1 /*- 2 * Copyright 2005 Colin Percival 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <sys/cdefs.h> 28 __FBSDID("$FreeBSD$"); 29 30 #include <sys/endian.h> 31 #include <sys/types.h> 32 33 #ifdef _KERNEL 34 #include <sys/systm.h> 35 #else 36 #include <string.h> 37 #endif 38 39 #include "sha224.h" 40 #include "sha256.h" 41 42 #if BYTE_ORDER == BIG_ENDIAN 43 44 /* Copy a vector of big-endian uint32_t into a vector of bytes */ 45 #define be32enc_vect(dst, src, len) \ 46 memcpy((void *)dst, (const void *)src, (size_t)len) 47 48 /* Copy a vector of bytes into a vector of big-endian uint32_t */ 49 #define be32dec_vect(dst, src, len) \ 50 memcpy((void *)dst, (const void *)src, (size_t)len) 51 52 #else /* BYTE_ORDER != BIG_ENDIAN */ 53 54 /* 55 * Encode a length len/4 vector of (uint32_t) into a length len vector of 56 * (unsigned char) in big-endian form. Assumes len is a multiple of 4. 57 */ 58 static void 59 be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len) 60 { 61 size_t i; 62 63 for (i = 0; i < len / 4; i++) 64 be32enc(dst + i * 4, src[i]); 65 } 66 67 /* 68 * Decode a big-endian length len vector of (unsigned char) into a length 69 * len/4 vector of (uint32_t). Assumes len is a multiple of 4. 70 */ 71 static void 72 be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len) 73 { 74 size_t i; 75 76 for (i = 0; i < len / 4; i++) 77 dst[i] = be32dec(src + i * 4); 78 } 79 80 #endif /* BYTE_ORDER != BIG_ENDIAN */ 81 82 /* SHA256 round constants. */ 83 static const uint32_t K[64] = { 84 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 85 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 86 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 87 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 88 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 89 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 90 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 91 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 92 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 93 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 94 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 95 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 96 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 97 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 98 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 99 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 100 }; 101 102 /* Elementary functions used by SHA256 */ 103 #define Ch(x, y, z) ((x & (y ^ z)) ^ z) 104 #define Maj(x, y, z) ((x & (y | z)) | (y & z)) 105 #define SHR(x, n) (x >> n) 106 #define ROTR(x, n) ((x >> n) | (x << (32 - n))) 107 #define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22)) 108 #define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25)) 109 #define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3)) 110 #define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10)) 111 112 /* SHA256 round function */ 113 #define RND(a, b, c, d, e, f, g, h, k) \ 114 h += S1(e) + Ch(e, f, g) + k; \ 115 d += h; \ 116 h += S0(a) + Maj(a, b, c); 117 118 /* Adjusted round function for rotating state */ 119 #define RNDr(S, W, i, ii) \ 120 RND(S[(64 - i) % 8], S[(65 - i) % 8], \ 121 S[(66 - i) % 8], S[(67 - i) % 8], \ 122 S[(68 - i) % 8], S[(69 - i) % 8], \ 123 S[(70 - i) % 8], S[(71 - i) % 8], \ 124 W[i + ii] + K[i + ii]) 125 126 /* Message schedule computation */ 127 #define MSCH(W, ii, i) \ 128 W[i + ii + 16] = s1(W[i + ii + 14]) + W[i + ii + 9] + s0(W[i + ii + 1]) + W[i + ii] 129 130 /* 131 * SHA256 block compression function. The 256-bit state is transformed via 132 * the 512-bit input block to produce a new state. 