projects / thirdparty / systemd.git / blame
| Commit | Line | Data |
|---|---|---|
| 073220bf LP |
1 | /* Stolen from glibc and converted to UEFI style. In glibc it comes with the following copyright blurb: */ |
| 2 | ||
| 3 | /* Functions to compute SHA256 message digest of files or memory blocks. | |
| 4 | according to the definition of SHA256 in FIPS 180-2. | |
| 5 | Copyright (C) 2007-2019 Free Software Foundation, Inc. | |
| 6 | This file is part of the GNU C Library. | |
| 7 | ||
| 8 | The GNU C Library is free software; you can redistribute it and/or | |
| 9 | modify it under the terms of the GNU Lesser General Public | |
| 10 | License as published by the Free Software Foundation; either | |
| 11 | version 2.1 of the License, or (at your option) any later version. | |
| 12 | ||
| 13 | The GNU C Library is distributed in the hope that it will be useful, | |
| 14 | but WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 15 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
| 16 | Lesser General Public License for more details. | |
| 17 | ||
| 18 | You should have received a copy of the GNU Lesser General Public | |
| 19 | License along with the GNU C Library; if not, see | |
| 20 | <http://www.gnu.org/licenses/>. */ | |
| 21 | ||
| 22 | /* Written by Ulrich Drepper <drepper@redhat.com>, 2007. */ | |
| 23 | ||
| 24 | #include "sha256.h" | |
| 25 | ||
| 26 | #if __BYTE_ORDER == __LITTLE_ENDIAN | |
| 27 | # define SWAP(n) \ | |
| 28 | (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24)) | |
| 29 | # define SWAP64(n) \ | |
| 30 | (((n) << 56) \ | |
| 31 | | (((n) & 0xff00) << 40) \ | |
| 32 | | (((n) & 0xff0000) << 24) \ | |
| 33 | | (((n) & 0xff000000) << 8) \ | |
| 34 | | (((n) >> 8) & 0xff000000) \ | |
| 35 | | (((n) >> 24) & 0xff0000) \ | |
| 36 | | (((n) >> 40) & 0xff00) \ | |
| 37 | | ((n) >> 56)) | |
| 38 | #else | |
| 39 | # define SWAP(n) (n) | |
| 40 | # define SWAP64(n) (n) | |
| 41 | #endif | |
| 42 | ||
| 43 | /* This array contains the bytes used to pad the buffer to the next | |
| 44 | 64-byte boundary. (FIPS 180-2:5.1.1) */ | |
| 45 | static const UINT8 fillbuf[64] = { | |
| 46 | 0x80, 0 /* , 0, 0, ... */ | |
| 47 | }; | |
| 48 | ||
| 49 | /* Constants for SHA256 from FIPS 180-2:4.2.2. */ | |
| 50 | static const UINT32 K[64] = { | |
| 51 | 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, | |
| 52 | 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, | |
| 53 | 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, | |
| 54 | 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, | |
| 55 | 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, | |
| 56 | 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, | |
| 57 | 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, | |
| 58 | 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, | |
| 59 | 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, | |
| 60 | 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, | |
| 61 | 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, | |
| 62 | 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, | |
| 63 | 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, | |
| 64 | 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, | |
| 65 | 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, | |
| 66 | 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 | |
| 67 | }; | |
| 68 | ||
| 69 | static void sha256_process_block(const void *, UINTN, struct sha256_ctx *); | |
| 70 | ||
| 71 | /* Initialize structure containing state of computation. | |
| 72 | (FIPS 180-2:5.3.2) */ | |
| 73 | void sha256_init_ctx(struct sha256_ctx *ctx) { | |
| 74 | ctx->H[0] = 0x6a09e667; | |
| 75 | ctx->H[1] = 0xbb67ae85; | |
| 76 | ctx->H[2] = 0x3c6ef372; | |
