
+   id-gostr3412-2015-magma-ctracpkm-omac OBJECT IDENTIFIER ::=
+   {
+       iso(1) member-body(2) ru(643) rosstandart(7)
+       tc26(1) algorithms(1) cipher(5)
+       gostr3412-2015-magma(1) mode-ctracpkm-omac(2)
+   }
+
+   When the id-gostr3412-2015-magma-ctracpkm-omac identifier is used,
+   the data is encrypted by the GOST R 34.12-2015 Magma cipher in
+   CTR_ACPKM mode in accordance with [RFC8645] and the MAC is computed
+   by the GOST R 34.12-2015 Magma cipher in MAC mode (MAC size is 64
+   bits).  The block size is 64 bits and the section size is fixed
+   within a specific protocol based on the requirements of the system
+   capacity and the key lifetime.
+
+   id-gostr3412-2015-kuznyechik-ctracpkm OBJECT IDENTIFIER ::=
+   {
+       iso(1) member-body(2) ru(643) rosstandart(7)
+       tc26(1) algorithms(1) cipher(5)
+       gostr3412-2015-kuznyechik(2) mode-ctracpkm(1)
+   }
+
+   When the id-gostr3412-2015-kuznyechik-ctracpkm identifier is used,
+   the data is encrypted by the GOST R 34.12-2015 Kuznyechik cipher in
+   CTR_ACPKM mode in accordance with [RFC8645].  The block size is 128
+   bits and the section size is fixed within a specific protocol based
+   on the requirements of the system capacity and the key lifetime.
+
+   id-gostr3412-2015-kuznyechik-ctracpkm-omac OBJECT IDENTIFIER ::=
+   {
+       iso(1) member-body(2) ru(643) rosstandart(7)
+       tc26(1) algorithms(1) cipher(5)
+       gostr3412-2015-kuznyechik(2) mode-ctracpkm-omac(2)
+   }
+
+   When the id-gostr3412-2015-kuznyechik-ctracpkm-omac identifier is
+   used, the data is encrypted by the GOST R 34.12-2015 Kuznyechik
+   cipher in CTR_ACPKM mode in accordance with [RFC8645] and MAC is
+   computed by the GOST R 34.12-2015 Kuznyechik cipher in MAC mode (MAC
+   size is 128 bits).  The block size is 128 bits and the section size
+   is fixed within a specific protocol based on the requirements of the
+   system capacity and the key lifetime.
+
+   The parameters field in an AlgorithmIdentifier SHALL have type
+   Gost3412-15-Encryption-Parameters:
+
+   Gost3412-15-Encryption-Parameters ::= SEQUENCE
+   {
+       ukm OCTET STRING
+   }
+
+   The field of type Gost3412-15-Encryption-Parameters have the
+   following meanings:
+
+   *  ukm MUST be present and MUST contain n octets.  Its value depends
+      on the selected encryption algorithm:
+
+      -  GOST R 34.12-2015 "Kuznyechik" n = 16 (see [RFC7801])
+
+      -  GOST R 34.12-2015 "Magma" n = 12 (see [RFC8891])
+
+7.4.  PBMAC1
+
+   The OID id-PBMAC1 identifies the PBMAC1 message authentication
+   scheme:
+
+   id-PBMAC1 OBJECT IDENTIFIER ::= { pkcs-5 14 }
+
+   The parameters field associated with this OID in an
+   AlgorithmIdentifier SHALL have type PBMAC1-params:
+
+   PBMAC1-params ::=  SEQUENCE
+   {
+       keyDerivationFunc AlgorithmIdentifier { { PBMAC1-KDFs } },
+       messageAuthScheme AlgorithmIdentifier { { PBMAC1-MACs } }
+   }
+
+   The fields of type PBMAC1-params have the following meanings:
+
+   *  keyDerivationFunc is the identifier and parameters of key
+      derivation function in accordance with Section 7.1.
+
+   *  messageAuthScheme is the identifier and parameters of the
+      HMAC_GOSTR3411 algorithm.
+
+8.  Security Considerations
+
+   For information on security considerations for password-based
+   cryptography, see [RFC8018].
