sha1.c

   1 /* sha1.c - Functions to compute SHA1 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-1.
   3
   4    Copyright (C) 2000, 2001, 2003, 2004, 2005 Free Software Foundation, Inc.
   5
   6    This program is free software; you can redistribute it and/or modify it
   7    under the terms of the GNU General Public License as published by the
   8    Free Software Foundation; either version 2, or (at your option) any
   9    later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software Foundation,
  18    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  19
  20 /* Written by Scott G. Miller
  21    Credits:
  22       Robert Klep <robert@ilse.nl>  -- Expansion function fix
  23 */
  24
  25 #ifdef HAVE_CONFIG_H
  26 # include <config.h>
  27 #endif
  28
  29 #include "sha1.h"
  30
  31 #include <stddef.h>
  32 #include <string.h>
  33
  34 #if USE_UNLOCKED_IO
  35 # include "unlocked-io.h"
  36 #endif
  37
  38 /* SWAP does an endian swap on architectures that are little-endian,
  39    as SHA1 needs some data in a big-endian form.  */
  40
  41 #ifdef WORDS_BIGENDIAN
  42 # define SWAP(n) (n)
  43 #else
  44 # define SWAP(n) \
  45     (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
  46 #endif
  47
  48 #define BLOCKSIZE 4096
  49 #if BLOCKSIZE % 64 != 0
  50 # error "invalid BLOCKSIZE"
  51 #endif
  52
  53 /* This array contains the bytes used to pad the buffer to the next
  54    64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
  55 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  56
  57
  58 /*
  59   Takes a pointer to a 160 bit block of data (five 32 bit ints) and
  60   intializes it to the start constants of the SHA1 algorithm.  This
  61   must be called before using hash in the call to sha1_hash.
  62 */
  63 void
  64 sha1_init_ctx (struct sha1_ctx *ctx)
  65 {
  66   ctx->A = 0x67452301;
  67   ctx->B = 0xefcdab89;
  68   ctx->C = 0x98badcfe;
  69   ctx->D = 0x10325476;
  70   ctx->E = 0xc3d2e1f0;
  71
  72   ctx->total[0] = ctx->total[1] = 0;
  73   ctx->buflen = 0;
  74 }
  75
  76 /* Put result from CTX in first 20 bytes following RESBUF.  The result
  77    must be in little endian byte order.
  78
  79    IMPORTANT: On some systems it is required that RESBUF is correctly
  80    aligned for a 32 bits value.  */
  81 void *
  82 sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
  83 {
  84   ((md5_uint32 *) resbuf)[0] = SWAP (ctx->A);
  85   ((md5_uint32 *) resbuf)[1] = SWAP (ctx->B);
  86   ((md5_uint32 *) resbuf)[2] = SWAP (ctx->C);
  87   ((md5_uint32 *) resbuf)[3] = SWAP (ctx->D);
  88   ((md5_uint32 *) resbuf)[4] = SWAP (ctx->E);
  89
  90   return resbuf;
  91 }
  92
  93 /* Process the remaining bytes in the internal buffer and the usual
  94    prolog according to the standard and write the result to RESBUF.
