1 /* 2 * SHA512-based Unix crypt implementation. 3 * Released into the Public Domain by Ulrich Drepper <drepper@redhat.com>. 4 */ 5 #include <errno.h> 6 #include <limits.h> 7 #include <stdbool.h> 8 #include <stdint.h> 9 #include <stdio.h> 10 #include <stdlib.h> 11 #include <string.h> 12 #include <sys/endian.h> 13 #include <sys/param.h> 14 #include <sys/types.h> 15 16 #include "local.h" 17 18 #if __BYTE_ORDER == __LITTLE_ENDIAN 19 # define SWAP(n) \ 20 (((n) << 56) \ 21 | (((n) & 0xff00) << 40) \ 22 | (((n) & 0xff0000) << 24) \ 23 | (((n) & 0xff000000) << 8) \ 24 | (((n) >> 8) & 0xff000000) \ 25 | (((n) >> 24) & 0xff0000) \ 26 | (((n) >> 40) & 0xff00) \ 27 | ((n) >> 56)) 28 #else 29 # define SWAP(n) (n) 30 #endif 31 32 33 /* This array contains the bytes used to pad the buffer to the next 34 64-byte boundary. (FIPS 180-2:5.1.2) */ 35 static const unsigned char fillbuf[128] = { 0x80, 0 /* , 0, 0, ... */ }; 36 37 38 /* Constants for SHA512 from FIPS 180-2:4.2.3. */ 39 static const uint64_t K[80] = 40 { 41 UINT64_C (0x428a2f98d728ae22), UINT64_C (0x7137449123ef65cd), 42 UINT64_C (0xb5c0fbcfec4d3b2f), UINT64_C (0xe9b5dba58189dbbc), 43 UINT64_C (0x3956c25bf348b538), UINT64_C (0x59f111f1b605d019), 44 UINT64_C (0x923f82a4af194f9b), UINT64_C (0xab1c5ed5da6d8118), 45 UINT64_C (0xd807aa98a3030242), UINT64_C (0x12835b0145706fbe), 46 UINT64_C (0x243185be4ee4b28c), UINT64_C (0x550c7dc3d5ffb4e2), 47 UINT64_C (0x72be5d74f27b896f), UINT64_C (0x80deb1fe3b1696b1), 48 UINT64_C (0x9bdc06a725c71235), UINT64_C (0xc19bf174cf692694), 49 UINT64_C (0xe49b69c19ef14ad2), UINT64_C (0xefbe4786384f25e3), 50 UINT64_C (0x0fc19dc68b8cd5b5), UINT64_C (0x240ca1cc77ac9c65), 51 UINT64_C (0x2de92c6f592b0275), UINT64_C (0x4a7484aa6ea6e483), 52 UINT64_C (0x5cb0a9dcbd41fbd4), UINT64_C (0x76f988da831153b5), 53 UINT64_C (0x983e5152ee66dfab), UINT64_C (0xa831c66d2db43210), 54 UINT64_C (0xb00327c898fb213f), UINT64_C (0xbf597fc7beef0ee4), 55 UINT64_C (0xc6e00bf33da88fc2), UINT64_C (0xd5a79147930aa725), 56 UINT64_C (0x06ca6351e003826f), UINT64_C (0x142929670a0e6e70), 57 UINT64_C (0x27b70a8546d22ffc), UINT64_C (0x2e1b21385c26c926), 58 UINT64_C (0x4d2c6dfc5ac42aed), UINT64_C (0x53380d139d95b3df), 59 UINT64_C (0x650a73548baf63de), UINT64_C (0x766a0abb3c77b2a8), 60 UINT64_C (0x81c2c92e47edaee6), UINT64_C (0x92722c851482353b), 61 UINT64_C (0xa2bfe8a14cf10364), UINT64_C (0xa81a664bbc423001), 62 UINT64_C (0xc24b8b70d0f89791), UINT64_C (0xc76c51a30654be30), 63 UINT64_C (0xd192e819d6ef5218), UINT64_C (0xd69906245565a910), 64 UINT64_C (0xf40e35855771202a), UINT64_C (0x106aa07032bbd1b8), 65 UINT64_C (0x19a4c116b8d2d0c8), UINT64_C (0x1e376c085141ab53), 66 UINT64_C (0x2748774cdf8eeb99), UINT64_C (0x34b0bcb5e19b48a8), 67 UINT64_C (0x391c0cb3c5c95a63), UINT64_C (0x4ed8aa4ae3418acb), 68 UINT64_C (0x5b9cca4f7763e373), UINT64_C (0x682e6ff3d6b2b8a3), 69 UINT64_C (0x748f82ee5defb2fc), UINT64_C (0x78a5636f43172f60), 70 UINT64_C (0x84c87814a1f0ab72), UINT64_C (0x8cc702081a6439ec), 71 UINT64_C (0x90befffa23631e28), UINT64_C (0xa4506cebde82bde9), 72 UINT64_C (0xbef9a3f7b2c67915), UINT64_C (0xc67178f2e372532b), 73 UINT64_C (0xca273eceea26619c), UINT64_C (0xd186b8c721c0c207), 74 UINT64_C (0xeada7dd6cde0eb1e), UINT64_C (0xf57d4f7fee6ed178), 75 UINT64_C (0x06f067aa72176fba), UINT64_C (0x0a637dc5a2c898a6), 76 UINT64_C (0x113f9804bef90dae), UINT64_C (0x1b710b35131c471b), 77 UINT64_C (0x28db77f523047d84), UINT64_C (0x32caab7b40c72493), 78 UINT64_C (0x3c9ebe0a15c9bebc), UINT64_C (0x431d67c49c100d4c), 79 UINT64_C (0x4cc5d4becb3e42b6), UINT64_C (0x597f299cfc657e2a), 80 UINT64_C (0x5fcb6fab3ad6faec), UINT64_C (0x6c44198c4a475817) 81 }; 82 83 84 /* Process LEN bytes of BUFFER, accumulating context into CTX. 85 It is assumed that LEN % 128 == 0. */ 86 void 87 __crypt__sha512_process_block (const void *buffer, size_t len, struct sha512_ctx *ctx) 88 { 89 const uint64_t *words = buffer; 90 size_t nwords = len / sizeof (uint64_t); 91 uint64_t a = ctx->H[0]; 92 uint64_t b = ctx->H[1]; 93 uint64_t c = ctx->H[2]; 94 uint64_t d = ctx->H[3]; 95 uint64_t e = ctx->H[4]; 96 uint64_t f = ctx->H[5]; 97 uint64_t g = ctx->H[6]; 98 uint64_t h = ctx->H[7]; 99 100 /* First increment the byte count. FIPS 180-2 specifies the possible 101 length of the file up to 2^128 bits. Here we only compute the 102 number of bytes. Do a double word increment. */ 103 ctx->total[0] += len; 104 if (ctx->total[0] < len) 105 ++ctx->total[1]; 106 107 /* Process all bytes in the buffer with 128 bytes in each round of 108 the loop. */ 109 while (nwords > 0) 110 { 111 uint64_t W[80]; 112 uint64_t a_save = a; 113 uint64_t b_save = b; 114 uint64_t c_save = c; 115 uint64_t d_save = d; 116 uint64_t e_save = e; 117 uint64_t f_save = f; 118 uint64_t g_save = g; 119 uint64_t h_save = h; 120 121 /* Operators defined in FIPS 180-2:4.1.2. */ 122 #define Ch(x, y, z) ((x & y) ^ (~x & z)) 123 #define Maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z)) 124 #define S0(x) (CYCLIC (x, 28) ^ CYCLIC (x, 34) ^ CYCLIC (x, 39)) 125 #define S1(x) (CYCLIC (x, 14) ^ CYCLIC (x, 18) ^ CYCLIC (x, 41)) 126 #define R0(x) (CYCLIC (x, 1) ^ CYCLIC (x, 8) ^ (x >> 7)) 127 #define R1(x) (CYCLIC (x, 19) ^ CYCLIC (x, 61) ^ (x >> 6)) 128 129 /* It is unfortunate that C does not provide an operator for 130 cyclic rotation. Hope the C compiler is smart enough. */ 131 #define CYCLIC(w, s) ((w >> s) | (w << (64 - s))) 132 133 /* Compute the message schedule according to FIPS 180-2:6.3.2 step 2. */ 134 for (unsigned int t = 0; t < 16; ++t) 135 { 136 W[t] = SWAP (*words); 137 ++words; 138 } 139 for (unsigned int t = 16; t < 80; ++t) 140 W[t] = R1 (W[t - 2]) + W[t - 7] + R0 (W[t - 15]) + W[t - 16]; 141 142 /* The actual computation according to FIPS 180-2:6.3.2 step 3. */ 143 for (unsigned int t = 0; t < 80; ++t) 144 { 145 uint64_t T1 = h + S1 (e) + Ch (e, f, g) + K[t] + W[t]; 146 uint64_t T2 = S0 (a) + Maj (a, b, c); 147 h = g; 148 g = f; 149 f = e; 150 e = d + T1; 151 d = c; 152 c = b; 153 b = a; 154 a = T1 + T2; 155 } 156 157 /* Add the starting values of the context according to FIPS 180-2:6.3.2 158 step 4. */ 159 a += a_save; 160 b += b_save; 161 c += c_save; 162 d += d_save; 163 e += e_save; 164 f += f_save; 165 g += g_save; 166 h += h_save; 167 168 /* Prepare for the next round. */ 169 nwords -= 16; 170 } 171 172 /* Put checksum in context given as argument. */ 173 ctx->H[0] = a; 174 ctx->H[1] = b; 175 ctx->H[2] = c; 176 ctx->H[3] = d; 177 ctx->H[4] = e; 178 ctx->H[5] = f; 179 ctx->H[6] = g; 180 ctx->H[7] = h; 181 } 182 183 184 /* Initialize structure containing state of computation. 185 (FIPS 180-2:5.3.3) */ 186 void 187 __crypt__sha512_init_ctx (struct sha512_ctx *ctx) 188 { 189 ctx->H[0] = UINT64_C (0x6a09e667f3bcc908); 190 ctx->H[1] = UINT64_C (0xbb67ae8584caa73b); 191 ctx->H[2] = UINT64_C (0x3c6ef372fe94f82b); 192 ctx->H[3] = UINT64_C (0xa54ff53a5f1d36f1); 193 ctx->H[4] = UINT64_C (0x510e527fade682d1); 194 ctx->H[5] = UINT64_C (0x9b05688c2b3e6c1f); 195 ctx->H[6] = UINT64_C (0x1f83d9abfb41bd6b); 196 ctx->H[7] = UINT64_C (0x5be0cd19137e2179); 197 198 ctx->total[0] = ctx->total[1] = 0; 199 ctx->buflen = 0; 200 } 201 202 203 /* Process the remaining bytes in the internal buffer and the usual 204 prolog according to the standard and write the result to RESBUF. 