| 77 | ctx->H[3] = 0xa54ff53a; | |
| 78 | ctx->H[4] = 0x510e527f; | |
| 79 | ctx->H[5] = 0x9b05688c; | |
| 80 | ctx->H[6] = 0x1f83d9ab; | |
| 81 | ctx->H[7] = 0x5be0cd19; | |
| 82 | ||
| 83 | ctx->total64 = 0; | |
| 84 | ctx->buflen = 0; | |
| 85 | } | |
| 86 | ||
| 87 | /* Process the remaining bytes in the internal buffer and the usual | |
| 88 | prolog according to the standard and write the result to RESBUF. | |
| 89 | ||
| 90 | IMPORTANT: On some systems it is required that RESBUF is correctly | |
| 91 | aligned for a 32 bits value. */ | |
| 92 | void *sha256_finish_ctx(struct sha256_ctx *ctx, void *resbuf) { | |
| 93 | /* Take yet unprocessed bytes into account. */ | |
| 94 | UINT32 bytes = ctx->buflen; | |
| 95 | UINTN pad, i; | |
| 96 | ||
| 97 | /* Now count remaining bytes. */ | |
| 98 | ctx->total64 += bytes; | |
| 99 | ||
| 100 | pad = bytes >= 56 ? 64 + 56 - bytes : 56 - bytes; | |
| 101 | CopyMem (&ctx->buffer[bytes], fillbuf, pad); | |
| 102 | ||
| 103 | /* Put the 64-bit file length in *bits* at the end of the buffer. */ | |
| 104 | ctx->buffer32[(bytes + pad + 4) / 4] = SWAP (ctx->total[TOTAL64_low] << 3); | |
| 105 | ctx->buffer32[(bytes + pad) / 4] = SWAP ((ctx->total[TOTAL64_high] << 3) | |
| 106 | | (ctx->total[TOTAL64_low] >> 29)); | |
| 107 | ||
| 108 | /* Process last bytes. */ | |
| 109 | sha256_process_block (ctx->buffer, bytes + pad + 8, ctx); | |
| 110 | ||
| 111 | /* Put result from CTX in first 32 bytes following RESBUF. */ | |
| 112 | for (i = 0; i < 8; ++i) | |
| 113 | ((UINT32 *) resbuf)[i] = SWAP (ctx->H[i]); | |
| 114 | ||
| 115 | return resbuf; | |
| 116 | } | |
| 117 | ||
| 118 | void sha256_process_bytes(const void *buffer, UINTN len, struct sha256_ctx *ctx) { | |
| 119 | /* When we already have some bits in our internal buffer concatenate | |
| 120 | both inputs first. */ | |
| 121 | ||
| 122 | if (ctx->buflen != 0) { | |
| 123 | UINTN left_over = ctx->buflen; | |
| 124 | UINTN add = 128 - left_over > len ? len : 128 - left_over; | |
| 125 | ||
| 126 | CopyMem (&ctx->buffer[left_over], buffer, add); | |
| 127 | ctx->buflen += add; | |
| 128 | ||
| 129 | if (ctx->buflen > 64) { | |
| 130 | sha256_process_block (ctx->buffer, ctx->buflen & ~63, ctx); | |
| 131 | ||
| 132 | ctx->buflen &= 63; | |
| 133 | /* The regions in the following copy operation cannot overlap. */ | |
| 134 | CopyMem (ctx->buffer, &ctx->buffer[(left_over + add) & ~63], | |
| 135 | ctx->buflen); | |
| 136 | } | |
| 137 | ||
| 138 | buffer = (const char *) buffer + add; | |
| 139 | len -= add; | |
| 140 | } | |
| 141 | ||
| 142 | /* Process available complete blocks. */ | |
| 143 | if (len >= 64) { | |
| 144 | #if !_STRING_ARCH_unaligned | |
| 145 | /* To check alignment gcc has an appropriate operator. Other | |
| 146 | compilers don't. */ | |
| 147 | # if __GNUC__ >= 2 | |
| 148 | # define UNALIGNED_P(p) (((UINTN) p) % __alignof__ (UINT32) != 0) | |
| 149 | # else | |
| 150 | # define UNALIGNED_P(p) (((UINTN) p) % sizeof (UINT32) != 0) | |
| 151 | # endif | |
| 152 | if (UNALIGNED_P (buffer)) | |
| 153 | while (len > 64) { | |
| 154 | CopyMem (ctx->buffer, buffer, 64); | |
| 155 | sha256_process_block (ctx->buffer, 64, ctx); | |
| 156 | buffer = (const char *) buffer + 64; | |
| 157 | len -= 64; | |
| 158 | } | |
| 159 | else | |
| 160 | #endif | |
| 161 | { | |
| 162 | sha256_process_block (buffer, len & ~63, ctx); | |
| 163 | buffer = (const char *) buffer + (len & ~63); | |
| 164 | len &= 63; | |
| 165 | } | |
| 166 | } | |
| 167 | ||
| 168 | /* Move remaining bytes into internal buffer. */ | |
| 169 | if (len > 0) { | |
| 170 | UINTN left_over = ctx->buflen; | |
| 171 | ||
| 172 | CopyMem (&ctx->buffer[left_over], buffer, len); | |