133 */ 134 static void 135 SHA256_Transform(uint32_t * state, const unsigned char block[64]) 136 { 137 uint32_t W[64]; 138 uint32_t S[8]; 139 int i; 140 141 /* 1. Prepare the first part of the message schedule W. */ 142 be32dec_vect(W, block, 64); 143 144 /* 2. Initialize working variables. */ 145 memcpy(S, state, 32); 146 147 /* 3. Mix. */ 148 for (i = 0; i < 64; i += 16) { 149 RNDr(S, W, 0, i); 150 RNDr(S, W, 1, i); 151 RNDr(S, W, 2, i); 152 RNDr(S, W, 3, i); 153 RNDr(S, W, 4, i); 154 RNDr(S, W, 5, i); 155 RNDr(S, W, 6, i); 156 RNDr(S, W, 7, i); 157 RNDr(S, W, 8, i); 158 RNDr(S, W, 9, i); 159 RNDr(S, W, 10, i); 160 RNDr(S, W, 11, i); 161 RNDr(S, W, 12, i); 162 RNDr(S, W, 13, i); 163 RNDr(S, W, 14, i); 164 RNDr(S, W, 15, i); 165 166 if (i == 48) 167 break; 168 MSCH(W, 0, i); 169 MSCH(W, 1, i); 170 MSCH(W, 2, i); 171 MSCH(W, 3, i); 172 MSCH(W, 4, i); 173 MSCH(W, 5, i); 174 MSCH(W, 6, i); 175 MSCH(W, 7, i); 176 MSCH(W, 8, i); 177 MSCH(W, 9, i); 178 MSCH(W, 10, i); 179 MSCH(W, 11, i); 180 MSCH(W, 12, i); 181 MSCH(W, 13, i); 182 MSCH(W, 14, i); 183 MSCH(W, 15, i); 184 } 185 186 /* 4. Mix local working variables into global state */ 187 for (i = 0; i < 8; i++) 188 state[i] += S[i]; 189 } 190 191 static unsigned char PAD[64] = { 192 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 194 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 195 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 196 }; 197 198 /* Add padding and terminating bit-count. */ 199 static void 200 SHA256_Pad(SHA256_CTX * ctx) 201 { 202 size_t r; 203 204 /* Figure out how many bytes we have buffered. */ 205 r = (ctx->count >> 3) & 0x3f; 206 207 /* Pad to 56 mod 64, transforming if we finish a block en route. */ 208 if (r < 56) { 209 /* Pad to 56 mod 64. */ 210 memcpy(&ctx->buf[r], PAD, 56 - r); 211 } else { 212 /* Finish the current block and mix. */ 213 memcpy(&ctx->buf[r], PAD, 64 - r); 214 SHA256_Transform(ctx->state, ctx->buf); 215 216 /* The start of the final block is all zeroes. */ 217 memset(&ctx->buf[0], 0, 56); 218 } 219 220 /* Add the terminating bit-count. */ 221 be64enc(&ctx->buf[56], ctx->count); 222 223 /* Mix in the final block. */ 224 SHA256_Transform(ctx->state, ctx->buf); 225 } 226 227 /* SHA-256 initialization. Begins a SHA-256 operation. */ 228 void 229 SHA256_Init(SHA256_CTX * ctx) 230 { 231 232 /* Zero bits processed so far */ 233 ctx->count = 0; 234 235 /* Magic initialization constants */ 236 ctx->state[0] = 0x6A09E667; 237 ctx->state[1] = 0xBB67AE85; 238 ctx->state[2] = 0x3C6EF372; 239 ctx->state[3] = 0xA54FF53A; 240 ctx->state[4] = 0x510E527F; 241 ctx->state[5] = 0x9B05688C; 242 ctx->state[6] = 0x1F83D9AB; 243 ctx->state[7] = 0x5BE0CD19; 244 } 245 246 /* Add bytes into the hash */ 247 void 248 SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len) 249 { 250 uint64_t bitlen; 251 uint32_t r; 252 const unsigned char *src = in; 253 