1 /* 2 * $KAME: sha2.c,v 1.8 2001/11/08 01:07:52 itojun Exp $ 3 * $FreeBSD: src/sys/crypto/sha2/sha2.c,v 1.2.2.2 2002/03/05 08:36:47 ume Exp $ 4 * $DragonFly: src/sys/crypto/sha2/sha2.c,v 1.4 2004/02/12 23:14:05 joerg Exp $ 5 */ 6 /* 7 * sha2.c 8 * 9 * Version 1.0.0beta1 10 * 11 * Written by Aaron D. Gifford <me@aarongifford.com> 12 * 13 * Copyright 2000 Aaron D. Gifford. All rights reserved. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 3. Neither the name of the copyright holder nor the names of contributors 24 * may be used to endorse or promote products derived from this software 25 * without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND 28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * 39 */ 40 41 42 #include <sys/types.h> 43 #include <sys/time.h> 44 #include <sys/systm.h> 45 #include <machine/endian.h> 46 #include <crypto/sha2/sha2.h> 47 48 /* 49 * ASSERT NOTE: 50 * Some sanity checking code is included using assert(). On my FreeBSD 51 * system, this additional code can be removed by compiling with NDEBUG 52 * defined. Check your own systems manpage on assert() to see how to 53 * compile WITHOUT the sanity checking code on your system. 54 * 55 * UNROLLED TRANSFORM LOOP NOTE: 56 * You can define SHA2_UNROLL_TRANSFORM to use the unrolled transform 57 * loop version for the hash transform rounds (defined using macros 58 * later in this file). Either define on the command line, for example: 59 * 60 * cc -DSHA2_UNROLL_TRANSFORM -o sha2 sha2.c sha2prog.c 61 * 62 * or define below: 63 * 64 * #define SHA2_UNROLL_TRANSFORM 65 * 66 */ 67 68 #if defined(__DragonFly__) || defined(__bsdi__) || defined(__FreeBSD__) 69 #define assert(x) 70 #endif 71 72 73 /*** SHA-256/384/512 Machine Architecture Definitions *****************/ 74 /* 75 * BYTE_ORDER NOTE: 76 * 77 * Please make sure that your system defines BYTE_ORDER. If your 78 * architecture is little-endian, make sure it also defines 79 * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are 80 * equivilent. 81 * 82 * If your system does not define the above, then you can do so by 83 * hand like this: 84 * 85 * #define LITTLE_ENDIAN 1234 86 * #define BIG_ENDIAN 4321 87 * 88 * And for little-endian machines, add: 89 * 90 * #define BYTE_ORDER LITTLE_ENDIAN 91 * 92 * Or for big-endian machines: 93 * 94 * #define BYTE_ORDER BIG_ENDIAN 95 * 96 * The FreeBSD machine this was written on defines BYTE_ORDER 97 * appropriately by including <sys/types.h> (which in turn includes 98 * <machine/endian.h> where the appropriate definitions are actually 99 * made). 100 */ 101 #if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN) 102 #error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN 103 #endif 104 105 /* 106 * Define the followingsha2_* types to types of the correct length on 107 * the native archtecture. Most BSD systems and Linux define u_intXX_t 108 * types. Machines with very recent ANSI C headers, can use the 109 * uintXX_t definintions from inttypes.h by defining SHA2_USE_INTTYPES_H 110 * during compile or in the sha.h header file. 111 * 112 * Machines that support neither u_intXX_t nor inttypes.h's uintXX_t 113 * will need to define these three typedefs below (and the appropriate 114 * ones in sha.h too) by hand according to their system architecture. 115 * 116 * Thank you, Jun-ichiro itojun Hagino, for suggesting using u_intXX_t 117 * types and pointing out recent ANSI C support for uintXX_t in inttypes.h. 118 */ 119 #if 0 /*def SHA2_USE_INTTYPES_H*/ 120 121 typedef uint8_t sha2_byte; /* Exactly 1 byte */ 122 typedef uint32_t sha2_word32; /* Exactly 4 bytes */ 123 typedef uint64_t sha2_word64; /* Exactly 8 bytes */ 124 125 #else /* SHA2_USE_INTTYPES_H */ 126 127 typedef u_int8_t sha2_byte; /* Exactly 1 byte */ 128 typedef u_int32_t sha2_word32; /* Exactly 4 bytes */ 129 typedef u_int64_t sha2_word64; /* Exactly 8 bytes */ 130 131 #endif /* SHA2_USE_INTTYPES_H */ 132 133 134 /*** SHA-256/384/512 Various Length Definitions ***********************/ 135 /* NOTE: Most of these are in sha2.h */ 136 #define SHA256_SHORT_BLOCK_LENGTH (SHA256_BLOCK_LENGTH - 8) 137 #define SHA384_SHORT_BLOCK_LENGTH (SHA384_BLOCK_LENGTH - 16) 138 #define SHA512_SHORT_BLOCK_LENGTH (SHA512_BLOCK_LENGTH - 16) 139 140 141 /*** ENDIAN REVERSAL MACROS *******************************************/ 142 #if BYTE_ORDER == LITTLE_ENDIAN 143 #define REVERSE32(w,x) { \ 144 sha2_word32 tmp = (w); \ 145 tmp = (tmp >> 16) | (tmp << 16); \ 146 (x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \ 147 } 148 #define REVERSE64(w,x) { \ 149 sha2_word64 tmp = (w); \ 150 tmp = (tmp >> 32) | (tmp << 32); \ 151 tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \ 152 ((tmp & 0x00ff00ff00ff00ffULL) << 8); \ 153 (x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \ 154 ((tmp & 0x0000ffff0000ffffULL) << 16); \ 155 } 156 #endif /* BYTE_ORDER == LITTLE_ENDIAN */ 157 158 /* 159 * Macro for incrementally adding the unsigned 64-bit integer n to the 160 * unsigned 128-bit integer (represented using a two-element array of 161 * 64-bit words): 162 */ 163 #define ADDINC128(w,n) { \ 164 (w)[0] += (sha2_word64)(n); \ 165 if ((w)[0] < (n)) { \ 166 (w)[1]++; \ 167 } \ 168 } 169 170 /*** THE SIX LOGICAL FUNCTIONS ****************************************/ 171 /* 172 * Bit shifting and rotation (used by the six SHA-XYZ logical functions: 173 * 174 * NOTE: The naming of R and S appears backwards here (R is a SHIFT and 175 * S is a ROTATION) because the SHA-256/384/512 description document 176 * (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this 177 * same "backwards" definition. 178 */ 179 /* Shift-right (used in SHA-256, SHA-384, and SHA-512): */ 180 #define R(b,x) ((x) >> (b)) 181 /* 32-bit Rotate-right (used in SHA-256): */ 182 #define S32(b,x) (((x) >> (b)) | ((x) << (32 - (b)))) 183 /* 64-bit Rotate-right (used in SHA-384 and SHA-512): */ 184 #define S64(b,x) (((x) >> (b)) | ((x) << (64 - (b)))) 185 186 /* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */ 187 #define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z))) 188 #define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) 189 190 /* Four of six logical functions used in SHA-256: */ 191 #define Sigma0_256(x) (S32(2, (x)) ^ S32(13, (x)) ^ S32(22, (x))) 192 #define Sigma1_256(x) (S32(6, (x)) ^ S32(11, (x)) ^ S32(25, (x))) 193 #define sigma0_256(x) (S32(7, (x)) ^ S32(18, (x)) ^ R(3 , (x))) 194 #define sigma1_256(x) (S32(17, (x)) ^ S32(19, (x)) ^ R(10, (x))) 195 196 /* Four of six logical functions used in SHA-384 and SHA-512: */ 197 #define Sigma0_512(x) (S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x))) 198 #define Sigma1_512(x) (S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x))) 199 #define sigma0_512(x) (S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7, (x))) 200 #define sigma1_512(x) (S64(19, (x)) ^ S64(61, (x)) ^ R( 6, (x))) 201 202 /*** INTERNAL FUNCTION PROTOTYPES *************************************/ 203 /* NOTE: These should not be accessed directly from outside this 204 * library -- they are intended for private internal visibility/use 205 * only. 206 */ 207 void SHA512_Last(SHA512_CTX*); 208 void SHA256_Transform(SHA256_CTX*, const sha2_word32*); 209 void SHA512_Transform(SHA512_CTX*, const sha2_word64*); 210 211 212 /*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/ 213 /* Hash constant words K for SHA-256: */ 214 const static sha2_word32 K256[64] = { 215 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 216 0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 217 0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL, 218 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL, 219 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL, 220 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 221 0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 222 0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL, 223 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL, 224 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL, 225 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 226 0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 227 0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL, 228 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL, 229 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL, 