+
+   Conforming applications MUST use unique values for ukm and S in order
+   to avoid the encryption of different data on the same keys with the
+   same initialization vector.
+
+   It is RECOMMENDED that parameter S consist of at least 32 octets of
+   pseudorandom data in order to reduce the probability of collisions of
+   keys generated from the same password.
+
+9.  IANA Considerations
+
+   This document has no IANA actions.
+
+10.  References
+
+10.1.  Normative References
+
+   [GostPkcs5]
+              Potashnikov, A., Karelina, E., Pianov, S., and A.
+              Naumenko, "Information technology. Cryptographic Data
+              Security. Password-based key security.",
+              R 1323565.1.040-2022. Federal Agency on Technical
+              Regulating and Metrology (In Russian).
+
+   [RFC0020]  Cerf, V., "ASCII format for network interchange", STD 80,
+              RFC 20, DOI 10.17487/RFC0020, October 1969,
+              <https://www.rfc-editor.org/info/rfc20>.
+
+   [RFC2104]  Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
+              Hashing for Message Authentication", RFC 2104,
+              DOI 10.17487/RFC2104, February 1997,
+              <https://www.rfc-editor.org/info/rfc2104>.
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119,
+              DOI 10.17487/RFC2119, March 1997,
+              <https://www.rfc-editor.org/info/rfc2119>.
+
+   [RFC6986]  Dolmatov, V., Ed. and A. Degtyarev, "GOST R 34.11-2012:
+              Hash Function", RFC 6986, DOI 10.17487/RFC6986, August
+              2013, <https://www.rfc-editor.org/info/rfc6986>.
+
+   [RFC7801]  Dolmatov, V., Ed., "GOST R 34.12-2015: Block Cipher
+              "Kuznyechik"", RFC 7801, DOI 10.17487/RFC7801, March 2016,
+              <https://www.rfc-editor.org/info/rfc7801>.
+
+   [RFC7836]  Smyshlyaev, S., Ed., Alekseev, E., Oshkin, I., Popov, V.,
+              Leontiev, S., Podobaev, V., and D. Belyavsky, "Guidelines
+              on the Cryptographic Algorithms to Accompany the Usage of
+              Standards GOST R 34.10-2012 and GOST R 34.11-2012",
+              RFC 7836, DOI 10.17487/RFC7836, March 2016,
+              <https://www.rfc-editor.org/info/rfc7836>.
+
+   [RFC8018]  Moriarty, K., Ed., Kaliski, B., and A. Rusch, "PKCS #5:
+              Password-Based Cryptography Specification Version 2.1",
+              RFC 8018, DOI 10.17487/RFC8018, January 2017,
+              <https://www.rfc-editor.org/info/rfc8018>.
+
+   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
+              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
+              May 2017, <https://www.rfc-editor.org/info/rfc8174>.
+
+   [RFC8645]  Smyshlyaev, S., Ed., "Re-keying Mechanisms for Symmetric
+              Keys", RFC 8645, DOI 10.17487/RFC8645, August 2019,
+              <https://www.rfc-editor.org/info/rfc8645>.
+
+   [RFC8891]  Dolmatov, V., Ed. and D. Baryshkov, "GOST R 34.12-2015:
+              Block Cipher "Magma"", RFC 8891, DOI 10.17487/RFC8891,
+              September 2020, <https://www.rfc-editor.org/info/rfc8891>.
+
+10.2.  Informative References
+
+   [RFC6070]  Josefsson, S., "PKCS #5: Password-Based Key Derivation
+              Function 2 (PBKDF2) Test Vectors", RFC 6070,
+              DOI 10.17487/RFC6070, January 2011,
+              <https://www.rfc-editor.org/info/rfc6070>.
+
+Appendix A.  PBKDF2 HMAC_GOSTR3411 Test Vectors
+
+   These test vectors are formed by analogy with test vectors from
+   [RFC6070].  The input strings below are encoded using ASCII (see
+   [RFC0020]).  The sequence "\0" (without quotation marks) means a
+   literal ASCII NULL value (1 octet).  "DK" refers to the derived key.
