1 /* 2 * FIPS-180-1 compliant SHA-1 implementation 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 6 * 7 * This file is provided under the Apache License 2.0, or the 8 * GNU General Public License v2.0 or later. 9 * 10 * ********** 11 * Apache License 2.0: 12 * 13 * Licensed under the Apache License, Version 2.0 (the "License"); you may 14 * not use this file except in compliance with the License. 15 * You may obtain a copy of the License at 16 * 17 * http://www.apache.org/licenses/LICENSE-2.0 18 * 19 * Unless required by applicable law or agreed to in writing, software 20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 22 * See the License for the specific language governing permissions and 23 * limitations under the License. 24 * 25 * ********** 26 * 27 * ********** 28 * GNU General Public License v2.0 or later: 29 * 30 * This program is free software; you can redistribute it and/or modify 31 * it under the terms of the GNU General Public License as published by 32 * the Free Software Foundation; either version 2 of the License, or 33 * (at your option) any later version. 34 * 35 * This program is distributed in the hope that it will be useful, 36 * but WITHOUT ANY WARRANTY; without even the implied warranty of 37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 38 * GNU General Public License for more details. 39 * 40 * You should have received a copy of the GNU General Public License along 41 * with this program; if not, write to the Free Software Foundation, Inc., 42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 43 * 44 * ********** 45 * 46 * This file is part of mbed TLS (https://tls.mbed.org) 47 */ 48 /* 49 * The SHA-1 standard was published by NIST in 1993. 50 * 51 * http://www.itl.nist.gov/fipspubs/fip180-1.htm 52 */ 53 54 #if !defined(MBEDTLS_CONFIG_FILE) 55 #include "mbedtls/config.h" 56 #else 57 #include MBEDTLS_CONFIG_FILE 58 #endif 59 60 #if defined(MBEDTLS_SHA1_C) 61 62 #include "mbedtls/sha1.h" 63 64 #include <string.h> 65 66 #if defined(MBEDTLS_SELF_TEST) 67 #if defined(MBEDTLS_PLATFORM_C) 68 #include "mbedtls/platform.h" 69 #else 70 #include <stdio.h> 71 #define mbedtls_printf printf 72 #endif /* MBEDTLS_PLATFORM_C */ 73 #endif /* MBEDTLS_SELF_TEST */ 74 75 #if !defined(MBEDTLS_SHA1_ALT) 76 77 /* Implementation that should never be optimized out by the compiler */ 78 static void mbedtls_zeroize( void *v, size_t n ) { 79 volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0; 80 } 81 82 /* 83 * 32-bit integer manipulation macros (big endian) 84 */ 85 #ifndef GET_UINT32_BE 86 #define GET_UINT32_BE(n,b,i) \ 87 { \ 88 (n) = ( (uint32_t) (b)[(i) ] << 24 ) \ 89 | ( (uint32_t) (b)[(i) + 1] << 16 ) \ 90 | ( (uint32_t) (b)[(i) + 2] << 8 ) \ 91 | ( (uint32_t) (b)[(i) + 3] ); \ 92 } 93 #endif 94 95 #ifndef PUT_UINT32_BE 96 #define PUT_UINT32_BE(n,b,i) \ 97 { \ 98 (b)[(i) ] = (unsigned