src/libfreeswan/libcrypto/libsha2/sha2.c

   1 /*
   2  *  sha512.c
   3  *
   4  *  Written by Jari Ruusu, April 16 2001
   5  *
   6  *  Copyright 2001 by Jari Ruusu.
   7  *  Redistribution of this file is permitted under the GNU Public License.
   8  */
   9
  10 #ifdef __KERNEL__
  11 #include <linux/string.h>
  12 #include <linux/types.h>
  13 #else
  14 #include <string.h>
  15 #include <sys/types.h>
  16 #endif
  17 #include "sha2.h"
  18
  19 /* Define one or more of these. If none is defined, you get all of them */
  20 #if !defined(SHA256_NEEDED)&&!defined(SHA512_NEEDED)&&!defined(SHA384_NEEDED)
  21 # define SHA256_NEEDED  1
  22 # define SHA512_NEEDED  1
  23 # define SHA384_NEEDED  1
  24 #endif
  25
  26 #if defined(SHA256_NEEDED)
  27 static const u_int32_t sha256_hashInit[8] = {
  28     0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c,
  29     0x1f83d9ab, 0x5be0cd19
  30 };
  31 static const u_int32_t sha256_K[64] = {
  32     0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
  33     0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
  34     0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
  35     0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
  36     0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
  37     0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
  38     0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
  39     0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
  40     0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
  41     0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
  42     0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
  43 };
  44 #endif
  45
  46 #if defined(SHA512_NEEDED)
  47 static const u_int64_t sha512_hashInit[8] = {
  48     0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL, 0x3c6ef372fe94f82bULL,
  49     0xa54ff53a5f1d36f1ULL, 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
  50     0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
  51 };
  52 #endif
  53
  54 #if defined(SHA384_NEEDED)
  55 static const u_int64_t sha384_hashInit[8] = {
  56     0xcbbb9d5dc1059ed8ULL, 0x629a292a367cd507ULL, 0x9159015a3070dd17ULL,
  57     0x152fecd8f70e5939ULL, 0x67332667ffc00b31ULL, 0x8eb44a8768581511ULL,
  58     0xdb0c2e0d64f98fa7ULL, 0x47b5481dbefa4fa4ULL
  59 };
  60 #endif
  61
  62 #if defined(SHA512_NEEDED) || defined(SHA384_NEEDED)
  63 static const u_int64_t sha512_K[80] = {
  64     0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,
  65     0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
  66     0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 0xd807aa98a3030242ULL,
  67     0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
  68     0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL,
  69     0xc19bf174cf692694ULL, 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
  70     0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL,
  71     0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
  72     0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL,
  73     0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
  74     0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 0x27b70a8546d22ffcULL,
  75     0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
  76     0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL,
  77     0x92722c851482353bULL, 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
  78     0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL,
  79     0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
  80     0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL,
  81     0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
  82     0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 0x748f82ee5defb2fcULL,
  83     0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
  84     0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL,
