Commit | Line | Data |
---|---|---|
eee16120 | 1 | /* -*-c-*- |
2 | * | |
eee16120 | 3 | * Implementation of the SHA-256 hash function |
4 | * | |
5 | * (c) 2000 Straylight/Edgeware | |
6 | */ | |
7 | ||
45c0fd36 | 8 | /*----- Licensing notice --------------------------------------------------* |
eee16120 | 9 | * |
10 | * This file is part of Catacomb. | |
11 | * | |
12 | * Catacomb is free software; you can redistribute it and/or modify | |
13 | * it under the terms of the GNU Library General Public License as | |
14 | * published by the Free Software Foundation; either version 2 of the | |
15 | * License, or (at your option) any later version. | |
45c0fd36 | 16 | * |
eee16120 | 17 | * Catacomb is distributed in the hope that it will be useful, |
18 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
20 | * GNU Library General Public License for more details. | |
45c0fd36 | 21 | * |
eee16120 | 22 | * You should have received a copy of the GNU Library General Public |
23 | * License along with Catacomb; if not, write to the Free | |
24 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, | |
25 | * MA 02111-1307, USA. | |
26 | */ | |
27 | ||
eee16120 | 28 | /*----- Header files ------------------------------------------------------*/ |
29 | ||
30 | #include <mLib/bits.h> | |
31 | ||
32 | #include "ghash.h" | |
33 | #include "ghash-def.h" | |
34 | #include "hash.h" | |
35 | #include "sha256.h" | |
36 | ||
37 | /*----- Main code ---------------------------------------------------------*/ | |
38 | ||
5b69c389 | 39 | /* --- @sha256_compress@, @sha224_compress@ --- * |
eee16120 | 40 | * |
41 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
42 | * @const void *sbuf@ = pointer to buffer of appropriate size | |
43 | * | |
44 | * Returns: --- | |
45 | * | |
46 | * Use: SHA-256 compression function. | |
47 | */ | |
48 | ||
49 | void sha256_compress(sha256_ctx *ctx, const void *sbuf) | |
50 | { | |
51 | uint32 a, b, c, d, e, f, g, h; | |
52 | uint32 buf[64]; | |
53 | ||
54 | /* --- Fetch the chaining variables --- */ | |
55 | ||
56 | a = ctx->a; | |
57 | b = ctx->b; | |
58 | c = ctx->c; | |
59 | d = ctx->d; | |
60 | e = ctx->e; | |
61 | f = ctx->f; | |
62 | g = ctx->g; | |
63 | h = ctx->h; | |
64 | ||
65 | /* --- Definitions for round functions --- */ | |
66 | ||
67 | #define CH(x, y, z) (((x) & (y)) | (~(x) & (z))) | |
68 | #define MAJ(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z))) | |
69 | ||
70 | #define S0(x) (ROR32((x), 2) ^ ROR32((x), 13) ^ ROR32((x), 22)) | |
71 | #define S1(x) (ROR32((x), 6) ^ ROR32((x), 11) ^ ROR32((x), 25)) | |
72 | #define s0(x) (ROR32((x), 7) ^ ROR32((x), 18) ^ LSR32((x), 3)) | |
73 | #define s1(x) (ROR32((x), 17) ^ ROR32((x), 19) ^ LSR32((x), 10)) | |
74 | ||
75 | #define T(a, b, c, d, e, f, g, h, i, k) do { \ | |
76 | uint32 t1 = h + S1(e) + CH(e, f, g) + k + buf[i]; \ | |
77 | uint32 t2 = S0(a) + MAJ(a, b, c); \ | |
78 | d += t1; h = t1 + t2; \ | |
79 | } while (0) | |
80 | ||
81 | /* --- Fetch and expand the buffer contents --- */ | |
82 | ||
83 | { | |
84 | int i; | |
85 | const octet *p; | |
86 | ||
87 | for (i = 0, p = sbuf; i < 16; i++, p += 4) | |
88 | buf[i] = LOAD32(p); | |
89 | for (i = 16; i < 64; i++) | |
90 | buf[i] = s1(buf[i - 2]) + buf[i - 7] + s0(buf[i - 15]) + buf[i - 16]; | |