char) ( (n) >> 24 ); \ 99 (b)[(i) + 1] = (unsigned char) ( (n) >> 16 ); \ 100 (b)[(i) + 2] = (unsigned char) ( (n) >> 8 ); \ 101 (b)[(i) + 3] = (unsigned char) ( (n) ); \ 102 } 103 #endif 104 105 void mbedtls_sha1_init( mbedtls_sha1_context *ctx ) 106 { 107 memset( ctx, 0, sizeof( mbedtls_sha1_context ) ); 108 } 109 110 void mbedtls_sha1_free( mbedtls_sha1_context *ctx ) 111 { 112 if( ctx == NULL ) 113 return; 114 115 mbedtls_zeroize( ctx, sizeof( mbedtls_sha1_context ) ); 116 } 117 118 void mbedtls_sha1_clone( mbedtls_sha1_context *dst, 119 const mbedtls_sha1_context *src ) 120 { 121 *dst = *src; 122 } 123 124 /* 125 * SHA-1 context setup 126 */ 127 int mbedtls_sha1_starts_ret( mbedtls_sha1_context *ctx ) 128 { 129 ctx->total[0] = 0; 130 ctx->total[1] = 0; 131 132 ctx->state[0] = 0x67452301; 133 ctx->state[1] = 0xEFCDAB89; 134 ctx->state[2] = 0x98BADCFE; 135 ctx->state[3] = 0x10325476; 136 ctx->state[4] = 0xC3D2E1F0; 137 138 return( 0 ); 139 } 140 141 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 142 void mbedtls_sha1_starts( mbedtls_sha1_context *ctx ) 143 { 144 mbedtls_sha1_starts_ret( ctx ); 145 } 146 #endif 147 148 #if !defined(MBEDTLS_SHA1_PROCESS_ALT) 149 int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, 150 const unsigned char data[64] ) 151 { 152 uint32_t temp, W[16], A, B, C, D, E; 153 154 GET_UINT32_BE( W[ 0], data, 0 ); 155 GET_UINT32_BE( W[ 1], data, 4 ); 156 GET_UINT32_BE( W[ 2], data, 8 ); 157 GET_UINT32_BE( W[ 3], data, 12 ); 158 GET_UINT32_BE( W[ 4], data, 16 ); 159 GET_UINT32_BE( W[ 5], data, 20 ); 160 GET_UINT32_BE( W[ 6], data, 24 ); 161 GET_UINT32_BE( W[ 7], data, 28 ); 162 GET_UINT32_BE( W[ 8], data, 32 ); 163 GET_UINT32_BE( W[ 9], data, 36 ); 164 GET_UINT32_BE( W[10], data, 40 ); 165 GET_UINT32_BE( W[11], data, 44 ); 166 GET_UINT32_BE( W[12], data, 48 ); 167 GET_UINT32_BE( W[13], data, 52 ); 168 GET_UINT32_BE( W[14], data, 56 ); 169 GET_UINT32_BE( W[15], data, 60 ); 170 171 #define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n))) 172 173 #define R(t) \ 174 ( \ 175 temp = W[( t - 3 ) & 0x0F] ^ W[( t - 8 ) & 0x0F] ^ \ 176 W[( t - 14 ) & 0x0F] ^ W[ t & 0x0F], \ 177 ( W[t & 0x0F] = S(temp,1) ) \ 178 ) 179 180 #define P(a,b,c,d,e,x) \ 181 { \ 182 e += S(a,5) + F(b,c,d) + K + x; b = S(b,30); \ 183 } 184 185 A = ctx->state[0]; 186 B = ctx->state[1]; 187 C = ctx->state[2]; 188 D = ctx->state[3]; 189 E = ctx->state[4]; 190 191 #define F(x,y,z) (z ^ (x & (y ^ z))) 192 #define K 0x5A827999 193 194 P( A, B, C, D, E, W[0] ); 195 P( E, A, B, C, D, W[1] ); 196 P( D, E, A, B, C, W[2] ); 197 P( C, D, E, A, B, W[3] ); 198 P( B, C, D, E, A, W[4] ); 199 P( A, B, C, D, E, W[5] ); 200 P( E, A, B, C, D, W[6] ); 201 P( D, E, A, B, C, W[7] ); 202 P( C, D, E, A, B, W[8] ); 203 P( B, C, D, E, A, W[9] ); 204 P( A, B, C, D, E, W[10] ); 205 P( E, A, B, C, D, W[11] ); 206 P( D, E, A, B, C, W[12] ); 