1 /*** 2 * Copyright 2017 Marc Stevens <marc@marc-stevens.nl>, Dan Shumow <danshu@microsoft.com> 3 * Distributed under the MIT Software License. 4 * See accompanying file LICENSE.txt or copy at 5 * https://opensource.org/licenses/MIT 6 ***/ 7 8 #ifndef SHA1DC_SHA1_H 9 #define SHA1DC_SHA1_H 10 11 #if defined(__cplusplus) 12 extern "C" { 13 #endif 14 15 #ifndef SHA1DC_NO_STANDARD_INCLUDES 16 #include <stdint.h> 17 #endif 18 19 /* sha-1 compression function that takes an already expanded message, and additionally store 20 * intermediate states */ 21 /* only stores states ii (the state between step ii-1 and step ii) when DOSTORESTATEii is 22 * defined in ubc_check.h */ 23 void sha1_compression_states(uint32_t[5], const uint32_t[16], uint32_t[80], uint32_t[80][5]); 24 25 /* 26 // Function type for sha1_recompression_step_T (uint32_t ihvin[5], uint32_t ihvout[5], const 27 uint32_t me2[80], const uint32_t state[5]). 28 // Where 0 <= T < 80 29 // me2 is an expanded message (the expansion of an original message block XOR'ed with a 30 disturbance vector's message block difference.) 31 // state is the internal state (a,b,c,d,e) before step T of the SHA-1 compression 32 function while processing the original message block. 33 // The function will return: 34 // ihvin: The reconstructed input chaining value. 35 // ihvout: The reconstructed output chaining value. 36 */ 37 typedef void (*sha1_recompression_type)(uint32_t *, 38 uint32_t *, 39 const uint32_t *, 40 const uint32_t *); 41 42 /* A callback function type that can be set to be called when a collision block has been found: 43 */ 44 /* void collision_block_callback(uint64_t byteoffset, const uint32_t ihvin1[5], const uint32_t 45 * ihvin2[5], const uint32_t m1[80], const uint32_t m2[80]) */ 46 typedef void (*collision_block_callback)( 47 uint64_t, const uint32_t *, const uint32_t *, const uint32_t *, const uint32_t *); 48 49 /* The SHA-1 context. */ 50 typedef struct { 51 uint64_t total; 52 uint32_t ihv[5]; 53 unsigned char buffer[64]; 54 int found_collision; 55 int safe_hash; 56 int detect_coll; 57 int ubc_check; 58 int reduced_round_coll; 59 collision_block_callback callback; 60 61 uint32_t ihv1[5]; 62 uint32_t ihv2[5]; 63 uint32_t m1[80]; 64 uint32_t m2[80]; 65 uint32_t states[80][5]; 66 } SHA1_CTX; 67 68 /* Initialize SHA-1 context. */ 69 void SHA1DCInit(SHA1_CTX *); 70 71 /* 72 Function to enable safe SHA-1 hashing: 73 Collision attacks are thwarted by hashing a detected near-collision block 3 times. 74 Think of it as extending SHA-1 from 80-steps to 240-steps for such blocks: 75 The best collision attacks against SHA-1 have complexity about 2^60, 76 thus for 240-steps an immediate lower-bound for the best cryptanalytic attacks would be 77 2^180. An attacker would be better off using a generic birthday search of complexity 2^80. 78 79 Enabling safe SHA-1 hashing will result in the correct SHA-1 hash for messages where no 80 collision attack was detected, but it will result in a different SHA-1 hash for messages 81 where a collision attack was detected. This will automatically invalidate SHA-1 based 82 digital signature forgeries. Enabled by default. 83 */ 84 void SHA1DCSetSafeHash(SHA1_CTX *, int); 85 86 /* 87 Function to disable or enable the use of Unavoidable Bitconditions (provides a significant 88 speed up). Enabled by default 89 */ 90 void SHA1DCSetUseUBC(SHA1_CTX *, int); 91 92 /* 93 Function to disable or enable the use of Collision Detection. 94 Enabled by default. 95 */ 96 void SHA1DCSetUseDetectColl(SHA1_CTX *, int); 97 98 /* function to disable or enable the detection of reduced-round SHA-1 collisions */ 99 /* disabled by default */ 100 void SHA1DCSetDetectReducedRoundCollision(SHA1_CTX *, int); 101 102 /* function to set a callback function, pass NULL to disable */ 103 /* by default no callback set */ 104 void SHA1DCSetCallback(SHA1_CTX *, collision_block_callback); 105 106 /* update SHA-1 context with buffer contents */ 107 void SHA1DCUpdate(SHA1_CTX *, const char *, size_t); 108 109 /* obtain SHA-1 hash from SHA-1 context */ 110 /* returns: 0 = no collision detected, otherwise = collision found => warn user for active 111 * attack */ 112 int SHA1DCFinal(unsigned char[20], SHA1_CTX *); 113 114 #if defined(__cplusplus) 115 } 116 #endif 117 118 #ifdef SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H 119 #include SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H 120 #endif 121 122 #endif 123