230 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL 231 }; 232 233 /* Initial hash value H for SHA-256: */ 234 const static sha2_word32 sha256_initial_hash_value[8] = { 235 0x6a09e667UL, 236 0xbb67ae85UL, 237 0x3c6ef372UL, 238 0xa54ff53aUL, 239 0x510e527fUL, 240 0x9b05688cUL, 241 0x1f83d9abUL, 242 0x5be0cd19UL 243 }; 244 245 /* Hash constant words K for SHA-384 and SHA-512: */ 246 const static sha2_word64 K512[80] = { 247 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 248 0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL, 249 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL, 250 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 251 0xd807aa98a3030242ULL, 0x12835b0145706fbeULL, 252 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL, 253 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 254 0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL, 255 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL, 256 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 257 0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL, 258 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL, 259 0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 260 0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL, 261 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL, 262 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 263 0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL, 264 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL, 265 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 266 0x81c2c92e47edaee6ULL, 0x92722c851482353bULL, 267 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL, 268 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 269 0xd192e819d6ef5218ULL, 0xd69906245565a910ULL, 270 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL, 271 0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 272 0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL, 273 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL, 274 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 275 0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL, 276 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL, 277 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 278 0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL, 279 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL, 280 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 281 0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL, 282 0x113f9804bef90daeULL, 0x1b710b35131c471bULL, 283 0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 284 0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL, 285 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL, 286 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL 287 }; 288 289 /* Initial hash value H for SHA-384 */ 290 const static sha2_word64 sha384_initial_hash_value[8] = { 291 0xcbbb9d5dc1059ed8ULL, 292 0x629a292a367cd507ULL, 293 0x9159015a3070dd17ULL, 294 0x152fecd8f70e5939ULL, 295 0x67332667ffc00b31ULL, 296 0x8eb44a8768581511ULL, 297 0xdb0c2e0d64f98fa7ULL, 298 0x47b5481dbefa4fa4ULL 299 }; 300 301 /* Initial hash value H for SHA-512 */ 302 const static sha2_word64 sha512_initial_hash_value[8] = { 303 0x6a09e667f3bcc908ULL, 304 0xbb67ae8584caa73bULL, 305 0x3c6ef372fe94f82bULL, 306 0xa54ff53a5f1d36f1ULL, 307 0x510e527fade682d1ULL, 308 0x9b05688c2b3e6c1fULL, 309 0x1f83d9abfb41bd6bULL, 310 0x5be0cd19137e2179ULL 311 }; 312 313 /* 314 * Constant used by SHA256/384/512_End() functions for converting the 315 * digest to a readable hexadecimal character string: 316 */ 317 static const char *sha2_hex_digits = "0123456789abcdef"; 318 319 320 /*** SHA-256: *********************************************************/ 321 void SHA256_Init(SHA256_CTX* context) { 322 if (context == (SHA256_CTX*)0) { 323 return; 324 } 325 bcopy(sha256_initial_hash_value, context->state, SHA256_DIGEST_LENGTH); 326 bzero(context->buffer, SHA256_BLOCK_LENGTH); 327 context->bitcount = 0; 328 } 329 330 #ifdef SHA2_UNROLL_TRANSFORM 331 332 /* Unrolled SHA-256 round macros: */ 333 334 #if BYTE_ORDER == LITTLE_ENDIAN 335 336 