207 P( C, D, E, A, B, W[13] ); 208 P( B, C, D, E, A, W[14] ); 209 P( A, B, C, D, E, W[15] ); 210 P( E, A, B, C, D, R(16) ); 211 P( D, E, A, B, C, R(17) ); 212 P( C, D, E, A, B, R(18) ); 213 P( B, C, D, E, A, R(19) ); 214 215 #undef K 216 #undef F 217 218 #define F(x,y,z) (x ^ y ^ z) 219 #define K 0x6ED9EBA1 220 221 P( A, B, C, D, E, R(20) ); 222 P( E, A, B, C, D, R(21) ); 223 P( D, E, A, B, C, R(22) ); 224 P( C, D, E, A, B, R(23) ); 225 P( B, C, D, E, A, R(24) ); 226 P( A, B, C, D, E, R(25) ); 227 P( E, A, B, C, D, R(26) ); 228 P( D, E, A, B, C, R(27) ); 229 P( C, D, E, A, B, R(28) ); 230 P( B, C, D, E, A, R(29) ); 231 P( A, B, C, D, E, R(30) ); 232 P( E, A, B, C, D, R(31) ); 233 P( D, E, A, B, C, R(32) ); 234 P( C, D, E, A, B, R(33) ); 235 P( B, C, D, E, A, R(34) ); 236 P( A, B, C, D, E, R(35) ); 237 P( E, A, B, C, D, R(36) ); 238 P( D, E, A, B, C, R(37) ); 239 P( C, D, E, A, B, R(38) ); 240 P( B, C, D, E, A, R(39) ); 241 242 #undef K 243 #undef F 244 245 #define F(x,y,z) ((x & y) | (z & (x | y))) 246 #define K 0x8F1BBCDC 247 248 P( A, B, C, D, E, R(40) ); 249 P( E, A, B, C, D, R(41) ); 250 P( D, E, A, B, C, R(42) ); 251 P( C, D, E, A, B, R(43) ); 252 P( B, C, D, E, A, R(44) ); 253 P( A, B, C, D, E, R(45) ); 254 P( E, A, B, C, D, R(46) ); 255 P( D, E, A, B, C, R(47) ); 256 P( C, D, E, A, B, R(48) ); 257 P( B, C, D, E, A, R(49) ); 258 P( A, B, C, D, E, R(50) ); 259 P( E, A, B, C, D, R(51) ); 260 P( D, E, A, B, C, R(52) ); 261 P( C, D, E, A, B, R(53) ); 262 P( B, C, D, E, A, R(54) ); 263 P( A, B, C, D, E, R(55) ); 264 P( E, A, B, C, D, R(56) ); 265 P( D, E, A, B, C, R(57) ); 266 P( C, D, E, A, B, R(58) ); 267 P( B, C, D, E, A, R(59) ); 268 269 #undef K 270 #undef F 271 272 #define F(x,y,z) (x ^ y ^ z) 273 #define K 0xCA62C1D6 274 275 P( A, B, C, D, E, R(60) ); 276 P( E, A, B, C, D, R(61) ); 277 P( D, E, A, B, C, R(62) ); 278 P( C, D, E, A, B, R(63) ); 279 P( B, C, D, E, A, R(64) ); 280 P( A, B, C, D, E, R(65) ); 281 P( E, A, B, C, D, R(66) ); 282 P( D, E, A, B, C, R(67) ); 283 P( C, D, E, A, B, R(68) ); 284 P( B, C, D, E, A, R(69) ); 285 P( A, B, C, D, E, R(70) ); 286 P( E, A, B, C, D, R(71) ); 287 P( D, E, A, B, C, R(72) ); 288 P( C, D, E, A, B, R(73) ); 289 P( B, C, D, E, A, R(74) ); 290 P( A, B, C, D, E, R(75) ); 291 P( E, A, B, C, D, R(76) ); 292 P( D, E, A, B, C, R(77) ); 293 P( C, D, E, A, B, R(78) ); 294 P( B, C, D, E, A, R(79) ); 295 296 #undef K 297 #undef F 298 299 ctx->state[0] += A; 300 ctx->state[1] += B; 301 ctx->state[2] += C; 302 ctx->state[3] += D; 303 ctx->state[4] += E; 304 305 return( 0 ); 306 } 307 308 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 309 void mbedtls_sha1_process( mbedtls_sha1_context *ctx, 310 const unsigned char data[64] ) 311 { 312 mbedtls_internal_sha1_process( ctx, data ); 313 } 314 #endif 315 #endif /* !MBEDTLS_SHA1_PROCESS_ALT */ 316 317 /* 318 * SHA-1 process