205 206 IMPORTANT: On some systems it is required that RESBUF is correctly 207 aligned for a 32 bits value. */ 208 void * 209 __crypt__sha512_finish_ctx (struct sha512_ctx *ctx, void *resbuf) 210 { 211 /* Take yet unprocessed bytes into account. */ 212 uint64_t bytes = ctx->buflen; 213 size_t pad; 214 215 /* Now count remaining bytes. */ 216 ctx->total[0] += bytes; 217 if (ctx->total[0] < bytes) 218 ++ctx->total[1]; 219 220 pad = bytes >= 112 ? 128 + 112 - bytes : 112 - bytes; 221 memcpy (&ctx->buffer[bytes], fillbuf, pad); 222 223 /* Put the 128-bit file length in *bits* at the end of the buffer. */ 224 *(uint64_t *) &ctx->buffer[bytes + pad + 8] = SWAP (ctx->total[0] << 3); 225 *(uint64_t *) &ctx->buffer[bytes + pad] = SWAP ((ctx->total[1] << 3) | 226 (ctx->total[0] >> 61)); 227 228 /* Process last bytes. */ 229 __crypt__sha512_process_block (ctx->buffer, bytes + pad + 16, ctx); 230 231 /* Put result from CTX in first 64 bytes following RESBUF. */ 232 for (unsigned int i = 0; i < 8; ++i) 233 ((uint64_t *) resbuf)[i] = SWAP (ctx->H[i]); 234 235 return resbuf; 236 } 237 238 239 void 240 __crypt__sha512_process_bytes (const void *buffer, size_t len, struct sha512_ctx *ctx) 241 { 242 /* When we already have some bits in our internal buffer concatenate 243 both inputs first. */ 244 if (ctx->buflen != 0) 245 { 246 size_t left_over = ctx->buflen; 247 size_t add = 256 - left_over > len ? len : 256 - left_over; 248 249 memcpy (&ctx->buffer[left_over], buffer, add); 250 ctx->buflen += add; 251 252 if (ctx->buflen > 128) 253 { 254 __crypt__sha512_process_block (ctx->buffer, ctx->buflen & ~127, ctx); 255 256 ctx->buflen &= 127; 257 /* The regions in the following copy operation cannot overlap. */ 258 memcpy (ctx->buffer, &ctx->buffer[(left_over + add) & ~127], 259 ctx->buflen); 260 } 261 262 buffer = (const char *) buffer + add; 263 len -= add; 264 } 265 266 /* Process available complete blocks. */ 267 if (len >= 128) 268 { 269 #if !_STRING_ARCH_unaligned 270 /* To check alignment gcc has an appropriate operator. Other 271 compilers don't. */ 272 # if __GNUC__ >= 2 273 # define UNALIGNED_P(p) (((uintptr_t) p) % __alignof__ (uint64_t) != 0) 274 # else 275 # define UNALIGNED_P(p) (((uintptr_t) p) % sizeof (uint64_t) != 0) 276 # endif 277 if (UNALIGNED_P (buffer)) 278 while (len > 128) 279 { 280 __crypt__sha512_process_block (memcpy (ctx->buffer, buffer, 128), 128, 281 ctx); 282 buffer = (const char *) buffer + 128; 283 len -= 128; 284 } 285 else 286 #endif 287 { 288 __crypt__sha512_process_block (buffer, len & ~127, ctx); 289 buffer = (const char *) buffer + (len & ~127); 290 len &= 127; 291 } 292 } 293 294 /* Move remaining bytes into internal buffer. */ 295 if (len > 0) 296 { 297 size_t left_over = ctx->buflen; 298 299 memcpy (&ctx->buffer[left_over], buffer, len); 300 left_over += len; 301 if (left_over >= 128) 302 { 303 __crypt__sha512_process_block (ctx->buffer, 128, ctx); 304 left_over -= 128; 305 memcpy (ctx->buffer, &ctx->buffer[128], left_over); 306 } 307 ctx->buflen = left_over; 308 } 309 } 310 311 312 /* Define our magic string to mark salt for SHA512 "encryption" 313 