| 1 | /* -*-c-*- |
| 2 | * |
| 3 | * Implementation of the SHA-256 hash function |
| 4 | * |
| 5 | * (c) 2000 Straylight/Edgeware |
| 6 | */ |
| 7 | |
| 8 | /*----- Licensing notice --------------------------------------------------* |
| 9 | * |
| 10 | * This file is part of Catacomb. |
| 11 | * |
| 12 | * Catacomb is free software; you can redistribute it and/or modify |
| 13 | * it under the terms of the GNU Library General Public License as |
| 14 | * published by the Free Software Foundation; either version 2 of the |
| 15 | * License, or (at your option) any later version. |
| 16 | * |
| 17 | * Catacomb is distributed in the hope that it will be useful, |
| 18 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 20 | * GNU Library General Public License for more details. |
| 21 | * |
| 22 | * You should have received a copy of the GNU Library General Public |
| 23 | * License along with Catacomb; if not, write to the Free |
| 24 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, |
| 25 | * MA 02111-1307, USA. |
| 26 | */ |
| 27 | |
| 28 | /*----- Header files ------------------------------------------------------*/ |
| 29 | |
| 30 | #include <mLib/bits.h> |
| 31 | |
| 32 | #include "ghash.h" |
| 33 | #include "ghash-def.h" |
| 34 | #include "hash.h" |
| 35 | #include "sha256.h" |
| 36 | |
| 37 | /*----- Main code ---------------------------------------------------------*/ |
| 38 | |
| 39 | /* --- @sha256_compress@, @sha224_compress@ --- * |
| 40 | * |
| 41 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 42 | * @const void *sbuf@ = pointer to buffer of appropriate size |
| 43 | * |
| 44 | * Returns: --- |
| 45 | * |
| 46 | * Use: SHA-256 compression function. |
| 47 | */ |
| 48 | |
| 49 | void sha256_compress(sha256_ctx *ctx, const void *sbuf) |
| 50 | { |
| 51 | uint32 a, b, c, d, e, f, g, h; |
| 52 | uint32 m[16]; |
| 53 | const octet *p; |
| 54 | int i; |
| 55 | |
| 56 | a = ctx->a; b = ctx->b; c = ctx->c; d = ctx->d; |
| 57 | e = ctx->e; f = ctx->f; g = ctx->g; h = ctx->h; |
| 58 | for (p = sbuf, i = 0; i < 16; i++, p += 4) m[i] = LOAD32(p); |
| 59 | |
| 60 | /* --- Definitions for round functions --- */ |
| 61 | |
| 62 | #define CH(x, y, z) (((x) & (y)) | (~(x) & (z))) |
| 63 | #define MAJ(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z))) |
| 64 | |
| 65 | #define S0(x) (ROR32((x), 2) ^ ROR32((x), 13) ^ ROR32((x), 22)) |
| 66 | #define S1(x) (ROR32((x), 6) ^ ROR32((x), 11) ^ ROR32((x), 25)) |
| 67 | #define s0(x) (ROR32((x), 7) ^ ROR32((x), 18) ^ LSR32((x), 3)) |
| 68 | #define s1(x) (ROR32((x), 17) ^ ROR32((x), 19) ^ LSR32((x), 10)) |
| 69 | |
