sha1.c

   1 /* sha1.c - Functions to compute SHA1 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-1.
   3
   4    Copyright (C) 2000, 2001, 2003, 2004, 2005, 2006, 2008 Free Software
   5    Foundation, Inc.
   6
   7    This program is free software; you can redistribute it and/or modify it
   8    under the terms of the GNU General Public License as published by the
   9    Free Software Foundation; either version 2, or (at your option) any
  10    later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software Foundation,
  19    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  20
  21 /* Written by Scott G. Miller
  22    Credits:
  23       Robert Klep <robert@ilse.nl>  -- Expansion function fix
  24 */
  25
  26 //#include <config.h>
  27
  28 #include "sha1.h"
  29
  30 #include <stddef.h>
  31 #include <string.h>
  32
  33 #if USE_UNLOCKED_IO
  34 # include "unlocked-io.h"
  35 #endif
  36
  37 #ifdef WORDS_BIGENDIAN
  38 # define SWAP(n) (n)
  39 #else
  40 # define SWAP(n) \
  41     (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
  42 #endif
  43
  44 #define BLOCKSIZE 4096
  45 #if BLOCKSIZE % 64 != 0
  46 # error "invalid BLOCKSIZE"
  47 #endif
  48
  49 /* This array contains the bytes used to pad the buffer to the next
  50    64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
  51 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  52
  53 /* Take a pointer to a 160 bit block of data (five 32 bit ints) and
  54    initialize it to the start constants of the SHA1 algorithm.  This
  55    must be called before using hash in the call to sha1_hash.  */
  56 void
  57 sha1_init_ctx (struct sha1_ctx *ctx)
  58 {
  59   ctx->A = 0x67452301;
  60   ctx->B = 0xefcdab89;
  61   ctx->C = 0x98badcfe;
  62   ctx->D = 0x10325476;
  63   ctx->E = 0xc3d2e1f0;
  64
  65   ctx->total[0] = ctx->total[1] = 0;
  66   ctx->buflen = 0;
  67 }
  68
  69 /* Put result from CTX in first 20 bytes following RESBUF.  The result
  70    must be in little endian byte order.
  71
  72    IMPORTANT: On some systems it is required that RESBUF is correctly
  73    aligned for a 32-bit value.  */
  74 void *
  75 sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
  76 {
  77   ((sha1_uint32 *) resbuf)[0] = SWAP (ctx->A);
  78   ((sha1_uint32 *) resbuf)[1] = SWAP (ctx->B);
  79   ((sha1_uint32 *) resbuf)[2] = SWAP (ctx->C);
  80   ((sha1_uint32 *) resbuf)[3] = SWAP (ctx->D);
  81   ((sha1_uint32 *) resbuf)[4] = SWAP (ctx->E);
  82
  83   return resbuf;
  84 }
  85
  86 /* Process the remaining bytes in the internal buffer and the usual
  87    prolog according to the standard and write the result to RESBUF.
  88
  89    IMPORTANT: On some systems it is required that RESBUF is correctly
  90    aligned for a 32-bit value.  */
  91 void *
  92 sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
  93 {
  94   /* Take yet unprocessed bytes into account.  */
  95   sha1_uint32 bytes = ctx->buflen;
  96   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
  97
  98   /* Now count remaining bytes.  */
  99   ctx->total[0] += bytes;
 100   if (ctx->total[0] < bytes)
 101     ++ctx->total[1];
 102
 103   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 104   ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 105   ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
 106
 107   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 108
 109   /* Process last bytes.  */
 110   sha1_process_block (ctx->buffer, size * 4, ctx);
 111
 112   return sha1_read_ctx (ctx, resbuf);
 113 }
 114
 115 /* Compute SHA1 message digest for bytes read from STREAM.  The
 116    resulting message digest number will be written into the 16 bytes
 117    beginning at RESBLOCK.  */
 118 int
 119 sha1_stream (FILE *stream, void *resblock)
 120 {
 121   struct sha1_ctx ctx;
 122   char buffer[BLOCKSIZE + 72];
 123   size_t sum;
 124
 125   /* Initialize the computation context.  */
 126   sha1_init_ctx (&ctx);
 127
 128   /* Iterate over full file contents.  */
 129   while (1)
 130     {
 131       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 132          computation function processes the whole buffer so that with the
 133          next round of the loop another block can be read.  */
 134       size_t n;
 135       sum = 0;
 136
 137       /* Read block.  Take care for partial reads.  */
 138       while (1)
 139         {
 140           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 141
 142           sum += n;
 143
 144           if (sum == BLOCKSIZE)
 145             break;
 146
 147           if (n == 0)
 148             {
 149               /* Check for the error flag IFF N == 0, so that we don't
 150                  exit the loop after a partial read due to e.g., EAGAIN
 151                  or EWOULDBLOCK.  */
 152               if (ferror (stream))
 153                 return 1;
 154               goto process_partial_block;
 155             }
 156
 157           /* We've read at least one byte, so ignore errors.  But always
 158              check for EOF, since feof may be true even though N > 0.