replacement. */ 314 static const char sha512_salt_prefix[] = "$6$"; 315 316 /* Prefix for optional rounds specification. */ 317 static const char sha512_rounds_prefix[] = "rounds="; 318 319 /* Maximum salt string length. */ 320 #define SALT_LEN_MAX 16 321 /* Default number of rounds if not explicitly specified. */ 322 #define ROUNDS_DEFAULT 5000 323 /* Minimum number of rounds. */ 324 #define ROUNDS_MIN 1000 325 /* Maximum number of rounds. */ 326 #define ROUNDS_MAX 999999999 327 328 /* Table with characters for base64 transformation. */ 329 static const char b64t[64] = 330 "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; 331 332 333 static char * 334 crypt_sha512_r (const char *key, const char *salt, char *buffer, int buflen) 335 { 336 unsigned char alt_result[64] 337 __attribute__ ((__aligned__ (__alignof__ (uint64_t)))); 338 unsigned char temp_result[64] 339 __attribute__ ((__aligned__ (__alignof__ (uint64_t)))); 340 struct sha512_ctx ctx; 341 struct sha512_ctx alt_ctx; 342 size_t salt_len; 343 size_t key_len; 344 size_t cnt; 345 char *cp; 346 char *copied_key = NULL; 347 char *copied_salt = NULL; 348 char *p_bytes; 349 char *s_bytes; 350 /* Default number of rounds. */ 351 size_t rounds = ROUNDS_DEFAULT; 352 bool rounds_custom = false; 353 354 /* Find beginning of salt string. The prefix should normally always 355 be present. Just in case it is not. */ 356 if (strncmp (sha512_salt_prefix, salt, sizeof (sha512_salt_prefix) - 1) == 0) 357 /* Skip salt prefix. */ 358 salt += sizeof (sha512_salt_prefix) - 1; 359 360 if (strncmp (salt, sha512_rounds_prefix, sizeof (sha512_rounds_prefix) - 1) 361 == 0) 362 { 363 const char *num = salt + sizeof (sha512_rounds_prefix) - 1; 364 char *endp; 365 unsigned long int srounds = strtoul (num, &endp, 10); 366 if (*endp == '$') 367 { 368 salt = endp + 1; 369 rounds = MAX (ROUNDS_MIN, MIN (srounds, ROUNDS_MAX)); 370 rounds_custom = true; 371 } 372 } 373 374 salt_len = MIN (strcspn (salt, "$"), SALT_LEN_MAX); 375 key_len = strlen (key); 376 377 if ((key - (char *) 0) % __alignof__ (uint64_t) != 0) 378 { 379 char *tmp = (char *) alloca (key_len + __alignof__ (uint64_t)); 380 key = copied_key = 381 memcpy (tmp + __alignof__ (uint64_t) 382 - (tmp - (char *) 0) % __alignof__ (uint64_t), 383 key, key_len); 384 } 385 386 if ((salt - (char *) 0) % __alignof__ (uint64_t) != 0) 387 { 388 char *tmp = (char *) alloca (salt_len + __alignof__ (uint64_t)); 389 salt = copied_salt = 390 memcpy (tmp + __alignof__ (uint64_t) 391 - (tmp - (char *) 0) % __alignof__ (uint64_t), 392 salt, salt_len); 393 } 394 395 /* Prepare for the real work. */ 396 __crypt__sha512_init_ctx (&ctx); 397 398 /* Add the key string. */ 399 __crypt__sha512_process_bytes (key, key_len, &ctx); 400 401 /* The last part is the salt string. This must be at most 16 402 characters and it ends at the first `$' character (for 403 compatibility with existing implementations). */ 404 __crypt__sha512_process_bytes (salt, salt_len, &ctx); 405 406 407 /* Compute alternate SHA512 sum with input KEY, SALT, and KEY. The 408 final result will be added to the first context. */ 409 __crypt__sha512_init_ctx (&alt_ctx); 410 411 /* Add key. */ 412 __crypt__sha512_process_bytes (key, key_len, &alt_ctx); 413 414 /* Add salt. */ 415 __crypt__sha512_process_bytes (salt, salt_len, &alt_ctx); 416 417 /* Add key again. */ 418 __crypt__sha512_process_bytes (key, key_len, &alt_ctx); 419 420 /* Now get result of this (64 bytes) and