1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * SHA-224, SHA-256, HMAC-SHA224, and HMAC-SHA256 library functions 4 * 5 * Copyright (c) Jean-Luc Cooke <jlcooke@certainkey.com> 6 * Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk> 7 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au> 8 * Copyright (c) 2014 Red Hat Inc. 9 */ 10 11 #include <crypto/hmac.h> 12 #include <crypto/internal/blockhash.h> 13 #include <crypto/internal/sha2.h> 14 #include <linux/export.h> 15 #include <linux/kernel.h> 16 #include <linux/module.h> 17 #include <linux/string.h> 18 #include <linux/wordpart.h> 19 20 static const struct sha256_block_state sha224_iv = { 21 .h = { 22 SHA224_H0, SHA224_H1, SHA224_H2, SHA224_H3, 23 SHA224_H4, SHA224_H5, SHA224_H6, SHA224_H7, 24 }, 25 }; 26 27 static const struct sha256_block_state sha256_iv = { 28 .h = { 29 SHA256_H0, SHA256_H1, SHA256_H2, SHA256_H3, 30 SHA256_H4, SHA256_H5, SHA256_H6, SHA256_H7, 31 }, 32 }; 33 34 /* 35 * If __DISABLE_EXPORTS is defined, then this file is being compiled for a 36 * pre-boot environment. In that case, ignore the kconfig options, pull the 37 * generic code into the same translation unit, and use that only. 38 */ 39 #ifdef __DISABLE_EXPORTS 40 #include "sha256-generic.c" 41 #endif 42 43 static inline bool sha256_purgatory(void) 44 { 45 return __is_defined(__DISABLE_EXPORTS); 46 } 47 48 static inline void sha256_blocks(struct sha256_block_state *state, 49 const u8 *data, size_t nblocks) 50 { 51 sha256_choose_blocks(state->h, data, nblocks, sha256_purgatory(), false); 52 } 53 54 static void __sha256_init(struct __sha256_ctx *ctx, 55 const struct sha256_block_state *iv, 56 u64 initial_bytecount) 57 { 58 ctx->state = *iv; 59 ctx->bytecount = initial_bytecount; 60 } 61 62 void sha224_init(struct sha224_ctx *ctx) 63 { 64 __sha256_init(&ctx->ctx, &sha224_iv, 0); 65 } 66 EXPORT_SYMBOL_GPL(sha224_init); 67 68 void sha256_init(struct sha256_ctx *ctx) 69 { 70 __sha256_init(&ctx->ctx, &sha256_iv, 0); 71 } 72 EXPORT_SYMBOL_GPL(sha256_init); 73 74 void __sha256_update(struct __sha256_ctx *ctx, const u8 *data, size_t len) 75 { 76 size_t partial = ctx->bytecount % SHA256_BLOCK_SIZE; 77 78 ctx->bytecount += len; 79 BLOCK_HASH_UPDATE_BLOCKS(sha256_blocks, &ctx->state, data, len, 80 SHA256_BLOCK_SIZE, ctx->buf, partial); 81 } 82 EXPORT_SYMBOL(__sha256_update); 83 84 static void __sha256_final(struct __sha256_ctx *ctx, 85 u8 *out, size_t digest_size) 86 { 87 u64 bitcount = ctx->bytecount << 3; 88 size_t partial = ctx->bytecount % SHA256_BLOCK_SIZE; 89 90 ctx->buf[partial++] = 0x80; 91 if (partial > SHA256_BLOCK_SIZE - 8) { 92 memset(&ctx->buf[partial], 0, SHA256_BLOCK_SIZE - partial); 93 sha256_blocks(&ctx->state, ctx->buf, 1); 94 partial = 0; 95 } 96 memset(&ctx->buf[partial], 0, SHA256_BLOCK_SIZE - 8 - partial); 97 *(__be64 *)&ctx->buf[SHA256_BLOCK_SIZE - 