  95
  96    IMPORTANT: On some systems it is required that RESBUF is correctly
  97    aligned for a 32 bits value.  */
  98 void *
  99 sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
 100 {
 101   /* Take yet unprocessed bytes into account.  */
 102   md5_uint32 bytes = ctx->buflen;
 103   size_t pad;
 104   md5_uint32 *ptr;
 105
 106   /* Now count remaining bytes.  */
 107   ctx->total[0] += bytes;
 108   if (ctx->total[0] < bytes)
 109     ++ctx->total[1];
 110
 111   pad = bytes >= 56 ? 64 + 56 - bytes : 56 - bytes;
 112   memcpy (&ctx->buffer[bytes], fillbuf, pad);
 113
 114   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 115   ptr = (md5_uint32 *) &ctx->buffer[bytes + pad + 4];
 116   *ptr = SWAP (ctx->total[0] << 3);
 117   ptr = (md5_uint32 *) &ctx->buffer[bytes + pad];
 118   *ptr = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 119
 120   /* Process last bytes.  */
 121   sha1_process_block (ctx->buffer, bytes + pad + 8, ctx);
 122
 123   return sha1_read_ctx (ctx, resbuf);
 124 }
 125
 126 /* Compute SHA1 message digest for bytes read from STREAM.  The
 127    resulting message digest number will be written into the 16 bytes
 128    beginning at RESBLOCK.  */
 129 int
 130 sha1_stream (FILE *stream, void *resblock)
 131 {
 132   struct sha1_ctx ctx;
 133   char buffer[BLOCKSIZE + 72];
 134   size_t sum;
 135
 136   /* Initialize the computation context.  */
 137   sha1_init_ctx (&ctx);
 138
 139   /* Iterate over full file contents.  */
 140   while (1)
 141     {
 142       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 143          computation function processes the whole buffer so that with the
 144          next round of the loop another block can be read.  */
 145       size_t n;
 146       sum = 0;
 147
 148       /* Read block.  Take care for partial reads.  */
 149       while (1)
 150         {
 151           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 152
 153           sum += n;
 154
 155           if (sum == BLOCKSIZE)
 156             break;
 157
 158           if (n == 0)
 159             {
 160               /* Check for the error flag IFF N == 0, so that we don't
 161                  exit the loop after a partial read due to e.g., EAGAIN
 162                  or EWOULDBLOCK.  */
 163               if (ferror (stream))
 164                 return 1;
 165               goto process_partial_block;
 166             }
 167
 168           /* We've read at least one byte, so ignore errors.  But always
 169              check for EOF, since feof may be true even though N > 0.
 170              Otherwise, we could end up calling fread after EOF.  */
 171           if (feof (stream))
 172             goto process_partial_block;
 173         }
 174
 175       /* Process buffer with BLOCKSIZE bytes.  Note that
 176                         BLOCKSIZE % 64 == 0
 177        */
 178       sha1_process_block (buffer, BLOCKSIZE, &ctx);
 179     }
 180
 181  process_partial_block:;
 182
 183   /* Process any remaining bytes.  */
 184   if (sum > 0)
 185     sha1_process_bytes (buffer, sum, &ctx);
 186
 187   /* Construct result in desired memory.  */
 188   sha1_finish_ctx (&ctx, resblock);
 189   return 0;
 190 }
 191
 192 /* Compute MD5 message digest for LEN bytes beginning at BUFFER.  The
 193    result is always in little endian byte order, so that a byte-wise
 194    output yields to the wanted ASCII representation of the message
 195    digest.  */
 196 void *
 197 sha1_buffer (const char *buffer, size_t len, void *resblock)
 198 {
 199   struct sha1_ctx ctx;
 200
 201   /* Initialize the computation context.  */
 202   sha1_init_ctx (&ctx);
 203
 204   /* Process whole buffer but last len % 64 bytes.  */
 205   sha1_process_bytes (buffer, len, &ctx);
 206
 207   /* Put result in desired memory area.  */
 208   return sha1_finish_ctx (&ctx, resblock);
 209 }
 210
 211 void
 212 sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
 213 {
 214   /* When we already have some bits in our internal buffer concatenate