91 | } | |
92 | ||
93 | /* --- The main compression function --- */ | |
45c0fd36 | 94 | |
eee16120 | 95 | T(a, b, c, d, e, f, g, h, 0, 0x428a2f98); |
96 | T(h, a, b, c, d, e, f, g, 1, 0x71374491); | |
97 | T(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcf); | |
98 | T(f, g, h, a, b, c, d, e, 3, 0xe9b5dba5); | |
99 | T(e, f, g, h, a, b, c, d, 4, 0x3956c25b); | |
100 | T(d, e, f, g, h, a, b, c, 5, 0x59f111f1); | |
101 | T(c, d, e, f, g, h, a, b, 6, 0x923f82a4); | |
102 | T(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5); | |
103 | T(a, b, c, d, e, f, g, h, 8, 0xd807aa98); | |
104 | T(h, a, b, c, d, e, f, g, 9, 0x12835b01); | |
105 | T(g, h, a, b, c, d, e, f, 10, 0x243185be); | |
106 | T(f, g, h, a, b, c, d, e, 11, 0x550c7dc3); | |
107 | T(e, f, g, h, a, b, c, d, 12, 0x72be5d74); | |
108 | T(d, e, f, g, h, a, b, c, 13, 0x80deb1fe); | |
109 | T(c, d, e, f, g, h, a, b, 14, 0x9bdc06a7); | |
110 | T(b, c, d, e, f, g, h, a, 15, 0xc19bf174); | |
111 | T(a, b, c, d, e, f, g, h, 16, 0xe49b69c1); | |
112 | T(h, a, b, c, d, e, f, g, 17, 0xefbe4786); | |
113 | T(g, h, a, b, c, d, e, f, 18, 0x0fc19dc6); | |
114 | T(f, g, h, a, b, c, d, e, 19, 0x240ca1cc); | |
115 | T(e, f, g, h, a, b, c, d, 20, 0x2de92c6f); | |
116 | T(d, e, f, g, h, a, b, c, 21, 0x4a7484aa); | |
117 | T(c, d, e, f, g, h, a, b, 22, 0x5cb0a9dc); | |
118 | T(b, c, d, e, f, g, h, a, 23, 0x76f988da); | |
119 | T(a, b, c, d, e, f, g, h, 24, 0x983e5152); | |
120 | T(h, a, b, c, d, e, f, g, 25, 0xa831c66d); | |
121 | T(g, h, a, b, c, d, e, f, 26, 0xb00327c8); | |
122 | T(f, g, h, a, b, c, d, e, 27, 0xbf597fc7); | |
123 | T(e, f, g, h, a, b, c, d, 28, 0xc6e00bf3); | |
124 | T(d, e, f, g, h, a, b, c, 29, 0xd5a79147); | |
125 | T(c, d, e, f, g, h, a, b, 30, 0x06ca6351); | |
126 | T(b, c, d, e, f, g, h, a, 31, 0x14292967); | |
127 | T(a, b, c, d, e, f, g, h, 32, 0x27b70a85); | |
128 | T(h, a, b, c, d, e, f, g, 33, 0x2e1b2138); | |
129 | T(g, h, a, b, c, d, e, f, 34, 0x4d2c6dfc); | |
130 | T(f, g, h, a, b, c, d, e, 35, 0x53380d13); | |
131 | T(e, f, g, h, a, b, c, d, 36, 0x650a7354); | |
132 | T(d, e, f, g, h, a, b, c, 37, 0x766a0abb); | |
133 | T(c, d, e, f, g, h, a, b, 38, 0x81c2c92e); | |
134 | T(b, c, d, e, f, g, h, a, 39, 0x92722c85); | |
135 | T(a, b, c, d, e, f, g, h, 40, 0xa2bfe8a1); | |
136 | T(h, a, b, c, d, e, f, g, 41, 0xa81a664b); | |
137 | T(g, h, a, b, c, d, e, f, 42, 0xc24b8b70); | |
138 | T(f, g, h, a, b, c, d, e, 43, 0xc76c51a3); | |
139 | T(e, f, g, h, a, b, c, d, 44, 0xd192e819); | |
140 | T(d, e, f, g, h, a, b, c, 45, 0xd6990624); | |
141 | T(c, d, e, f, g, h, a, b, 46, 0xf40e3585); | |
142 | T(b, c, d, e, f, g, h, a, 47, 0x106aa070); | |
143 | T(a, b, c, d, e, f, g, h, 48, 0x19a4c116); | |
144 | T(h, a, b, c, d, e, f, g, 49, 0x1e376c08); | |
145 | T(g, h, a, b, c, d, e, f, 50, 0x2748774c); | |
146 | T(f, g, h, a, b, c, d, e, 51, 0x34b0bcb5); | |
147 | T(e, f, g, h, a, b, c, d, 52, 0x391c0cb3); | |
148 | T(d, e, f, g, h, a, b, c, 53, 0x4ed8aa4a); | |
149 | T(c, d, e, f, g, h, a, b, 54, 0x5b9cca4f); | |
150 | T(b, c, d, e, f, g, h, a, 55, 0x682e6ff3); | |
151 | T(a, b, c, d, e, f, g, h, 56, 0x748f82ee); | |
152 | T(h, a, b, c, d, e, f, g, 57, 0x78a5636f); | |
153 | T(g, h, a, b, c, d, e, f, 58, 0x84c87814); | |