  85     0xc67178f2e372532bULL, 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
  86     0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL,
  87     0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
  88     0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL,
  89     0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
  90     0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
  91 };
  92 #endif
  93
  94 #define Ch(x,y,z)   (((x) & (y)) ^ ((~(x)) & (z)))
  95 #define Maj(x,y,z)  (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
  96 #define R(x,y)      ((y) >> (x))
  97
  98 #if defined(SHA256_NEEDED)
  99 void sha256_init(sha256_context *ctx)
 100 {
 101     memcpy(&ctx->sha_H[0], &sha256_hashInit[0], sizeof(ctx->sha_H));
 102     ctx->sha_blocks = 0;
 103     ctx->sha_bufCnt = 0;
 104 }
 105
 106 #define S(x,y)      (((y) >> (x)) | ((y) << (32 - (x))))
 107 #define uSig0(x)    ((S(2,(x))) ^ (S(13,(x))) ^ (S(22,(x))))
 108 #define uSig1(x)    ((S(6,(x))) ^ (S(11,(x))) ^ (S(25,(x))))
 109 #define lSig0(x)    ((S(7,(x))) ^ (S(18,(x))) ^ (R(3,(x))))
 110 #define lSig1(x)    ((S(17,(x))) ^ (S(19,(x))) ^ (R(10,(x))))
 111
 112 static void sha256_transform(sha256_context *ctx, const unsigned char *datap)
 113 {
 114     register int    j;
 115     u_int32_t       a, b, c, d, e, f, g, h;
 116     u_int32_t       T1, T2, W[64], Wm2, Wm15;
 117
 118     /* read the data, big endian byte order */
 119     j = 0;
 120     do {
 121         W[j] = (((u_int32_t)(datap[0]))<<24) | (((u_int32_t)(datap[1]))<<16) |
 122                (((u_int32_t)(datap[2]))<<8 ) | ((u_int32_t)(datap[3]));
 123         datap += 4;
 124     } while(++j < 16);
 125
 126     /* initialize variables a...h */
 127     a = ctx->sha_H[0];
 128     b = ctx->sha_H[1];
 129     c = ctx->sha_H[2];
 130     d = ctx->sha_H[3];
 131     e = ctx->sha_H[4];
 132     f = ctx->sha_H[5];
 133     g = ctx->sha_H[6];
 134     h = ctx->sha_H[7];
 135
 136     /* apply compression function */
 137     j = 0;
 138     do {
 139         if(j >= 16) {
 140             Wm2 = W[j - 2];
 141             Wm15 = W[j - 15];
 142             W[j] = lSig1(Wm2) + W[j - 7] + lSig0(Wm15) + W[j - 16];
 143         }
 144         T1 = h + uSig1(e) + Ch(e,f,g) + sha256_K[j] + W[j];
 145         T2 = uSig0(a) + Maj(a,b,c);
 146         h = g; g = f; f = e;
 147         e = d + T1;
 148         d = c; c = b; b = a;
 149         a = T1 + T2;
 150     } while(++j < 64);
 151
 152     /* compute intermediate hash value */
 153     ctx->sha_H[0] += a;
 154     ctx->sha_H[1] += b;
 155     ctx->sha_H[2] += c;
 156     ctx->sha_H[3] += d;
 157     ctx->sha_H[4] += e;
 158     ctx->sha_H[5] += f;
 159     ctx->sha_H[6] += g;
 160     ctx->sha_H[7] += h;
 161
 162     ctx->sha_blocks++;
 163 }
 164
 165 void sha256_write(sha256_context *ctx, const unsigned char *datap, int length)
 166 {
 167     while(length > 0) {
 168         if(!ctx->sha_bufCnt) {
 169             while(length >= sizeof(ctx->sha_out)) {
 170                 sha256_transform(ctx, datap);
 171                 datap += sizeof(ctx->sha_out);
 172                 length -= sizeof(ctx->sha_out);
 173             }
 174             if(!length) return;
 175         }
 176         ctx->sha_out[ctx->sha_bufCnt] = *datap++;
 177         length--;
 178         if(++ctx->sha_bufCnt == sizeof(ctx->sha_out)) {
 179             sha256_transform(ctx, &ctx->sha_out[0]);
 180             ctx->sha_bufCnt = 0;
 181         }
 182     }
 183 }
 184
 185 void sha256_final(sha256_context *ctx)
 186 {
 187     register int    j;
 188     u_int64_t       bitLength;
 189     u_int32_t       i;
 190     unsigned char   padByte, *datap;
 191
 192     bitLength = (ctx->sha_blocks << 9) | (ctx->sha_bufCnt << 3);
 193     padByte = 0x80;
 194     sha256_write(ctx, &padByte, 1);
 195
 196     /* pad extra space with zeroes */
 197     padByte = 0;
