1 /* 2 * SHA512-based Unix crypt implementation. 3 * Released into the Public Domain by Ulrich Drepper <drepper@redhat.com>. 4 */ 5 #include <errno.h> 6 #include <limits.h> 7 #include <stdbool.h> 8 #include <stdint.h> 9 #include <stdio.h> 10 #include <stdlib.h> 11 #include <string.h> 12 #include <sys/endian.h> 13 #include <sys/param.h> 14 #include <sys/types.h> 15 16 17 /* Structure to save state of computation between the single steps. */ 18 struct sha512_ctx 19 { 20 uint64_t H[8]; 21 22 uint64_t total[2]; 23 uint64_t buflen; 24 char buffer[256]; /* NB: always correctly aligned for uint64_t. */ 25 }; 26 27 28 #if __BYTE_ORDER == __LITTLE_ENDIAN 29 # define SWAP(n) \ 30 (((n) << 56) \ 31 | (((n) & 0xff00) << 40) \ 32 | (((n) & 0xff0000) << 24) \ 33 | (((n) & 0xff000000) << 8) \ 34 | (((n) >> 8) & 0xff000000) \ 35 | (((n) >> 24) & 0xff0000) \ 36 | (((n) >> 40) & 0xff00) \ 37 | ((n) >> 56)) 38 #else 39 # define SWAP(n) (n) 40 #endif 41 42 43 /* This array contains the bytes used to pad the buffer to the next 44 64-byte boundary. (FIPS 180-2:5.1.2) */ 45 static const unsigned char fillbuf[128] = { 0x80, 0 /* , 0, 0, ... */ }; 46 47 48 /* Constants for SHA512 from FIPS 180-2:4.2.3. */ 49 static const uint64_t K[80] = 50 { 51 UINT64_C (0x428a2f98d728ae22), UINT64_C (0x7137449123ef65cd), 52 UINT64_C (0xb5c0fbcfec4d3b2f), UINT64_C (0xe9b5dba58189dbbc), 53 UINT64_C (0x3956c25bf348b538), UINT64_C (0x59f111f1b605d019), 54 UINT64_C (0x923f82a4af194f9b), UINT64_C (0xab1c5ed5da6d8118), 55 UINT64_C (0xd807aa98a3030242), UINT64_C (0x12835b0145706fbe), 56 UINT64_C (0x243185be4ee4b28c), UINT64_C (0x550c7dc3d5ffb4e2), 57 UINT64_C (0x72be5d74f27b896f), UINT64_C (0x80deb1fe3b1696b1), 58 UINT64_C (0x9bdc06a725c71235), UINT64_C (0xc19bf174cf692694), 59 UINT64_C (0xe49b69c19ef14ad2), UINT64_C (0xefbe4786384f25e3), 60 UINT64_C (0x0fc19dc68b8cd5b5), UINT64_C (0x240ca1cc77ac9c65), 61 UINT64_C (0x2de92c6f592b0275), UINT64_C (0x4a7484aa6ea6e483), 62 UINT64_C (0x5cb0a9dcbd41fbd4), UINT64_C (0x76f988da831153b5), 63 UINT64_C (0x983e5152ee66dfab), UINT64_C (0xa831c66d2db43210), 64 UINT64_C (0xb00327c898fb213f), UINT64_C (0xbf597fc7beef0ee4), 65 UINT64_C (0xc6e00bf33da88fc2), UINT64_C (0xd5a79147930aa725), 66 UINT64_C (0x06ca6351e003826f), UINT64_C (0x142929670a0e6e70), 67 UINT64_C (0x27b70a8546d22ffc), UINT64_C (0x2e1b21385c26c926), 68 UINT64_C (0x4d2c6dfc5ac42aed), UINT64_C (0x53380d139d95b3df), 69 UINT64_C (0x650a73548baf63de), UINT64_C (0x766a0abb3c77b2a8), 70 UINT64_C (0x81c2c92e47edaee6), UINT64_C (0x92722c851482353b), 71 UINT64_C (0xa2bfe8a14cf10364), UINT64_C (0xa81a664bbc423001), 72 UINT64_C (0xc24b8b70d0f89791), UINT64_C (0xc76c51a30654be30), 73 UINT64_C (0xd192e819d6ef5218), UINT64_C (0xd69906245565a910), 74 UINT64_C (0xf40e35855771202a), UINT64_C (0x106aa07032bbd1b8), 75 UINT64_C (0x19a4c116b8d2d0c8), UINT64_C (0x1e376c085141ab53), 76 UINT64_C (0x2748774cdf8eeb99), UINT64_C (0x34b0bcb5e19b48a8), 77 UINT64_C (0x391c0cb3c5c95a63), UINT64_C (0x4ed8aa4ae3418acb), 78 UINT64_C (0x5b9cca4f7763e373), UINT64_C (0x682e6ff3d6b2b8a3), 79 UINT64_C (0x748f82ee5defb2fc), UINT64_C (0x78a5636f43172f60), 80 UINT64_C (0x84c87814a1f0ab72), UINT64_C (0x8cc702081a6439ec), 81 UINT64_C (0x90befffa23631e28), UINT64_C (0xa4506cebde82bde9), 82 UINT64_C (0xbef9a3f7b2c67915), UINT64_C (0xc67178f2e372532b), 83 UINT64_C (0xca273eceea26619c), UINT64_C (0xd186b8c721c0c207), 84 UINT64_C (0xeada7dd6cde0eb1e), UINT64_C (0xf57d4f7fee6ed178), 85 UINT64_C (0x06f067aa72176fba), UINT64_C (0x0a637dc5a2c898a6), 86 UINT64_C (0x113f9804bef90dae), UINT64_C (0x1b710b35131c471b), 87 UINT64_C (0x28db77f523047d84), UINT64_C (0x32caab7b40c72493), 88 UINT64_C (0x3c9ebe0a15c9bebc), UINT64_C (0x431d67c49c100d4c), 89 UINT64_C (0x4cc5d4becb3e42b6), UINT64_C (0x597f299cfc657e2a), 90 UINT64_C (0x5fcb6fab3ad6faec), UINT64_C (0x6c44198c4a475817) 91 }; 92 93 94 /* Process LEN bytes of BUFFER, accumulating context into CTX. 95 It is assumed that LEN % 128 == 0. */ 96 static void 97 sha512_process_block (const void *buffer, size_t len, struct sha512_ctx *ctx) 98 { 99 const uint64_t *words = buffer; 100 size_t nwords = len / sizeof (uint64_t); 101 uint64_t a = ctx->H[0]; 102 uint64_t b = ctx->H[1]; 103 uint64_t c = ctx->H[2]; 104 uint64_t d = ctx->H[3]; 105 uint64_t e = ctx->H[4]; 106 uint64_t f = ctx->H[5]; 107 uint64_t g = ctx->H[6]; 108 uint64_t h = ctx->H[7]; 109 110 /* First increment the byte count. FIPS 180-2 specifies the possible 111 length of the file up to 2^128 bits. Here we only compute the 112 number of bytes. Do a double word increment. */ 113 ctx->total[0] += len; 114 if (ctx->total[0] < len) 115 ++ctx->total[1]; 116 117 /* Process all bytes in the buffer with 128 bytes in each round of 118 the loop. */ 119 while (nwords > 0) 120 { 121 uint64_t W[80]; 122 uint64_t a_save = a; 123 uint64_t b_save = b; 124 uint64_t c_save = c; 125 uint64_t d_save = d; 126 uint64_t e_save = e; 127 uint64_t f_save = f; 128 uint64_t g_save = g; 129 uint64_t h_save = h; 130 131 /* Operators defined in FIPS 180-2:4.1.2. */ 132 #define Ch(x, y, z) ((x & y) ^ (~x & z)) 133 #define Maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z)) 134 #define S0(x) (CYCLIC (x, 28) ^ CYCLIC (x, 34) ^ CYCLIC (x, 39)) 135 #define S1(x) (CYCLIC (x, 14) ^ CYCLIC (x, 18) ^ CYCLIC (x, 41)) 136 #define R0(x) (CYCLIC (x, 1) ^ CYCLIC (x, 8) ^ (x >> 7)) 137 #define R1(x) (CYCLIC (x, 19) ^ CYCLIC (x, 61) ^ (x >> 6)) 138 139 /* It is unfortunate that C does not provide an operator for 140 cyclic rotation. Hope the C compiler is smart enough. */ 141 #define CYCLIC(w, s) ((w >> s) | (w << (64 - s))) 142 143 /* Compute the message schedule according to FIPS 180-2:6.3.2 step 2. */ 144 for (unsigned int t = 0; t < 16; ++t) 145 { 146 W[t] = SWAP (*words); 147 ++words; 148 } 149 for (unsigned int t = 16; t < 80; ++t) 150 W[t] = R1 (W[t - 2]) + W[t - 7] + R0 (W[t - 15]) + W[t - 16]; 151 152 /* The actual computation according to FIPS 180-2:6.3.2 step 3. */ 153 for (unsigned int t = 0; t < 80; ++t) 154 { 155 uint64_t T1 = h + S1 (e) + Ch (e, f, g) + K[t] + W[t]; 156 uint64_t T2 = S0 (a) + Maj (a, b, c); 157 h = g; 158 g = f; 159 f = e; 160 e = d + T1; 161 d = c; 162 c = b; 163 b = a; 164 a = T1 + T2; 165 } 166 167 /* Add the starting values of the context according to FIPS 180-2:6.3.2 168 step 4. */ 169 a += a_save; 170 b += b_save; 171 c += c_save; 172 d += d_save; 173 e += e_save; 174 f += f_save; 175 g += g_save; 176 h += h_save; 177 178 /* Prepare for the next round. */ 179 nwords -= 16; 180 } 181 182 /* Put checksum in context given as argument. */ 183 ctx->H[0] = a; 184 ctx->H[1] = b; 185 ctx->H[2] = c; 186 ctx->H[3] = d; 187 ctx->H[4] = e; 188 ctx->H[5] = f; 189 ctx->H[6] = g; 190 ctx->H[7] = h; 191 } 192 193 194 /* Initialize structure containing state of computation. 