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) \ 337 REVERSE32(*data++, W256[j]); \ 338 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \ 339 K256[j] + W256[j]; \ 340 (d) += T1; \ 341 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \ 342 j++ 343 344 345 #else /* BYTE_ORDER == LITTLE_ENDIAN */ 346 347 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) \ 348 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \ 349 K256[j] + (W256[j] = *data++); \ 350 (d) += T1; \ 351 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \ 352 j++ 353 354 #endif /* BYTE_ORDER == LITTLE_ENDIAN */ 355 356 #define ROUND256(a,b,c,d,e,f,g,h) \ 357 s0 = W256[(j+1)&0x0f]; \ 358 s0 = sigma0_256(s0); \ 359 s1 = W256[(j+14)&0x0f]; \ 360 s1 = sigma1_256(s1); \ 361 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + K256[j] + \ 362 (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); \ 363 (d) += T1; \ 364 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \ 365 j++ 366 367 void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) { 368 sha2_word32 a, b, c, d, e, f, g, h, s0, s1; 369 sha2_word32 T1, *W256; 370 int j; 371 372 W256 = (sha2_word32*)context->buffer; 373 374 /* Initialize registers with the prev. intermediate value */ 375 a = context->state[0]; 376 b = context->state[1]; 377 c = context->state[2]; 378 d = context->state[3]; 379 e = context->state[4]; 380 f = context->state[5]; 381 g = context->state[6]; 382 h = context->state[7]; 383 384 j = 0; 385 do { 386 /* Rounds 0 to 15 (unrolled): */ 387 ROUND256_0_TO_15(a,b,c,d,e,f,g,h); 388 ROUND256_0_TO_15(h,a,b,c,d,e,f,g); 389 ROUND256_0_TO_15(g,h,a,b,c,d,e,f); 390 ROUND256_0_TO_15(f,g,h,a,b,c,d,e); 391 ROUND256_0_TO_15(e,f,g,h,a,b,c,d); 392 ROUND256_0_TO_15(d,e,f,g,h,a,b,c); 393 ROUND256_0_TO_15(c,d,e,f,g,h,a,b); 394 ROUND256_0_TO_15(b,c,d,e,f,g,h,a); 395 } while (j < 16); 396 397 /* Now for the remaining rounds to 64: */ 398 do { 399 ROUND256(a,b,c,d,e,f,g,h); 400 ROUND256(h,a,b,c,d,e,f,g); 401 ROUND256(g,h,a,b,c,d,e,f); 402 ROUND256(f,g,h,a,b,c,d,e); 403 ROUND256(e,f,g,h,a,b,c,d); 404 ROUND256(d,e,f,g,h,a,b,c); 405 ROUND256(c,d,e,f,g,h,a,b); 406 ROUND256(b,c,d,e,f,g,h,a); 407 } while (j < 64); 408 409 /* Compute the current intermediate hash value */ 410 context->state[0] += a; 411 context->state[1] += b; 412 context->state[2] += c; 413 context->state[3] += d; 414 context->state[4] += e; 415 context->state[5] += f; 416 context->state[6] += g; 417 context->state[7] += h; 418 419 /* Clean up */ 420 a = b = c = d = e = f = g = h = T1 = 0; 421 } 422 423 #else /* SHA2_UNROLL_TRANSFORM */ 424 425 void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) { 426 sha2_word32 a, b, c, d, e, f, g, h, s0, s1; 427 sha2_word32 T1, T2, *W256; 428 int j; 429 430 W256 = (sha2_word32*)context->buffer; 431 432 /* Initialize registers with the prev. intermediate value */ 433 a = context->state[0]; 434 b = context->state[1]; 435 c = context->state[2]; 436 d = context->state[3]; 437 e = context->state[4]; 438 f = context->state[5]; 439 g = context->state[6]; 440 h = context->state[7]; 441 442 j = 0; 443 do { 444 #if BYTE_ORDER == LITTLE_ENDIAN 445 /* Copy data while converting to host byte order */ 446 REVERSE32(*data++,W256[j]); 447 /* Apply the SHA-256 compression function to update a..h */ 448 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + W256[j]; 449 #else /* BYTE_ORDER == LITTLE_ENDIAN */ 450 /* Apply the SHA-256 compression function to update a..h with copy */ 451 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + (W256[j] = *data++); 452 #endif /* BYTE_ORDER == LITTLE_ENDIAN */ 453 T2 = Sigma0_256(a) + Maj(a, b, c); 454 h = g; 455 g = f; 456 f = e; 457 e = d + T1; 458 d = c; 459 c = b; 460 b = a; 461 a = T1 + T2; 462 463 j++; 464 } while (j < 16); 465 466 do { 467 /* Part of the message block expansion: */ 468 s0 = W256[(j+1)&0x0f]; 469 s0 = sigma0_256(s0); 470 s1 = W256[(j+14)&0x0f]; 471 s1 = sigma1_256(s1); 472 473 /* Apply the SHA-256 compression function to update a..h */ 474 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + 475 (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); 476 T2 = Sigma0_256(a) + Maj(a, b, c); 