154 | T(f, g, h, a, b, c, d, e, 59, 0x8cc70208); | |
155 | T(e, f, g, h, a, b, c, d, 60, 0x90befffa); | |
156 | T(d, e, f, g, h, a, b, c, 61, 0xa4506ceb); | |
157 | T(c, d, e, f, g, h, a, b, 62, 0xbef9a3f7); | |
158 | T(b, c, d, e, f, g, h, a, 63, 0xc67178f2); | |
159 | ||
160 | /* --- Update the chaining variables --- */ | |
161 | ||
162 | ctx->a += a; | |
163 | ctx->b += b; | |
164 | ctx->c += c; | |
165 | ctx->d += d; | |
166 | ctx->e += e; | |
167 | ctx->f += f; | |
168 | ctx->g += g; | |
169 | ctx->h += h; | |
170 | } | |
171 | ||
5b69c389 | 172 | /* --- @sha256_init@, @sha224_init@ --- * |
eee16120 | 173 | * |
174 | * Arguments: @sha256_ctx *ctx@ = pointer to context block to initialize | |
175 | * | |
176 | * Returns: --- | |
177 | * | |
178 | * Use: Initializes a context block ready for hashing. | |
179 | */ | |
180 | ||
181 | void sha256_init(sha256_ctx *ctx) | |
182 | { | |
183 | ctx->a = 0x6a09e667; | |
184 | ctx->b = 0xbb67ae85; | |
185 | ctx->c = 0x3c6ef372; | |
186 | ctx->d = 0xa54ff53a; | |
187 | ctx->e = 0x510e527f; | |
188 | ctx->f = 0x9b05688c; | |
189 | ctx->g = 0x1f83d9ab; | |
190 | ctx->h = 0x5be0cd19; | |
191 | ctx->off = 0; | |
192 | ctx->nl = ctx->nh = 0; | |
193 | } | |
194 | ||
5b69c389 | 195 | void sha224_init(sha256_ctx *ctx) |
196 | { | |
197 | ctx->a = 0xc1059ed8; | |
198 | ctx->b = 0x367cd507; | |
199 | ctx->c = 0x3070dd17; | |
200 | ctx->d = 0xf70e5939; | |
201 | ctx->e = 0xffc00b31; | |
202 | ctx->f = 0x68581511; | |
203 | ctx->g = 0x64f98fa7; | |
204 | ctx->h = 0xbefa4fa4; | |
205 | ctx->off = 0; | |
206 | ctx->nl = ctx->nh = 0; | |
207 | } | |
208 | ||
209 | /* --- @sha256_set@, @sha224_set@ --- * | |
eee16120 | 210 | * |
211 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
212 | * @const void *buf@ = pointer to state buffer | |
213 | * @unsigned long count@ = current count of bytes processed | |
214 | * | |
215 | * Returns: --- | |
216 | * | |
217 | * Use: Initializes a context block from a given state. This is | |
218 | * useful in cases where the initial hash state is meant to be | |
219 | * secret, e.g., for NMAC and HMAC support. | |
220 | */ | |
221 | ||
222 | void sha256_set(sha256_ctx *ctx, const void *buf, unsigned long count) | |
223 | { | |
224 | const octet *p = buf; | |
225 | ctx->a = LOAD32(p + 0); | |
226 | ctx->b = LOAD32(p + 4); | |
227 | ctx->c = LOAD32(p + 8); | |
228 | ctx->d = LOAD32(p + 12); | |
229 | ctx->e = LOAD32(p + 16); | |
230 | ctx->f = LOAD32(p + 20); | |
231 | ctx->g = LOAD32(p + 24); | |
232 | ctx->h = LOAD32(p + 28); | |
233 | ctx->off = 0; | |
234 | ctx->nl = U32(count); | |
235 | ctx->nh = U32(((count & ~MASK32) >> 16) >> 16); | |
236 | } | |
237 | ||
5b69c389 | 238 | /* --- @sha256_hash@, @sha224_hash@ --- * |
eee16120 | 239 | * |
240 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
241 | * @const void *buf@ = buffer of data to hash | |
242 | * @size_t sz@ = size of buffer to hash | |
243 | * | |
244 | * Returns: --- | |
245 | * | |
246 | * Use: Hashes a buffer of data. The buffer may be of any size and | |
247 | * alignment. | |
248 | */ | |
249 | ||
250 | void sha256_hash(sha256_ctx *ctx, const void *buf, size_t sz) | |
251 | { | |
252 | HASH_BUFFER(SHA256, sha256, ctx, buf, sz); | |
253 | } | |