 198     while(ctx->sha_bufCnt != 56) {
 199         sha256_write(ctx, &padByte, 1);
 200     }
 201
 202     /* write bit length, big endian byte order */
 203     ctx->sha_out[56] = bitLength >> 56;
 204     ctx->sha_out[57] = bitLength >> 48;
 205     ctx->sha_out[58] = bitLength >> 40;
 206     ctx->sha_out[59] = bitLength >> 32;
 207     ctx->sha_out[60] = bitLength >> 24;
 208     ctx->sha_out[61] = bitLength >> 16;
 209     ctx->sha_out[62] = bitLength >> 8;
 210     ctx->sha_out[63] = bitLength;
 211     sha256_transform(ctx, &ctx->sha_out[0]);
 212
 213     /* return results in ctx->sha_out[0...31] */
 214     datap = &ctx->sha_out[0];
 215     j = 0;
 216     do {
 217         i = ctx->sha_H[j];
 218         datap[0] = i >> 24;
 219         datap[1] = i >> 16;
 220         datap[2] = i >> 8;
 221         datap[3] = i;
 222         datap += 4;
 223     } while(++j < 8);
 224
 225     /* clear sensitive information */
 226     memset(&ctx->sha_out[32], 0, sizeof(sha256_context) - 32);
 227 }
 228
 229 void sha256_hash_buffer(unsigned char *ib, int ile, unsigned char *ob, int ole)
 230 {
 231     sha256_context ctx;
 232
 233     if(ole < 1) return;
 234     memset(ob, 0, ole);
 235     if(ole > 32) ole = 32;
 236     sha256_init(&ctx);
 237     sha256_write(&ctx, ib, ile);
 238     sha256_final(&ctx);
 239     memcpy(ob, &ctx.sha_out[0], ole);
 240     memset(&ctx, 0, sizeof(ctx));
 241 }
 242
 243 #endif
 244
 245 #if defined(SHA512_NEEDED)
 246 void sha512_init(sha512_context *ctx)
 247 {
 248     memcpy(&ctx->sha_H[0], &sha512_hashInit[0], sizeof(ctx->sha_H));
 249     ctx->sha_blocks = 0;
 250     ctx->sha_blocksMSB = 0;
 251     ctx->sha_bufCnt = 0;
 252 }
 253 #endif
 254
 255 #if defined(SHA512_NEEDED) || defined(SHA384_NEEDED)
 256 #undef S
 257 #undef uSig0
 258 #undef uSig1
 259 #undef lSig0
 260 #undef lSig1
 261 #define S(x,y)      (((y) >> (x)) | ((y) << (64 - (x))))
 262 #define uSig0(x)    ((S(28,(x))) ^ (S(34,(x))) ^ (S(39,(x))))
 263 #define uSig1(x)    ((S(14,(x))) ^ (S(18,(x))) ^ (S(41,(x))))
 264 #define lSig0(x)    ((S(1,(x))) ^ (S(8,(x))) ^ (R(7,(x))))
 265 #define lSig1(x)    ((S(19,(x))) ^ (S(61,(x))) ^ (R(6,(x))))
 266
 267 static void sha512_transform(sha512_context *ctx, const unsigned char *datap)
 268 {
 269     register int    j;
 270     u_int64_t       a, b, c, d, e, f, g, h;
 271     u_int64_t       T1, T2, W[80], Wm2, Wm15;
 272
 273     /* read the data, big endian byte order */
 274     j = 0;
 275     do {
 276         W[j] = (((u_int64_t)(datap[0]))<<56) | (((u_int64_t)(datap[1]))<<48) |
 277                (((u_int64_t)(datap[2]))<<40) | (((u_int64_t)(datap[3]))<<32) |
 278                (((u_int64_t)(datap[4]))<<24) | (((u_int64_t)(datap[5]))<<16) |
 279                (((u_int64_t)(datap[6]))<<8 ) | ((u_int64_t)(datap[7]));
 280         datap += 8;
 281     } while(++j < 16);
 282
 283     /* initialize variables a...h */
 284     a = ctx->sha_H[0];
 285     b = ctx->sha_H[1];
 286     c = ctx->sha_H[2];
 287     d = ctx->sha_H[3];
 288     e = ctx->sha_H[4];
 289     f = ctx->sha_H[5];
 290     g = ctx->sha_H[6];
 291     h = ctx->sha_H[7];
 292
 293     /* apply compression function */
 294     j = 0;
 295     do {
 296         if(j >= 16) {
 297             Wm2 = W[j - 2];
 298             Wm15 = W[j - 15];
 299             W[j] = lSig1(Wm2) + W[j - 7] + lSig0(Wm15) + W[j - 16];
 300         }
 301         T1 = h + uSig1(e) + Ch(e,f,g) + sha512_K[j] + W[j];
 302         T2 = uSig0(a) + Maj(a,b,c);
 303         h = g; g = f; f = e;
 304         e = d + T1;
 305         d = c; c = b; b = a;
 306         a = T1 + T2;
 307     } while(++j < 80);
 308
 309     /* compute intermediate hash value */
 310     ctx->sha_H[0] += a;
 311     ctx->sha_H[1] += b;
 312     ctx->sha_H[2] += c;
 313     ctx->sha_H[3] += d;
 314     ctx->sha_H[4] += e;
 315     ctx->sha_H[5] += f;
 316     ctx->sha_H[6] += g;
 317     ctx->sha_H[7] += h;
 318
