1 /*
2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22 * SOFTWARE.
23 */
24
25 #include "inner.h"
26
27 #define F(B, C, D) ((((C) ^ (D)) & (B)) ^ (D))
28 #define G(B, C, D) ((B) ^ (C) ^ (D))
29 #define H(B, C, D) (((D) & (C)) | (((D) | (C)) & (B)))
30 #define I(B, C, D) G(B, C, D)
31
32 #define ROTL(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
33
34 #define K1 ((uint32_t)0x5A827999)
35 #define K2 ((uint32_t)0x6ED9EBA1)
36 #define K3 ((uint32_t)0x8F1BBCDC)
37 #define K4 ((uint32_t)0xCA62C1D6)
38
39 /* see inner.h */
40 const uint32_t br_sha1_IV[5] = {
41 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
42 };
43
44 /* see inner.h */
45 void
br_sha1_round(const unsigned char * buf,uint32_t * val)46 br_sha1_round(const unsigned char *buf, uint32_t *val)
47 {
48 uint32_t m[80];
49 uint32_t a, b, c, d, e;
50 int i;
51
52 a = val[0];
53 b = val[1];
54 c = val[2];
55 d = val[3];
56 e = val[4];
57 br_range_dec32be(m, 16, buf);
58 for (i = 16; i < 80; i ++) {
59 uint32_t x = m[i - 3] ^ m[i - 8] ^ m[i - 14] ^ m[i - 16];
60 m[i] = ROTL(x, 1);
61 }
62
63 for (i = 0; i < 20; i += 5) {
64 e += ROTL(a, 5) + F(b, c, d) + K1 + m[i + 0]; b = ROTL(b, 30);
65 d += ROTL(e, 5) + F(a, b, c) + K1 + m[i + 1]; a = ROTL(a, 30);
66 c += ROTL(d, 5) + F(e, a, b) + K1 + m[i + 2]; e = ROTL(e, 30);
67 b += ROTL(c, 5) + F(d, e, a) + K1 + m[i + 3]; d = ROTL(d, 30);
68 a += ROTL(b, 5) + F(c, d, e) + K1 + m[i + 4]; c = ROTL(c, 30);
69 }
70 for (i = 20; i < 40; i += 5) {
71 e += ROTL(a, 5) + G(b, c, d) + K2 + m[i + 0]; b = ROTL(b, 30);
72 d += ROTL(e, 5) + G(a, b, c) + K2 + m[i + 1]; a = ROTL(a, 30);
73 c += ROTL(d, 5) + G(e, a, b) + K2 + m[i + 2]; e = ROTL(e, 30);
74 b += ROTL(c, 5) + G(d, e, a) + K2 + m[i + 3]; d = ROTL(d, 30);
75 a += ROTL(b, 5) + G(c, d, e) + K2 + m[i + 4]; c = ROTL(c, 30);
76 }
77 for (i = 40; i < 60; i += 5) {
78 e += ROTL(a, 5) + H(b, c, d) + K3 + m[i + 0]; b = ROTL(b, 30);
79 d += ROTL(e, 5) + H(a, b, c) + K3 + m[i + 1]; a = ROTL(a, 30);
80 c += ROTL(d, 5) + H(e, a, b) + K3 + m[i + 2]; e = ROTL(e, 30);
81 b += ROTL(c, 5) + H(d, e, a) + K3 + m[i + 3]; d = ROTL(d, 30);
82 a += ROTL(b, 5) + H(c, d, e) + K3 + m[i + 4]; c = ROTL(c, 30);
83 }
84 for (i = 60; i < 80; i += 5) {
85 e += ROTL(a, 5) + I(b, c, d) + K4 + m[i + 0]; b = ROTL(b, 30);
86 d += ROTL(e, 5) + I(a, b, c) + K4 + m[i + 1]; a = ROTL(a, 30);
87 c += ROTL(d, 5) + I(e, a, b) + K4 + m[i + 2]; e = ROTL(e, 30);
88 b += ROTL(c, 5) + I(d, e, a) + K4 + m[i + 3]; d = ROTL(d, 30);
89 a += ROTL(b, 5) + I(c, d, e) + K4 + m[i + 4]; c = ROTL(c, 30);
90 }
91
92 val[0] += a;
93 val[1] += b;
94 val[2] += c;