| 70 | #define T(a, b, c, d, e, f, g, h, i, k) do { \ |
| 71 | uint32 t1 = h + S1(e) + CH(e, f, g) + k + m[i]; \ |
| 72 | uint32 t2 = S0(a) + MAJ(a, b, c); \ |
| 73 | d += t1; h = t1 + t2; \ |
| 74 | } while (0) |
| 75 | |
| 76 | #define M(i, i2, i7, i15) \ |
| 77 | do { m[i] += s1(m[i2]) + m[i7] + s0(m[i15]); } while (0) |
| 78 | |
| 79 | /* --- The main compression function --- */ |
| 80 | |
| 81 | T(a, b, c, d, e, f, g, h, 0, 0x428a2f98); M( 0, 14, 9, 1); |
| 82 | T(h, a, b, c, d, e, f, g, 1, 0x71374491); M( 1, 15, 10, 2); |
| 83 | T(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcf); M( 2, 0, 11, 3); |
| 84 | T(f, g, h, a, b, c, d, e, 3, 0xe9b5dba5); M( 3, 1, 12, 4); |
| 85 | T(e, f, g, h, a, b, c, d, 4, 0x3956c25b); M( 4, 2, 13, 5); |
| 86 | T(d, e, f, g, h, a, b, c, 5, 0x59f111f1); M( 5, 3, 14, 6); |
| 87 | T(c, d, e, f, g, h, a, b, 6, 0x923f82a4); M( 6, 4, 15, 7); |
| 88 | T(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5); M( 7, 5, 0, 8); |
| 89 | T(a, b, c, d, e, f, g, h, 8, 0xd807aa98); M( 8, 6, 1, 9); |
| 90 | T(h, a, b, c, d, e, f, g, 9, 0x12835b01); M( 9, 7, 2, 10); |
| 91 | T(g, h, a, b, c, d, e, f, 10, 0x243185be); M(10, 8, 3, 11); |
| 92 | T(f, g, h, a, b, c, d, e, 11, 0x550c7dc3); M(11, 9, 4, 12); |
| 93 | T(e, f, g, h, a, b, c, d, 12, 0x72be5d74); M(12, 10, 5, 13); |
| 94 | T(d, e, f, g, h, a, b, c, 13, 0x80deb1fe); M(13, 11, 6, 14); |
| 95 | T(c, d, e, f, g, h, a, b, 14, 0x9bdc06a7); M(14, 12, 7, 15); |
| 96 | T(b, c, d, e, f, g, h, a, 15, 0xc19bf174); M(15, 13, 8, 0); |
| 97 | T(a, b, c, d, e, f, g, h, 0, 0xe49b69c1); M( 0, 14, 9, 1); |
| 98 | T(h, a, b, c, d, e, f, g, 1, 0xefbe4786); M( 1, 15, 10, 2); |
| 99 | T(g, h, a, b, c, d, e, f, 2, 0x0fc19dc6); M( 2, 0, 11, 3); |
| 100 | T(f, g, h, a, b, c, d, e, 3, 0x240ca1cc); M( 3, 1, 12, 4); |
| 101 | T(e, f, g, h, a, b, c, d, 4, 0x2de92c6f); M( 4, 2, 13, 5); |
| 102 | T(d, e, f, g, h, a, b, c, 5, 0x4a7484aa); M( 5, 3, 14, 6); |
| 103 | T(c, d, e, f, g, h, a, b, 6, 0x5cb0a9dc); M( 6, 4, 15, 7); |
| 104 | T(b, c, d, e, f, g, h, a, 7, 0x76f988da); M( 7, 5, 0, 8); |
| 105 | T(a, b, c, d, e, f, g, h, 8, 0x983e5152); M( 8, 6, 1, 9); |
| 106 | T(h, a, b, c, d, e, f, g, 9, 0xa831c66d); M( 9, 7, 2, 10); |
| 107 | T(g, h, a, b, c, d, e, f, 10, 0xb00327c8); M(10, 8, 3, 11); |
| 108 | T(f, g, h, a, b, c, d, e, 11, 0xbf597fc7); M(11, 9, 4, 12); |
| 109 | T(e, f, g, h, a, b, c, d, 12, 0xc6e00bf3); M(12, 10, 5, 13); |
| 110 | T(d, e, f, g, h, a, b, c, 13, 0xd5a79147); M(13, 11, 6, 14); |
| 111 | T(c, d, e, f, g, h, a, b, 14, 0x06ca6351); M(14, 12, 7, 15); |
| 112 | T(b, c, d, e, f, g, h, a, 15, 0x14292967); M(15, 13, 8, 0); |
