lib/sha1.c

   1 /*
   2  *      BIRD Library -- SHA-1 Hash Function (FIPS 180-1, RFC 3174) and HMAC-SHA-1
   3  *
   4  *      (c) 2015 CZ.NIC z.s.p.o.
   5  *
   6  *      Based on the code from libucw-6.4
   7  *      (c) 2008--2009 Martin Mares <mj@ucw.cz>
   8  *
   9  *      Based on the code from libgcrypt-1.2.3, which is
  10  *      (c) 1998, 2001, 2002, 2003 Free Software Foundation, Inc.
  11  *
  12  *      Can be freely distributed and used under the terms of the GNU GPL.
  13  */
  14
  15 #include "lib/sha1.h"
  16 #include "lib/unaligned.h"
  17
  18
  19 void
  20 sha1_init(struct sha1_context *ctx)
  21 {
  22   ctx->h0 = 0x67452301;
  23   ctx->h1 = 0xefcdab89;
  24   ctx->h2 = 0x98badcfe;
  25   ctx->h3 = 0x10325476;
  26   ctx->h4 = 0xc3d2e1f0;
  27
  28   ctx->nblocks = 0;
  29   ctx->count = 0;
  30 }
  31
  32 /*
  33  * Transform the message X which consists of 16 32-bit-words
  34  */
  35 static void
  36 sha1_transform(struct sha1_context *ctx, const byte *data)
  37 {
  38   u32 a,b,c,d,e,tm;
  39   u32 x[16];
  40
  41   /* Get values from the chaining vars. */
  42   a = ctx->h0;
  43   b = ctx->h1;
  44   c = ctx->h2;
  45   d = ctx->h3;
  46   e = ctx->h4;
  47
  48 #ifdef CPU_BIG_ENDIAN
  49   memcpy(x, data, 64);
  50 #else
  51   int i;
  52   for (i = 0; i < 16; i++)
  53     x[i] = get_u32(data+4*i);
  54 #endif
  55
  56 #define K1              0x5A827999L
  57 #define K2              0x6ED9EBA1L
  58 #define K3              0x8F1BBCDCL
  59 #define K4              0xCA62C1D6L
  60 #define F1(x,y,z)       ( z ^ ( x & ( y ^ z ) ) )
  61 #define F2(x,y,z)       ( x ^ y ^ z )
  62 #define F3(x,y,z)       ( ( x & y ) | ( z & ( x | y ) ) )
  63 #define F4(x,y,z)       ( x ^ y ^ z )
  64
  65 #define M(i) (tm = x[i&0x0f] ^ x[(i-14)&0x0f] ^ x[(i-8)&0x0f] ^ x[(i-3)&0x0f], (x[i&0x0f] = ROL(tm, 1)))
  66
  67 /* Bitwise rotation of an unsigned int to the left **/
  68 #define ROL(x, bits) (((x) << (bits)) | ((uint)(x) >> (sizeof(uint)*8 - (bits))))
  69
  70   #define R(a, b, c, d, e, f, k, m)             \
  71     do                                          \
  72     {                                           \
  73       e += ROL(a, 5) + f(b, c, d) + k + m;      \
  74       b = ROL(b, 30);                           \
  75     } while(0)
  76
  77   R( a, b, c, d, e, F1, K1, x[ 0] );
  78   R( e, a, b, c, d, F1, K1, x[ 1] );
  79   R( d, e, a, b, c, F1, K1, x[ 2] );
  80   R( c, d, e, a, b, F1, K1, x[ 3] );
  81   R( b, c, d, e, a, F1, K1, x[ 4] );
  82   R( a, b, c, d, e, F1, K1, x[ 5] );
  83   R( e, a, b, c, d, F1, K1, x[ 6] );
  84   R( d, e, a, b, c, F1, K1, x[ 7] );
  85   R( c, d, e, a, b, F1, K1, x[ 8] );
  86   R( b, c, d, e, a, F1, K1, x[ 9] );
  87   R( a, b, c, d, e, F1, K1, x[10] );
  88   R( e, a, b, c, d, F1, K1, x[11] );
  89   R( d, e, a, b, c, F1, K1, x[12] );
  90   R( c, d, e, a, b, F1, K1, x[13] );
  91   R( b, c, d, e, a, F1, K1, x[14] );