+
+   Input:
+       P = "password" (8 octets)
+       S = "salt" (4 octets)
+       c = 1
+       dkLen = 64
+
+   Output:
+       DK = 64 77 0a f7 f7 48 c3 b1 c9 ac 83 1d bc fd 85 c2
+            61 11 b3 0a 8a 65 7d dc 30 56 b8 0c a7 3e 04 0d
+            28 54 fd 36 81 1f 6d 82 5c c4 ab 66 ec 0a 68 a4
+            90 a9 e5 cf 51 56 b3 a2 b7 ee cd db f9 a1 6b 47
+
+   Input:
+       P = "password" (8 octets)
+       S = "salt" (4 octets)
+       c = 2
+       dkLen = 64
+
+   Output:
+       DK = 5a 58 5b af df bb 6e 88 30 d6 d6 8a a3 b4 3a c0
+            0d 2e 4a eb ce 01 c9 b3 1c 2c ae d5 6f 02 36 d4
+            d3 4b 2b 8f bd 2c 4e 89 d5 4d 46 f5 0e 47 d4 5b
+            ba c3 01 57 17 43 11 9e 8d 3c 42 ba 66 d3 48 de
+
+   Input:
+       P = "password" (8 octets)
+       S = "salt" (4 octets)
+       c = 4096
+       dkLen = 64
+
+   Output:
+       DK = e5 2d eb 9a 2d 2a af f4 e2 ac 9d 47 a4 1f 34 c2
+            03 76 59 1c 67 80 7f 04 77 e3 25 49 dc 34 1b c7
+            86 7c 09 84 1b 6d 58 e2 9d 03 47 c9 96 30 1d 55
+            df 0d 34 e4 7c f6 8f 4e 3c 2c da f1 d9 ab 86 c3
+
+   Input:
+       P = "password" (8 octets)
+       S = "salt" (4 octets)
+       c = 16777216
+       dkLen = 64
+
+   Output:
+       DK = 49 e4 84 3b ba 76 e3 00 af e2 4c 4d 23 dc 73 92
+            de f1 2f 2c 0e 24 41 72 36 7c d7 0a 89 82 ac 36
+            1a db 60 1c 7e 2a 31 4e 8c b7 b1 e9 df 84 0e 36
+            ab 56 15 be 5d 74 2b 6c f2 03 fb 55 fd c4 80 71
+
+   Input:
+       P = "passwordPASSWORDpassword" (24 octets)
+       S = "saltSALTsaltSALTsaltSALTsaltSALTsalt" (36 octets)
+       c = 4096
+       dkLen = 100
+
+   Output:
+       DK = b2 d8 f1 24 5f c4 d2 92 74 80 20 57 e4 b5 4e 0a
+            07 53 aa 22 fc 53 76 0b 30 1c f0 08 67 9e 58 fe
+            4b ee 9a dd ca e9 9b a2 b0 b2 0f 43 1a 9c 5e 50
+            f3 95 c8 93 87 d0 94 5a ed ec a6 eb 40 15 df c2
+            bd 24 21 ee 9b b7 11 83 ba 88 2c ee bf ef 25 9f
+            33 f9 e2 7d c6 17 8c b8 9d c3 74 28 cf 9c c5 2a
+            2b aa 2d 3a
+
+   Input:
+       P = "pass\0word" (9 octets)
+       S = "sa\0lt" (5 octets)
+       c = 4096
+       dkLen = 64
+
+   Output:
+       DK = 50 df 06 28 85 b6 98 01 a3 c1 02 48 eb 0a 27 ab
+            6e 52 2f fe b2 0c 99 1c 66 0f 00 14 75 d7 3a 4e
+            16 7f 78 2c 18 e9 7e 92 97 6d 9c 1d 97 08 31 ea
+            78 cc b8 79 f6 70 68 cd ac 19 10 74 08 44 e8 30
+
+Acknowledgments
+
+   The author thanks Potashnikov Alexander, Pianov Semen, Davletshina
+   Alexandra, Belyavsky Dmitry, and Smyslov Valery for their careful
+   readings and useful comments.
+
+Author's Address
+
+   Ekaterina Karelina (editor)
+   InfoTeCS
+   2B stroenie 1, ul. Otradnaya
+   Moscow
+   127273
+   Russian Federation
+   Email: Ekaterina.Karelina@infotecs.ru