8] = cpu_to_be64(bitcount); 98 sha256_blocks(&ctx->state, ctx->buf, 1); 99 100 for (size_t i = 0; i < digest_size; i += 4) 101 put_unaligned_be32(ctx->state.h[i / 4], out + i); 102 } 103 104 void sha224_final(struct sha224_ctx *ctx, u8 out[SHA224_DIGEST_SIZE]) 105 { 106 __sha256_final(&ctx->ctx, out, SHA224_DIGEST_SIZE); 107 memzero_explicit(ctx, sizeof(*ctx)); 108 } 109 EXPORT_SYMBOL(sha224_final); 110 111 void sha256_final(struct sha256_ctx *ctx, u8 out[SHA256_DIGEST_SIZE]) 112 { 113 __sha256_final(&ctx->ctx, out, SHA256_DIGEST_SIZE); 114 memzero_explicit(ctx, sizeof(*ctx)); 115 } 116 EXPORT_SYMBOL(sha256_final); 117 118 void sha224(const u8 *data, size_t len, u8 out[SHA224_DIGEST_SIZE]) 119 { 120 struct sha224_ctx ctx; 121 122 sha224_init(&ctx); 123 sha224_update(&ctx, data, len); 124 sha224_final(&ctx, out); 125 } 126 EXPORT_SYMBOL(sha224); 127 128 void sha256(const u8 *data, size_t len, u8 out[SHA256_DIGEST_SIZE]) 129 { 130 struct sha256_ctx ctx; 131 132 sha256_init(&ctx); 133 sha256_update(&ctx, data, len); 134 sha256_final(&ctx, out); 135 } 136 EXPORT_SYMBOL(sha256); 137 138 /* pre-boot environment (as indicated by __DISABLE_EXPORTS) doesn't need HMAC */ 139 #ifndef __DISABLE_EXPORTS 140 static void __hmac_sha256_preparekey(struct __hmac_sha256_key *key, 141 const u8 *raw_key, size_t raw_key_len, 142 const struct sha256_block_state *iv) 143 { 144 union { 145 u8 b[SHA256_BLOCK_SIZE]; 146 unsigned long w[SHA256_BLOCK_SIZE / sizeof(unsigned long)]; 147 } derived_key = { 0 }; 148 149 if (unlikely(raw_key_len > SHA256_BLOCK_SIZE)) { 150 if (iv == &sha224_iv) 151 sha224(raw_key, raw_key_len, derived_key.b); 152 else 153 sha256(raw_key, raw_key_len, derived_key.b); 154 } else { 155 memcpy(derived_key.b, raw_key, raw_key_len); 156 } 157 158 for (size_t i = 0; i < ARRAY_SIZE(derived_key.w); i++) 159 derived_key.w[i] ^= REPEAT_BYTE(HMAC_IPAD_VALUE); 160 key->istate = *iv; 161 sha256_blocks(&key->istate, derived_key.b, 1); 162 163 for (size_t i = 0; i < ARRAY_SIZE(derived_key.w); i++) 164 derived_key.w[i] ^= REPEAT_BYTE(HMAC_OPAD_VALUE ^ 165 HMAC_IPAD_VALUE); 166 key->ostate = *iv; 167 sha256_blocks(&key->ostate, derived_key.b, 1); 168 169 memzero_explicit(&derived_key, sizeof(derived_key)); 170 } 171 172 void hmac_sha224_preparekey(struct hmac_sha224_key *key, 173 const u8 *raw_key, size_t raw_key_len) 174 { 175 __hmac_sha256_preparekey(&key->key, raw_key, raw_key_len, &sha224_iv); 176 } 177 EXPORT_SYMBOL_GPL(hmac_sha224_preparekey); 178 179 void hmac_sha256_preparekey(struct hmac_sha256_key *key, 180 const u8 *raw_key, size_t raw_key_len) 181 { 182 __hmac_sha256_preparekey(&key->key, raw_key, raw_key_len, &sha256_iv); 183 } 184 EXPORT_SYMBOL_GPL(hmac_sha256_preparekey); 185 186 void __hmac_sha256_init(struct __hmac_sha256_ctx *ctx, 187 const struct __hmac_sha256_key *key) 188 { 189 __sha256_init(&ctx->sha_ctx, &key->istate, SHA256_BLOCK_SIZE); 