Commit | Line | Data |
---|---|---|
eee16120 | 1 | /* -*-c-*- |
2 | * | |
eee16120 | 3 | * Implementation of the SHA-256 hash function |
4 | * | |
5 | * (c) 2000 Straylight/Edgeware | |
6 | */ | |
7 | ||
45c0fd36 | 8 | /*----- Licensing notice --------------------------------------------------* |
eee16120 | 9 | * |
10 | * This file is part of Catacomb. | |
11 | * | |
12 | * Catacomb is free software; you can redistribute it and/or modify | |
13 | * it under the terms of the GNU Library General Public License as | |
14 | * published by the Free Software Foundation; either version 2 of the | |
15 | * License, or (at your option) any later version. | |
45c0fd36 | 16 | * |
eee16120 | 17 | * Catacomb is distributed in the hope that it will be useful, |
18 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
20 | * GNU Library General Public License for more details. | |
45c0fd36 | 21 | * |
eee16120 | 22 | * You should have received a copy of the GNU Library General Public |
23 | * License along with Catacomb; if not, write to the Free | |
24 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, | |
25 | * MA 02111-1307, USA. | |
26 | */ | |
27 | ||
eee16120 | 28 | /*----- Header files ------------------------------------------------------*/ |
29 | ||
30 | #include <mLib/bits.h> | |
31 | ||
32 | #include "ghash.h" | |
33 | #include "ghash-def.h" | |
34 | #include "hash.h" | |
35 | #include "sha256.h" | |
36 | ||
37 | /*----- Main code ---------------------------------------------------------*/ | |
38 | ||
5b69c389 | 39 | /* --- @sha256_compress@, @sha224_compress@ --- * |
eee16120 | 40 | * |
41 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
42 | * @const void *sbuf@ = pointer to buffer of appropriate size | |
43 | * | |
44 | * Returns: --- | |
45 | * | |
46 | * Use: SHA-256 compression function. | |
47 | */ | |
48 | ||
49 | void sha256_compress(sha256_ctx *ctx, const void *sbuf) | |
50 | { | |
51 | uint32 a, b, c, d, e, f, g, h; | |
15dfa998 MW |
52 | uint32 m[16]; |
53 | const octet *p; | |
54 | int i; | |
eee16120 | 55 | |
15dfa998 MW |
56 | a = ctx->a; b = ctx->b; c = ctx->c; d = ctx->d; |
57 | e = ctx->e; f = ctx->f; g = ctx->g; h = ctx->h; | |
58 | for (p = sbuf, i = 0; i < 16; i++, p += 4) m[i] = LOAD32(p); | |
eee16120 | 59 | |
60 | /* --- Definitions for round functions --- */ | |
61 | ||
62 | #define CH(x, y, z) (((x) & (y)) | (~(x) & (z))) | |
63 | #define MAJ(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z))) | |
64 | ||
65 | #define S0(x) (ROR32((x), 2) ^ ROR32((x), 13) ^ ROR32((x), 22)) | |
66 | #define S1(x) (ROR32((x), 6) ^ ROR32((x), 11) ^ ROR32((x), 25)) | |
67 | #define s0(x) (ROR32((x), 7) ^ ROR32((x), 18) ^ LSR32((x), 3)) | |