add it to the other 421 context. */ 422 __crypt__sha512_finish_ctx (&alt_ctx, alt_result); 423 424 /* Add for any character in the key one byte of the alternate sum. */ 425 for (cnt = key_len; cnt > 64; cnt -= 64) 426 __crypt__sha512_process_bytes (alt_result, 64, &ctx); 427 __crypt__sha512_process_bytes (alt_result, cnt, &ctx); 428 429 /* Take the binary representation of the length of the key and for every 430 1 add the alternate sum, for every 0 the key. */ 431 for (cnt = key_len; cnt > 0; cnt >>= 1) 432 if ((cnt & 1) != 0) 433 __crypt__sha512_process_bytes (alt_result, 64, &ctx); 434 else 435 __crypt__sha512_process_bytes (key, key_len, &ctx); 436 437 /* Create intermediate result. */ 438 __crypt__sha512_finish_ctx (&ctx, alt_result); 439 440 /* Start computation of P byte sequence. */ 441 __crypt__sha512_init_ctx (&alt_ctx); 442 443 /* For every character in the password add the entire password. */ 444 for (cnt = 0; cnt < key_len; ++cnt) 445 __crypt__sha512_process_bytes (key, key_len, &alt_ctx); 446 447 /* Finish the digest. */ 448 __crypt__sha512_finish_ctx (&alt_ctx, temp_result); 449 450 /* Create byte sequence P. */ 451 cp = p_bytes = alloca (key_len); 452 for (cnt = key_len; cnt >= 64; cnt -= 64) 453 cp = mempcpy (cp, temp_result, 64); 454 memcpy (cp, temp_result, cnt); 455 456 /* Start computation of S byte sequence. */ 457 __crypt__sha512_init_ctx (&alt_ctx); 458 459 /* For every character in the password add the entire password. */ 460 for (cnt = 0; cnt < 16 + alt_result[0]; ++cnt) 461 __crypt__sha512_process_bytes (salt, salt_len, &alt_ctx); 462 463 /* Finish the digest. */ 464 __crypt__sha512_finish_ctx (&alt_ctx, temp_result); 465 466 /* Create byte sequence S. */ 467 cp = s_bytes = alloca (salt_len); 468 for (cnt = salt_len; cnt >= 64; cnt -= 64) 469 cp = mempcpy (cp, temp_result, 64); 470 memcpy (cp, temp_result, cnt); 471 472 /* Repeatedly run the collected hash value through SHA512 to burn 473 CPU cycles. */ 474 for (cnt = 0; cnt < rounds; ++cnt) 475 { 476 /* New context. */ 477 __crypt__sha512_init_ctx (&ctx); 478 479 /* Add key or last result. */ 480 if ((cnt & 1) != 0) 481 __crypt__sha512_process_bytes (p_bytes, key_len, &ctx); 482 else 483 __crypt__sha512_process_bytes (alt_result, 64, &ctx); 484 485 /* Add salt for numbers not divisible by 3. */ 486 if (cnt % 3 != 0) 487 __crypt__sha512_process_bytes (s_bytes, salt_len, &ctx); 488 489 /* Add key for numbers not divisible by 7. */ 490 if (cnt % 7 != 0) 491 __crypt__sha512_process_bytes (p_bytes, key_len, &ctx); 492 493 /* Add key or last result. */ 494 if ((cnt & 1) != 0) 495 __crypt__sha512_process_bytes (alt_result, 64, &ctx); 496 else 497 __crypt__sha512_process_bytes (p_bytes, key_len, &ctx); 498 499 /* Create intermediate result. */ 500 __crypt__sha512_finish_ctx (&ctx, alt_result); 501 } 502 503 /* Now we can construct the result string. It consists of three 504 parts. */ 505 cp = stpncpy (buffer, sha512_salt_prefix, MAX (0, buflen)); 506 buflen -= sizeof (sha512_salt_prefix) - 1; 507 508 if (rounds_custom) 509 { 510 int n = snprintf (cp, MAX (0, buflen), "%s%zu$", 511 sha512_rounds_prefix, rounds); 512 cp += n; 513 buflen -= n; 514 } 515 516 cp = stpncpy (cp, salt, MIN ((size_t) MAX (0, buflen), salt_len)); 517 buflen -= MIN ((size_t) MAX (0, buflen), salt_len); 518 519 if (buflen > 0) 520 { 521 *cp++ = '$'; 522 --buflen; 523 } 524 525 #define b64_from_24bit(B2, B1, B0, N) \ 526 do { \ 527 unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0); \ 528 int n = (N); \ 529 while (n-- > 0 && buflen > 0) \ 530 { \ 531 *cp++ = b64t[w & 0x3f]; \ 532 --buflen; \ 533 w >>= 6; \ 534 } \ 535 } while (0) 536 537 b64_from_24bit (alt_result[0], alt_result[21], alt_result[42], 4); 538 b64_from_24bit (alt_result[22], alt_result[43], alt_result[1], 4); 539 b64_from_24bit (alt_result[44], alt_result[2], alt_result[23], 4); 540 b64_from_24bit (alt_result[3], alt_result[24], alt_result[45], 4); 541 b64_from_24bit (alt_result[25], alt_result[46], alt_result[4], 4); 542 b64_from_24bit (alt_result[47], alt_result[5], alt_result[26], 4); 543 b64_from_24bit (alt_result[6], alt_result[27], alt_result[48], 4); 544 b64_from_24bit (alt_result[28], alt_result[49], alt_result[7], 4); 545 b64_from_24bit (alt_result[50], alt_result[8], alt_result[29], 4); 546 b64_from_24bit (alt_result[9], alt_result[30], alt_result[51], 4); 547 b64_from_24bit (alt_result[31], alt_result[52], alt_result[10], 4); 548 b64_from_24bit (alt_result[53], alt_result[11], alt_result[32], 4); 549 b64_from_24bit (alt_result[12], alt_result[33], alt_result[54], 4); 550 b64_from_24bit (alt_result[34], alt_result[55], alt_result[13], 4); 551 b64_from_24bit (alt_result[56], alt_result[14], alt_result[35], 4); 552 b64_from_24bit (alt_result[15], alt_result[36], alt_result[57], 4); 553 b64_from_24bit (alt_result[37], alt_result[58], alt_result[16], 4); 554 b64_from_24bit (alt_result[59], alt_result[17], alt_result[38], 4); 555 b64_from_24bit (alt_result[18], alt_result[39], alt_result[60], 4); 556 b64_from_24bit (alt_result[40], alt_result[61], alt_result[19], 4); 557 b64_from_24bit (alt_result[62], alt_result[20], alt_result[41], 4); 558 b64_from_24bit (0, 0, alt_result[63], 2); 559 560 if (buflen <= 0) 561 { 562 errno = ERANGE; 563 buffer = NULL; 564 } 565 else 566 *cp = '\0'; /* Terminate the string. */ 567 568 /* Clear the buffer for the intermediate result so that people 569 attaching to processes or reading core dumps cannot get any 570 information. We do it in this way to clear correct_words[] 571 inside the SHA512 implementation as well. */ 572 __crypt__sha512_init_ctx (&ctx); 573 __crypt__sha512_finish_ctx (&ctx, alt_result); 574 memset (temp_result, '\0', sizeof (temp_result)); 575 memset (p_bytes, '\0', key_len); 576 memset (s_bytes, '\0', salt_len); 577 memset (&ctx, '\0', sizeof (ctx)); 578 memset (&alt_ctx, '\0', sizeof (alt_ctx)); 579 if (copied_key != NULL) 580 memset (copied_key, '\0', key_len); 581 if (copied_salt != NULL) 582 memset (copied_salt, '\0', salt_len); 583 584 return buffer; 585 } 586 587 588 /* This entry point is equivalent to the `crypt' function in Unix 589 libcs. */ 590 char * 591 crypt_sha512 (const char *key, const char *salt) 592 { 593 /* We don't want to have an arbitrary limit in the size of the 594 password. We can compute an upper bound for the size of the 595 result in advance and so we can prepare the buffer we pass to 596 `crypt_sha512_r'. */ 597 static char *buffer; 598 static int buflen; 599 int needed = (sizeof (sha512_salt_prefix) - 1 600 + sizeof (sha512_rounds_prefix) + 9 + 1 601 + strlen (salt) + 1 + 86 + 1); 602 603 if (buflen < needed) 604 { 605 char *new_buffer = (char *) realloc (buffer, needed); 606 if (new_buffer == NULL) 607 return NULL; 608 609 buffer = new_buffer; 610 buflen = needed; 611 } 612 613 return crypt_sha512_r (key, salt, buffer, buflen); 614 } 615 616 617 #ifdef TEST 618 static const