95 val[3] += d;
96 val[4] += e;
97 }
98
99 /* see bearssl.h */
100 void
br_sha1_init(br_sha1_context * cc)101 br_sha1_init(br_sha1_context *cc)
102 {
103 cc->vtable = &br_sha1_vtable;
104 memcpy(cc->val, br_sha1_IV, sizeof cc->val);
105 cc->count = 0;
106 }
107
108 /* see bearssl.h */
109 void
br_sha1_update(br_sha1_context * cc,const void * data,size_t len)110 br_sha1_update(br_sha1_context *cc, const void *data, size_t len)
111 {
112 const unsigned char *buf;
113 size_t ptr;
114
115 buf = data;
116 ptr = (size_t)cc->count & 63;
117 while (len > 0) {
118 size_t clen;
119
120 clen = 64 - ptr;
121 if (clen > len) {
122 clen = len;
123 }
124 memcpy(cc->buf + ptr, buf, clen);
125 ptr += clen;
126 buf += clen;
127 len -= clen;
128 cc->count += (uint64_t)clen;
129 if (ptr == 64) {
130 br_sha1_round(cc->buf, cc->val);
131 ptr = 0;
132 }
133 }
134 }
135
136 /* see bearssl.h */
137 void
br_sha1_out(const br_sha1_context * cc,void * dst)138 br_sha1_out(const br_sha1_context *cc, void *dst)
139 {
140 unsigned char buf[64];
141 uint32_t val[5];
142 size_t ptr;
143
144 ptr = (size_t)cc->count & 63;
145 memcpy(buf, cc->buf, ptr);
146 memcpy(val, cc->val, sizeof val);
147 buf[ptr ++] = 0x80;
148 if (ptr > 56) {
149 memset(buf + ptr, 0, 64 - ptr);
150 br_sha1_round(buf, val);
151 memset(buf, 0, 56);
152 } else {
153 memset(buf + ptr, 0, 56 - ptr);
154 }
155 br_enc64be(buf + 56, cc->count << 3);
156 br_sha1_round(buf, val);
157 br_range_enc32be(dst, val, 5);
158 }
159
160 /* see bearssl.h */
161 uint64_t
br_sha1_state(const br_sha1_context * cc,void * dst)162 br_sha1_state(const br_sha1_context *cc, void *dst)
163 {
164 br_range_enc32be(dst, cc->val, 5);
165 return cc->count;
166 }
167
168 /* see bearssl.h */
169 void
br_sha1_set_state(br_sha1_context * cc,const void * stb,uint64_t count)170 br_sha1_set_state(br_sha1_context *cc, const void *stb, uint64_t count)
171 {
172 br_range_dec32be(cc->val, 5, stb);
173 cc->count = count;
174 }
175
176 /* see bearssl.h */
177 const br_hash_class br_sha1_vtable = {
178 sizeof(br_sha1_context),
179 BR_HASHDESC_ID(br_sha1_ID)
180 | BR_HASHDESC_OUT(20)
181 | BR_HASHDESC_STATE(20)
182 | BR_HASHDESC_LBLEN(6)
183 | BR_HASHDESC_MD_PADDING
184 | BR_HASHDESC_MD_PADDING_BE,
185 (void (*)(const br_hash_class **))&br_sha1_init,
186 (void (*)(const br_hash_class **, const void *, size_t))&br_sha1_update,
187 (void (*)(const br_hash_class *const *, void *))&br_sha1_out,
188 (uint64_t (*)(const br_hash_class *const *, void *))&br_sha1_state,
189 (void (*)(const br_hash_class **, const void *, uint64_t))
190 &br_sha1_set_state
191 };
192