  92   R( a, b, c, d, e, F1, K1, x[15] );
  93   R( e, a, b, c, d, F1, K1, M(16) );
  94   R( d, e, a, b, c, F1, K1, M(17) );
  95   R( c, d, e, a, b, F1, K1, M(18) );
  96   R( b, c, d, e, a, F1, K1, M(19) );
  97   R( a, b, c, d, e, F2, K2, M(20) );
  98   R( e, a, b, c, d, F2, K2, M(21) );
  99   R( d, e, a, b, c, F2, K2, M(22) );
 100   R( c, d, e, a, b, F2, K2, M(23) );
 101   R( b, c, d, e, a, F2, K2, M(24) );
 102   R( a, b, c, d, e, F2, K2, M(25) );
 103   R( e, a, b, c, d, F2, K2, M(26) );
 104   R( d, e, a, b, c, F2, K2, M(27) );
 105   R( c, d, e, a, b, F2, K2, M(28) );
 106   R( b, c, d, e, a, F2, K2, M(29) );
 107   R( a, b, c, d, e, F2, K2, M(30) );
 108   R( e, a, b, c, d, F2, K2, M(31) );
 109   R( d, e, a, b, c, F2, K2, M(32) );
 110   R( c, d, e, a, b, F2, K2, M(33) );
 111   R( b, c, d, e, a, F2, K2, M(34) );
 112   R( a, b, c, d, e, F2, K2, M(35) );
 113   R( e, a, b, c, d, F2, K2, M(36) );
 114   R( d, e, a, b, c, F2, K2, M(37) );
 115   R( c, d, e, a, b, F2, K2, M(38) );
 116   R( b, c, d, e, a, F2, K2, M(39) );
 117   R( a, b, c, d, e, F3, K3, M(40) );
 118   R( e, a, b, c, d, F3, K3, M(41) );
 119   R( d, e, a, b, c, F3, K3, M(42) );
 120   R( c, d, e, a, b, F3, K3, M(43) );
 121   R( b, c, d, e, a, F3, K3, M(44) );
 122   R( a, b, c, d, e, F3, K3, M(45) );
 123   R( e, a, b, c, d, F3, K3, M(46) );
 124   R( d, e, a, b, c, F3, K3, M(47) );
 125   R( c, d, e, a, b, F3, K3, M(48) );
 126   R( b, c, d, e, a, F3, K3, M(49) );
 127   R( a, b, c, d, e, F3, K3, M(50) );
 128   R( e, a, b, c, d, F3, K3, M(51) );
 129   R( d, e, a, b, c, F3, K3, M(52) );
 130   R( c, d, e, a, b, F3, K3, M(53) );
 131   R( b, c, d, e, a, F3, K3, M(54) );
 132   R( a, b, c, d, e, F3, K3, M(55) );
 133   R( e, a, b, c, d, F3, K3, M(56) );
 134   R( d, e, a, b, c, F3, K3, M(57) );
 135   R( c, d, e, a, b, F3, K3, M(58) );
 136   R( b, c, d, e, a, F3, K3, M(59) );
 137   R( a, b, c, d, e, F4, K4, M(60) );
 138   R( e, a, b, c, d, F4, K4, M(61) );
 139   R( d, e, a, b, c, F4, K4, M(62) );
 140   R( c, d, e, a, b, F4, K4, M(63) );
 141   R( b, c, d, e, a, F4, K4, M(64) );
 142   R( a, b, c, d, e, F4, K4, M(65) );
 143   R( e, a, b, c, d, F4, K4, M(66) );
 144   R( d, e, a, b, c, F4, K4, M(67) );
 145   R( c, d, e, a, b, F4, K4, M(68) );
 146   R( b, c, d, e, a, F4, K4, M(69) );
 147   R( a, b, c, d, e, F4, K4, M(70) );
 148   R( e, a, b, c, d, F4, K4, M(71) );
 149   R( d, e, a, b, c, F4, K4, M(72) );
 150   R( c, d, e, a, b, F4, K4, M(73) );
 151   R( b, c, d, e, a, F4, K4, M(74) );
 152   R( a, b, c, d, e, F4, K4, M(75) );
 153   R( e, a, b, c, d, F4, K4, M(76) );
 154   R( d, e, a, b, c, F4, K4, M(77) );
 155   R( c, d, e, a, b, F4, K4, M(78) );
 156   R( b, c, d, e, a, F4, K4, M(79) );
 157
 158   /* Update chaining vars. */
 159   ctx->h0 += a;
 160   ctx->h1 += b;
 161   ctx->h2 += c;
 162   ctx->h3 += d;
 163   ctx->h4 += e;
 164 }
 165
 166 /*
 167  * Update the message digest with the contents of BUF with length LEN.