68 | #define s1(x) (ROR32((x), 17) ^ ROR32((x), 19) ^ LSR32((x), 10)) | |
69 | ||
70 | #define T(a, b, c, d, e, f, g, h, i, k) do { \ | |
15dfa998 | 71 | uint32 t1 = h + S1(e) + CH(e, f, g) + k + m[i]; \ |
eee16120 | 72 | uint32 t2 = S0(a) + MAJ(a, b, c); \ |
73 | d += t1; h = t1 + t2; \ | |
74 | } while (0) | |
75 | ||
15dfa998 MW |
76 | #define M(i, i2, i7, i15) \ |
77 | do { m[i] += s1(m[i2]) + m[i7] + s0(m[i15]); } while (0) | |
eee16120 | 78 | |
79 | /* --- The main compression function --- */ | |
45c0fd36 | 80 | |
15dfa998 MW |
81 | T(a, b, c, d, e, f, g, h, 0, 0x428a2f98); M( 0, 14, 9, 1); |
82 | T(h, a, b, c, d, e, f, g, 1, 0x71374491); M( 1, 15, 10, 2); | |
83 | T(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcf); M( 2, 0, 11, 3); | |
84 | T(f, g, h, a, b, c, d, e, 3, 0xe9b5dba5); M( 3, 1, 12, 4); | |
85 | T(e, f, g, h, a, b, c, d, 4, 0x3956c25b); M( 4, 2, 13, 5); | |
86 | T(d, e, f, g, h, a, b, c, 5, 0x59f111f1); M( 5, 3, 14, 6); | |
87 | T(c, d, e, f, g, h, a, b, 6, 0x923f82a4); M( 6, 4, 15, 7); | |
88 | T(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5); M( 7, 5, 0, 8); | |
89 | T(a, b, c, d, e, f, g, h, 8, 0xd807aa98); M( 8, 6, 1, 9); | |
90 | T(h, a, b, c, d, e, f, g, 9, 0x12835b01); M( 9, 7, 2, 10); | |
91 | T(g, h, a, b, c, d, e, f, 10, 0x243185be); M(10, 8, 3, 11); | |
92 | T(f, g, h, a, b, c, d, e, 11, 0x550c7dc3); M(11, 9, 4, 12); | |
93 | T(e, f, g, h, a, b, c, d, 12, 0x72be5d74); M(12, 10, 5, 13); | |
94 | T(d, e, f, g, h, a, b, c, 13, 0x80deb1fe); M(13, 11, 6, 14); | |
95 | T(c, d, e, f, g, h, a, b, 14, 0x9bdc06a7); M(14, 12, 7, 15); | |
96 | T(b, c, d, e, f, g, h, a, 15, 0xc19bf174); M(15, 13, 8, 0); | |
97 | T(a, b, c, d, e, f, g, h, 0, 0xe49b69c1); M( 0, 14, 9, 1); | |
98 | T(h, a, b, c, d, e, f, g, 1, 0xefbe4786); M( 1, 15, 10, 2); | |
99 | T(g, h, a, b, c, d, e, f, 2, 0x0fc19dc6); M( 2, 0, 11, 3); | |
100 | T(f, g, h, a, b, c, d, e, 3, 0x240ca1cc); M( 3, 1, 12, 4); | |
101 | T(e, f, g, h, a, b, c, d, 4, 0x2de92c6f); M( 4, 2, 13, 5); | |
102 | T(d, e, f, g, h, a, b, c, 5, 0x4a7484aa); M( 5, 3, 14, 6); | |
103 | T(c, d, e, f, g, h, a, b, 6, 0x5cb0a9dc); M( 6, 4, 15, 7); | |
104 | T(b, c, d, e, f, g, h, a, 7, 0x76f988da); M( 7, 5, 0, 8); | |
105 | T(a, b, c, d, e, f, g, h, 8, 0x983e5152); M( 8, 6, 1, 9); | |
106 | T(h, a, b, c, d, e, f, g, 9, 0xa831c66d); M( 9, 7, 2, 10); | |
107 | T(g, h, a, b, c, d, e, f, 10, 0xb00327c8); M(10, 8, 3, 11); | |
108 | T(f, g, h, a, b, c, d, e, 11, 0xbf597fc7); M(11, 9, 4, 12); | |
109 | T(e, f, g, h, a, b, c, d, 12, 0xc6e00bf3); M(12, 10, 5, 13); | |
110 | T(d, e, f, g, h, a, b, c, 13, 0xd5a79147); M(13, 11, 6, 14); | |
111 | T(c, d, e, f, g, h, a, b, 14, 0x06ca6351); M(14, 12, 7, 15); | |
112 | T(b, c, d, e, f, g, h, a, 15, 0x14292967); M(15, 13, 8, 0); | |