477 h = g; 478 g = f; 479 f = e; 480 e = d + T1; 481 d = c; 482 c = b; 483 b = a; 484 a = T1 + T2; 485 486 j++; 487 } while (j < 64); 488 489 /* Compute the current intermediate hash value */ 490 context->state[0] += a; 491 context->state[1] += b; 492 context->state[2] += c; 493 context->state[3] += d; 494 context->state[4] += e; 495 context->state[5] += f; 496 context->state[6] += g; 497 context->state[7] += h; 498 499 /* Clean up */ 500 a = b = c = d = e = f = g = h = T1 = T2 = 0; 501 } 502 503 #endif /* SHA2_UNROLL_TRANSFORM */ 504 505 void SHA256_Update(SHA256_CTX* context, const sha2_byte *data, size_t len) { 506 unsigned int freespace, usedspace; 507 508 if (len == 0) { 509 /* Calling with no data is valid - we do nothing */ 510 return; 511 } 512 513 /* Sanity check: */ 514 assert(context != (SHA256_CTX*)0 && data != (sha2_byte*)0); 515 516 usedspace = (context->bitcount >> 3) % SHA256_BLOCK_LENGTH; 517 if (usedspace > 0) { 518 /* Calculate how much free space is available in the buffer */ 519 freespace = SHA256_BLOCK_LENGTH - usedspace; 520 521 if (len >= freespace) { 522 /* Fill the buffer completely and process it */ 523 bcopy(data, &context->buffer[usedspace], freespace); 524 context->bitcount += freespace << 3; 525 len -= freespace; 526 data += freespace; 527 SHA256_Transform(context, (sha2_word32*)context->buffer); 528 } else { 529 /* The buffer is not yet full */ 530 bcopy(data, &context->buffer[usedspace], len); 531 context->bitcount += len << 3; 532 /* Clean up: */ 533 usedspace = freespace = 0; 534 return; 535 } 536 } 537 while (len >= SHA256_BLOCK_LENGTH) { 538 /* Process as many complete blocks as we can */ 539 SHA256_Transform(context, (const sha2_word32*)data); 540 context->bitcount += SHA256_BLOCK_LENGTH << 3; 541 len -= SHA256_BLOCK_LENGTH; 542 data += SHA256_BLOCK_LENGTH; 543 } 544 if (len > 0) { 545 /* There's left-overs, so save 'em */ 546 bcopy(data, context->buffer, len); 547 context->bitcount += len << 3; 548 } 549 /* Clean up: */ 550 usedspace = freespace = 0; 551 } 552 553 void SHA256_Final(sha2_byte digest[], SHA256_CTX* context) { 554 sha2_word32 *d = (sha2_word32*)digest; 555 unsigned int usedspace; 556 557 /* Sanity check: */ 558 assert(context != (SHA256_CTX*)0); 559 560 /* If no digest buffer is passed, we don't bother doing this: */ 561 if (digest != (sha2_byte*)0) { 562 usedspace = (context->bitcount >> 3) % SHA256_BLOCK_LENGTH; 563 #if BYTE_ORDER == LITTLE_ENDIAN 564 /* Convert FROM host byte order */ 565 REVERSE64(context->bitcount,context->bitcount); 566 #endif 567 if (usedspace > 0) { 568 /* Begin padding with a 1 bit: */ 569 context->buffer[usedspace++] = 0x80; 570 571 if (usedspace <= SHA256_SHORT_BLOCK_LENGTH) { 572 /* Set-up for the last transform: */ 573 bzero(&context->buffer[usedspace], SHA256_SHORT_BLOCK_LENGTH - usedspace); 574 } else { 575 if (usedspace < SHA256_BLOCK_LENGTH) { 576 bzero(&context->buffer[usedspace], SHA256_BLOCK_LENGTH - usedspace); 577 } 578 /* Do second-to-last transform: */ 579 SHA256_Transform(context, (sha2_word32*)context->buffer); 580 581 /* And set-up for the last transform: */ 582 bzero(context->buffer, SHA256_SHORT_BLOCK_LENGTH); 583 } 584 } else { 585 /* Set-up for the last transform: */ 586 bzero(context->buffer, SHA256_SHORT_BLOCK_LENGTH); 587 588 /* Begin padding with a 1 bit: */ 589 *context->buffer = 0x80; 590 } 591 /* Set the bit count: */ 592 *(sha2_word64*)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = context->bitcount; 593 594 /* Final transform: */ 595 SHA256_Transform(context, (sha2_word32*)context->buffer); 596 597 #if BYTE_ORDER == LITTLE_ENDIAN 598 { 599 /* Convert TO host byte order */ 600 int j; 601 for (j = 0; j < 8; j++) { 602 REVERSE32(context->state[j],context->state[j]); 603 *d++ = context->state[j]; 604 } 605 } 606 #else 607 bcopy(context->state, d, SHA256_DIGEST_LENGTH); 608 #endif 609 } 610 611 /* Clean up state data: */ 612 bzero(context, sizeof(context)); 613 usedspace = 0; 614 } 615 616 char *SHA256_End(SHA256_CTX* context, char buffer[]) { 617 sha2_byte digest[SHA256_DIGEST_LENGTH], *d = digest; 618 int i; 619 620 /* Sanity check: */ 621 