| 1 | /* -*-c-*- |
| 2 | * |
| 3 | * Implementation of the SHA-256 hash function |
| 4 | * |
| 5 | * (c) 2000 Straylight/Edgeware |
| 6 | */ |
| 7 | |
| 8 | /*----- Licensing notice --------------------------------------------------* |
| 9 | * |
| 10 | * This file is part of Catacomb. |
| 11 | * |
| 12 | * Catacomb is free software; you can redistribute it and/or modify |
| 13 | * it under the terms of the GNU Library General Public License as |
| 14 | * published by the Free Software Foundation; either version 2 of the |
| 15 | * License, or (at your option) any later version. |
| 16 | * |
| 17 | * Catacomb is distributed in the hope that it will be useful, |
| 18 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 20 | * GNU Library General Public License for more details. |
| 21 | * |
| 22 | * You should have received a copy of the GNU Library General Public |
| 23 | * License along with Catacomb; if not, write to the Free |
| 24 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, |
| 25 | * MA 02111-1307, USA. |
| 26 | */ |
| 27 | |
| 28 | /*----- Header files ------------------------------------------------------*/ |
| 29 | |
| 30 | #include <mLib/bits.h> |
| 31 | |
| 32 | #include "ghash.h" |
| 33 | #include "ghash-def.h" |
| 34 | #include "hash.h" |
| 35 | #include "sha256.h" |
| 36 | |
| 37 | /*----- Main code ---------------------------------------------------------*/ |
| 38 | |
| 39 | /* --- @sha256_compress@, @sha224_compress@ --- * |
| 40 | * |
| 41 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 42 | * @const void *sbuf@ = pointer to buffer of appropriate size |
| 43 | * |
| 44 | * Returns: --- |
| 45 | * |
| 46 | * Use: SHA-256 compression function. |
| 47 | */ |
| 48 | |
| 49 | void sha256_compress(sha256_ctx *ctx, const void *sbuf) |
| 50 | { |
| 51 | uint32 a, b, c, d, e, f, g, h; |
| 52 | uint32 buf[64]; |
| 53 | |
| 54 | /* --- Fetch the chaining variables --- */ |
| 55 | |
| 56 | a = ctx->a; |
| 57 | b = ctx->b; |
| 58 | c = ctx->c; |
| 59 | d = ctx->d; |
| 60 | e = ctx->e; |
| 61 | f = ctx->f; |
| 62 | g = ctx->g; |
| 63 | h = ctx->h; |
| 64 | |
| 65 | /* --- Definitions for round functions --- */ |
| 66 | |
| 67 | #define CH(x, y, z) (((x) & (y)) | (~(x) & (z))) |
| 68 | #define MAJ(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z))) |
| 69 | |
| 70 | #define S0(x) (ROR32((x), 2) ^ ROR32((x), 13) ^ ROR32((x), 22)) |
| 71 | #define S1(x) (ROR32((x), 6) ^ ROR32((x), 11) ^ ROR32((x), 25)) |
| 72 | #define s0(x) (ROR32((x), 7) ^ ROR32((x), 18) ^ LSR32((x), 3)) |
| 73 | #define s1(x) (ROR32((x), 17) ^ ROR32((x), 19) ^ LSR32((x), 10)) |
| 74 | |
| 75 | #define T(a, b, c, d, e, f, g, h, i, k) do { \ |
| 76 | uint32 t1 = h + S1(e) + CH(e, f, g) + k + buf[i]; \ |
| 77 | uint32 t2 = S0(a) + MAJ(a, b, c); \ |
| 78 | d += t1; h = t1 + t2; \ |
| 79 | } while (0) |
| 80 | |
| 81 | /* --- Fetch and expand the buffer contents --- */ |
| 82 | |
| 83 | { |
| 84 | int i; |
| 85 | const octet *p; |
| 86 | |
| 87 | for (i = 0, p = sbuf; i < 16; i++, p += 4) |
| 88 | buf[i] = LOAD32(p); |
