4 * MD5 implementation for PuTTY. Written directly from the spec by
8 /* ----------------------------------------------------------------------
9 * Core MD5 algorithm: processes 16-word blocks into a message digest.
12 #define F(x,y,z) ( ((x) & (y)) | ((~(x)) & (z)) )
13 #define G(x,y,z) ( ((x) & (z)) | ((~(z)) & (y)) )
14 #define H(x,y,z) ( (x) ^ (y) ^ (z) )
15 #define I(x,y,z) ( (y) ^ ( (x) | ~(z) ) )
17 #define rol(x,y) ( ((x) << (y)) | (((uint32)x) >> (32-y)) )
19 #define subround(f,w,x,y,z,k,s,ti) \
20 w = x + rol(w + f(x,y,z) + block[k] + ti, s)
22 static void MD5_Core_Init(MD5_Core_State
* s
)
30 static void MD5_Block(MD5_Core_State
* s
, uint32
* block
)
39 subround(F
, a
, b
, c
, d
, 0, 7, 0xd76aa478);
40 subround(F
, d
, a
, b
, c
, 1, 12, 0xe8c7b756);
41 subround(F
, c
, d
, a
, b
, 2, 17, 0x242070db);
42 subround(F
, b
, c
, d
, a
, 3, 22, 0xc1bdceee);
43 subround(F
, a
, b
, c
, d
, 4, 7, 0xf57c0faf);
44 subround(F
, d
, a
, b
, c
, 5, 12, 0x4787c62a);
45 subround(F
, c
, d
, a
, b
, 6, 17, 0xa8304613);
46 subround(F
, b
, c
, d
, a
, 7, 22, 0xfd469501);
47 subround(F
, a
, b
, c
, d
, 8, 7, 0x698098d8);
48 subround(F
, d
, a
, b
, c
, 9, 12, 0x8b44f7af);
49 subround(F
, c
, d
, a
, b
, 10, 17, 0xffff5bb1);
50 subround(F
, b
, c
, d
, a
, 11, 22, 0x895cd7be);
51 subround(F
, a
, b
, c
, d
, 12, 7, 0x6b901122);
52 subround(F
, d
, a
, b
, c
, 13, 12, 0xfd987193);
53 subround(F
, c
, d
, a
, b
, 14, 17, 0xa679438e);
54 subround(F
, b
, c
, d
, a
, 15, 22, 0x49b40821);
55 subround(G
, a
, b
, c
, d
, 1, 5, 0xf61e2562);
56 subround(G
, d
, a
, b
, c
, 6, 9, 0xc040b340);
57 subround(G
, c
, d
, a
, b
, 11, 14, 0x265e5a51);
58 subround(G
, b
, c
, d
, a
, 0, 20, 0xe9b6c7aa);
59 subround(G
, a
, b
, c
, d
, 5, 5, 0xd62f105d);
60 subround(G
, d
, a
, b
, c
, 10, 9, 0x02441453);
61 subround(G
, c
, d
, a
, b
, 15, 14, 0xd8a1e681);
62 subround(G
, b
, c
, d
, a
, 4, 20, 0xe7d3fbc8);
63 subround(G
, a
, b
, c
, d
, 9, 5, 0x21e1cde6);
64 subround(G
, d
, a
, b
, c
, 14, 9, 0xc33707d6);
65 subround(G
, c
, d
, a
, b
, 3, 14, 0xf4d50d87);
66 subround(G
, b
, c
, d
, a
, 8, 20, 0x455a14ed);
67 subround(G
, a
, b
, c
, d
, 13, 5, 0xa9e3e905);
68 subround(G
, d
, a
, b
, c
, 2, 9, 0xfcefa3f8);
69 subround(G
, c
, d
, a
, b
, 7, 14, 0x676f02d9);
70 subround(G
, b
, c
, d
, a
, 12, 20, 0x8d2a4c8a);
71 subround(H
, a
, b
, c
, d
, 5, 4, 0xfffa3942);
72 subround(H
, d
, a
, b
, c
, 8, 11, 0x8771f681);
73 subround(H
, c
, d
, a
, b
, 11, 16, 0x6d9d6122);
74 subround(H
, b
, c
, d
, a
, 14, 23, 0xfde5380c);
75 subround(H
, a
, b
, c
, d
, 1, 4, 0xa4beea44);
76 subround(H
, d
, a
, b
, c
, 4, 11, 0x4bdecfa9);
77 subround(H
, c
, d
, a
, b
, 7, 16, 0xf6bb4b60);
78 subround(H
, b
, c
, d
, a
, 10, 23, 0xbebfbc70);
79 subround(H
, a
, b
, c
, d
, 13, 4, 0x289b7ec6);
80 subround(H
, d
, a
, b
, c
, 0, 11, 0xeaa127fa);
81 subround(H
, c
, d
, a
, b
, 3, 16, 0xd4ef3085);
82 subround(H
, b
, c
, d
, a
, 6, 23, 0x04881d05);
83 subround(H
, a
, b
, c
, d
, 9, 4, 0xd9d4d039);
84 subround(H
, d
, a
, b
, c
, 12, 11, 0xe6db99e5);
85 subround(H
, c
, d
, a
, b
, 15, 16, 0x1fa27cf8);
86 subround(H
, b
, c
, d
, a
, 2, 23, 0xc4ac5665);
87 subround(I
, a
, b
, c
, d
, 0, 6, 0xf4292244);
88 subround(I