195 (FIPS 180-2:5.3.3) */ 196 static void 197 sha512_init_ctx (struct sha512_ctx *ctx) 198 { 199 ctx->H[0] = UINT64_C (0x6a09e667f3bcc908); 200 ctx->H[1] = UINT64_C (0xbb67ae8584caa73b); 201 ctx->H[2] = UINT64_C (0x3c6ef372fe94f82b); 202 ctx->H[3] = UINT64_C (0xa54ff53a5f1d36f1); 203 ctx->H[4] = UINT64_C (0x510e527fade682d1); 204 ctx->H[5] = UINT64_C (0x9b05688c2b3e6c1f); 205 ctx->H[6] = UINT64_C (0x1f83d9abfb41bd6b); 206 ctx->H[7] = UINT64_C (0x5be0cd19137e2179); 207 208 ctx->total[0] = ctx->total[1] = 0; 209 ctx->buflen = 0; 210 } 211 212 213 /* Process the remaining bytes in the internal buffer and the usual 214 prolog according to the standard and write the result to RESBUF. 215 216 IMPORTANT: On some systems it is required that RESBUF is correctly 217 aligned for a 32 bits value. */ 218 static void * 219 sha512_finish_ctx (struct sha512_ctx *ctx, void *resbuf) 220 { 221 /* Take yet unprocessed bytes into account. */ 222 uint64_t bytes = ctx->buflen; 223 size_t pad; 224 225 /* Now count remaining bytes. */ 226 ctx->total[0] += bytes; 227 if (ctx->total[0] < bytes) 228 ++ctx->total[1]; 229 230 pad = bytes >= 112 ? 128 + 112 - bytes : 112 - bytes; 231 memcpy (&ctx->buffer[bytes], fillbuf, pad); 232 233 /* Put the 128-bit file length in *bits* at the end of the buffer. */ 234 *(uint64_t *) &ctx->buffer[bytes + pad + 8] = SWAP (ctx->total[0] << 3); 235 *(uint64_t *) &ctx->buffer[bytes + pad] = SWAP ((ctx->total[1] << 3) | 236 (ctx->total[0] >> 61)); 237 238 /* Process last bytes. */ 239 sha512_process_block (ctx->buffer, bytes + pad + 16, ctx); 240 241 /* Put result from CTX in first 64 bytes following RESBUF. */ 242 for (unsigned int i = 0; i < 8; ++i) 243 ((uint64_t *) resbuf)[i] = SWAP (ctx->H[i]); 244 245 return resbuf; 246 } 247 248 249 static void 250 sha512_process_bytes (const void *buffer, size_t len, struct sha512_ctx *ctx) 251 { 252 /* When we already have some bits in our internal buffer concatenate 253 both inputs first. */ 254 if (ctx->buflen != 0) 255 { 256 size_t left_over = ctx->buflen; 257 size_t add = 256 - left_over > len ? len : 256 - left_over; 258 259 memcpy (&ctx->buffer[left_over], buffer, add); 260 ctx->buflen += add; 261 262 if (ctx->buflen > 128) 263 { 264 sha512_process_block (ctx->buffer, ctx->buflen & ~127, ctx); 265 266 ctx->buflen &= 127; 267 /* The regions in the following copy operation cannot overlap. */ 268 memcpy (ctx->buffer, &ctx->buffer[(left_over + add) & ~127], 269 ctx->buflen); 270 } 271 272 buffer = (const char *) buffer + add; 273 len -= add; 274 } 275 276 /* Process available complete blocks. */ 277 if (len >= 128) 278 { 279 #if !_STRING_ARCH_unaligned 280 /* To check alignment gcc has an appropriate operator. Other 281 compilers don't. */ 282 # if __GNUC__ >= 2 283 # define UNALIGNED_P(p) (((uintptr_t) p) % __alignof__ (uint64_t) != 0) 284 # else 285 # define UNALIGNED_P(p) (((uintptr_t) p) % sizeof (uint64_t) != 0) 286 # endif 287 if (UNALIGNED_P (buffer)) 288 while (len > 128) 289 { 290 sha512_process_block (memcpy (ctx->buffer, buffer, 128), 128, 291 ctx); 292 buffer = (const char *) buffer + 128; 293 len -= 128; 294 } 295 else 296 #endif 297 { 298 sha512_process_block (buffer, len & ~127, ctx); 299 buffer = (const char *) buffer + (len & ~127); 300 len &= 127; 301 } 302 } 303 304 /* Move remaining bytes into internal buffer. */ 305 if (len > 0) 306 { 307 size_t left_over = ctx->buflen; 308 309 memcpy (&ctx->buffer[left_over], buffer, len); 310 left_over += len; 311 if (left_over >= 128) 312 { 313 sha512_process_block (ctx->buffer, 128, ctx); 314 left_over -= 128; 315 memcpy (ctx->buffer, &ctx->buffer[128], left_over); 316 } 317 ctx->buflen = left_over; 318 } 319 } 320 321 322 /* Define our magic string to mark salt for SHA512 "encryption" 323 replacement. */ 324 static const char sha512_salt_prefix[] = "$6$"; 325 326 /* Prefix for optional rounds specification. */ 327 static const char sha512_rounds_prefix[] = "rounds="; 328 329 /* Maximum salt string length. */ 330 #define SALT_LEN_MAX 16 331 /* Default number of rounds if not explicitly specified. */ 332 #define ROUNDS_DEFAULT 5000 333 /* Minimum number of rounds. */ 334 #define ROUNDS_MIN 1000 335 /* Maximum number of rounds. */ 336 #define ROUNDS_MAX 999999999 337 338 /* Table with characters for base64 transformation. */ 339 static const char b64t[64] = 340 "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; 341 342 343 static char * 344 crypt_sha512_r (const char *key, const char *salt, char *buffer, int buflen) 345 { 346 unsigned char alt_result[64] 347 __attribute__ ((__aligned__ (__alignof__ (uint64_t)))); 348 unsigned char temp_result[64] 349 __attribute__ ((__aligned__ (__alignof__ (uint64_t)))); 350 struct sha512_ctx ctx; 351 struct sha512_ctx alt_ctx; 352 size_t salt_len; 353 size_t key_len; 354 size_t cnt; 355 char *cp; 356 char *copied_key = NULL; 357 char *copied_salt = NULL; 358 char *p_bytes; 359 char *s_bytes; 360 /* Default number of rounds. */ 361 size_t rounds = ROUNDS_DEFAULT; 362 bool rounds_custom = false; 363 364 /* Find beginning of salt string. The prefix should normally always 365 be present. Just in case it is not. */ 366 if (strncmp (sha512_salt_prefix, salt, sizeof (sha512_salt_prefix) - 1) == 0) 367 /* Skip salt prefix. */ 368 salt += sizeof (sha512_salt_prefix) - 1; 369 370 if (strncmp (salt, sha512_rounds_prefix, sizeof (sha512_rounds_prefix) - 1) 371 == 0) 372 { 373 const char *num = salt + sizeof (sha512_rounds_prefix) - 1; 374 char *endp; 375 unsigned long int srounds = strtoul (num, &endp, 10); 376 if (*endp == '$') 377 { 378 salt = endp + 1; 379 rounds = MAX (ROUNDS_MIN, MIN (srounds, ROUNDS_MAX)); 380 rounds_custom = true; 381 } 382 } 383 384 salt_len = MIN (strcspn (salt, "$"), SALT_LEN_MAX); 385 key_len = strlen (key); 386 387 if ((key - (char *) 0) % __alignof__ (uint64_t) != 0) 388 { 389 char *tmp = (char *) alloca (key_len + __alignof__ (uint64_t)); 390 key = copied_key = 391 memcpy (tmp + __alignof__ (uint64_t) 392 - (tmp - (char *) 0) % __alignof__ (uint64_t), 393 key, key_len); 394 } 395 396 if ((salt - (char *) 0) % __alignof__ (uint64_t) != 0) 397 { 398 char *tmp = (char *) alloca (salt_len + __alignof__ (uint64_t)); 399 salt = copied_salt = 400 memcpy (tmp + __alignof__ (uint64_t) 401 - (tmp - (char *) 0) % __alignof__ (uint64_t), 402 salt, salt_len); 403 } 404 405 /* Prepare for the real work. */ 406 sha512_init_ctx (&ctx); 407 408 /* Add the key string. */ 409 sha512_process_bytes (key, key_len, &ctx); 410 411 /* The last part is the salt string. This must be at most 16 412 characters and it ends at the first `$' character (for 413 compatibility with existing implementations). */ 414 sha512_process_bytes (salt, salt_len, &ctx); 415 416 417 /* Compute alternate SHA512 sum with input KEY, SALT, and KEY. The 418 final result will be added to the first context. */ 419 sha512_init_ctx (&alt_ctx); 420 421 /* Add key. */ 422 sha512_process_bytes (key, key_len, &alt_ctx); 423 