mbedtls_pkcs5_pbkdf2_hmac accepts PBKDF2 count 0 and derives the same key as count 1 #10836

Summary

• Version: Mbed TLS 2.28.10 and 3.6.7.

• Public/native API: mbedtls_pkcs5_pbkdf2_hmac.

• Observed result: for PBKDF2-HMAC-SHA256 with password password, salt salt, output length 32, and count 0, the call returned 0 and wrote: 120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b.

• Effective control: the same call with count 1 also returned 0 and wrote the same 32-byte value.

• Standard/API conflict: RFC 8018 defines the PBKDF2 count input as a positive integer. This public PKCS#5 API accepts zero and returns derived key bytes.

This report is scoped to the public PKCS#5 API present in the 2.28 and 3.6 release lines.

Minimal reproducer

The attached repro.cpp is deterministic and uses only mbedtls_pkcs5_pbkdf2_hmac. It compares:

• count_1: count 1
• count_0: count 0

All other inputs are fixed.

Build and run

export MBEDTLS_ROOT=/path/to/mbedtls-release
export MBEDTLS_LIB=/path/to/libmbedcrypto.a
./build.sh
./run.sh

Observed behavior

Mbed TLS 3.6.7:

row,library,version,algorithm,api,param,case,count,return_value,success,out_prefix8,out_hex,matches_count_1 case,mbedTLS,Mbed TLS 3.6.7,PBKDF2-HMAC-SHA256,mbedtls_pkcs5_pbkdf2_hmac,count,count_1,1,0,true,120fb6cffcf8b32c,120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b,true
case,mbedTLS,Mbed TLS 3.6.7,PBKDF2-HMAC-SHA256,mbedtls_pkcs5_pbkdf2_hmac,count,count_0,0,0,true,120fb6cffcf8b32c,120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b,true
result,count_0_accepted_and_equal_to_count_1

Mbed TLS 2.28.10:

row,library,version,algorithm,api,param,case,count,return_value,success,out_prefix8,out_hex,matches_count_1
case,mbedTLS,Mbed TLS 2.28.10,PBKDF2-HMAC-SHA256,mbedtls_pkcs5_pbkdf2_hmac,count,count_1,1,0,true,120fb6cffcf8b32c,120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b,true
case,mbedTLS,Mbed TLS 2.28.10,PBKDF2-HMAC-SHA256,mbedtls_pkcs5_pbkdf2_hmac,count,count_0,0,0,true,120fb6cffcf8b32c,120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b,true
result,count_0_accepted_and_equal_to_count_1

Expected behavior

The count-0 call should return an mbedTLS error code and should not produce derived key bytes. RFC 8018 defines the PBKDF2 count input as a positive integer, so count = 0 is outside the valid PBKDF2 input domain.

If accepting count = 0 as equivalent to count = 1 is intentional for compatibility, that behavior should be documented explicitly.

build.sh
repro.cpp
run.sh