1 /*- 2 * Copyright 2005 Colin Percival 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <sys/cdefs.h> 28 __FBSDID("$FreeBSD$"); 29 30 #include <sys/endian.h> 31 #include <sys/types.h> 32 33 #ifdef _KERNEL 34 #include <sys/systm.h> 35 #else 36 #include <string.h> 37 #endif 38 39 #include "sha256.h" 40 41 #if BYTE_ORDER == BIG_ENDIAN 42 43 /* Copy a vector of big-endian uint32_t into a vector of bytes */ 44 #define be32enc_vect(dst, src, len) \ 45 memcpy((void *)dst, (const void *)src, (size_t)len) 46 47 /* Copy a vector of bytes into a vector of big-endian uint32_t */ 48 #define be32dec_vect(dst, src, len) \ 49 memcpy((void *)dst, (const void *)src, (size_t)len) 50 51 #else /* BYTE_ORDER != BIG_ENDIAN */ 52 53 /* 54 * Encode a length len/4 vector of (uint32_t) into a length len vector of 55 * (unsigned char) in big-endian form. Assumes len is a multiple of 4. 56 */ 57 static void 58 be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len) 59 { 60 size_t i; 61 62 for (i = 0; i < len / 4; i++) 63 be32enc(dst + i * 4, src[i]); 64 } 65 66 /* 67 * Decode a big-endian length len vector of (unsigned char) into a length 68 * len/4 vector of (uint32_t). Assumes len is a multiple of 4. 69 */ 70 static void 71 be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len) 72 { 73 size_t i; 74 75 for (i = 0; i < len / 4; i++) 76 dst[i] = be32dec(src + i * 4); 77 } 78 79 #endif /* BYTE_ORDER != BIG_ENDIAN */ 80 81 /* SHA256 round constants. */ 82 static const uint32_t K[64] = { 83 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 84 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 85 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 86 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 87 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 88 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 89 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 90 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 91 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 92 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 93 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 94 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 95 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 96 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 97 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 98 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 99 }; 100 101 /* Elementary functions used by SHA256 */ 102 #define Ch(x, y, z) ((x & (y ^ z)) ^ z) 103 #define Maj(x, y, z) ((x & (y | z)) | (y & z)) 104 #define SHR(x, n) (x >> n) 105 #define ROTR(x, n) ((x >> n) | (x << (32 - n))) 106 #define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22)) 107 #define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25)) 108 #define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3)) 109 #define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10)) 110 111 /* SHA256 round function */ 112 #define RND(a, b, c, d, e, f, g, h, k) \ 113 h += S1(e) + Ch(e, f, g) + k; \ 114 d += h; \ 115 h += S0(a) + Maj(a, b, c); 116 117 /* Adjusted round function for rotating state */ 118 #define RNDr(S, W, i, ii) \ 119 RND(S[(64 - i) % 8], S[(65 - i) % 8], \ 120 S[(66 - i) % 8], S[(67 - i) % 8], \ 121 S[(68 - i) % 8], S[(69 - i) % 8], \ 122 S[(70 - i) % 8], S[(71 - i) % 8], \ 123 W[i + ii] + K[i + ii]) 124 125 /* Message schedule computation */ 126 #define MSCH(W, ii, i) \ 127 W[i + ii + 16] = s1(W[i + ii + 14]) + W[i + ii + 9] + s0(W[i + ii + 1]) + W[i + ii] 128 129 /* 130 * SHA256 block compression function. The 256-bit state is transformed via 131 * the 512-bit input block to produce a new state. 