113 | T(a, b, c, d, e, f, g, h, 0, 0x27b70a85); M( 0, 14, 9, 1); | |
114 | T(h, a, b, c, d, e, f, g, 1, 0x2e1b2138); M( 1, 15, 10, 2); | |
115 | T(g, h, a, b, c, d, e, f, 2, 0x4d2c6dfc); M( 2, 0, 11, 3); | |
116 | T(f, g, h, a, b, c, d, e, 3, 0x53380d13); M( 3, 1, 12, 4); | |
117 | T(e, f, g, h, a, b, c, d, 4, 0x650a7354); M( 4, 2, 13, 5); | |
118 | T(d, e, f, g, h, a, b, c, 5, 0x766a0abb); M( 5, 3, 14, 6); | |
119 | T(c, d, e, f, g, h, a, b, 6, 0x81c2c92e); M( 6, 4, 15, 7); | |
120 | T(b, c, d, e, f, g, h, a, 7, 0x92722c85); M( 7, 5, 0, 8); | |
121 | T(a, b, c, d, e, f, g, h, 8, 0xa2bfe8a1); M( 8, 6, 1, 9); | |
122 | T(h, a, b, c, d, e, f, g, 9, 0xa81a664b); M( 9, 7, 2, 10); | |
123 | T(g, h, a, b, c, d, e, f, 10, 0xc24b8b70); M(10, 8, 3, 11); | |
124 | T(f, g, h, a, b, c, d, e, 11, 0xc76c51a3); M(11, 9, 4, 12); | |
125 | T(e, f, g, h, a, b, c, d, 12, 0xd192e819); M(12, 10, 5, 13); | |
126 | T(d, e, f, g, h, a, b, c, 13, 0xd6990624); M(13, 11, 6, 14); | |
127 | T(c, d, e, f, g, h, a, b, 14, 0xf40e3585); M(14, 12, 7, 15); | |
128 | T(b, c, d, e, f, g, h, a, 15, 0x106aa070); M(15, 13, 8, 0); | |
129 | T(a, b, c, d, e, f, g, h, 0, 0x19a4c116); | |
130 | T(h, a, b, c, d, e, f, g, 1, 0x1e376c08); | |
131 | T(g, h, a, b, c, d, e, f, 2, 0x2748774c); | |
132 | T(f, g, h, a, b, c, d, e, 3, 0x34b0bcb5); | |
133 | T(e, f, g, h, a, b, c, d, 4, 0x391c0cb3); | |
134 | T(d, e, f, g, h, a, b, c, 5, 0x4ed8aa4a); | |
135 | T(c, d, e, f, g, h, a, b, 6, 0x5b9cca4f); | |
136 | T(b, c, d, e, f, g, h, a, 7, 0x682e6ff3); | |
137 | T(a, b, c, d, e, f, g, h, 8, 0x748f82ee); | |
138 | T(h, a, b, c, d, e, f, g, 9, 0x78a5636f); | |
139 | T(g, h, a, b, c, d, e, f, 10, 0x84c87814); | |
140 | T(f, g, h, a, b, c, d, e, 11, 0x8cc70208); | |
141 | T(e, f, g, h, a, b, c, d, 12, 0x90befffa); | |
142 | T(d, e, f, g, h, a, b, c, 13, 0xa4506ceb); | |
143 | T(c, d, e, f, g, h, a, b, 14, 0xbef9a3f7); | |
144 | T(b, c, d, e, f, g, h, a, 15, 0xc67178f2); | |
eee16120 | 145 | |
146 | /* --- Update the chaining variables --- */ | |
147 | ||
15dfa998 MW |
148 | ctx->a += a; ctx->b += b; ctx->c += c; ctx->d += d; |
149 | ctx->e += e; ctx->f += f; ctx->g += g; ctx->h += h; | |
eee16120 | 150 | } |
151 | ||
5b69c389 | 152 | /* --- @sha256_init@, @sha224_init@ --- * |
eee16120 | 153 | * |
154 | * Arguments: @sha256_ctx *ctx@ = pointer to context block to initialize | |
155 | * | |
156 | * Returns: --- | |
157 | * | |
158 | * Use: Initializes a context block ready for hashing. | |
159 | */ | |
160 | ||
161 | void sha256_init(sha256_ctx *ctx) | |
162 | { | |
163 | ctx->a = 0x6a09e667; | |
164 | ctx->b = 0xbb67ae85; | |
165 | ctx->c = 0x3c6ef372; | |
166 | ctx->d = 0xa54ff53a; | |
167 | ctx->e = 0x510e527f; | |
168 | ctx->f = 0x9b05688c; | |