| 89 | for (i = 16; i < 64; i++) |
| 90 | buf[i] = s1(buf[i - 2]) + buf[i - 7] + s0(buf[i - 15]) + buf[i - 16]; |
| 91 | } |
| 92 | |
| 93 | /* --- The main compression function --- */ |
| 94 | |
| 95 | T(a, b, c, d, e, f, g, h, 0, 0x428a2f98); |
| 96 | T(h, a, b, c, d, e, f, g, 1, 0x71374491); |
| 97 | T(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcf); |
| 98 | T(f, g, h, a, b, c, d, e, 3, 0xe9b5dba5); |
| 99 | T(e, f, g, h, a, b, c, d, 4, 0x3956c25b); |
| 100 | T(d, e, f, g, h, a, b, c, 5, 0x59f111f1); |
| 101 | T(c, d, e, f, g, h, a, b, 6, 0x923f82a4); |
| 102 | T(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5); |
| 103 | T(a, b, c, d, e, f, g, h, 8, 0xd807aa98); |
| 104 | T(h, a, b, c, d, e, f, g, 9, 0x12835b01); |
| 105 | T(g, h, a, b, c, d, e, f, 10, 0x243185be); |
| 106 | T(f, g, h, a, b, c, d, e, 11, 0x550c7dc3); |
| 107 | T(e, f, g, h, a, b, c, d, 12, 0x72be5d74); |
| 108 | T(d, e, f, g, h, a, b, c, 13, 0x80deb1fe); |
| 109 | T(c, d, e, f, g, h, a, b, 14, 0x9bdc06a7); |
| 110 | T(b, c, d, e, f, g, h, a, 15, 0xc19bf174); |
| 111 | T(a, b, c, d, e, f, g, h, 16, 0xe49b69c1); |
| 112 | T(h, a, b, c, d, e, f, g, 17, 0xefbe4786); |
| 113 | T(g, h, a, b, c, d, e, f, 18, 0x0fc19dc6); |
| 114 | T(f, g, h, a, b, c, d, e, 19, 0x240ca1cc); |
| 115 | T(e, f, g, h, a, b, c, d, 20, 0x2de92c6f); |
| 116 | T(d, e, f, g, h, a, b, c, 21, 0x4a7484aa); |
| 117 | T(c, d, e, f, g, h, a, b, 22, 0x5cb0a9dc); |
| 118 | T(b, c, d, e, f, g, h, a, 23, 0x76f988da); |
| 119 | T(a, b, c, d, e, f, g, h, 24, 0x983e5152); |
| 120 | T(h, a, b, c, d, e, f, g, 25, 0xa831c66d); |
| 121 | T(g, h, a, b, c, d, e, f, 26, 0xb00327c8); |
| 122 | T(f, g, h, a, b, c, d, e, 27, 0xbf597fc7); |
| 123 | T(e, f, g, h, a, b, c, d, 28, 0xc6e00bf3); |
| 124 | T(d, e, f, g, h, a, b, c, 29, 0xd5a79147); |
| 125 | T(c, d, e, f, g, h, a, b, 30, 0x06ca6351); |
| 126 | T(b, c, d, e, f, g, h, a, 31, 0x14292967); |
| 127 | T(a, b, c, d, e, f, g, h, 32, 0x27b70a85); |
| 128 | T(h, a, b, c, d, e, f, g, 33, 0x2e1b2138); |
| 129 | T(g, h, a, b, c, d, e, f, 34, 0x4d2c6dfc); |
| 130 | T(f, g, h, a, b, c, d, e, 35, 0x53380d13); |
| 131 | T(e, f, g, h, a, b, c, d, 36, 0x650a7354); |
| 132 | T(d, e, f, g, h, a, b, c, 37, 0x766a0abb); |
| 133 | T(c, d, e, f, g, h, a, b, 38, 0x81c2c92e); |
| 134 | T(b, c, d, e, f, g, h, a, 39, 0x92722c85); |
| 135 | T(a, b, c, d, e, f, g, h, 40, 0xa2bfe8a1); |
| 136 | T(h, a, b, c, d, e, f, g, 41, 0xa81a664b); |
| 137 | T(g, h, a, b, c, d, e, f, 42, 0xc24b8b70); |
| 138 | T(f, g, h, a, b, c, d, e, 43, 0xc76c51a3); |
| 139 | T(e, f, g, h, a, b, c, d, 44, 0xd192e819); |
| 140 | T(d, e, f, g, h, a, b, c, 45, 0xd6990624); |
| 141 | T(c, d, e, f, g, h, a, b, 46, 0xf40e3585); |
| 142 | T(b, c, d, e, f, g, h, a, 47, 0x106aa070); |
| 143 | T(a, b, c, d, e, f, g, h, 48, 0x19a4c116); |
| 144 | T(h, a, b, c, d, e, f, g, 49, 0x1e376c08); |
| 145 | T(g, h, a, b, c, d, e, f, 50, 0x2748774c); |
| 146 | T(f, g, h, a, b, c, d, e, 51, 0x34b0bcb5); |
| 147 | T(e, f, g, h, a, b, c, d, 52, 0x391c0cb3); |