 159              Otherwise, we could end up calling fread after EOF.  */
 160           if (feof (stream))
 161             goto process_partial_block;
 162         }
 163
 164       /* Process buffer with BLOCKSIZE bytes.  Note that
 165                         BLOCKSIZE % 64 == 0
 166        */
 167       sha1_process_block (buffer, BLOCKSIZE, &ctx);
 168     }
 169
 170  process_partial_block:;
 171
 172   /* Process any remaining bytes.  */
 173   if (sum > 0)
 174     sha1_process_bytes (buffer, sum, &ctx);
 175
 176   /* Construct result in desired memory.  */
 177   sha1_finish_ctx (&ctx, resblock);
 178   return 0;
 179 }
 180
 181 /* Compute SHA1 message digest for LEN bytes beginning at BUFFER.  The
 182    result is always in little endian byte order, so that a byte-wise
 183    output yields to the wanted ASCII representation of the message
 184    digest.  */
 185 void *
 186 sha1_buffer (const char *buffer, size_t len, void *resblock)
 187 {
 188   struct sha1_ctx ctx;
 189
 190   /* Initialize the computation context.  */
 191   sha1_init_ctx (&ctx);
 192
 193   /* Process whole buffer but last len % 64 bytes.  */
 194   sha1_process_bytes (buffer, len, &ctx);
 195
 196   /* Put result in desired memory area.  */
 197   return sha1_finish_ctx (&ctx, resblock);
 198 }
 199
 200 void
 201 sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
 202 {
 203   /* When we already have some bits in our internal buffer concatenate
 204      both inputs first.  */
 205   if (ctx->buflen != 0)
 206     {
 207       size_t left_over = ctx->buflen;
 208       size_t add = 128 - left_over > len ? len : 128 - left_over;
 209
 210       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 211       ctx->buflen += add;
 212
 213       if (ctx->buflen > 64)
 214         {
 215           sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 216
 217           ctx->buflen &= 63;
 218           /* The regions in the following copy operation cannot overlap.  */
 219           memcpy (ctx->buffer,
 220                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 221                   ctx->buflen);
 222         }
 223
 224       buffer = (const char *) buffer + add;
 225       len -= add;
 226     }
 227
 228   /* Process available complete blocks.  */
 229   if (len >= 64)
 230     {
 231 #if !_STRING_ARCH_unaligned
 232 /* GCC releases before GCC 4.9 had a bug in _Alignof.  See GCC bug 52023
 233    <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52023>.