169 | ctx->g = 0x1f83d9ab; | |
170 | ctx->h = 0x5be0cd19; | |
171 | ctx->off = 0; | |
172 | ctx->nl = ctx->nh = 0; | |
173 | } | |
174 | ||
5b69c389 | 175 | void sha224_init(sha256_ctx *ctx) |
176 | { | |
177 | ctx->a = 0xc1059ed8; | |
178 | ctx->b = 0x367cd507; | |
179 | ctx->c = 0x3070dd17; | |
180 | ctx->d = 0xf70e5939; | |
181 | ctx->e = 0xffc00b31; | |
182 | ctx->f = 0x68581511; | |
183 | ctx->g = 0x64f98fa7; | |
184 | ctx->h = 0xbefa4fa4; | |
185 | ctx->off = 0; | |
186 | ctx->nl = ctx->nh = 0; | |
187 | } | |
188 | ||
189 | /* --- @sha256_set@, @sha224_set@ --- * | |
eee16120 | 190 | * |
191 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
192 | * @const void *buf@ = pointer to state buffer | |
193 | * @unsigned long count@ = current count of bytes processed | |
194 | * | |
195 | * Returns: --- | |
196 | * | |
197 | * Use: Initializes a context block from a given state. This is | |
198 | * useful in cases where the initial hash state is meant to be | |
199 | * secret, e.g., for NMAC and HMAC support. | |
200 | */ | |
201 | ||
202 | void sha256_set(sha256_ctx *ctx, const void *buf, unsigned long count) | |
203 | { | |
204 | const octet *p = buf; | |
205 | ctx->a = LOAD32(p + 0); | |
206 | ctx->b = LOAD32(p + 4); | |
207 | ctx->c = LOAD32(p + 8); | |
208 | ctx->d = LOAD32(p + 12); | |
209 | ctx->e = LOAD32(p + 16); | |
210 | ctx->f = LOAD32(p + 20); | |
211 | ctx->g = LOAD32(p + 24); | |
212 | ctx->h = LOAD32(p + 28); | |
213 | ctx->off = 0; | |
214 | ctx->nl = U32(count); | |
e91d142c | 215 | ctx->nh = U32(((count & ~(unsigned long)MASK32) >> 16) >> 16); |
eee16120 | 216 | } |
217 | ||
5b69c389 | 218 | /* --- @sha256_hash@, @sha224_hash@ --- * |
eee16120 | 219 | * |
220 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
221 | * @const void *buf@ = buffer of data to hash | |
222 | * @size_t sz@ = size of buffer to hash | |
223 | * | |
224 | * Returns: --- | |
225 | * | |
226 | * Use: Hashes a buffer of data. The buffer may be of any size and | |
227 | * alignment. | |
228 | */ | |
229 | ||
230 | void sha256_hash(sha256_ctx *ctx, const void *buf, size_t sz) | |
231 | { | |
232 | HASH_BUFFER(SHA256, sha256, ctx, buf, sz); | |
233 | } | |
234 | ||
5b69c389 | 235 | /* --- @sha256_done, @sha224_done@ --- * |
eee16120 | 236 | * |
237 | * Arguments: @sha256_ctx *ctx@ = pointer to context block | |
238 | * @void *hash@ = pointer to output buffer | |
239 | * | |
240 | * Returns: --- | |
241 | * | |
242 | * Use: Returns the hash of the data read so far. | |
243 | */ | |
244 | ||
5b69c389 | 245 | static void final(sha256_ctx *ctx) |
eee16120 | 246 | { |
eee16120 | 247 | HASH_PAD(SHA256, sha256, ctx, 0x80, 0, 8); |
248 | STORE32(ctx->buf + SHA256_BUFSZ - 8, (ctx->nl >> 29) | (ctx->nh << 3)); | |