190 ctx->ostate = key->ostate; 191 } 192 EXPORT_SYMBOL_GPL(__hmac_sha256_init); 193 194 static void __hmac_sha256_final(struct __hmac_sha256_ctx *ctx, 195 u8 *out, size_t digest_size) 196 { 197 /* Generate the padded input for the outer hash in ctx->sha_ctx.buf. */ 198 __sha256_final(&ctx->sha_ctx, ctx->sha_ctx.buf, digest_size); 199 memset(&ctx->sha_ctx.buf[digest_size], 0, 200 SHA256_BLOCK_SIZE - digest_size); 201 ctx->sha_ctx.buf[digest_size] = 0x80; 202 *(__be32 *)&ctx->sha_ctx.buf[SHA256_BLOCK_SIZE - 4] = 203 cpu_to_be32(8 * (SHA256_BLOCK_SIZE + digest_size)); 204 205 /* Compute the outer hash, which gives the HMAC value. */ 206 sha256_blocks(&ctx->ostate, ctx->sha_ctx.buf, 1); 207 for (size_t i = 0; i < digest_size; i += 4) 208 put_unaligned_be32(ctx->ostate.h[i / 4], out + i); 209 210 memzero_explicit(ctx, sizeof(*ctx)); 211 } 212 213 void hmac_sha224_final(struct hmac_sha224_ctx *ctx, 214 u8 out[SHA224_DIGEST_SIZE]) 215 { 216 __hmac_sha256_final(&ctx->ctx, out, SHA224_DIGEST_SIZE); 217 } 218 EXPORT_SYMBOL_GPL(hmac_sha224_final); 219 220 void hmac_sha256_final(struct hmac_sha256_ctx *ctx, 221 u8 out[SHA256_DIGEST_SIZE]) 222 { 223 __hmac_sha256_final(&ctx->ctx, out, SHA256_DIGEST_SIZE); 224 } 225 EXPORT_SYMBOL_GPL(hmac_sha256_final); 226 227 void hmac_sha224(const struct hmac_sha224_key *key, 228 const u8 *data, size_t data_len, u8 out[SHA224_DIGEST_SIZE]) 229 { 230 struct hmac_sha224_ctx ctx; 231 232 hmac_sha224_init(&ctx, key); 233 hmac_sha224_update(&ctx, data, data_len); 234 hmac_sha224_final(&ctx, out); 235 } 236 EXPORT_SYMBOL_GPL(hmac_sha224); 237 238 void hmac_sha256(const struct hmac_sha256_key *key, 239 const u8 *data, size_t data_len, u8 out[SHA256_DIGEST_SIZE]) 240 { 241 struct hmac_sha256_ctx ctx; 242 243 hmac_sha256_init(&ctx, key); 244 hmac_sha256_update(&ctx, data, data_len); 245 hmac_sha256_final(&ctx, out); 246 } 247 EXPORT_SYMBOL_GPL(hmac_sha256); 248 249 void hmac_sha224_usingrawkey(const u8 *raw_key, size_t raw_key_len, 250 const u8 *data, size_t data_len, 251 u8 out[SHA224_DIGEST_SIZE]) 252 { 253 struct hmac_sha224_key key; 254 255 hmac_sha224_preparekey(&key, raw_key, raw_key_len); 256 hmac_sha224(&key, data, data_len, out); 257 258 memzero_explicit(&key, sizeof(key)); 259 } 260 EXPORT_SYMBOL_GPL(hmac_sha224_usingrawkey); 261 262 void hmac_sha256_usingrawkey(const u8 *raw_key, size_t raw_key_len, 263 const u8 *data, size_t data_len, 264 u8 out[SHA256_DIGEST_SIZE]) 265 { 266 struct hmac_sha256_key key; 267 268 hmac_sha256_preparekey(&key, raw_key, raw_key_len); 269 hmac_sha256(&key, data, data_len, out); 270 271 memzero_explicit(&key, sizeof(key)); 272 } 273 EXPORT_SYMBOL_GPL(hmac_sha256_usingrawkey); 274 #endif /* !__DISABLE_EXPORTS */ 275 276 MODULE_DESCRIPTION("SHA-224, SHA-256, HMAC-SHA224, and HMAC-SHA256 library functions"); 277 MODULE_LICENSE("GPL"); 278