 234    clang versions < 8.0.0 have the same bug.  */
 235 # if (!defined __STDC_VERSION__ || __STDC_VERSION__ < 201112 \
 236       || (defined __GNUC__ && __GNUC__ < 4 + (__GNUC_MINOR__ < 9) \
 237    && !defined __clang__) \
 238       || (defined __clang__ && __clang_major__ < 8))
 239 #  define alignof(type) offsetof (struct { char c; type x; }, x)
 240 # else
 241 #  define alignof(type) _Alignof(type)
 242 # endif
 243 # define UNALIGNED_P(p) (((size_t) p) % alignof (sha1_uint32) != 0)
 244       if (UNALIGNED_P (buffer))
 245         while (len > 64)
 246           {
 247             sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 248             buffer = (const char *) buffer + 64;
 249             len -= 64;
 250           }
 251       else
 252 #endif
 253         {
 254           sha1_process_block (buffer, len & ~63, ctx);
 255           buffer = (const char *) buffer + (len & ~63);
 256           len &= 63;
 257         }
 258     }
 259
 260   /* Move remaining bytes in internal buffer.  */
 261   if (len > 0)
 262     {
 263       size_t left_over = ctx->buflen;
 264
 265       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 266       left_over += len;
 267       if (left_over >= 64)
 268         {
 269           sha1_process_block (ctx->buffer, 64, ctx);
 270           left_over -= 64;
 271           memmove (ctx->buffer, &ctx->buffer[16], left_over);
 272         }
 273       ctx->buflen = left_over;
 274     }
 275 }
 276
 277 /* --- Code below is the primary difference between md5.c and sha1.c --- */
 278
 279 /* SHA1 round constants */
 280 #define K1 0x5a827999
 281 #define K2 0x6ed9eba1
 282 #define K3 0x8f1bbcdc
 283 #define K4 0xca62c1d6
 284
 285 /* Round functions.  Note that F2 is the same as F4.  */
 286 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
 287 #define F2(B,C,D) (B ^ C ^ D)
 288 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
 289 #define F4(B,C,D) (B ^ C ^ D)
 290
 291 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 292    It is assumed that LEN % 64 == 0.
 293    Most of this code comes from GnuPG's cipher/sha1.c.  */
 294
 295 void
 296 sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
 297 {
 298   const sha1_uint32 *words = (const sha1_uint32*) buffer;
 299   size_t nwords = len / sizeof (sha1_uint32);
 300   const sha1_uint32 *endp = words + nwords;
 301   sha1_uint32 x[16];
 302   sha1_uint32 a = ctx->A;
 303   sha1_uint32 b = ctx->B;
 304   sha1_uint32 c = ctx->C;
 305   sha1_uint32 d = ctx->D;
 306   sha1_uint32 e = ctx->E;
 307
 308   /* First increment the byte count.  RFC 1321 specifies the possible
 309      length of the file up to 2^64 bits.  Here we only compute the
 310      number of bytes.  Do a double word increment.  */
 311   ctx->total[0] += len;
 312   if (ctx->total[0] < len)
 313     ++ctx->total[1];
 314
 315 #define rol(x, n) (((x) << (n)) | ((sha1_uint32) (x) >> (32 - (n))))
 316
 317 #define M(I) ( tm =   x[I&0x0f] ^ x[(I-14)&0x0f] \
 318                     ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
 319                , (x[I&0x0f] = rol(tm, 1)) )
 320
 321 #define R(A,B,C,D,E,F,K,M)  do { E += rol( A, 5 )     \
 322                                       + F( B, C, D )  \
 323                                       + K             \
 324                                       + M;            \
 325                                  B = rol( B, 30 );    \
 326                                } while(0)
 327
 328   while (words < endp)
 329     {
 330       sha1_uint32 tm;
 331       int t;
 332       for (t = 0; t < 16; t++)
 333         {
 334           x[t] = SWAP (*words);
 335           words++;
 336         }
 337
 338       R( a, b, c, d, e, F1, K1, x[ 0] );
 339       R( e, a, b, c, d, F1, K1, x[ 1] );