assert(context != (SHA256_CTX*)0); 622 623 if (buffer != (char*)0) { 624 SHA256_Final(digest, context); 625 626 for (i = 0; i < SHA256_DIGEST_LENGTH; i++) { 627 *buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4]; 628 *buffer++ = sha2_hex_digits[*d & 0x0f]; 629 d++; 630 } 631 *buffer = (char)0; 632 } else { 633 bzero(context, sizeof(context)); 634 } 635 bzero(digest, SHA256_DIGEST_LENGTH); 636 return buffer; 637 } 638 639 char* SHA256_Data(const sha2_byte* data, size_t len, char digest[SHA256_DIGEST_STRING_LENGTH]) { 640 SHA256_CTX context; 641 642 SHA256_Init(&context); 643 SHA256_Update(&context, data, len); 644 return SHA256_End(&context, digest); 645 } 646 647 648 /*** SHA-512: *********************************************************/ 649 void SHA512_Init(SHA512_CTX* context) { 650 if (context == (SHA512_CTX*)0) { 651 return; 652 } 653 bcopy(sha512_initial_hash_value, context->state, SHA512_DIGEST_LENGTH); 654 bzero(context->buffer, SHA512_BLOCK_LENGTH); 655 context->bitcount[0] = context->bitcount[1] = 0; 656 } 657 658 #ifdef SHA2_UNROLL_TRANSFORM 659 660 /* Unrolled SHA-512 round macros: */ 661 #if BYTE_ORDER == LITTLE_ENDIAN 662 663 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \ 664 REVERSE64(*data++, W512[j]); \ 665 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \ 666 K512[j] + W512[j]; \ 667 (d) += T1, \ 668 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)), \ 669 j++ 670 671 672 #else /* BYTE_ORDER == LITTLE_ENDIAN */ 673 674 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \ 675 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \ 676 K512[j] + (W512[j] = *data++); \ 677 (d) += T1; \ 678 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \ 679 j++ 680 681 #endif /* BYTE_ORDER == LITTLE_ENDIAN */ 682 683 #define ROUND512(a,b,c,d,e,f,g,h) \ 684 s0 = W512[(j+1)&0x0f]; \ 685 s0 = sigma0_512(s0); \ 686 s1 = W512[(j+14)&0x0f]; \ 687 s1 = sigma1_512(s1); \ 688 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + K512[j] + \ 689 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); \ 690 (d) += T1; \ 691 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \ 692 j++ 693 694 void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) { 695 sha2_word64 a, b, c, d, e, f, g, h, s0, s1; 696 sha2_word64 T1, *W512 = (sha2_word64*)context->buffer; 697 int j; 698 699 /* Initialize registers with the prev. intermediate value */ 700 a = context->state[0]; 701 b = context->state[1]; 702 c = context->state[2]; 703 d = context->state[3]; 704 e = context->state[4]; 705 f = context->state[5]; 706 g = context->state[6]; 707 h = context->state[7]; 708 709 j = 0; 710 do { 711 ROUND512_0_TO_15(a,b,c,d,e,f,g,h); 712 ROUND512_0_TO_15(h,a,b,c,d,e,f,g); 713 ROUND512_0_TO_15(g,h,a,b,c,d,e,f); 714 ROUND512_0_TO_15(f,g,h,a,b,c,d,e); 715 ROUND512_0_TO_15(e,f,g,h,a,b,c,d); 716 ROUND512_0_TO_15(d,e,f,g,h,a,b,c); 717 ROUND512_0_TO_15(c,d,e,f,g,h,a,b); 718 ROUND512_0_TO_15(b,c,d,e,f,g,h,a); 719 } while (j < 16); 720 721 /* Now for the remaining rounds up to 79: */ 722 do { 723 ROUND512(a,b,c,d,e,f,g,h); 724 ROUND512(h,a,b,c,d,e,f,g); 725 ROUND512(g,h,a,b,c,d,e,f); 726 ROUND512(f,g,h,a,b,c,d,e); 727 ROUND512(e,f,g,h,a,b,c,d); 728 ROUND512(d,e,f,g,h,a,b,c); 729 ROUND512(c,d,e,f,g,h,a,b); 730 ROUND512(b,c,d,e,f,g,h,a); 731 } while (j < 80); 732 733 /* Compute the current intermediate hash value */ 734 context->state[0] += a; 735 context->state[1] += b; 736 context->state[2] += c; 737 context->state[3] += d; 738 context->state[4] += e; 739 context->state[5] += f; 740 context->state[6] += g; 741 context->state[7] += h; 742 743 /* Clean up */ 744 a = b = c = d = e = f = g = h = T1 = 0; 745 } 746 747 #else /* SHA2_UNROLL_TRANSFORM */ 748 749 void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) { 750 sha2_word64 a, b, c, d, e, f, g, h, s0, s1; 751 sha2_word64 T1, T2, *W512 = (sha2_word64*)context->buffer; 752 int j; 753 754 /* Initialize registers with the prev. intermediate value */ 755 a = context->state[0]; 756 b = context->state[1]; 757 c = context->state[2]; 758 d = context->state[3]; 759 e = context->state[4]; 760 f = context->state[5]; 761 g = context->state[6]; 