| 113 | T(a, b, c, d, e, f, g, h, 0, 0x27b70a85); M( 0, 14, 9, 1); |
| 114 | T(h, a, b, c, d, e, f, g, 1, 0x2e1b2138); M( 1, 15, 10, 2); |
| 115 | T(g, h, a, b, c, d, e, f, 2, 0x4d2c6dfc); M( 2, 0, 11, 3); |
| 116 | T(f, g, h, a, b, c, d, e, 3, 0x53380d13); M( 3, 1, 12, 4); |
| 117 | T(e, f, g, h, a, b, c, d, 4, 0x650a7354); M( 4, 2, 13, 5); |
| 118 | T(d, e, f, g, h, a, b, c, 5, 0x766a0abb); M( 5, 3, 14, 6); |
| 119 | T(c, d, e, f, g, h, a, b, 6, 0x81c2c92e); M( 6, 4, 15, 7); |
| 120 | T(b, c, d, e, f, g, h, a, 7, 0x92722c85); M( 7, 5, 0, 8); |
| 121 | T(a, b, c, d, e, f, g, h, 8, 0xa2bfe8a1); M( 8, 6, 1, 9); |
| 122 | T(h, a, b, c, d, e, f, g, 9, 0xa81a664b); M( 9, 7, 2, 10); |
| 123 | T(g, h, a, b, c, d, e, f, 10, 0xc24b8b70); M(10, 8, 3, 11); |
| 124 | T(f, g, h, a, b, c, d, e, 11, 0xc76c51a3); M(11, 9, 4, 12); |
| 125 | T(e, f, g, h, a, b, c, d, 12, 0xd192e819); M(12, 10, 5, 13); |
| 126 | T(d, e, f, g, h, a, b, c, 13, 0xd6990624); M(13, 11, 6, 14); |
| 127 | T(c, d, e, f, g, h, a, b, 14, 0xf40e3585); M(14, 12, 7, 15); |
| 128 | T(b, c, d, e, f, g, h, a, 15, 0x106aa070); M(15, 13, 8, 0); |
| 129 | T(a, b, c, d, e, f, g, h, 0, 0x19a4c116); |
| 130 | T(h, a, b, c, d, e, f, g, 1, 0x1e376c08); |
| 131 | T(g, h, a, b, c, d, e, f, 2, 0x2748774c); |
| 132 | T(f, g, h, a, b, c, d, e, 3, 0x34b0bcb5); |
| 133 | T(e, f, g, h, a, b, c, d, 4, 0x391c0cb3); |
| 134 | T(d, e, f, g, h, a, b, c, 5, 0x4ed8aa4a); |
| 135 | T(c, d, e, f, g, h, a, b, 6, 0x5b9cca4f); |
| 136 | T(b, c, d, e, f, g, h, a, 7, 0x682e6ff3); |
| 137 | T(a, b, c, d, e, f, g, h, 8, 0x748f82ee); |
| 138 | T(h, a, b, c, d, e, f, g, 9, 0x78a5636f); |
| 139 | T(g, h, a, b, c, d, e, f, 10, 0x84c87814); |
| 140 | T(f, g, h, a, b, c, d, e, 11, 0x8cc70208); |
| 141 | T(e, f, g, h, a, b, c, d, 12, 0x90befffa); |
| 142 | T(d, e, f, g, h, a, b, c, 13, 0xa4506ceb); |
| 143 | T(c, d, e, f, g, h, a, b, 14, 0xbef9a3f7); |
| 144 | T(b, c, d, e, f, g, h, a, 15, 0xc67178f2); |
| 145 | |
| 146 | /* --- Update the chaining variables --- */ |
| 147 | |
| 148 | ctx->a += a; ctx->b += b; ctx->c += c; ctx->d += d; |
| 149 | ctx->e += e; ctx->f += f; ctx->g += g; ctx->h += h; |
| 150 | } |
| 151 | |
| 152 | /* --- @sha256_init@, @sha224_init@ --- * |
| 153 | * |
| 154 | * Arguments: @sha256_ctx *ctx@ = pointer to context block to initialize |
| 155 | * |
| 156 | * Returns: --- |
| 157 | * |
| 158 | * Use: Initializes a context block ready for hashing. |
| 159 | */ |
| 160 | |
| 161 | void sha256_init(sha256_ctx *ctx) |
| 162 | { |
| 163 | ctx->a = 0x6a09e667; |
| 164 | ctx->b = 0xbb67ae85; |
| 165 | ctx->c = 0x3c6ef372; |
| 166 | ctx->d = 0xa54ff53a; |
| 167 | ctx->e = 0x510e527f; |