 340       R( d, e, a, b, c, F1, K1, x[ 2] );
 341       R( c, d, e, a, b, F1, K1, x[ 3] );
 342       R( b, c, d, e, a, F1, K1, x[ 4] );
 343       R( a, b, c, d, e, F1, K1, x[ 5] );
 344       R( e, a, b, c, d, F1, K1, x[ 6] );
 345       R( d, e, a, b, c, F1, K1, x[ 7] );
 346       R( c, d, e, a, b, F1, K1, x[ 8] );
 347       R( b, c, d, e, a, F1, K1, x[ 9] );
 348       R( a, b, c, d, e, F1, K1, x[10] );
 349       R( e, a, b, c, d, F1, K1, x[11] );
 350       R( d, e, a, b, c, F1, K1, x[12] );
 351       R( c, d, e, a, b, F1, K1, x[13] );
 352       R( b, c, d, e, a, F1, K1, x[14] );
 353       R( a, b, c, d, e, F1, K1, x[15] );
 354       R( e, a, b, c, d, F1, K1, M(16) );
 355       R( d, e, a, b, c, F1, K1, M(17) );
 356       R( c, d, e, a, b, F1, K1, M(18) );
 357       R( b, c, d, e, a, F1, K1, M(19) );
 358       R( a, b, c, d, e, F2, K2, M(20) );
 359       R( e, a, b, c, d, F2, K2, M(21) );
 360       R( d, e, a, b, c, F2, K2, M(22) );
 361       R( c, d, e, a, b, F2, K2, M(23) );
 362       R( b, c, d, e, a, F2, K2, M(24) );
 363       R( a, b, c, d, e, F2, K2, M(25) );
 364       R( e, a, b, c, d, F2, K2, M(26) );
 365       R( d, e, a, b, c, F2, K2, M(27) );
 366       R( c, d, e, a, b, F2, K2, M(28) );
 367       R( b, c, d, e, a, F2, K2, M(29) );
 368       R( a, b, c, d, e, F2, K2, M(30) );
 369       R( e, a, b, c, d, F2, K2, M(31) );
 370       R( d, e, a, b, c, F2, K2, M(32) );
 371       R( c, d, e, a, b, F2, K2, M(33) );
 372       R( b, c, d, e, a, F2, K2, M(34) );
 373       R( a, b, c, d, e, F2, K2, M(35) );
 374       R( e, a, b, c, d, F2, K2, M(36) );
 375       R( d, e, a, b, c, F2, K2, M(37) );
 376       R( c, d, e, a, b, F2, K2, M(38) );
 377       R( b, c, d, e, a, F2, K2, M(39) );
 378       R( a, b, c, d, e, F3, K3, M(40) );
 379       R( e, a, b, c, d, F3, K3, M(41) );
 380       R( d, e, a, b, c, F3, K3, M(42) );
 381       R( c, d, e, a, b, F3, K3, M(43) );
 382       R( b, c, d, e, a, F3, K3, M(44) );
 383       R( a, b, c, d, e, F3, K3, M(45) );
 384       R( e, a, b, c, d, F3, K3, M(46) );
 385       R( d, e, a, b, c, F3, K3, M(47) );
 386       R( c, d, e, a, b, F3, K3, M(48) );
 387       R( b, c, d, e, a, F3, K3, M(49) );
 388       R( a, b, c, d, e, F3, K3, M(50) );
 389       R( e, a, b, c, d, F3, K3, M(51) );
 390       R( d, e, a, b, c, F3, K3, M(52) );
 391       R( c, d, e, a, b, F3, K3, M(53) );
 392       R( b, c, d, e, a, F3, K3, M(54) );
 393       R( a, b, c, d, e, F3, K3, M(55) );
 394       R( e, a, b, c, d, F3, K3, M(56) );
 395       R( d, e, a, b, c, F3, K3, M(57) );
 396       R( c, d, e, a, b, F3, K3, M(58) );
 397       R( b, c, d, e, a, F3, K3, M(59) );
 398       R( a, b, c, d, e, F4, K4, M(60) );
 399       R( e, a, b, c, d, F4, K4, M(61) );
 400       R( d, e, a, b, c, F4, K4, M(62) );
 401       R( c, d, e, a, b, F4, K4, M(63) );
 402       R( b, c, d, e, a, F4, K4, M(64) );
 403       R( a, b, c, d, e, F4, K4, M(65) );
 404       R( e, a, b, c, d, F4, K4, M(66) );
 405       R( d, e, a, b, c, F4, K4, M(67) );
 406       R( c, d, e, a, b, F4, K4, M(68) );
 407       R( b, c, d, e, a, F4, K4, M(69) );
 408       R( a, b, c, d, e, F4, K4, M(70) );
 409       R( e, a, b, c, d, F4, K4, M(71) );
 410       R( d, e, a, b, c, F4, K4, M(72) );
 411       R( c, d, e, a, b, F4, K4, M(73) );
 412       R( b, c, d, e, a, F4, K4, M(74) );
 413       R( a, b, c, d, e, F4, K4, M(75) );
 414       R( e, a, b, c, d, F4, K4, M(76) );
 415       R( d, e, a, b, c, F4, K4, M(77) );
 416       R( c, d, e, a, b, F4, K4, M(78) );
 417       R( b, c, d, e, a, F4, K4, M(79) );
 418
 419       a = ctx->A += a;
 420       b = ctx->B += b;
 421       c = ctx->C += c;
 422       d = ctx->D += d;
 423       e = ctx->E += e;
 424     }
 425 }