762 h = context->state[7]; 763 764 j = 0; 765 do { 766 #if BYTE_ORDER == LITTLE_ENDIAN 767 /* Convert TO host byte order */ 768 REVERSE64(*data++, W512[j]); 769 /* Apply the SHA-512 compression function to update a..h */ 770 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j]; 771 #else /* BYTE_ORDER == LITTLE_ENDIAN */ 772 /* Apply the SHA-512 compression function to update a..h with copy */ 773 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + (W512[j] = *data++); 774 #endif /* BYTE_ORDER == LITTLE_ENDIAN */ 775 T2 = Sigma0_512(a) + Maj(a, b, c); 776 h = g; 777 g = f; 778 f = e; 779 e = d + T1; 780 d = c; 781 c = b; 782 b = a; 783 a = T1 + T2; 784 785 j++; 786 } while (j < 16); 787 788 do { 789 /* Part of the message block expansion: */ 790 s0 = W512[(j+1)&0x0f]; 791 s0 = sigma0_512(s0); 792 s1 = W512[(j+14)&0x0f]; 793 s1 = sigma1_512(s1); 794 795 /* Apply the SHA-512 compression function to update a..h */ 796 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + 797 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); 798 T2 = Sigma0_512(a) + Maj(a, b, c); 799 h = g; 800 g = f; 801 f = e; 802 e = d + T1; 803 d = c; 804 c = b; 805 b = a; 806 a = T1 + T2; 807 808 j++; 809 } while (j < 80); 810 811 /* Compute the current intermediate hash value */ 812 context->state[0] += a; 813 context->state[1] += b; 814 context->state[2] += c; 815 context->state[3] += d; 816 context->state[4] += e; 817 context->state[5] += f; 818 context->state[6] += g; 819 context->state[7] += h; 820 821 /* Clean up */ 822 a = b = c = d = e = f = g = h = T1 = T2 = 0; 823 } 824 825 #endif /* SHA2_UNROLL_TRANSFORM */ 826 827 void SHA512_Update(SHA512_CTX* context, const sha2_byte *data, size_t len) { 828 unsigned int freespace, usedspace; 829 830 if (len == 0) { 831 /* Calling with no data is valid - we do nothing */ 832 return; 833 } 834 835 /* Sanity check: */ 836 assert(context != (SHA512_CTX*)0 && data != (sha2_byte*)0); 837 838 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH; 839 if (usedspace > 0) { 840 /* Calculate how much free space is available in the buffer */ 841 freespace = SHA512_BLOCK_LENGTH - usedspace; 842 843 if (len >= freespace) { 844 /* Fill the buffer completely and process it */ 845 bcopy(data, &context->buffer[usedspace], freespace); 846 ADDINC128(context->bitcount, freespace << 3); 847 len -= freespace; 848 data += freespace; 849 SHA512_Transform(context, (sha2_word64*)context->buffer); 850 } else { 851 /* The buffer is not yet full */ 852 bcopy(data, &context->buffer[usedspace], len); 853 ADDINC128(context->bitcount, len << 3); 854 /* Clean up: */ 855 usedspace = freespace = 0; 856 return; 857 } 858 } 859 while (len >= SHA512_BLOCK_LENGTH) { 860 /* Process as many complete blocks as we can */ 861 SHA512_Transform(context, (const sha2_word64*)data); 862 ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3); 863 len -= SHA512_BLOCK_LENGTH; 864 data += SHA512_BLOCK_LENGTH; 865 } 866 if (len > 0) { 867 /* There's left-overs, so save 'em */ 868 bcopy(data, context->buffer, len); 869 ADDINC128(context->bitcount, len << 3); 870 } 871 /* Clean up: */ 872 usedspace = freespace = 0; 873 } 874 875 void SHA512_Last(SHA512_CTX* context) { 876 unsigned int usedspace; 877 878 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH; 879 #if BYTE_ORDER == LITTLE_ENDIAN 880 /* Convert FROM host byte order */ 881 REVERSE64(context->bitcount[0],context->bitcount[0]); 882 REVERSE64(context->bitcount[1],context->bitcount[1]); 883 #endif 884 if (usedspace > 0) { 885 /* Begin padding with a 1 bit: */ 886 context->buffer[usedspace++] = 0x80; 887 888 if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) { 889 /* Set-up for the last transform: */ 890 bzero(&context->buffer[usedspace], SHA512_SHORT_BLOCK_LENGTH - usedspace); 891 } else { 892 if (usedspace < SHA512_BLOCK_LENGTH) { 893 bzero(&context->buffer[usedspace], SHA512_BLOCK_LENGTH - usedspace); 894 } 895 /* Do second-to-last transform: */ 896 SHA512_Transform(context, (sha2_word64*)context->buffer); 897 898 /* And set-up for the last transform: */ 899 bzero(context->buffer, SHA512_BLOCK_LENGTH - 2); 900 } 901 } else { 902 /* Prepare for final transform: */ 903 bzero(context->buffer, SHA512_SHORT_BLOCK_LENGTH); 904 905 /* Begin padding with a 1 bit: */ 906 *context->buffer = 0x80; 907 } 908 /* Store the length of input data (in bits): */ 909 *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1]; 910 *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0]; 911 912 /* Final transform: */ 913 SHA512_Transform(context, (sha2_word64*)context->buffer); 914 } 915 916 void SHA512_Final(sha2_byte digest[], SHA512_CTX* context) { 917 sha2_word64 *d = (sha2_word64*)digest; 918 919 /* Sanity check: */ 920 assert(context != (SHA512_CTX*)0); 921 922 /* If no digest buffer is passed, we don't bother doing this: */ 923 if (digest != (sha2_byte*)0) { 924 SHA512_Last(context); 925 926 /* Save the hash data for output: */ 927 #if BYTE_ORDER == LITTLE_ENDIAN 928 { 929 /* Convert TO host byte order */ 930 int j; 931 for (j = 0; j < 8; j++) { 932 REVERSE64(context->state[j],context->state[j]); 933 *d++ = context->state[j]; 934 } 935 } 936 #else 937 bcopy(context->state, d, SHA512_DIGEST_LENGTH); 938 #endif 939 } 940 941 /* Zero out state data */ 942 bzero(context, sizeof(context)); 943 } 944 945 char *SHA512_End(SHA512_CTX* context, char buffer[]) { 946 sha2_byte digest[SHA512_DIGEST_LENGTH], *d = digest; 947 int i; 948 949 /* Sanity check: */ 950 assert(context != (SHA512_CTX*)0); 951 952 if (buffer != (char*)0) { 953 SHA512_Final(digest, context); 954 955 for (i = 0; i < SHA512_DIGEST_LENGTH; i++) { 956 *buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4]; 957 *buffer++ = sha2_hex_digits[*d & 0x0f]; 958 d++; 959 } 960 *buffer = (char)0; 961 } else { 962 bzero(context, sizeof(context)); 963 } 964 bzero(digest, SHA512_DIGEST_LENGTH); 965 return buffer; 966 } 967 968 char* SHA512_Data(const sha2_byte* data, size_t len, char digest[SHA512_DIGEST_STRING_LENGTH]) { 969 SHA512_CTX context; 970 971 SHA512_Init(&context); 972 SHA512_Update(&context, data, len); 973 return SHA512_End(&context, digest); 974 } 975 976 977 /*** SHA-384: *********************************************************/ 978 void SHA384_Init(SHA384_CTX* context) { 979 if (context == (SHA384_CTX*)0) { 980 return; 981 } 982 bcopy(sha384_initial_hash_value, context->state, SHA512_DIGEST_LENGTH); 983 bzero(context->buffer, SHA384_BLOCK_LENGTH); 984 context->bitcount[0] = context->bitcount[1] = 0; 985 } 986 987 void SHA384_Update(SHA384_CTX* context, const sha2_byte* data, size_t len) { 988 SHA512_Update((SHA512_CTX*)context, data, len); 989 } 990 991 void SHA384_Final(sha2_byte digest[], SHA384_CTX* context) { 992 sha2_word64 *d = (sha2_word64*)digest; 993 994 /* Sanity check: */ 995 assert(context != (SHA384_CTX*)0); 996 997 /* If no digest buffer is passed, we don't bother doing this: */ 998 if (digest != (sha2_byte*)0) { 999 SHA512_Last((SHA512_CTX*)context); 1000 1001 /* Save the hash data for output: */ 1002 #if BYTE_ORDER == LITTLE_ENDIAN 1003 { 1004 /* Convert TO host byte order */ 1005 int j; 1006 for (j = 0; j < 6; j++) { 1007 REVERSE64(context->state[j],context->state[j]); 1008 *d++ = context->state[j]; 1009 } 1010 } 1011 #else 1012 bcopy(context->state, d, SHA384_DIGEST_LENGTH); 1013 #endif 1014 } 1015 1016 /* Zero out state data */ 1017 bzero(context, sizeof(context)); 1018 } 1019 1020 char *SHA384_End(SHA384_CTX* context, char buffer[]) { 1021 sha2_byte digest[SHA384_DIGEST_LENGTH], *d = digest; 1022 int i; 1023 1024 /* Sanity check: */ 1025 assert(context != (SHA384_CTX*)0); 1026 1027 if (buffer != (char*)0) { 1028 SHA384_Final(digest, context); 1029 1030 for (i = 0; i < SHA384_DIGEST_LENGTH; i++) { 1031 *buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4]; 1032 *buffer++ = sha2_hex_digits[*d & 0x0f]; 1033 d++; 1034 } 1035 *buffer = (char)0; 1036 } else { 1037 bzero(context, sizeof(context)); 1038 } 1039 bzero(digest, SHA384_DIGEST_LENGTH); 1040 return buffer; 1041 } 1042 1043 char* SHA384_Data(const sha2_byte* data, size_t len, char digest[SHA384_DIGEST_STRING_LENGTH]) { 1044 SHA384_CTX context; 1045 1046 SHA384_Init(&context); 1047 SHA384_Update(&context, data, len); 1048 return SHA384_End(&context, digest); 1049 } 1050 1051