 168  */
 169 void
 170 sha1_update(struct sha1_context *ctx, const byte *buf, uint len)
 171 {
 172   if (ctx->count)
 173   {
 174     /* Fill rest of internal buffer */
 175     for (; len && ctx->count < SHA1_BLOCK_SIZE; len--)
 176       ctx->buf[ctx->count++] = *buf++;
 177
 178     if (ctx->count < SHA1_BLOCK_SIZE)
 179       return;
 180
 181     /* Process data from internal buffer */
 182     sha1_transform(ctx, ctx->buf);
 183     ctx->nblocks++;
 184     ctx->count = 0;
 185   }
 186
 187   if (!len)
 188     return;
 189
 190   /* Process data from input buffer */
 191   while (len >= SHA1_BLOCK_SIZE)
 192   {
 193     sha1_transform(ctx, buf);
 194     ctx->nblocks++;
 195     buf += SHA1_BLOCK_SIZE;
 196     len -= SHA1_BLOCK_SIZE;
 197   }
 198
 199   /* Copy remaining data to internal buffer */
 200   memcpy(ctx->buf, buf, len);
 201   ctx->count = len;
 202 }
 203
 204 /*
 205  * The routine final terminates the computation and returns the digest. The
 206  * handle is prepared for a new cycle, but adding bytes to the handle will the
 207  * destroy the returned buffer.
 208  *
 209  * Returns: 20 bytes representing the digest.
 210  */
 211 byte *
 212 sha1_final(struct sha1_context *ctx)
 213 {
 214   u32 t, msb, lsb;
 215
 216   sha1_update(ctx, NULL, 0);    /* flush */
 217
 218   t = ctx->nblocks;
 219   /* multiply by 64 to make a byte count */
 220   lsb = t << 6;
 221   msb = t >> 26;
 222   /* add the count */
 223   t = lsb;
 224   if ((lsb += ctx->count) < t)
 225     msb++;
 226   /* multiply by 8 to make a bit count */
 227   t = lsb;
 228   lsb <<= 3;
 229   msb <<= 3;
 230   msb |= t >> 29;
 231
 232   if (ctx->count < 56)
 233   {
 234     /* enough room */
 235     ctx->buf[ctx->count++] = 0x80; /* pad */
 236     while (ctx->count < 56)
 237       ctx->buf[ctx->count++] = 0;  /* pad */
 238   }
 239   else
 240   {
 241     /* need one extra block */
 242     ctx->buf[ctx->count++] = 0x80; /* pad character */
 243     while (ctx->count < 64)
 244       ctx->buf[ctx->count++] = 0;
 245     sha1_update(ctx, NULL, 0);  /* flush */
 246     memset(ctx->buf, 0, 56); /* fill next block with zeroes */
 247   }
 248
 249   /* append the 64 bit count */
 250   ctx->buf[56] = msb >> 24;
 251   ctx->buf[57] = msb >> 16;
 252   ctx->buf[58] = msb >>  8;
 253   ctx->buf[59] = msb;
 254   ctx->buf[60] = lsb >> 24;
 255   ctx->buf[61] = lsb >> 16;
 256   ctx->buf[62] = lsb >>  8;
 257   ctx->buf[63] = lsb;
 258   sha1_transform(ctx, ctx->buf);
 259
 260   byte *p = ctx->buf;
 261 #define X(a) do { put_u32(p, ctx->h##a); p += 4; } while(0)
 262   X(0);
 263   X(1);
 264   X(2);
 265   X(3);
 266   X(4);
 267 #undef X
 268
 269   return ctx->buf;
 270 }
 271
 272
 273 /*
 274  *      SHA1-HMAC
 275  */
 276
 277 /*
 278  * Shortcut function which puts the hash value of the supplied buffer
 279  * into outbuf which must have a size of 20 bytes.