249 | STORE32(ctx->buf + SHA256_BUFSZ - 4, ctx->nl << 3); | |
45c0fd36 | 250 | sha256_compress(ctx, ctx->buf); |
5b69c389 | 251 | } |
252 | ||
253 | void sha256_done(sha256_ctx *ctx, void *hash) | |
254 | { | |
255 | octet *p = hash; | |
256 | final(ctx); | |
eee16120 | 257 | STORE32(p + 0, ctx->a); |
258 | STORE32(p + 4, ctx->b); | |
259 | STORE32(p + 8, ctx->c); | |
260 | STORE32(p + 12, ctx->d); | |
261 | STORE32(p + 16, ctx->e); | |
262 | STORE32(p + 20, ctx->f); | |
263 | STORE32(p + 24, ctx->g); | |
264 | STORE32(p + 28, ctx->h); | |
265 | } | |
266 | ||
5b69c389 | 267 | void sha224_done(sha224_ctx *ctx, void *hash) |
268 | { | |
269 | octet *p = hash; | |
270 | final(ctx); | |
271 | STORE32(p + 0, ctx->a); | |
272 | STORE32(p + 4, ctx->b); | |
273 | STORE32(p + 8, ctx->c); | |
274 | STORE32(p + 12, ctx->d); | |
275 | STORE32(p + 16, ctx->e); | |
276 | STORE32(p + 20, ctx->f); | |
277 | STORE32(p + 24, ctx->g); | |
278 | } | |
279 | ||
280 | /* --- @sha256_state@, @sha224_state@ --- * | |
eee16120 | 281 | * |
282 | * Arguments: @sha256_ctx *ctx@ = pointer to context | |
283 | * @void *state@ = pointer to buffer for current state | |
284 | * | |
285 | * Returns: Number of bytes written to the hash function so far. | |
286 | * | |
287 | * Use: Returns the current state of the hash function such that | |
288 | * it can be passed to @sha256_set@. | |
289 | */ | |
290 | ||
291 | unsigned long sha256_state(sha256_ctx *ctx, void *state) | |
292 | { | |
293 | octet *p = state; | |
294 | STORE32(p + 0, ctx->a); | |
295 | STORE32(p + 4, ctx->b); | |
296 | STORE32(p + 8, ctx->c); | |
297 | STORE32(p + 12, ctx->d); | |
298 | STORE32(p + 16, ctx->e); | |
299 | STORE32(p + 20, ctx->f); | |
300 | STORE32(p + 24, ctx->g); | |
301 | STORE32(p + 28, ctx->h); | |
302 | return (ctx->nl | ((ctx->nh << 16) << 16)); | |
303 | } | |
304 | ||
305 | /* --- Generic interface --- */ | |
306 | ||
84924d42 MW |
307 | #define HASHES(_) \ |
308 | _(SHA224, sha224) \ | |
309 | _(SHA256, sha256) | |
eee16120 | 310 | |
84924d42 | 311 | HASHES(GHASH_DEF) |
eee16120 | 312 | |
84924d42 MW |
313 | /*----- Test rig ----------------------------------------------------------*/ |
314 | ||
315 | #ifdef TEST_RIG | |
316 | ||
317 | #include <mLib/testrig.h> | |
318 | ||
319 | HASHES(HASH_VERIFY) | |
320 | ||
321 | static const test_chunk defs[] = { | |
322 | HASHES(HASH_TESTDEFS) | |
323 | { 0, 0, { 0 } } | |
324 | }; | |
325 | ||
326 | int main(int argc, char *argv[]) | |
327 | { | |
328 | test_run(argc, argv, defs, SRCDIR "/t/sha256"); | |
329 | return (0); | |
330 | } | |
331 | ||
332 | #endif | |
eee16120 | 333 | |
334 | /*----- That's all, folks -------------------------------------------------*/ |