| 168 | ctx->f = 0x9b05688c; |
| 169 | ctx->g = 0x1f83d9ab; |
| 170 | ctx->h = 0x5be0cd19; |
| 171 | ctx->off = 0; |
| 172 | ctx->nl = ctx->nh = 0; |
| 173 | } |
| 174 | |
| 175 | void sha224_init(sha256_ctx *ctx) |
| 176 | { |
| 177 | ctx->a = 0xc1059ed8; |
| 178 | ctx->b = 0x367cd507; |
| 179 | ctx->c = 0x3070dd17; |
| 180 | ctx->d = 0xf70e5939; |
| 181 | ctx->e = 0xffc00b31; |
| 182 | ctx->f = 0x68581511; |
| 183 | ctx->g = 0x64f98fa7; |
| 184 | ctx->h = 0xbefa4fa4; |
| 185 | ctx->off = 0; |
| 186 | ctx->nl = ctx->nh = 0; |
| 187 | } |
| 188 | |
| 189 | /* --- @sha256_set@, @sha224_set@ --- * |
| 190 | * |
| 191 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 192 | * @const void *buf@ = pointer to state buffer |
| 193 | * @unsigned long count@ = current count of bytes processed |
| 194 | * |
| 195 | * Returns: --- |
| 196 | * |
| 197 | * Use: Initializes a context block from a given state. This is |
| 198 | * useful in cases where the initial hash state is meant to be |
| 199 | * secret, e.g., for NMAC and HMAC support. |
| 200 | */ |
| 201 | |
| 202 | void sha256_set(sha256_ctx *ctx, const void *buf, unsigned long count) |
| 203 | { |
| 204 | const octet *p = buf; |
| 205 | ctx->a = LOAD32(p + 0); |
| 206 | ctx->b = LOAD32(p + 4); |
| 207 | ctx->c = LOAD32(p + 8); |
| 208 | ctx->d = LOAD32(p + 12); |
| 209 | ctx->e = LOAD32(p + 16); |
| 210 | ctx->f = LOAD32(p + 20); |
| 211 | ctx->g = LOAD32(p + 24); |
| 212 | ctx->h = LOAD32(p + 28); |
| 213 | ctx->off = 0; |
| 214 | ctx->nl = U32(count); |
| 215 | ctx->nh = U32(((count & ~(unsigned long)MASK32) >> 16) >> 16); |
| 216 | } |
| 217 | |
| 218 | /* --- @sha256_hash@, @sha224_hash@ --- * |
| 219 | * |
| 220 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 221 | * @const void *buf@ = buffer of data to hash |
| 222 | * @size_t sz@ = size of buffer to hash |
| 223 | * |
| 224 | * Returns: --- |
| 225 | * |
| 226 | * Use: Hashes a buffer of data. The buffer may be of any size and |
| 227 | * alignment. |
| 228 | */ |
| 229 | |
| 230 | void sha256_hash(sha256_ctx *ctx, const void *buf, size_t sz) |
| 231 | { |
| 232 | HASH_BUFFER(SHA256, sha256, ctx, buf, sz); |
| 233 | } |
| 234 | |
| 235 | /* --- @sha256_done, @sha224_done@ --- * |
| 236 | * |
| 237 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
| 238 | * @void *hash@ = pointer to output buffer |
| 239 | * |
| 240 | * Returns: --- |
| 241 | * |
| 242 | * Use: Returns the hash of the data read so far. |
| 243 | */ |
| 244 | |
| 245 | static void final(sha256_ctx *ctx) |
| 246 | { |
| 247 | HASH_PAD(SHA256, sha256, ctx, 0x80, 0, 8); |
| 248 | STORE32(ctx->buf + SHA256_BUFSZ - 8, (ctx->nl >> 29) | (ctx->nh << 3)); |