| 173 | left_over += len; | |
| 174 | if (left_over >= 64) { | |
| 175 | sha256_process_block (ctx->buffer, 64, ctx); | |
| 176 | left_over -= 64; | |
| 177 | CopyMem (ctx->buffer, &ctx->buffer[64], left_over); | |
| 178 | } | |
| 179 | ctx->buflen = left_over; | |
| 180 | } | |
| 181 | } | |
| 182 | ||
| 183 | ||
| 184 | /* Process LEN bytes of BUFFER, accumulating context into CTX. | |
| 185 | It is assumed that LEN % 64 == 0. */ | |
| 186 | static void sha256_process_block(const void *buffer, UINTN len, struct sha256_ctx *ctx) { | |
| 187 | const UINT32 *words = buffer; | |
| 188 | UINTN nwords = len / sizeof (UINT32); | |
| 189 | UINT32 a = ctx->H[0]; | |
| 190 | UINT32 b = ctx->H[1]; | |
| 191 | UINT32 c = ctx->H[2]; | |
| 192 | UINT32 d = ctx->H[3]; | |
| 193 | UINT32 e = ctx->H[4]; | |
| 194 | UINT32 f = ctx->H[5]; | |
| 195 | UINT32 g = ctx->H[6]; | |
| 196 | UINT32 h = ctx->H[7]; | |
| 197 | ||
| 198 | /* First increment the byte count. FIPS 180-2 specifies the possible | |
| 199 | length of the file up to 2^64 bits. Here we only compute the | |
| 200 | number of bytes. */ | |
| 201 | ctx->total64 += len; | |
| 202 | ||
| 203 | /* Process all bytes in the buffer with 64 bytes in each round of | |
| 204 | the loop. */ | |
| 205 | while (nwords > 0) { | |
| 206 | UINT32 W[64]; | |
| 207 | UINT32 a_save = a; | |
| 208 | UINT32 b_save = b; | |
| 209 | UINT32 c_save = c; | |
| 210 | UINT32 d_save = d; | |
| 211 | UINT32 e_save = e; | |
| 212 | UINT32 f_save = f; | |
| 213 | UINT32 g_save = g; | |
| 214 | UINT32 h_save = h; | |
| 215 | UINTN t; | |
| 216 | ||
| 217 | /* Operators defined in FIPS 180-2:4.1.2. */ | |
| 218 | #define Ch(x, y, z) ((x & y) ^ (~x & z)) | |
| 219 | #define Maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z)) | |
| 220 | #define S0(x) (CYCLIC (x, 2) ^ CYCLIC (x, 13) ^ CYCLIC (x, 22)) | |
| 221 | #define S1(x) (CYCLIC (x, 6) ^ CYCLIC (x, 11) ^ CYCLIC (x, 25)) | |
| 222 | #define R0(x) (CYCLIC (x, 7) ^ CYCLIC (x, 18) ^ (x >> 3)) | |
| 223 | #define R1(x) (CYCLIC (x, 17) ^ CYCLIC (x, 19) ^ (x >> 10)) | |
| 224 | ||
| 225 | /* It is unfortunate that C does not provide an operator for | |
| 226 | cyclic rotation. Hope the C compiler is smart enough. */ | |
| 227 | #define CYCLIC(w, s) ((w >> s) | (w << (32 - s))) | |
| 228 | ||
| 229 | /* Compute the message schedule according to FIPS 180-2:6.2.2 step 2. */ | |
| 230 | for (t = 0; t < 16; ++t) { | |
| 231 | W[t] = SWAP (*words); | |
| 232 | ++words; | |
| 233 | } | |
| 234 | for (t = 16; t < 64; ++t) | |
| 235 | W[t] = R1 (W[t - 2]) + W[t - 7] + R0 (W[t - 15]) + W[t - 16]; | |
| 236 | ||
| 237 | /* The actual computation according to FIPS 180-2:6.2.2 step 3. */ | |
| 238 | for (t = 0; t < 64; ++t) { | |
| 239 | UINT32 T1 = h + S1 (e) + Ch (e, f, g) + K[t] + W[t]; | |
| 240 | UINT32 T2 = S0 (a) + Maj (a, b, c); | |
| 241 | h = g; | |
| 242 | g = f; | |
| 243 | f = e; | |
| 244 | e = d + T1; | |
| 245 | d = c; | |
| 246 | c = b; | |
| 247 | b = a; | |
| 248 | a = T1 + T2; | |
| 249 | } | |
| 250 | ||
| 251 | /* Add the starting values of the context according to FIPS 180-2:6.2.2 | |
| 252 | step 4. */ | |
| 253 | a += a_save; | |
| 254 | b += b_save; | |
| 255 | c += c_save; | |
| 256 | d += d_save; | |
| 257 | e += e_save; | |
| 258 | f += f_save; | |
| 259 | g += g_save; | |
| 260 | h += h_save; | |
| 261 | ||
| 262 | /* Prepare for the next round. */ | |
| 263 | nwords -= 16; | |
| 264 | } | |
| 265 | ||
| 266 | /* Put checksum in context given as argument. */ | |
| 267 | ctx->H[0] = a; | |
| 268 | ctx->H[1] = b; | |
| 269 | ctx->H[2] = c; | |
| 270 | ctx->H[3] = d; | |
| 271 | ctx->H[4] = e; | |
| 272 | ctx->H[5] = f; | |
| 273 | ctx->H[6] = g; | |
| 274 | ctx->H[7] = h; | |
| 275 | } |