struct 619 { 620 const char *input; 621 const char result[64]; 622 } tests[] = 623 { 624 /* Test vectors from FIPS 180-2: appendix C.1. */ 625 { "abc", 626 "\xdd\xaf\x35\xa1\x93\x61\x7a\xba\xcc\x41\x73\x49\xae\x20\x41\x31" 627 "\x12\xe6\xfa\x4e\x89\xa9\x7e\xa2\x0a\x9e\xee\xe6\x4b\x55\xd3\x9a" 628 "\x21\x92\x99\x2a\x27\x4f\xc1\xa8\x36\xba\x3c\x23\xa3\xfe\xeb\xbd" 629 "\x45\x4d\x44\x23\x64\x3c\xe8\x0e\x2a\x9a\xc9\x4f\xa5\x4c\xa4\x9f" }, 630 /* Test vectors from FIPS 180-2: appendix C.2. */ 631 { "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn" 632 "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu", 633 "\x8e\x95\x9b\x75\xda\xe3\x13\xda\x8c\xf4\xf7\x28\x14\xfc\x14\x3f" 634 "\x8f\x77\x79\xc6\xeb\x9f\x7f\xa1\x72\x99\xae\xad\xb6\x88\x90\x18" 635 "\x50\x1d\x28\x9e\x49\x00\xf7\xe4\x33\x1b\x99\xde\xc4\xb5\x43\x3a" 636 "\xc7\xd3\x29\xee\xb6\xdd\x26\x54\x5e\x96\xe5\x5b\x87\x4b\xe9\x09" }, 637 /* Test vectors from the NESSIE project. */ 638 { "", 639 "\xcf\x83\xe1\x35\x7e\xef\xb8\xbd\xf1\x54\x28\x50\xd6\x6d\x80\x07" 640 "\xd6\x20\xe4\x05\x0b\x57\x15\xdc\x83\xf4\xa9\x21\xd3\x6c\xe9\xce" 641 "\x47\xd0\xd1\x3c\x5d\x85\xf2\xb0\xff\x83\x18\xd2\x87\x7e\xec\x2f" 642 "\x63\xb9\x31\xbd\x47\x41\x7a\x81\xa5\x38\x32\x7a\xf9\x27\xda\x3e" }, 643 { "a", 644 "\x1f\x40\xfc\x92\xda\x24\x16\x94\x75\x09\x79\xee\x6c\xf5\x82\xf2" 645 "\xd5\xd7\xd2\x8e\x18\x33\x5d\xe0\x5a\xbc\x54\xd0\x56\x0e\x0f\x53" 646 "\x02\x86\x0c\x65\x2b\xf0\x8d\x56\x02\x52\xaa\x5e\x74\x21\x05\x46" 647 "\xf3\x69\xfb\xbb\xce\x8c\x12\xcf\xc7\x95\x7b\x26\x52\xfe\x9a\x75" }, 648 { "message digest", 649 "\x10\x7d\xbf\x38\x9d\x9e\x9f\x71\xa3\xa9\x5f\x6c\x05\x5b\x92\x51" 650 "\xbc\x52\x68\xc2\xbe\x16\xd6\xc1\x34\x92\xea\x45\xb0\x19\x9f\x33" 651 "\x09\xe1\x64\x55\xab\x1e\x96\x11\x8e\x8a\x90\x5d\x55\x97\xb7\x20" 652 "\x38\xdd\xb3\x72\xa8\x98\x26\x04\x6d\xe6\x66\x87\xbb\x42\x0e\x7c" }, 653 { "abcdefghijklmnopqrstuvwxyz", 654 "\x4d\xbf\xf8\x6c\xc2\xca\x1b\xae\x1e\x16\x46\x8a\x05\xcb\x98\x81" 655 "\xc9\x7f\x17\x53\xbc\xe3\x61\x90\x34\x89\x8f\xaa\x1a\xab\xe4\x29" 656 "\x95\x5a\x1b\xf8\xec\x48\x3d\x74\x21\xfe\x3c\x16\x46\x61\x3a\x59" 657 "\xed\x54\x41\xfb\x0f\x32\x13\x89\xf7\x7f\x48\xa8\x79\xc7\xb1\xf1" }, 658 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", 659 "\x20\x4a\x8f\xc6\xdd\xa8\x2f\x0a\x0c\xed\x7b\xeb\x8e\x08\xa4\x16" 660 "\x57\xc1\x6e\xf4\x68\xb2\x28\xa8\x27\x9b\xe3\x31\xa7\x03\xc3\x35" 661 "\x96\xfd\x15\xc1\x3b\x1b\x07\xf9\xaa\x1d\x3b\xea\x57\x78\x9c\xa0" 662 "\x31\xad\x85\xc7\xa7\x1d\xd7\x03\x54\xec\x63\x12\x38\xca\x34\x45" }, 663 { "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", 664 "\x1e\x07\xbe\x23\xc2\x6a\x86\xea\x37\xea\x81\x0c\x8e\xc7\x80\x93" 665 "\x52\x51\x5a\x97\x0e\x92\x53\xc2\x6f\x53\x6c\xfc\x7a\x99\x96\xc4" 666 "\x5c\x83\x70\x58\x3e\x0a\x78\xfa\x4a\x90\x04\x1d\x71\xa4\xce\xab" 667 "\x74\x23\xf1\x9c\x71\xb9\xd5\xa3\xe0\x12\x49\xf0\xbe\xbd\x58\x94" }, 668 { "123456789012345678901234567890123456789012345678901234567890" 669 "12345678901234567890", 670 "\x72\xec\x1e\xf1\x12\x4a\x45\xb0\x47\xe8\xb7\xc7\x5a\x93\x21\x95" 671 "\x13\x5b\xb6\x1d\xe2\x4e\xc0\xd1\x91\x40\x42\x24\x6e\x0a\xec\x3a" 672 "\x23\x54\xe0\x93\xd7\x6f\x30\x48\xb4\x56\x76\x43\x46\x90\x0c\xb1" 673 "\x30\xd2\xa4\xfd\x5d\xd1\x6a\xbb\x5e\x30\xbc\xb8\x50\xde\xe8\x43" } 674 }; 675 #define ntests (sizeof (tests) / sizeof (tests[0])) 676 677 678 static const struct 679 { 680 const char *salt; 681 const char *input; 682 const char *expected; 683 } tests2[] = 684 { 