| 148 | T(d, e, f, g, h, a, b, c, 53, 0x4ed8aa4a); |
| 149 | T(c, d, e, f, g, h, a, b, 54, 0x5b9cca4f); |
| 150 | T(b, c, d, e, f, g, h, a, 55, 0x682e6ff3); |
| 151 | T(a, b, c, d, e, f, g, h, 56, 0x748f82ee); |
| 152 | T(h, a, b, c, d, e, f, g, 57, 0x78a5636f); |
| 153 | T(g, h, a, b, c, d, e, f, 58, 0x84c87814); |
| 154 | T(f, g, h, a, b, c, d, e, 59, 0x8cc70208); |
| 155 | T(e, f, g, h, a, b, c, d, 60, 0x90befffa); |
| 156 | T(d, e, f, g, h, a, b, c, 61, 0xa4506ceb); |
| 157 | T(c, d, e, f, g, h, a, b, 62, 0xbef9a3f7); |
| 158 | T(b, c, d, e, f, g, h, a, 63, 0xc67178f2); |
| 159 | |
| 160 | /* --- Update the chaining variables --- */ |
| 161 | |
| 162 | ctx->a += a; |
| 163 | ctx->b += b; |
| 164 | ctx->c += c; |
| 165 | ctx->d += d; |
| 166 | ctx->e += e; |
| 167 | ctx->f += f; |
| 168 | ctx->g += g; |
| 169 | ctx->h += h; |
| 170 | } |
| 171 | |
| 172 | /* --- @sha256_init@, @sha224_init@ --- * |
| 173 | * |
| 174 | * Arguments: @sha256_ctx *ctx@ = pointer to context block to initialize |
| 175 | * |
| 176 | * Returns: --- |
| 177 | * |
| 178 | * Use: Initializes a context block ready for hashing. |
| 179 | */ |
| 180 | |
| 181 | void sha256_init(sha256_ctx *ctx) |
| 182 | { |
| 183 | ctx->a = 0x6a09e667; |
| 184 | ctx->b = 0xbb67ae85; |
| 185 | ctx->c = 0x3c6ef372; |
| 186 | ctx->d = 0xa54ff53a; |
| 187 | ctx->e = 0x510e527f; |
| 188 | ctx->f = 0x9b05688c; |
| 189 | ctx->g = 0x1f83d9ab; |
| 190 | ctx->h = 0x5be0cd19; |
| 191 | ctx->off = 0; |
| 192 | ctx->nl = ctx->nh = 0; |
| 193 | } |
| 194 | |
| 195 | void sha224_init(sha256_ctx *ctx) |
| 196 | { |
| 197 | ctx->a = 0xc1059ed8; |
| 198 | ctx->b = 0x367cd507; |
| 199 | ctx->c = 0x3070dd17; |
| 200 | ctx->d = 0xf70e5939; |
| 201 | ctx->e = 0xffc00b31; |
| 202 | ctx->f = 0x68581511; |
| 203 | ctx->g = 0x64f98fa7; |
| 204 | ctx->h = 0xbefa4fa4; |
| 205 | ctx->off = 0; |
| 206 | ctx->nl = ctx->nh = 0; |
| 207 | } |
| 208 | |
| 209 | /* --- @sha256_set@, @sha224_set@ --- * |
| 210 | * |
| 211 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 212 | * @const void *buf@ = pointer to state buffer |
| 213 | * @unsigned long count@ = current count of bytes processed |
| 214 | * |
| 215 | * Returns: --- |
| 216 | * |
| 217 | * Use: Initializes a context block from a given state. This is |
| 218 | * useful in cases where the initial hash state is meant to be |
| 219 | * secret, e.g., for NMAC and HMAC support. |
| 220 | */ |
| 221 | |
| 222 | void sha256_set(sha256_ctx *ctx, const void *buf, unsigned long count) |
| 223 | { |
| 224 | const octet *p = buf; |
| 225 | ctx->a = LOAD32(p + 0); |
| 226 | ctx->b = LOAD32(p + 4); |
| 227 | ctx->c = LOAD32(p + 8); |
| 228 | ctx->d = LOAD32(p + 12); |
| 229 | ctx->e = LOAD32(p + 16); |
| 230 | ctx->f = LOAD32(p + 20); |
| 231 | ctx->g = LOAD32(p + 24); |
| 232 | ctx->h = LOAD32(p + 28); |
| 233 | ctx->off = 0; |
| 234 | ctx->nl = U32(count); |
| 235 | ctx->nh = U32(((count & ~MASK32) >> 16) >> 16); |
| 236 | } |
| 237 | |
| 238 | /* --- @sha256_hash@, @sha224_hash@ --- * |
| 239 | * |