424 /* Add salt. */ 425 sha512_process_bytes (salt, salt_len, &alt_ctx); 426 427 /* Add key again. */ 428 sha512_process_bytes (key, key_len, &alt_ctx); 429 430 /* Now get result of this (64 bytes) and add it to the other 431 context. */ 432 sha512_finish_ctx (&alt_ctx, alt_result); 433 434 /* Add for any character in the key one byte of the alternate sum. */ 435 for (cnt = key_len; cnt > 64; cnt -= 64) 436 sha512_process_bytes (alt_result, 64, &ctx); 437 sha512_process_bytes (alt_result, cnt, &ctx); 438 439 /* Take the binary representation of the length of the key and for every 440 1 add the alternate sum, for every 0 the key. */ 441 for (cnt = key_len; cnt > 0; cnt >>= 1) 442 if ((cnt & 1) != 0) 443 sha512_process_bytes (alt_result, 64, &ctx); 444 else 445 sha512_process_bytes (key, key_len, &ctx); 446 447 /* Create intermediate result. */ 448 sha512_finish_ctx (&ctx, alt_result); 449 450 /* Start computation of P byte sequence. */ 451 sha512_init_ctx (&alt_ctx); 452 453 /* For every character in the password add the entire password. */ 454 for (cnt = 0; cnt < key_len; ++cnt) 455 sha512_process_bytes (key, key_len, &alt_ctx); 456 457 /* Finish the digest. */ 458 sha512_finish_ctx (&alt_ctx, temp_result); 459 460 /* Create byte sequence P. */ 461 cp = p_bytes = alloca (key_len); 462 for (cnt = key_len; cnt >= 64; cnt -= 64) 463 cp = mempcpy (cp, temp_result, 64); 464 memcpy (cp, temp_result, cnt); 465 466 /* Start computation of S byte sequence. */ 467 sha512_init_ctx (&alt_ctx); 468 469 /* For every character in the password add the entire password. */ 470 for (cnt = 0; cnt < 16 + alt_result[0]; ++cnt) 471 sha512_process_bytes (salt, salt_len, &alt_ctx); 472 473 /* Finish the digest. */ 474 sha512_finish_ctx (&alt_ctx, temp_result); 475 476 /* Create byte sequence S. */ 477 cp = s_bytes = alloca (salt_len); 478 for (cnt = salt_len; cnt >= 64; cnt -= 64) 479 cp = mempcpy (cp, temp_result, 64); 480 memcpy (cp, temp_result, cnt); 481 482 /* Repeatedly run the collected hash value through SHA512 to burn 483 CPU cycles. */ 484 for (cnt = 0; cnt < rounds; ++cnt) 485 { 486 /* New context. */ 487 sha512_init_ctx (&ctx); 488 489 /* Add key or last result. */ 490 if ((cnt & 1) != 0) 491 sha512_process_bytes (p_bytes, key_len, &ctx); 492 else 493 sha512_process_bytes (alt_result, 64, &ctx); 494 495 /* Add salt for numbers not divisible by 3. */ 496 if (cnt % 3 != 0) 497 sha512_process_bytes (s_bytes, salt_len, &ctx); 498 499 /* Add key for numbers not divisible by 7. */ 500 if (cnt % 7 != 0) 501 sha512_process_bytes (p_bytes, key_len, &ctx); 502 503 /* Add key or last result. */ 504 if ((cnt & 1) != 0) 505 sha512_process_bytes (alt_result, 64, &ctx); 506 else 507 sha512_process_bytes (p_bytes, key_len, &ctx); 508 509 /* Create intermediate result. */ 510 sha512_finish_ctx (&ctx, alt_result); 511 } 512 513 /* Now we can construct the result string. It consists of three 514 parts. */ 515 cp = stpncpy (buffer, sha512_salt_prefix, MAX (0, buflen)); 516 buflen -= sizeof (sha512_salt_prefix) - 1; 517 518 if (rounds_custom) 519 { 520 int n = snprintf (cp, MAX (0, buflen), "%s%zu$", 521 sha512_rounds_prefix, rounds); 522 cp += n; 523 buflen -= n; 524 } 525 526 cp = stpncpy (cp, salt, MIN ((size_t) MAX (0, buflen), salt_len)); 527 buflen -= MIN ((size_t) MAX (0, buflen), salt_len); 528 529 if (buflen > 0) 530 { 531 *cp++ = '$'; 532 --buflen; 533 } 534 535 #define b64_from_24bit(B2, B1, B0, N) \ 