buffer 319 */ 320 int mbedtls_sha1_update_ret( mbedtls_sha1_context *ctx, 321 const unsigned char *input, 322 size_t ilen ) 323 { 324 int ret; 325 size_t fill; 326 uint32_t left; 327 328 if( ilen == 0 ) 329 return( 0 ); 330 331 left = ctx->total[0] & 0x3F; 332 fill = 64 - left; 333 334 ctx->total[0] += (uint32_t) ilen; 335 ctx->total[0] &= 0xFFFFFFFF; 336 337 if( ctx->total[0] < (uint32_t) ilen ) 338 ctx->total[1]++; 339 340 if( left && ilen >= fill ) 341 { 342 memcpy( (void *) (ctx->buffer + left), input, fill ); 343 344 if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 ) 345 return( ret ); 346 347 input += fill; 348 ilen -= fill; 349 left = 0; 350 } 351 352 while( ilen >= 64 ) 353 { 354 if( ( ret = mbedtls_internal_sha1_process( ctx, input ) ) != 0 ) 355 return( ret ); 356 357 input += 64; 358 ilen -= 64; 359 } 360 361 if( ilen > 0 ) 362 memcpy( (void *) (ctx->buffer + left), input, ilen ); 363 364 return( 0 ); 365 } 366 367 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 368 void mbedtls_sha1_update( mbedtls_sha1_context *ctx, 369 const unsigned char *input, 370 size_t ilen ) 371 { 372 mbedtls_sha1_update_ret( ctx, input, ilen ); 373 } 374 #endif 375 376 /* 377 * SHA-1 final digest 378 */ 379 int mbedtls_sha1_finish_ret( mbedtls_sha1_context *ctx, 380 unsigned char output[20] ) 381 { 382 int ret; 383 uint32_t used; 384 uint32_t high, low; 385 386 /* 387 * Add padding: 0x80 then 0x00 until 8 bytes remain for the length 388 */ 389 used = ctx->total[0] & 0x3F; 390 391 ctx->buffer[used++] = 0x80; 392 393 if( used <= 56 ) 394 { 395 /* Enough room for padding + length in current block */ 396 memset( ctx->buffer + used, 0, 56 - used ); 397 } 398 else 399 { 400 /* We'll need an extra block */ 401 memset( ctx->buffer + used, 0, 64 - used ); 402 403 if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 ) 404 return( ret ); 405 406 memset( ctx->buffer, 0, 56 ); 407 } 408 409 /* 410 * Add message length 411 */ 412 high = ( ctx->total[0] >> 29 ) 413 | ( ctx->total[1] << 3 ); 414 low = ( ctx->total[0] << 3 ); 415 416 PUT_UINT32_BE( high, ctx->buffer, 56 ); 417 PUT_UINT32_BE( low, ctx->buffer, 60 ); 418 419 if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 ) 420 return( ret ); 421 422 /* 423 * Output final state 424 */ 425 PUT_UINT32_BE( ctx->state[0], output, 0 ); 426 PUT_UINT32_BE( ctx->state[1], output, 4 ); 427 PUT_UINT32_BE( ctx->state[2], output, 8 ); 428 PUT_UINT32_BE( ctx->state[3], output, 12 ); 429 PUT_UINT32_BE( ctx->state[4], output, 16 ); 430 431 return( 0 ); 432 } 433 434 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 435 void mbedtls_sha1_finish( mbedtls_sha1_context *ctx, 436 unsigned char output[20] ) 437 { 438 mbedtls_sha1_finish_ret( ctx, output ); 439 } 440 #endif 441 442 #endif /* !MBEDTLS_SHA1_ALT */ 443 444 /* 445 * output = SHA-1( input buffer ) 446 */ 447 int