254 /* Number of bytes left in the buffer from previous updates */ 255 r = (ctx->count >> 3) & 0x3f; 256 257 /* Convert the length into a number of bits */ 258 bitlen = len << 3; 259 260 /* Update number of bits */ 261 ctx->count += bitlen; 262 263 /* Handle the case where we don't need to perform any transforms */ 264 if (len < 64 - r) { 265 memcpy(&ctx->buf[r], src, len); 266 return; 267 } 268 269 /* Finish the current block */ 270 memcpy(&ctx->buf[r], src, 64 - r); 271 SHA256_Transform(ctx->state, ctx->buf); 272 src += 64 - r; 273 len -= 64 - r; 274 275 /* Perform complete blocks */ 276 while (len >= 64) { 277 SHA256_Transform(ctx->state, src); 278 src += 64; 279 len -= 64; 280 } 281 282 /* Copy left over data into buffer */ 283 memcpy(ctx->buf, src, len); 284 } 285 286 /* 287 * SHA-256 finalization. Pads the input data, exports the hash value, 288 * and clears the context state. 289 */ 290 void 291 SHA256_Final(unsigned char digest[static SHA256_DIGEST_LENGTH], SHA256_CTX *ctx) 292 { 293 294 /* Add padding */ 295 SHA256_Pad(ctx); 296 297 /* Write the hash */ 298 be32enc_vect(digest, ctx->state, SHA256_DIGEST_LENGTH); 299 300 /* Clear the context state */ 301 explicit_bzero(ctx, sizeof(*ctx)); 302 } 303 304 /*** SHA-224: *********************************************************/ 305 /* 306 * the SHA224 and SHA256 transforms are identical 307 */ 308 309 /* SHA-224 initialization. Begins a SHA-224 operation. */ 310 void 311 SHA224_Init(SHA224_CTX * ctx) 312 { 313 314 /* Zero bits processed so far */ 315 ctx->count = 0; 316 317 /* Magic initialization constants */ 318 ctx->state[0] = 0xC1059ED8; 319 ctx->state[1] = 0x367CD507; 320 ctx->state[2] = 0x3070DD17; 321 ctx->state[3] = 0xF70E5939; 322 ctx->state[4] = 0xFFC00B31; 323 ctx->state[5] = 0x68581511; 324 ctx->state[6] = 0x64f98FA7; 325 ctx->state[7] = 0xBEFA4FA4; 326 } 327 328 /* Add bytes into the SHA-224 hash */ 329 void 330 SHA224_Update(SHA224_CTX * ctx, const void *in, size_t len) 331 { 332 333 SHA256_Update((SHA256_CTX *)ctx, in, len); 334 } 335 336 /* 337 * SHA-224 finalization. Pads the input data, exports the hash value, 338 * and clears the context state. 339 */ 340 void 341 SHA224_Final(unsigned char digest[static SHA224_DIGEST_LENGTH], SHA224_CTX *ctx) 342 { 343 344 /* Add padding */ 345 SHA256_Pad((SHA256_CTX *)ctx); 346 347 /* Write the hash */ 348 be32enc_vect(digest, ctx->state, SHA224_DIGEST_LENGTH); 349 350 /* Clear the context state */ 351 explicit_bzero(ctx, sizeof(*ctx)); 352 } 353 354 #ifdef WEAK_REFS 355 /* When building libmd, provide weak references. Note: this is not 356 activated in the context of compiling these sources for internal 357 use in libcrypt. 358 */ 359 #undef SHA256_Init 360 __weak_reference(_libmd_SHA256_Init, SHA256_Init); 361 #undef SHA256_Update 362 __weak_reference(_libmd_SHA256_Update, SHA256_Update); 363 #undef SHA256_Final 364 __weak_reference(_libmd_SHA256_Final, SHA256_Final); 365 #undef SHA256_Transform 366 __weak_reference(_libmd_SHA256_Transform, SHA256_Transform); 367 368 #undef SHA224_Init 369 __weak_reference(_libmd_SHA224_Init, SHA224_Init); 370 #undef SHA224_Update 371 __weak_reference(_libmd_SHA224_Update, SHA224_Update); 372 #undef SHA224_Final 373 __weak_reference(_libmd_SHA224_Final, SHA224_Final); 374 #endif 375