254 | ||
5b69c389 | 255 | /* --- @sha256_done, @sha224_done@ --- * |
eee16120 | 256 | * |
257 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
258 | * @void *hash@ = pointer to output buffer | |
259 | * | |
260 | * Returns: --- | |
261 | * | |
262 | * Use: Returns the hash of the data read so far. | |
263 | */ | |
264 | ||
5b69c389 | 265 | static void final(sha256_ctx *ctx) |
eee16120 | 266 | { |
eee16120 | 267 | HASH_PAD(SHA256, sha256, ctx, 0x80, 0, 8); |
268 | STORE32(ctx->buf + SHA256_BUFSZ - 8, (ctx->nl >> 29) | (ctx->nh << 3)); | |
269 | STORE32(ctx->buf + SHA256_BUFSZ - 4, ctx->nl << 3); | |
45c0fd36 | 270 | sha256_compress(ctx, ctx->buf); |
5b69c389 | 271 | } |
272 | ||
273 | void sha256_done(sha256_ctx *ctx, void *hash) | |
274 | { | |
275 | octet *p = hash; | |
276 | final(ctx); | |
eee16120 | 277 | STORE32(p + 0, ctx->a); |
278 | STORE32(p + 4, ctx->b); | |
279 | STORE32(p + 8, ctx->c); | |
280 | STORE32(p + 12, ctx->d); | |
281 | STORE32(p + 16, ctx->e); | |
282 | STORE32(p + 20, ctx->f); | |
283 | STORE32(p + 24, ctx->g); | |
284 | STORE32(p + 28, ctx->h); | |
285 | } | |
286 | ||
5b69c389 | 287 | void sha224_done(sha224_ctx *ctx, void *hash) |
288 | { | |
289 | octet *p = hash; | |
290 | final(ctx); | |
291 | STORE32(p + 0, ctx->a); | |
292 | STORE32(p + 4, ctx->b); | |
293 | STORE32(p + 8, ctx->c); | |
294 | STORE32(p + 12, ctx->d); | |
295 | STORE32(p + 16, ctx->e); | |
296 | STORE32(p + 20, ctx->f); | |
297 | STORE32(p + 24, ctx->g); | |
298 | } | |
299 | ||
300 | /* --- @sha256_state@, @sha224_state@ --- * | |
eee16120 | 301 | * |
302 | * Arguments: @sha256_ctx *ctx@ = pointer to context | |
303 | * @void *state@ = pointer to buffer for current state | |
304 | * | |
305 | * Returns: Number of bytes written to the hash function so far. | |
306 | * | |
307 | * Use: Returns the current state of the hash function such that | |
308 | * it can be passed to @sha256_set@. | |
309 | */ | |
310 | ||
311 | unsigned long sha256_state(sha256_ctx *ctx, void *state) | |
312 | { | |
313 | octet *p = state; | |
314 | STORE32(p + 0, ctx->a); | |
315 | STORE32(p + 4, ctx->b); | |
316 | STORE32(p + 8, ctx->c); | |
317 | STORE32(p + 12, ctx->d); | |
318 | STORE32(p + 16, ctx->e); | |
319 | STORE32(p + 20, ctx->f); | |
320 | STORE32(p + 24, ctx->g); | |
321 | STORE32(p + 28, ctx->h); | |
322 | return (ctx->nl | ((ctx->nh << 16) << 16)); | |
323 | } | |
324 | ||
325 | /* --- Generic interface --- */ | |
326 | ||
84924d42 MW |
327 | #define HASHES(_) \ |
328 | _(SHA224, sha224) \ | |
329 | _(SHA256, sha256) | |
eee16120 | 330 | |
84924d42 | 331 | HASHES(GHASH_DEF) |
eee16120 | 332 | |
84924d42 MW |
333 | /*----- Test rig ----------------------------------------------------------*/ |
334 | ||
335 | #ifdef TEST_RIG | |
336 | ||
337 | #include <mLib/testrig.h> | |
338 | ||
339 | HASHES(HASH_VERIFY) | |
340 | ||
341 | static const test_chunk defs[] = { | |
342 | HASHES(HASH_TESTDEFS) | |
343 | { 0, 0, { 0 } } | |
344 | }; | |
345 | ||
346 | int main(int argc, char *argv[]) | |
347 | { | |
348 | test_run(argc, argv, defs, SRCDIR "/t/sha256"); | |
349 | return (0); | |
350 | } | |
351 | ||
352 | #endif | |
eee16120 | 353 | |
354 | /*----- That's all, folks -------------------------------------------------*/ |