536 do { \ 537 unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0); \ 538 int n = (N); \ 539 while (n-- > 0 && buflen > 0) \ 540 { \ 541 *cp++ = b64t[w & 0x3f]; \ 542 --buflen; \ 543 w >>= 6; \ 544 } \ 545 } while (0) 546 547 b64_from_24bit (alt_result[0], alt_result[21], alt_result[42], 4); 548 b64_from_24bit (alt_result[22], alt_result[43], alt_result[1], 4); 549 b64_from_24bit (alt_result[44], alt_result[2], alt_result[23], 4); 550 b64_from_24bit (alt_result[3], alt_result[24], alt_result[45], 4); 551 b64_from_24bit (alt_result[25], alt_result[46], alt_result[4], 4); 552 b64_from_24bit (alt_result[47], alt_result[5], alt_result[26], 4); 553 b64_from_24bit (alt_result[6], alt_result[27], alt_result[48], 4); 554 b64_from_24bit (alt_result[28], alt_result[49], alt_result[7], 4); 555 b64_from_24bit (alt_result[50], alt_result[8], alt_result[29], 4); 556 b64_from_24bit (alt_result[9], alt_result[30], alt_result[51], 4); 557 b64_from_24bit (alt_result[31], alt_result[52], alt_result[10], 4); 558 b64_from_24bit (alt_result[53], alt_result[11], alt_result[32], 4); 559 b64_from_24bit (alt_result[12], alt_result[33], alt_result[54], 4); 560 b64_from_24bit (alt_result[34], alt_result[55], alt_result[13], 4); 561 b64_from_24bit (alt_result[56], alt_result[14], alt_result[35], 4); 562 b64_from_24bit (alt_result[15], alt_result[36], alt_result[57], 4); 563 b64_from_24bit (alt_result[37], alt_result[58], alt_result[16], 4); 564 b64_from_24bit (alt_result[59], alt_result[17], alt_result[38], 4); 565 b64_from_24bit (alt_result[18], alt_result[39], alt_result[60], 4); 566 b64_from_24bit (alt_result[40], alt_result[61], alt_result[19], 4); 567 b64_from_24bit (alt_result[62], alt_result[20], alt_result[41], 4); 568 b64_from_24bit (0, 0, alt_result[63], 2); 569 570 if (buflen <= 0) 571 { 572 errno = ERANGE; 573 buffer = NULL; 574 } 575 else 576 *cp = '\0'; /* Terminate the string. */ 577 578 /* Clear the buffer for the intermediate result so that people 579 attaching to processes or reading core dumps cannot get any 580 information. We do it in this way to clear correct_words[] 581 inside the SHA512 implementation as well. */ 582 sha512_init_ctx (&ctx); 583 sha512_finish_ctx (&ctx, alt_result); 584 memset (temp_result, '\0', sizeof (temp_result)); 585 memset (p_bytes, '\0', key_len); 586 memset (s_bytes, '\0', salt_len); 587 memset (&ctx, '\0', sizeof (ctx)); 588 memset (&alt_ctx, '\0', sizeof (alt_ctx)); 589 if (copied_key != NULL) 590 memset (copied_key, '\0', key_len); 591 if (copied_salt != NULL) 592 memset (copied_salt, '\0', salt_len); 593 594 return buffer; 595 } 596 597 598 /* This entry point is equivalent to the `crypt' function in Unix 599 libcs. */ 600 char * 601 crypt_sha512 (const char *key, const char *salt) 602 { 603 /* We don't want to have an arbitrary limit in the size of the 604 password. We can compute an upper bound for the size of the 605 result in advance and so we can prepare the buffer we pass to 606 `crypt_sha512_r'. */ 607 static char *buffer; 608 static int buflen; 609 int needed = (sizeof (sha512_salt_prefix) - 1 610 + sizeof (sha512_rounds_prefix) + 9 + 1 611 + strlen (salt) + 1 + 86 + 1); 612 613 if (buflen < needed) 614 { 615 char *new_buffer = (char *) realloc (buffer, needed); 616 if (new_buffer == NULL) 617 return NULL; 618 619 buffer = new_buffer; 620 buflen = needed; 621 } 622 623 return crypt_sha512_r (key, salt, buffer, buflen); 624 } 625 