 280  */
 281 void
 282 sha1_hash_buffer(byte *outbuf, const byte *buffer, uint length)
 283 {
 284   struct sha1_context ctx;
 285
 286   sha1_init(&ctx);
 287   sha1_update(&ctx, buffer, length);
 288   memcpy(outbuf, sha1_final(&ctx), SHA1_SIZE);
 289 }
 290
 291 void
 292 sha1_hmac_init(struct sha1_hmac_context *ctx, const byte *key, uint keylen)
 293 {
 294   byte keybuf[SHA1_BLOCK_SIZE], buf[SHA1_BLOCK_SIZE];
 295
 296   /* Hash the key if necessary */
 297   if (keylen <= SHA1_BLOCK_SIZE)
 298   {
 299     memcpy(keybuf, key, keylen);
 300     memset(keybuf + keylen, 0, SHA1_BLOCK_SIZE - keylen);
 301   }
 302   else
 303   {
 304     sha1_hash_buffer(keybuf, key, keylen);
 305     memset(keybuf + SHA1_SIZE, 0, SHA1_BLOCK_SIZE - SHA1_SIZE);
 306   }
 307
 308   /* Initialize the inner digest */
 309   sha1_init(&ctx->ictx);
 310   int i;
 311   for (i = 0; i < SHA1_BLOCK_SIZE; i++)
 312     buf[i] = keybuf[i] ^ 0x36;
 313   sha1_update(&ctx->ictx, buf, SHA1_BLOCK_SIZE);
 314
 315   /* Initialize the outer digest */
 316   sha1_init(&ctx->octx);
 317   for (i = 0; i < SHA1_BLOCK_SIZE; i++)
 318     buf[i] = keybuf[i] ^ 0x5c;
 319   sha1_update(&ctx->octx, buf, SHA1_BLOCK_SIZE);
 320 }
 321
 322 void
 323 sha1_hmac_update(struct sha1_hmac_context *ctx, const byte *data, uint datalen)
 324 {
 325   /* Just update the inner digest */
 326   sha1_update(&ctx->ictx, data, datalen);
 327 }
 328
 329 byte *
 330 sha1_hmac_final(struct sha1_hmac_context *ctx)
 331 {
 332   /* Finish the inner digest */
 333   byte *isha = sha1_final(&ctx->ictx);
 334
 335   /* Finish the outer digest */
 336   sha1_update(&ctx->octx, isha, SHA1_SIZE);
 337   return sha1_final(&ctx->octx);
 338 }
 339
 340 void
 341 sha1_hmac(byte *outbuf, const byte *key, uint keylen, const byte *data, uint datalen)
 342 {
 343   struct sha1_hmac_context ctx;
 344
 345   sha1_hmac_init(&ctx, key, keylen);
 346   sha1_hmac_update(&ctx, data, datalen);
 347   memcpy(outbuf, sha1_hmac_final(&ctx), SHA1_SIZE);
 348 }