| 249 | STORE32(ctx->buf + SHA256_BUFSZ - 4, ctx->nl << 3); |
| 250 | sha256_compress(ctx, ctx->buf); |
| 251 | } |
| 252 | |
| 253 | void sha256_done(sha256_ctx *ctx, void *hash) |
| 254 | { |
| 255 | octet *p = hash; |
| 256 | final(ctx); |
| 257 | STORE32(p + 0, ctx->a); |
| 258 | STORE32(p + 4, ctx->b); |
| 259 | STORE32(p + 8, ctx->c); |
| 260 | STORE32(p + 12, ctx->d); |
| 261 | STORE32(p + 16, ctx->e); |
| 262 | STORE32(p + 20, ctx->f); |
| 263 | STORE32(p + 24, ctx->g); |
| 264 | STORE32(p + 28, ctx->h); |
| 265 | } |
| 266 | |
| 267 | void sha224_done(sha224_ctx *ctx, void *hash) |
| 268 | { |
| 269 | octet *p = hash; |
| 270 | final(ctx); |
| 271 | STORE32(p + 0, ctx->a); |
| 272 | STORE32(p + 4, ctx->b); |
| 273 | STORE32(p + 8, ctx->c); |
| 274 | STORE32(p + 12, ctx->d); |
| 275 | STORE32(p + 16, ctx->e); |
| 276 | STORE32(p + 20, ctx->f); |
| 277 | STORE32(p + 24, ctx->g); |
| 278 | } |
| 279 | |
| 280 | /* --- @sha256_state@, @sha224_state@ --- * |
| 281 | * |
| 282 | * Arguments: @sha256_ctx *ctx@ = pointer to context |
| 283 | * @void *state@ = pointer to buffer for current state |
| 284 | * |
| 285 | * Returns: Number of bytes written to the hash function so far. |
| 286 | * |
| 287 | * Use: Returns the current state of the hash function such that |
| 288 | * it can be passed to @sha256_set@. |
| 289 | */ |
| 290 | |
| 291 | unsigned long sha256_state(sha256_ctx *ctx, void *state) |
| 292 | { |
| 293 | octet *p = state; |
| 294 | STORE32(p + 0, ctx->a); |
| 295 | STORE32(p + 4, ctx->b); |
| 296 | STORE32(p + 8, ctx->c); |
| 297 | STORE32(p + 12, ctx->d); |
| 298 | STORE32(p + 16, ctx->e); |
| 299 | STORE32(p + 20, ctx->f); |
| 300 | STORE32(p + 24, ctx->g); |
| 301 | STORE32(p + 28, ctx->h); |
| 302 | return (ctx->nl | ((ctx->nh << 16) << 16)); |
| 303 | } |
| 304 | |
| 305 | /* --- Generic interface --- */ |
| 306 | |
| 307 | #define HASHES(_) \ |
| 308 | _(SHA224, sha224) \ |
| 309 | _(SHA256, sha256) |
| 310 | |
| 311 | HASHES(GHASH_DEF) |
| 312 | |
| 313 | /*----- Test rig ----------------------------------------------------------*/ |
| 314 | |
| 315 | #ifdef TEST_RIG |
| 316 | |
| 317 | #include <mLib/testrig.h> |
| 318 | |
| 319 | HASHES(HASH_VERIFY) |
| 320 | |
| 321 | static const test_chunk defs[] = { |
| 322 | HASHES(HASH_TESTDEFS) |
| 323 | { 0, 0, { 0 } } |
| 324 | }; |
| 325 | |
| 326 | int main(int argc, char *argv[]) |
| 327 | { |
| 328 | test_run(argc, argv, defs, SRCDIR "/t/sha256"); |
| 329 | return (0); |
| 330 | } |
| 331 | |
| 332 | #endif |
| 333 | |
| 334 | /*----- That's all, folks -------------------------------------------------*/ |