626 627 #ifdef TEST 628 static const struct 629 { 630 const char *input; 631 const char result[64]; 632 } tests[] = 633 { 634 /* Test vectors from FIPS 180-2: appendix C.1. */ 635 { "abc", 636 "\xdd\xaf\x35\xa1\x93\x61\x7a\xba\xcc\x41\x73\x49\xae\x20\x41\x31" 637 "\x12\xe6\xfa\x4e\x89\xa9\x7e\xa2\x0a\x9e\xee\xe6\x4b\x55\xd3\x9a" 638 "\x21\x92\x99\x2a\x27\x4f\xc1\xa8\x36\xba\x3c\x23\xa3\xfe\xeb\xbd" 639 "\x45\x4d\x44\x23\x64\x3c\xe8\x0e\x2a\x9a\xc9\x4f\xa5\x4c\xa4\x9f" }, 640 /* Test vectors from FIPS 180-2: appendix C.2. */ 641 { "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn" 642 "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu", 643 "\x8e\x95\x9b\x75\xda\xe3\x13\xda\x8c\xf4\xf7\x28\x14\xfc\x14\x3f" 644 "\x8f\x77\x79\xc6\xeb\x9f\x7f\xa1\x72\x99\xae\xad\xb6\x88\x90\x18" 645 "\x50\x1d\x28\x9e\x49\x00\xf7\xe4\x33\x1b\x99\xde\xc4\xb5\x43\x3a" 646 "\xc7\xd3\x29\xee\xb6\xdd\x26\x54\x5e\x96\xe5\x5b\x87\x4b\xe9\x09" }, 647 /* Test vectors from the NESSIE project. */ 648 { "", 649 "\xcf\x83\xe1\x35\x7e\xef\xb8\xbd\xf1\x54\x28\x50\xd6\x6d\x80\x07" 650 "\xd6\x20\xe4\x05\x0b\x57\x15\xdc\x83\xf4\xa9\x21\xd3\x6c\xe9\xce" 651 "\x47\xd0\xd1\x3c\x5d\x85\xf2\xb0\xff\x83\x18\xd2\x87\x7e\xec\x2f" 652 "\x63\xb9\x31\xbd\x47\x41\x7a\x81\xa5\x38\x32\x7a\xf9\x27\xda\x3e" }, 653 { "a", 654 "\x1f\x40\xfc\x92\xda\x24\x16\x94\x75\x09\x79\xee\x6c\xf5\x82\xf2" 655 "\xd5\xd7\xd2\x8e\x18\x33\x5d\xe0\x5a\xbc\x54\xd0\x56\x0e\x0f\x53" 656 "\x02\x86\x0c\x65\x2b\xf0\x8d\x56\x02\x52\xaa\x5e\x74\x21\x05\x46" 657 "\xf3\x69\xfb\xbb\xce\x8c\x12\xcf\xc7\x95\x7b\x26\x52\xfe\x9a\x75" }, 658 { "message digest", 659 "\x10\x7d\xbf\x38\x9d\x9e\x9f\x71\xa3\xa9\x5f\x6c\x05\x5b\x92\x51" 660 "\xbc\x52\x68\xc2\xbe\x16\xd6\xc1\x34\x92\xea\x45\xb0\x19\x9f\x33" 661 "\x09\xe1\x64\x55\xab\x1e\x96\x11\x8e\x8a\x90\x5d\x55\x97\xb7\x20" 662 "\x38\xdd\xb3\x72\xa8\x98\x26\x04\x6d\xe6\x66\x87\xbb\x42\x0e\x7c" }, 663 { "abcdefghijklmnopqrstuvwxyz", 664 "\x4d\xbf\xf8\x6c\xc2\xca\x1b\xae\x1e\x16\x46\x8a\x05\xcb\x98\x81" 665 "\xc9\x7f\x17\x53\xbc\xe3\x61\x90\x34\x89\x8f\xaa\x1a\xab\xe4\x29" 666 "\x95\x5a\x1b\xf8\xec\x48\x3d\x74\x21\xfe\x3c\x16\x46\x61\x3a\x59" 667 "\xed\x54\x41\xfb\x0f\x32\x13\x89\xf7\x7f\x48\xa8\x79\xc7\xb1\xf1" }, 668 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", 669 "\x20\x4a\x8f\xc6\xdd\xa8\x2f\x0a\x0c\xed\x7b\xeb\x8e\x08\xa4\x16" 670 "\x57\xc1\x6e\xf4\x68\xb2\x28\xa8\x27\x9b\xe3\x31\xa7\x03\xc3\x35" 671 "\x96\xfd\x15\xc1\x3b\x1b\x07\xf9\xaa\x1d\x3b\xea\x57\x78\x9c\xa0" 672 "\x31\xad\x85\xc7\xa7\x1d\xd7\x03\x54\xec\x63\x12\x38\xca\x34\x45" }, 673 { "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", 674 "\x1e\x07\xbe\x23\xc2\x6a\x86\xea\x37\xea\x81\x0c\x8e\xc7\x80\x93" 675 "\x52\x51\x5a\x97\x0e\x92\x53\xc2\x6f\x53\x6c\xfc\x7a\x99\x96\xc4" 676 "\x5c\x83\x70\x58\x3e\x0a\x78\xfa\x4a\x90\x04\x1d\x71\xa4\xce\xab" 677 "\x74\x23\xf1\x9c\x71\xb9\xd5\xa3\xe0\x12\x49\xf0\xbe\xbd\x58\x94" }, 678 { "123456789012345678901234567890123456789012345678901234567890" 679 "12345678901234567890", 680 "\x72\xec\x1e\xf1\x12\x4a\x45\xb0\x47\xe8\xb7\xc7\x5a\x93\x21\x95" 681 "\x13\x5b\xb6\x1d\xe2\x4e\xc0\xd1\x91\x40\x42\x24\x6e\x0a\xec\x3a" 682 "\x23\x54\xe0\x93\xd7\x6f\x30\x48\xb4\x56\x76\x43\x46\x90\x0c\xb1" 683 "\x30\xd2\xa4\xfd\x5d\xd1\x6a\xbb\x5e\x30\xbc\xb8\x50\xde\xe8\x43" } 684 }; 685 #define ntests (sizeof (tests) / sizeof (tests[0])) 686 687 688 static const struct 689 { 690 const char *salt; 691 const