685 { "$6$saltstring", "Hello world!", 686 "$6$saltstring$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" 687 "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1" }, 688 { "$6$rounds=10000$saltstringsaltstring", "Hello world!", 689 "$6$rounds=10000$saltstringsaltst$OW1/O6BYHV6BcXZu8QVeXbDWra3Oeqh0sb" 690 "HbbMCVNSnCM/UrjmM0Dp8vOuZeHBy/YTBmSK6H9qs/y3RnOaw5v." }, 691 { "$6$rounds=5000$toolongsaltstring", "This is just a test", 692 "$6$rounds=5000$toolongsaltstrin$lQ8jolhgVRVhY4b5pZKaysCLi0QBxGoNeKQ" 693 "zQ3glMhwllF7oGDZxUhx1yxdYcz/e1JSbq3y6JMxxl8audkUEm0" }, 694 { "$6$rounds=1400$anotherlongsaltstring", 695 "a very much longer text to encrypt. This one even stretches over more" 696 "than one line.", 697 "$6$rounds=1400$anotherlongsalts$POfYwTEok97VWcjxIiSOjiykti.o/pQs.wP" 698 "vMxQ6Fm7I6IoYN3CmLs66x9t0oSwbtEW7o7UmJEiDwGqd8p4ur1" }, 699 { "$6$rounds=77777$short", 700 "we have a short salt string but not a short password", 701 "$6$rounds=77777$short$WuQyW2YR.hBNpjjRhpYD/ifIw05xdfeEyQoMxIXbkvr0g" 702 "ge1a1x3yRULJ5CCaUeOxFmtlcGZelFl5CxtgfiAc0" }, 703 { "$6$rounds=123456$asaltof16chars..", "a short string", 704 "$6$rounds=123456$asaltof16chars..$BtCwjqMJGx5hrJhZywWvt0RLE8uZ4oPwc" 705 "elCjmw2kSYu.Ec6ycULevoBK25fs2xXgMNrCzIMVcgEJAstJeonj1" }, 706 { "$6$rounds=10$roundstoolow", "the minimum number is still observed", 707 "$6$rounds=1000$roundstoolow$kUMsbe306n21p9R.FRkW3IGn.S9NPN0x50YhH1x" 708 "hLsPuWGsUSklZt58jaTfF4ZEQpyUNGc0dqbpBYYBaHHrsX." }, 709 }; 710 #define ntests2 (sizeof (tests2) / sizeof (tests2[0])) 711 712 713 int 714 main (void) 715 { 716 struct sha512_ctx ctx; 717 char sum[64]; 718 int result = 0; 719 int cnt; 720 721 for (cnt = 0; cnt < (int) ntests; ++cnt) 722 { 723 __crypt__sha512_init_ctx (&ctx); 724 __crypt__sha512_process_bytes (tests[cnt].input, strlen (tests[cnt].input), &ctx); 725 __crypt__sha512_finish_ctx (&ctx, sum); 726 if (memcmp (tests[cnt].result, sum, 64) != 0) 727 { 728 printf ("test %d run %d failed\n", cnt, 1); 729 result = 1; 730 } 731 732 __crypt__sha512_init_ctx (&ctx); 733 for (int i = 0; tests[cnt].input[i] != '\0'; ++i) 734 __crypt__sha512_process_bytes (&tests[cnt].input[i], 1, &ctx); 735 __crypt__sha512_finish_ctx (&ctx, sum); 736 if (memcmp (tests[cnt].result, sum, 64) != 0) 737 { 738 printf ("test %d run %d failed\n", cnt, 2); 739 result = 1; 740 } 741 } 742 743 /* Test vector from FIPS 180-2: appendix C.3. */ 744 char buf[1000]; 745 memset (buf, 'a', sizeof (buf)); 746 __crypt__sha512_init_ctx (&ctx); 747 for (int i = 0; i < 1000; ++i) 748 __crypt__sha512_process_bytes (buf, sizeof (buf), &ctx); 749 __crypt__sha512_finish_ctx (&ctx, sum); 750 static const char expected[64] = 751 "\xe7\x18\x48\x3d\x0c\xe7\x69\x64\x4e\x2e\x42\xc7\xbc\x15\xb4\x63" 752 "\x8e\x1f\x98\xb1\x3b\x20\x44\x28\x56\x32\xa8\x03\xaf\xa9\x73\xeb" 753 "\xde\x0f\xf2\x44\x87\x7e\xa6\x0a\x4c\xb0\x43\x2c\xe5\x77\xc3\x1b" 754 "\xeb\x00\x9c\x5c\x2c\x49\xaa\x2e\x4e\xad\xb2\x17\xad\x8c\xc0\x9b"; 755 if (memcmp (expected, sum, 64) != 0) 756 { 757 printf ("test %d failed\n", cnt); 758 result = 1; 759 } 760 761 for (cnt = 0; cnt < ntests2; ++cnt) 762 { 763 char *cp = crypt_sha512 (tests2[cnt].input, tests2[cnt].salt); 764 765 if (strcmp (cp, tests2[cnt].expected) != 0) 766 { 767 printf ("test %d: expected \"%s\", got \"%s\"\n", 768 cnt, tests2[cnt].expected, cp); 769 result = 1; 770 } 771 } 772 773 if (result == 0) 774 puts ("all tests OK"); 775 776 return result; 777 } 778 #endif 779 780