| 240 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 241 | * @const void *buf@ = buffer of data to hash |
| 242 | * @size_t sz@ = size of buffer to hash |
| 243 | * |
| 244 | * Returns: --- |
| 245 | * |
| 246 | * Use: Hashes a buffer of data. The buffer may be of any size and |
| 247 | * alignment. |
| 248 | */ |
| 249 | |
| 250 | void sha256_hash(sha256_ctx *ctx, const void *buf, size_t sz) |
| 251 | { |
| 252 | HASH_BUFFER(SHA256, sha256, ctx, buf, sz); |
| 253 | } |
| 254 | |
| 255 | /* --- @sha256_done, @sha224_done@ --- * |
| 256 | * |
| 257 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 258 | * @void *hash@ = pointer to output buffer |
| 259 | * |
| 260 | * Returns: --- |
| 261 | * |
| 262 | * Use: Returns the hash of the data read so far. |
| 263 | */ |
| 264 | |
| 265 | static void final(sha256_ctx *ctx) |
| 266 | { |
| 267 | HASH_PAD(SHA256, sha256, ctx, 0x80, 0, 8); |
| 268 | STORE32(ctx->buf + SHA256_BUFSZ - 8, (ctx->nl >> 29) | (ctx->nh << 3)); |
| 269 | STORE32(ctx->buf + SHA256_BUFSZ - 4, ctx->nl << 3); |
| 270 | sha256_compress(ctx, ctx->buf); |
| 271 | } |
| 272 | |
| 273 | void sha256_done(sha256_ctx *ctx, void *hash) |
| 274 | { |
| 275 | octet *p = hash; |
| 276 | final(ctx); |
| 277 | STORE32(p + 0, ctx->a); |
| 278 | STORE32(p + 4, ctx->b); |
| 279 | STORE32(p + 8, ctx->c); |
| 280 | STORE32(p + 12, ctx->d); |
| 281 | STORE32(p + 16, ctx->e); |
| 282 | STORE32(p + 20, ctx->f); |
| 283 | STORE32(p + 24, ctx->g); |
| 284 | STORE32(p + 28, ctx->h); |
| 285 | } |
| 286 | |
| 287 | void sha224_done(sha224_ctx *ctx, void *hash) |
| 288 | { |
| 289 | octet *p = hash; |
| 290 | final(ctx); |
| 291 | STORE32(p + 0, ctx->a); |
| 292 | STORE32(p + 4, ctx->b); |
| 293 | STORE32(p + 8, ctx->c); |
| 294 | STORE32(p + 12, ctx->d); |
| 295 | STORE32(p + 16, ctx->e); |
| 296 | STORE32(p + 20, ctx->f); |
| 297 | STORE32(p + 24, ctx->g); |
| 298 | } |
| 299 | |
| 300 | /* --- @sha256_state@, @sha224_state@ --- * |
| 301 | * |
| 302 | * Arguments: @sha256_ctx *ctx@ = pointer to context |
| 303 | * @void *state@ = pointer to buffer for current state |
| 304 | * |
| 305 | * Returns: Number of bytes written to the hash function so far. |
| 306 | * |
| 307 | * Use: Returns the current state of the hash function such that |
| 308 | * it can be passed to @sha256_set@. |
| 309 | */ |
| 310 | |
| 311 | unsigned long sha256_state(sha256_ctx *ctx, void *state) |
| 312 | { |
| 313 | octet *p = state; |
| 314 | STORE32(p + 0, ctx->a); |
| 315 | STORE32(p + 4, ctx->b); |
| 316 | STORE32(p + 8, ctx->c); |
| 317 | STORE32(p + 12, ctx->d); |
| 318 | STORE32(p + 16, ctx->e); |
| 319 | STORE32(p + 20, ctx->f); |
| 320 | STORE32(p + 24, ctx->g); |
| 321 | STORE32(p + 28, ctx->h); |
| 322 | return (ctx->nl | ((ctx->nh << 16) << 16)); |
| 323 | } |
| 324 | |
| 325 | /* --- Generic interface --- */ |
| 326 | |
| 327 | GHASH_DEF(SHA256, sha256) |
| 328 | |
| 329 | /* --- Test code --- */ |
| 330 | |
| 331 | HASH_TEST(SHA256, sha256) |
| 332 | |
| 333 | /*----- That's all, folks -------------------------------------------------*/ |