, d
, a
, b
, c
, 7, 10, 0x432aff97);
89 subround(I
, c
, d
, a
, b
, 14, 15, 0xab9423a7);
90 subround(I
, b
, c
, d
, a
, 5, 21, 0xfc93a039);
91 subround(I
, a
, b
, c
, d
, 12, 6, 0x655b59c3);
92 subround(I
, d
, a
, b
, c
, 3, 10, 0x8f0ccc92);
93 subround(I
, c
, d
, a
, b
, 10, 15, 0xffeff47d);
94 subround(I
, b
, c
, d
, a
, 1, 21, 0x85845dd1);
95 subround(I
, a
, b
, c
, d
, 8, 6, 0x6fa87e4f);
96 subround(I
, d
, a
, b
, c
, 15, 10, 0xfe2ce6e0);
97 subround(I
, c
, d
, a
, b
, 6, 15, 0xa3014314);
98 subround(I
, b
, c
, d
, a
, 13, 21, 0x4e0811a1);
99 subround(I
, a
, b
, c
, d
, 4, 6, 0xf7537e82);
100 subround(I
, d
, a
, b
, c
, 11, 10, 0xbd3af235);
101 subround(I
, c
, d
, a
, b
, 2, 15, 0x2ad7d2bb);
102 subround(I
, b
, c
, d
, a
, 9, 21, 0xeb86d391);
110 /* ----------------------------------------------------------------------
111 * Outer MD5 algorithm: take an arbitrary length byte string,
112 * convert it into 16-word blocks with the prescribed padding at
113 * the end, and pass those blocks to the core MD5 algorithm.
118 void MD5Init(struct MD5Context
*s
)
120 MD5_Core_Init(&s
->core
);
122 s
->lenhi
= s
->lenlo
= 0;
125 void MD5Update(struct MD5Context
*s
, unsigned char const *p
, unsigned len
)
127 unsigned char *q
= (unsigned char *) p
;
128 uint32 wordblock
[16];
133 * Update the length field.
136 s
->lenhi
+= (s
->lenlo
< lenw
);
138 if (s
->blkused
+ len
< BLKSIZE
) {
140 * Trivial case: just add to the block.
142 memcpy(s
->block
+ s
->blkused
, q
, len
);
146 * We must complete and process at least one block.
148 while (s
->blkused
+ len
>= BLKSIZE
) {
149 memcpy(s
->block
+ s
->blkused
, q
, BLKSIZE
- s
->blkused
);
150 q
+= BLKSIZE
- s
->blkused
;
151 len
-= BLKSIZE
- s
->blkused
;
152 /* Now process the block. Gather bytes little-endian into words */
153 for (i
= 0; i
< 16; i
++) {
155 (((uint32
) s
->block
[i
* 4 + 3]) << 24) |
156 (((uint32
) s
->block
[i
* 4 + 2]) << 16) |
157 (((uint32
) s
->block
[i
* 4 + 1]) << 8) |
158 (((uint32
) s
->block
[i
* 4 + 0]) << 0);
160 MD5_Block(&s
->core
, wordblock
);
163 memcpy(s
->block
, q
, len
);
168 void MD5Final(unsigned char output
[16], struct MD5Context
*s
)
175 if (s
->blkused
>= 56)
176 pad
= 56 + 64 - s
->blkused
;
178 pad
= 56 - s
->blkused
;
180 lenhi
= (s
->lenhi
<< 3) | (s
->lenlo
>> (32 - 3));
181 lenlo
= (s
->lenlo
<< 3);
185 MD5Update(s
, c
, pad
);
187 c
[7] = (lenhi
>> 24) & 0xFF;
188 c
[6] = (lenhi
>> 16) & 0xFF;
189 c
[5] = (lenhi
>> 8) & 0xFF;
190 c
[4] = (lenhi
>> 0) & 0xFF;
191 c
[3] = (lenlo
>> 24) & 0xFF;
192 c
[2] = (lenlo
>> 16) & 0xFF;
193 c
[1] = (lenlo
>> 8) & 0xFF;
194 c
[0] = (lenlo
>> 0) & 0xFF;
198 for (i
= 0; i
< 4; i
++) {
199 output
[4 * i
+ 3] = (s
->core
.h
[i
] >> 24) & 0xFF;
200 output
[4 * i
+ 2] = (s
->core
.h
[i
] >> 16) & 0xFF;
201 output
[4 * i
+ 1] = (s
->core
.h
[i
] >> 8) & 0xFF;
202 output
[4 * i
+ 0] = (s
->core
.h
[i
] >> 0) & 0xFF;
206 void MD5Simple(void const *p
, unsigned len
, unsigned char output
[16])
211 MD5Update(&s
, (unsigned char const *)p
, len
);
212 MD5Final(output
, &s
);
215 /* ----------------------------------------------------------------------
216 * The above is the MD5 algorithm itself. Now we implement the
217 * HMAC wrapper on it.