 215      both inputs first.  */
 216   if (ctx->buflen != 0)
 217     {
 218       size_t left_over = ctx->buflen;
 219       size_t add = 128 - left_over > len ? len : 128 - left_over;
 220
 221       memcpy (&ctx->buffer[left_over], buffer, add);
 222       ctx->buflen += add;
 223
 224       if (ctx->buflen > 64)
 225         {
 226           sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 227
 228           ctx->buflen &= 63;
 229           /* The regions in the following copy operation cannot overlap.  */
 230           memcpy (ctx->buffer, &ctx->buffer[(left_over + add) & ~63],
 231                   ctx->buflen);
 232         }
 233
 234       buffer = (const char *) buffer + add;
 235       len -= add;
 236     }
 237
 238   /* Process available complete blocks.  */
 239   if (len >= 64)
 240     {
 241 #if !_STRING_ARCH_unaligned
 242 # define alignof(type) offsetof (struct { char c; type x; }, x)
 243 # define UNALIGNED_P(p) (((size_t) p) % alignof (md5_uint32) != 0)
 244       if (UNALIGNED_P (buffer))
 245         while (len > 64)
 246           {
 247             sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 248             buffer = (const char *) buffer + 64;
 249             len -= 64;
 250           }
 251       else
 252 #endif
 253         {
 254           sha1_process_block (buffer, len & ~63, ctx);
 255           buffer = (const char *) buffer + (len & ~63);
 256           len &= 63;
 257         }
 258     }
 259
 260   /* Move remaining bytes in internal buffer.  */
 261   if (len > 0)
 262     {
 263       size_t left_over = ctx->buflen;
 264
 265       memcpy (&ctx->buffer[left_over], buffer, len);
 266       left_over += len;
 267       if (left_over >= 64)
 268         {
 269           sha1_process_block (ctx->buffer, 64, ctx);
 270           left_over -= 64;
 271           memcpy (ctx->buffer, &ctx->buffer[64], left_over);
 272         }
 273       ctx->buflen = left_over;
 274     }
 275 }
 276
 277 /* --- Code below is the primary difference between md5.c and sha1.c --- */
 278
 279 /* SHA1 round constants */
 280 #define K1 0x5a827999L
 281 #define K2 0x6ed9eba1L
 282 #define K3 0x8f1bbcdcL
 283 #define K4 0xca62c1d6L
 284
 285 /* Round functions.  Note that F2 is the same as F4.  */
 286 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
 287 #define F2(B,C,D) (B ^ C ^ D)
 288 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
 289 #define F4(B,C,D) (B ^ C ^ D)
 290
 291 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 292    It is assumed that LEN % 64 == 0.
 293    Most of this code comes from GnuPG's cipher/sha1.c.  */
 294
 295 void
 296 sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
 297 {
 298   const md5_uint32 *words = buffer;
 299   size_t nwords = len / sizeof (md5_uint32);
 300   const md5_uint32 *endp = words + nwords;
 301   md5_uint32 x[16];
 302   md5_uint32 a = ctx->A;
 303   md5_uint32 b = ctx->B;
 304   md5_uint32 c = ctx->C;
 305   md5_uint32 d = ctx->D;
 306   md5_uint32 e = ctx->E;
 307
 308   /* First increment the byte count.  RFC 1321 specifies the possible
 309      length of the file up to 2^64 bits.  Here we only compute the
 310      number of bytes.  Do a double word increment.  */
 311   ctx->total[0] += len;
 312   if (ctx->total[0] < len)
 313     ++ctx->total[1];
 314
 315 #define rol(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
 316
 317 #define M(I) ( tm =   x[I&0x0f] ^ x[(I-14)&0x0f] \
 318                     ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
 319                , (x[I&0x0f] = rol(tm, 1)) )
 320
 321 #define R(A,B,C,D,E,F,K,M)  do { E += rol( A, 5 )     \
 322                                       + F( B, C, D )  \
 323                                       + K             \
 324                                       + M;            \
 325                                  B = rol( B, 30 );    \
 326                                } while(0)
 327
 328   while (words < endp)
 329     {