 319     ctx->sha_blocks++;
 320     if(!ctx->sha_blocks) ctx->sha_blocksMSB++;
 321 }
 322
 323 void sha512_write(sha512_context *ctx, const unsigned char *datap, int length)
 324 {
 325     while(length > 0) {
 326         if(!ctx->sha_bufCnt) {
 327             while(length >= sizeof(ctx->sha_out)) {
 328                 sha512_transform(ctx, datap);
 329                 datap += sizeof(ctx->sha_out);
 330                 length -= sizeof(ctx->sha_out);
 331             }
 332             if(!length) return;
 333         }
 334         ctx->sha_out[ctx->sha_bufCnt] = *datap++;
 335         length--;
 336         if(++ctx->sha_bufCnt == sizeof(ctx->sha_out)) {
 337             sha512_transform(ctx, &ctx->sha_out[0]);
 338             ctx->sha_bufCnt = 0;
 339         }
 340     }
 341 }
 342
 343 void sha512_final(sha512_context *ctx)
 344 {
 345     register int    j;
 346     u_int64_t       bitLength, bitLengthMSB;
 347     u_int64_t       i;
 348     unsigned char   padByte, *datap;
 349
 350     bitLength = (ctx->sha_blocks << 10) | (ctx->sha_bufCnt << 3);
 351     bitLengthMSB = (ctx->sha_blocksMSB << 10) | (ctx->sha_blocks >> 54);
 352     padByte = 0x80;
 353     sha512_write(ctx, &padByte, 1);
 354
 355     /* pad extra space with zeroes */
 356     padByte = 0;
 357     while(ctx->sha_bufCnt != 112) {
 358         sha512_write(ctx, &padByte, 1);
 359     }
 360
 361     /* write bit length, big endian byte order */
 362     ctx->sha_out[112] = bitLengthMSB >> 56;
 363     ctx->sha_out[113] = bitLengthMSB >> 48;
 364     ctx->sha_out[114] = bitLengthMSB >> 40;
 365     ctx->sha_out[115] = bitLengthMSB >> 32;
 366     ctx->sha_out[116] = bitLengthMSB >> 24;
 367     ctx->sha_out[117] = bitLengthMSB >> 16;
 368     ctx->sha_out[118] = bitLengthMSB >> 8;
 369     ctx->sha_out[119] = bitLengthMSB;
 370     ctx->sha_out[120] = bitLength >> 56;
 371     ctx->sha_out[121] = bitLength >> 48;
 372     ctx->sha_out[122] = bitLength >> 40;
 373     ctx->sha_out[123] = bitLength >> 32;
 374     ctx->sha_out[124] = bitLength >> 24;
 375     ctx->sha_out[125] = bitLength >> 16;
 376     ctx->sha_out[126] = bitLength >> 8;
 377     ctx->sha_out[127] = bitLength;
 378     sha512_transform(ctx, &ctx->sha_out[0]);
 379
 380     /* return results in ctx->sha_out[0...63] */
 381     datap = &ctx->sha_out[0];
 382     j = 0;
 383     do {
 384         i = ctx->sha_H[j];
 385         datap[0] = i >> 56;
 386         datap[1] = i >> 48;
 387         datap[2] = i >> 40;
 388         datap[3] = i >> 32;
 389         datap[4] = i >> 24;
 390         datap[5] = i >> 16;
 391         datap[6] = i >> 8;
 392         datap[7] = i;
 393         datap += 8;
 394     } while(++j < 8);
 395
 396     /* clear sensitive information */
 397     memset(&ctx->sha_out[64], 0, sizeof(sha512_context) - 64);
 398 }
 399
 400 void sha512_hash_buffer(unsigned char *ib, int ile, unsigned char *ob, int ole)
 401 {
 402     sha512_context ctx;
 403
 404     if(ole < 1) return;
 405     memset(ob, 0, ole);
 406     if(ole > 64) ole = 64;
 407     sha512_init(&ctx);
 408     sha512_write(&ctx, ib, ile);
 409     sha512_final(&ctx);
 410     memcpy(ob, &ctx.sha_out[0], ole);
 411     memset(&ctx, 0, sizeof(ctx));
 412 }
 413 #endif
 414
 415 #if defined(SHA384_NEEDED)
 416 void sha384_init(sha512_context *ctx)
 417 {
 418     memcpy(&ctx->sha_H[0], &sha384_hashInit[0], sizeof(ctx->sha_H));
 419     ctx->sha_blocks = 0;
 420     ctx->sha_blocksMSB = 0;
 421     ctx->sha_bufCnt = 0;
 422 }
 423
 424 void sha384_hash_buffer(unsigned char *ib, int ile, unsigned char *ob, int ole)
 425 {
 426     sha512_context ctx;
 427
 428     if(ole < 1) return;
 429     memset(ob, 0, ole);
 430     if(ole > 48) ole = 48;
 431     sha384_init(&ctx);
 432     sha512_write(&ctx, ib, ile);
 433     sha512_final(&ctx);
 434     memcpy(ob, &ctx.sha_out[0], ole);
 435     memset(&ctx, 0, sizeof(ctx));
 436 }
 437 #endif