char *input; 692 const char *expected; 693 } tests2[] = 694 { 695 { "$6$saltstring", "Hello world!", 696 "$6$saltstring$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu" 697 "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1" }, 698 { "$6$rounds=10000$saltstringsaltstring", "Hello world!", 699 "$6$rounds=10000$saltstringsaltst$OW1/O6BYHV6BcXZu8QVeXbDWra3Oeqh0sb" 700 "HbbMCVNSnCM/UrjmM0Dp8vOuZeHBy/YTBmSK6H9qs/y3RnOaw5v." }, 701 { "$6$rounds=5000$toolongsaltstring", "This is just a test", 702 "$6$rounds=5000$toolongsaltstrin$lQ8jolhgVRVhY4b5pZKaysCLi0QBxGoNeKQ" 703 "zQ3glMhwllF7oGDZxUhx1yxdYcz/e1JSbq3y6JMxxl8audkUEm0" }, 704 { "$6$rounds=1400$anotherlongsaltstring", 705 "a very much longer text to encrypt. This one even stretches over more" 706 "than one line.", 707 "$6$rounds=1400$anotherlongsalts$POfYwTEok97VWcjxIiSOjiykti.o/pQs.wP" 708 "vMxQ6Fm7I6IoYN3CmLs66x9t0oSwbtEW7o7UmJEiDwGqd8p4ur1" }, 709 { "$6$rounds=77777$short", 710 "we have a short salt string but not a short password", 711 "$6$rounds=77777$short$WuQyW2YR.hBNpjjRhpYD/ifIw05xdfeEyQoMxIXbkvr0g" 712 "ge1a1x3yRULJ5CCaUeOxFmtlcGZelFl5CxtgfiAc0" }, 713 { "$6$rounds=123456$asaltof16chars..", "a short string", 714 "$6$rounds=123456$asaltof16chars..$BtCwjqMJGx5hrJhZywWvt0RLE8uZ4oPwc" 715 "elCjmw2kSYu.Ec6ycULevoBK25fs2xXgMNrCzIMVcgEJAstJeonj1" }, 716 { "$6$rounds=10$roundstoolow", "the minimum number is still observed", 717 "$6$rounds=1000$roundstoolow$kUMsbe306n21p9R.FRkW3IGn.S9NPN0x50YhH1x" 718 "hLsPuWGsUSklZt58jaTfF4ZEQpyUNGc0dqbpBYYBaHHrsX." }, 719 }; 720 #define ntests2 (sizeof (tests2) / sizeof (tests2[0])) 721 722 723 int 724 main (void) 725 { 726 struct sha512_ctx ctx; 727 char sum[64]; 728 int result = 0; 729 int cnt; 730 731 for (cnt = 0; cnt < (int) ntests; ++cnt) 732 { 733 sha512_init_ctx (&ctx); 734 sha512_process_bytes (tests[cnt].input, strlen (tests[cnt].input), &ctx); 735 sha512_finish_ctx (&ctx, sum); 736 if (memcmp (tests[cnt].result, sum, 64) != 0) 737 { 738 printf ("test %d run %d failed\n", cnt, 1); 739 result = 1; 740 } 741 742 sha512_init_ctx (&ctx); 743 for (int i = 0; tests[cnt].input[i] != '\0'; ++i) 744 sha512_process_bytes (&tests[cnt].input[i], 1, &ctx); 745 sha512_finish_ctx (&ctx, sum); 746 if (memcmp (tests[cnt].result, sum, 64) != 0) 747 { 748 printf ("test %d run %d failed\n", cnt, 2); 749 result = 1; 750 } 751 } 752 753 /* Test vector from FIPS 180-2: appendix C.3. */ 754 char buf[1000]; 755 memset (buf, 'a', sizeof (buf)); 756 sha512_init_ctx (&ctx); 757 for (int i = 0; i < 1000; ++i) 758 sha512_process_bytes (buf, sizeof (buf), &ctx); 759 sha512_finish_ctx (&ctx, sum); 760 static const char expected[64] = 761 "\xe7\x18\x48\x3d\x0c\xe7\x69\x64\x4e\x2e\x42\xc7\xbc\x15\xb4\x63" 762 "\x8e\x1f\x98\xb1\x3b\x20\x44\x28\x56\x32\xa8\x03\xaf\xa9\x73\xeb" 763 "\xde\x0f\xf2\x44\x87\x7e\xa6\x0a\x4c\xb0\x43\x2c\xe5\x77\xc3\x1b" 764 "\xeb\x00\x9c\x5c\x2c\x49\xaa\x2e\x4e\xad\xb2\x17\xad\x8c\xc0\x9b"; 765 if (memcmp (expected, sum, 64) != 0) 766 { 767 printf ("test %d failed\n", cnt); 768 result = 1; 769 } 770 771 for (cnt = 0; cnt < ntests2; ++cnt) 772 { 773 char *cp = crypt_sha512 (tests2[cnt].input, tests2[cnt].salt); 774 775 if (strcmp (cp, tests2[cnt].expected) != 0) 776 { 777 printf ("test %d: expected \"%s\", got \"%s\"\n", 778 cnt, tests2[cnt].expected, cp); 779 result = 1; 780 } 781 } 782 783 if (result == 0) 784 puts ("all tests OK"); 785 786 return result; 787 } 788 #endif 789 790