 330       md5_uint32 tm;
 331       int t;
 332       for (t = 0; t < 16; t++)
 333         {
 334           x[t] = SWAP (*words);
 335           words++;
 336         }
 337
 338       R( a, b, c, d, e, F1, K1, x[ 0] );
 339       R( e, a, b, c, d, F1, K1, x[ 1] );
 340       R( d, e, a, b, c, F1, K1, x[ 2] );
 341       R( c, d, e, a, b, F1, K1, x[ 3] );
 342       R( b, c, d, e, a, F1, K1, x[ 4] );
 343       R( a, b, c, d, e, F1, K1, x[ 5] );
 344       R( e, a, b, c, d, F1, K1, x[ 6] );
 345       R( d, e, a, b, c, F1, K1, x[ 7] );
 346       R( c, d, e, a, b, F1, K1, x[ 8] );
 347       R( b, c, d, e, a, F1, K1, x[ 9] );
 348       R( a, b, c, d, e, F1, K1, x[10] );
 349       R( e, a, b, c, d, F1, K1, x[11] );
 350       R( d, e, a, b, c, F1, K1, x[12] );
 351       R( c, d, e, a, b, F1, K1, x[13] );
 352       R( b, c, d, e, a, F1, K1, x[14] );
 353       R( a, b, c, d, e, F1, K1, x[15] );
 354       R( e, a, b, c, d, F1, K1, M(16) );
 355       R( d, e, a, b, c, F1, K1, M(17) );
 356       R( c, d, e, a, b, F1, K1, M(18) );
 357       R( b, c, d, e, a, F1, K1, M(19) );
 358       R( a, b, c, d, e, F2, K2, M(20) );
 359       R( e, a, b, c, d, F2, K2, M(21) );
 360       R( d, e, a, b, c, F2, K2, M(22) );
 361       R( c, d, e, a, b, F2, K2, M(23) );
 362       R( b, c, d, e, a, F2, K2, M(24) );
 363       R( a, b, c, d, e, F2, K2, M(25) );
 364       R( e, a, b, c, d, F2, K2, M(26) );
 365       R( d, e, a, b, c, F2, K2, M(27) );
 366       R( c, d, e, a, b, F2, K2, M(28) );
 367       R( b, c, d, e, a, F2, K2, M(29) );
 368       R( a, b, c, d, e, F2, K2, M(30) );
 369       R( e, a, b, c, d, F2, K2, M(31) );
 370       R( d, e, a, b, c, F2, K2, M(32) );
 371       R( c, d, e, a, b, F2, K2, M(33) );
 372       R( b, c, d, e, a, F2, K2, M(34) );
 373       R( a, b, c, d, e, F2, K2, M(35) );
 374       R( e, a, b, c, d, F2, K2, M(36) );
 375       R( d, e, a, b, c, F2, K2, M(37) );
 376       R( c, d, e, a, b, F2, K2, M(38) );
 377       R( b, c, d, e, a, F2, K2, M(39) );
 378       R( a, b, c, d, e, F3, K3, M(40) );
 379       R( e, a, b, c, d, F3, K3, M(41) );
 380       R( d, e, a, b, c, F3, K3, M(42) );
 381       R( c, d, e, a, b, F3, K3, M(43) );
 382       R( b, c, d, e, a, F3, K3, M(44) );
 383       R( a, b, c, d, e, F3, K3, M(45) );
 384       R( e, a, b, c, d, F3, K3, M(46) );
 385       R( d, e, a, b, c, F3, K3, M(47) );
 386       R( c, d, e, a, b, F3, K3, M(48) );
 387       R( b, c, d, e, a, F3, K3, M(49) );
 388       R( a, b, c, d, e, F3, K3, M(50) );
 389       R( e, a, b, c, d, F3, K3, M(51) );
 390       R( d, e, a, b, c, F3, K3, M(52) );
 391       R( c, d, e, a, b, F3, K3, M(53) );
 392       R( b, c, d, e, a, F3, K3, M(54) );
 393       R( a, b, c, d, e, F3, K3, M(55) );
 394       R( e, a, b, c, d, F3, K3, M(56) );
 395       R( d, e, a, b, c, F3, K3, M(57) );
 396       R( c, d, e, a, b, F3, K3, M(58) );
 397       R( b, c, d, e, a, F3, K3, M(59) );
 398       R( a, b, c, d, e, F4, K4, M(60) );
 399       R( e, a, b, c, d, F4, K4, M(61) );
 400       R( d, e, a, b, c, F4, K4, M(62) );
 401       R( c, d, e, a, b, F4, K4, M(63) );
 402       R( b, c, d, e, a, F4, K4, M(64) );
 403       R( a, b, c, d, e, F4, K4, M(65) );
 404       R( e, a, b, c, d, F4, K4, M(66) );
 405       R( d, e, a, b, c, F4, K4, M(67) );
 406       R( c, d, e, a, b, F4, K4, M(68) );
 407       R( b, c, d, e, a, F4, K4, M(69) );
 408       R( a, b, c, d, e, F4, K4, M(70) );
 409       R( e, a, b, c, d, F4, K4, M(71) );
 410       R( d, e, a, b, c, F4, K4, M(72) );
 411       R( c, d, e, a, b, F4, K4, M(73) );
 412       R( b, c, d, e, a, F4, K4, M(74) );
 413       R( a, b, c, d, e, F4, K4, M(75) );
 414       R( e, a, b, c, d, F4, K4, M(76) );
 415       R( d, e, a, b, c, F4, K4, M(77) );
 416       R( c, d, e, a, b, F4, K4, M(78) );
 417       R( b, c, d, e, a, F4, K4, M(79) );
 418
 419       a = ctx->A += a;
 420       b = ctx->B += b;
 421       c = ctx->C += c;
 422       d = ctx->D += d;
 423       e = ctx->E += e;
 424     }
 425 }