132 */ 133 static void 134 SHA256_Transform(uint32_t * state, const unsigned char block[64]) 135 { 136 uint32_t W[64]; 137 uint32_t S[8]; 138 int i; 139 140 /* 1. Prepare the first part of the message schedule W. */ 141 be32dec_vect(W, block, 64); 142 143 /* 2. Initialize working variables. */ 144 memcpy(S, state, 32); 145 146 /* 3. Mix. */ 147 for (i = 0; i < 64; i += 16) { 148 RNDr(S, W, 0, i); 149 RNDr(S, W, 1, i); 150 RNDr(S, W, 2, i); 151 RNDr(S, W, 3, i); 152 RNDr(S, W, 4, i); 153 RNDr(S, W, 5, i); 154 RNDr(S, W, 6, i); 155 RNDr(S, W, 7, i); 156 RNDr(S, W, 8, i); 157 RNDr(S, W, 9, i); 158 RNDr(S, W, 10, i); 159 RNDr(S, W, 11, i); 160 RNDr(S, W, 12, i); 161 RNDr(S, W, 13, i); 162 RNDr(S, W, 14, i); 163 RNDr(S, W, 15, i); 164 165 if (i == 48) 166 break; 167 MSCH(W, 0, i); 168 MSCH(W, 1, i); 169 MSCH(W, 2, i); 170 MSCH(W, 3, i); 171 MSCH(W, 4, i); 172 MSCH(W, 5, i); 173 MSCH(W, 6, i); 174 MSCH(W, 7, i); 175 MSCH(W, 8, i); 176 MSCH(W, 9, i); 177 MSCH(W, 10, i); 178 MSCH(W, 11, i); 179 MSCH(W, 12, i); 180 MSCH(W, 13, i); 181 MSCH(W, 14, i); 182 MSCH(W, 15, i); 183 } 184 185 /* 4. Mix local working variables into global state */ 186 for (i = 0; i < 8; i++) 187 state[i] += S[i]; 188 } 189 190 static unsigned char PAD[64] = { 191 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 192 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 194 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 195 }; 196 197 /* Add padding and terminating bit-count. */ 198 static void 199 SHA256_Pad(SHA256_CTX * ctx) 200 { 201 size_t r; 202 203 /* Figure out how many bytes we have buffered. */ 204 r = (ctx->count >> 3) & 0x3f; 205 206 /* Pad to 56 mod 64, transforming if we finish a block en route. */ 207 if (r < 56) { 208 /* Pad to 56 mod 64. */ 209 memcpy(&ctx->buf[r], PAD, 56 - r); 210 } else { 211 /* Finish the current block and mix. */ 212 memcpy(&ctx->buf[r], PAD, 64 - r); 213 SHA256_Transform(ctx->state, ctx->buf); 214 215 /* The start of the final block is all zeroes. */ 216 memset(&ctx->buf[0], 0, 56); 217 } 218 219 /* Add the terminating bit-count. */ 220 be64enc(&ctx->buf[56], ctx->count); 221 222 /* Mix in the final block. */ 223 SHA256_Transform(ctx->state, ctx->buf); 224 } 225 226 /* SHA-256 initialization. Begins a SHA-256 operation. */ 227 void 228 SHA256_Init(SHA256_CTX * ctx) 229 { 230 231 /* Zero bits processed so far */ 232 ctx->count = 0; 233 234 /* Magic initialization constants */ 235 ctx->state[0] = 0x6A09E667; 236 ctx->state[1] = 0xBB67AE85; 237 ctx->state[2] = 0x3C6EF372; 238 ctx->state[3] = 0xA54FF53A; 239 ctx->state[4] = 0x510E527F; 240 ctx->state[5] = 0x9B05688C; 241 ctx->state[6] = 0x1F83D9AB; 242 ctx->state[7] = 0x5BE0CD19; 243 } 244 245 /* Add bytes into the hash */ 246 void 247 SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len) 248 { 249 uint64_t bitlen; 250 uint32_t r; 251 const unsigned char *src = in; 252 253 /* Number of bytes left in the buffer from previous updates */ 254 r = (ctx->count >> 3) & 0x3f; 255 256 /* Convert the length into a number of bits */ 257 bitlen = len << 3; 258 259 /* Update number of bits */ 260 ctx->count += bitlen; 261 262 /* Handle the case where we don't need to perform any transforms */ 263 if (len < 64 - r) { 264 memcpy(&ctx->buf[r], src, len); 265 return; 266 } 267 268 /* Finish the current block */ 269 memcpy(&ctx->buf[r], src, 64 - r); 270 SHA256_Transform(ctx->state, ctx->buf); 271 src += 64 - r; 272 len -= 64 - r; 273 274 /* Perform complete blocks */ 275 while (len >= 64) { 276 SHA256_Transform(ctx->state, src); 277 src += 64; 278 len -= 64; 279 } 280 281 /* Copy left over data into buffer */ 282 memcpy(ctx->buf, src, len); 283 } 284 285 /* 286 * SHA-256 finalization. Pads the input data, exports the hash value, 287 * and clears the context state. 288 */ 289 void 290 SHA256_Final(unsigned char digest[static SHA256_DIGEST_LENGTH], SHA256_CTX *ctx) 291 { 292 293 /* Add padding */ 294 SHA256_Pad(ctx); 295 296 /* Write the hash */ 297 be32enc_vect(digest, ctx->state, SHA256_DIGEST_LENGTH); 298 299 /* Clear the context state */ 300 memset(ctx, 0, sizeof(*ctx)); 301 } 302 303 #ifdef WEAK_REFS 304 /* When building libmd, provide weak references. Note: this is not 305 activated in the context of compiling these sources for internal 306 use in libcrypt. 307 */ 308 #undef SHA256_Init 309 __weak_reference(_libmd_SHA256_Init, SHA256_Init); 310 #undef SHA256_Update 311 __weak_reference(_libmd_SHA256_Update, SHA256_Update); 312 #undef SHA256_Final 313 __weak_reference(_libmd_SHA256_Final, SHA256_Final); 314 #undef SHA256_Transform 315 __weak_reference(_libmd_SHA256_Transform, SHA256_Transform); 316 #endif 317