mbedtls_sha1_ret( const unsigned char *input, 448 size_t ilen, 449 unsigned char output[20] ) 450 { 451 int ret; 452 mbedtls_sha1_context ctx; 453 454 mbedtls_sha1_init( &ctx ); 455 456 if( ( ret = mbedtls_sha1_starts_ret( &ctx ) ) != 0 ) 457 goto exit; 458 459 if( ( ret = mbedtls_sha1_update_ret( &ctx, input, ilen ) ) != 0 ) 460 goto exit; 461 462 if( ( ret = mbedtls_sha1_finish_ret( &ctx, output ) ) != 0 ) 463 goto exit; 464 465 exit: 466 mbedtls_sha1_free( &ctx ); 467 468 return( ret ); 469 } 470 471 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 472 void mbedtls_sha1( const unsigned char *input, 473 size_t ilen, 474 unsigned char output[20] ) 475 { 476 mbedtls_sha1_ret( input, ilen, output ); 477 } 478 #endif 479 480 #if defined(MBEDTLS_SELF_TEST) 481 /* 482 * FIPS-180-1 test vectors 483 */ 484 static const unsigned char sha1_test_buf[3][57] = 485 { 486 { "abc" }, 487 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" }, 488 { "" } 489 }; 490 491 static const size_t sha1_test_buflen[3] = 492 { 493 3, 56, 1000 494 }; 495 496 static const unsigned char sha1_test_sum[3][20] = 497 { 498 { 0xA9, 0x99, 0x3E, 0x36, 0x47, 0x06, 0x81, 0x6A, 0xBA, 0x3E, 499 0x25, 0x71, 0x78, 0x50, 0xC2, 0x6C, 0x9C, 0xD0, 0xD8, 0x9D }, 500 { 0x84, 0x98, 0x3E, 0x44, 0x1C, 0x3B, 0xD2, 0x6E, 0xBA, 0xAE, 501 0x4A, 0xA1, 0xF9, 0x51, 0x29, 0xE5, 0xE5, 0x46, 0x70, 0xF1 }, 502 { 0x34, 0xAA, 0x97, 0x3C, 0xD4, 0xC4, 0xDA, 0xA4, 0xF6, 0x1E, 503 0xEB, 0x2B, 0xDB, 0xAD, 0x27, 0x31, 0x65, 0x34, 0x01, 0x6F } 504 }; 505 506 /* 507 * Checkup routine 508 */ 509 int mbedtls_sha1_self_test( int verbose ) 510 { 511 int i, j, buflen, ret = 0; 512 unsigned char buf[1024]; 513 unsigned char sha1sum[20]; 514 mbedtls_sha1_context ctx; 515 516 mbedtls_sha1_init( &ctx ); 517 518 /* 519 * SHA-1 520 */ 521 for( i = 0; i < 3; i++ ) 522 { 523 if( verbose != 0 ) 524 mbedtls_printf( " SHA-1 test #%d: ", i + 1 ); 525 526 if( ( ret = mbedtls_sha1_starts_ret( &ctx ) ) != 0 ) 527 goto fail; 528 529 if( i == 2 ) 530 { 531 memset( buf, 'a', buflen = 1000 ); 532 533 for( j = 0; j < 1000; j++ ) 534 { 535 ret = mbedtls_sha1_update_ret( &ctx, buf, buflen ); 536 if( ret != 0 ) 537 goto fail; 538 } 539 } 540 else 541 { 542 ret = mbedtls_sha1_update_ret( &ctx, sha1_test_buf[i], 543 sha1_test_buflen[i] ); 544 if( ret != 0 ) 545 goto fail; 546 } 547 548 if( ( ret = mbedtls_sha1_finish_ret( &ctx, sha1sum ) ) != 0 ) 549 goto fail; 550 551 if( memcmp( sha1sum, sha1_test_sum[i], 20 ) != 0 ) 552 { 553 ret = 1; 554 goto fail; 555 } 556 557 if( verbose != 0 ) 558 mbedtls_printf( "passed\n" ); 559 } 560 561 if( verbose != 0 ) 562 mbedtls_printf( "\n" ); 563 564 goto exit; 565 566 fail: 567 if( verbose != 0 ) 568 mbedtls_printf( "failed\n" ); 569 570 exit: 571 mbedtls_sha1_free( &ctx ); 572 573 return( ret ); 574 } 575 576 #endif /* MBEDTLS_SELF_TEST */ 577 578 #endif /* MBEDTLS_SHA1_C */ 579