219 * Some of these functions are exported directly, because they are
220 * useful elsewhere (SOCKS5 CHAP authentication uses HMAC-MD5).
223 void *hmacmd5_make_context(void)
225 return snewn(2, struct MD5Context
);
228 void hmacmd5_free_context(void *handle
)
233 void hmacmd5_key(void *handle
, void const *keyv
, int len
)
235 struct MD5Context
*keys
= (struct MD5Context
*)handle
;
236 unsigned char foo
[64];
237 unsigned char const *key
= (unsigned char const *)keyv
;
240 memset(foo
, 0x36, 64);
241 for (i
= 0; i
< len
&& i
< 64; i
++)
244 MD5Update(&keys
[0], foo
, 64);
246 memset(foo
, 0x5C, 64);
247 for (i
= 0; i
< len
&& i
< 64; i
++)
250 MD5Update(&keys
[1], foo
, 64);
252 memset(foo
, 0, 64); /* burn the evidence */
255 static void hmacmd5_key_16(void *handle
, unsigned char *key
)
257 hmacmd5_key(handle
, key
, 16);
260 static void hmacmd5_do_hmac_internal(void *handle
,
261 unsigned char const *blk
, int len
,
262 unsigned char const *blk2
, int len2
,
265 struct MD5Context
*keys
= (struct MD5Context
*)handle
;
267 unsigned char intermediate
[16];
269 s
= keys
[0]; /* structure copy */
270 MD5Update(&s
, blk
, len
);
271 if (blk2
) MD5Update(&s
, blk2
, len2
);
272 MD5Final(intermediate
, &s
);
273 s
= keys
[1]; /* structure copy */
274 MD5Update(&s
, intermediate
, 16);
278 void hmacmd5_do_hmac(void *handle
, unsigned char const *blk
, int len
,
281 hmacmd5_do_hmac_internal(handle
, blk
, len
, NULL
, 0, hmac
);
284 static void hmacmd5_do_hmac_ssh(void *handle
, unsigned char const *blk
, int len
,
285 unsigned long seq
, unsigned char *hmac
)
287 unsigned char seqbuf
[16];
289 seqbuf
[0] = (unsigned char) ((seq
>> 24) & 0xFF);
290 seqbuf
[1] = (unsigned char) ((seq
>> 16) & 0xFF);
291 seqbuf
[2] = (unsigned char) ((seq
>> 8) & 0xFF);
292 seqbuf
[3] = (unsigned char) ((seq
) & 0xFF);
294 hmacmd5_do_hmac_internal(handle
, seqbuf
, 4, blk
, len
, hmac
);
297 static void hmacmd5_generate(void *handle
, unsigned char *blk
, int len
,
300 hmacmd5_do_hmac_ssh(handle
, blk
, len
, seq
, blk
+ len
);
303 static int hmacmd5_verify(void *handle
, unsigned char *blk
, int len
,
306 unsigned char correct
[16];
307 hmacmd5_do_hmac_ssh(handle
, blk
, len
, seq
, correct
);
308 return !memcmp(correct
, blk
+ len
, 16);
311 const struct ssh_mac ssh_hmac_md5
= {
312 hmacmd5_make_context
, hmacmd5_free_context
, hmacmd5_key_16
,
313 hmacmd5_generate
, hmacmd5_verify
,