[sgt/putty] / sshsha.c

/*
 * SHA1 hash algorithm. Used in SSH-2 as a MAC, and the transform is
 * also used as a `stirring' function for the PuTTY random number
 * pool. Implemented directly from the specification by Simon
 * Tatham.
 */

#include "ssh.h"

/* ----------------------------------------------------------------------
 * Core SHA algorithm: processes 16-word blocks into a message digest.
 */

#define rol(x,y) ( ((x) << (y)) | (((uint32)x) >> (32-y)) )

static void SHA_Core_Init(uint32 h[5])
{
    h[0] = 0x67452301;
    h[1] = 0xefcdab89;
    h[2] = 0x98badcfe;
    h[3] = 0x10325476;
    h[4] = 0xc3d2e1f0;
}

void SHATransform(word32 * digest, word32 * block)
{
    word32 w[80];
    word32 a, b, c, d, e;
    int t;

    for (t = 0; t < 16; t++)
	w[t] = block[t];

    for (t = 16; t < 80; t++) {
	word32 tmp = w[t - 3] ^ w[t - 8] ^ w[t - 14] ^ w[t - 16];
	w[t] = rol(tmp, 1);
    }

    a = digest[0];
    b = digest[1];
    c = digest[2];
    d = digest[3];
    e = digest[4];

    for (t = 0; t < 20; t++) {
	word32 tmp =
	    rol(a, 5) + ((b & c) | (d & ~b)) + e + w[t] + 0x5a827999;
	e = d;
	d = c;
	c = rol(b, 30);
	b = a;
	a = tmp;
    }
    for (t = 20; t < 40; t++) {
	word32 tmp = rol(a, 5) + (b ^ c ^ d) + e + w[t] + 0x6ed9eba1;
	e = d;
	d = c;
	c = rol(b, 30);
	b = a;
	a = tmp;
    }
    for (t = 40; t < 60; t++) {
	word32 tmp = rol(a,
			 5) + ((b & c) | (b & d) | (c & d)) + e + w[t] +
	    0x8f1bbcdc;
	e = d;
	d = c;
	c = rol(b, 30);
	b = a;
	a = tmp;
    }
    for (t = 60; t < 80; t++) {
	word32 tmp = rol(a, 5) + (b ^ c ^ d) + e + w[t] + 0xca62c1d6;
	e = d;
	d = c;
	c = rol(b, 30);
	b = a;
	a = tmp;
    }

    digest[0] += a;
    digest[1] += b;
    digest[2] += c;
    digest[3] += d;
    digest[4] += e;
}

/* ----------------------------------------------------------------------
 * Outer SHA algorithm: take an arbitrary length byte string,
 * convert it into 16-word blocks with the prescribed padding at
 * the end, and pass those blocks to the core SHA algorithm.
 */

void SHA_Init(SHA_State * s)
{
    SHA_Core_Init(s->h);
    s->blkused = 0;
    s->lenhi = s->lenlo = 0;
}

void SHA_Bytes(SHA_State * s, void *p, int len)
{
    unsigned char *q = (unsigned char *) p;
    uint32 wordblock[16];
    uint32 lenw = len;
    int i;

    /*
     * Update the length field.
     */
    s->lenlo += lenw;
    s->lenhi += (s->lenlo < lenw);

    if (s->blkused && s->blkused + len < 64) {
	/*
	 * Trivial case: just add to the block.
	 */
	memcpy(s->block + s->blkused, q, len);
	s->blkused += len;
    } else {
	/*
	 * We must complete and process at least one block.
	 */
	while (s->blkused + len >= 64) {
	    memcpy(s->block + s->blkused, q, 64 - s->blkused);
	    q += 64 - s->blkused;
	    len -= 64 - s->blkused;
	    /* Now process the block. Gather bytes big-endian into words */
	    for (i = 0; i < 16; i++) {
		wordblock[i] =
		    (((uint32) s->block[i * 4 + 0]) << 24) |
		    (((uint32) s->block[i * 4 + 1]) << 16) |
		    (((uint32) s->block[i * 4 + 2]) << 8) |
		    (((uint32) s->block[i * 4 + 3]) << 0);
	    }
	    SHATransform(s->h, wordblock);
	    s->blkused = 0;
	}
	memcpy(s->block, q, len);
	s->blkused = len;
    }
}

void SHA_Final(SHA_State * s, unsigned char *output)
{
    int i;
    int pad;
    unsigned char c[64];
    uint32 lenhi, lenlo;

    if (s->blkused >= 56)
	pad = 56 + 64 - s->blkused;
    else
	pad = 56 - s->blkused;

    lenhi = (s->lenhi << 3) | (s->lenlo >> (32 - 3));
    lenlo = (s->lenlo << 3);

    memset(c, 0, pad);
    c[0] = 0x80;
    SHA_Bytes(s, &c, pad);

    c[0] = (lenhi >> 24) & 0xFF;
    c[1] = (lenhi >> 16) & 0xFF;
    c[2] = (lenhi >> 8) & 0xFF;
    c[3] = (lenhi >> 0) & 0xFF;
    c[4] = (lenlo >> 24) & 0xFF;
    c[5] = (lenlo >> 16) & 0xFF;
    c[6] = (lenlo >> 8) & 0xFF;
    c[7] = (lenlo >> 0) & 0xFF;

    SHA_Bytes(s, &c, 8);

    for (i = 0; i < 5; i++) {
	output[i * 4] = (s->h[i] >> 24) & 0xFF;
	output[i * 4 + 1] = (s->h[i] >> 16) & 0xFF;
	output[i * 4 + 2] = (s->h[i] >> 8) & 0xFF;
	output[i * 4 + 3] = (s->h[i]) & 0xFF;
    }
}

void SHA_Simple(void *p, int len, unsigned char *output)
{
    SHA_State s;

    SHA_Init(&s);
    SHA_Bytes(&s, p, len);
    SHA_Final(&s, output);
}

/*
 * Thin abstraction for things where hashes are pluggable.
 */

static void *sha1_init(void)
{
    SHA_State *s;

    s = snew(SHA_State);
    SHA_Init(s);
    return s;
}

static void sha1_bytes(void *handle, void *p, int len)
{
    SHA_State *s = handle;

    SHA_Bytes(s, p, len);
}

static void sha1_final(void *handle, unsigned char *output)
{
    SHA_State *s = handle;

    SHA_Final(s, output);
    sfree(s);
}

const struct ssh_hash ssh_sha1 = {
    sha1_init, sha1_bytes, sha1_final, 20, "SHA-1"
};

/* ----------------------------------------------------------------------
 * The above is the SHA-1 algorithm itself. Now we implement the
 * HMAC wrapper on it.
 */

static void *sha1_make_context(void)
{
    return snewn(3, SHA_State);
}

static void sha1_free_context(void *handle)
{
    sfree(handle);
}

static void sha1_key_internal(void *handle, unsigned char *key, int len)
{
    SHA_State *keys = (SHA_State *)handle;
    unsigned char foo[64];
    int i;

    memset(foo, 0x36, 64);
    for (i = 0; i < len && i < 64; i++)
	foo[i] ^= key[i];
    SHA_Init(&keys[0]);
    SHA_Bytes(&keys[0], foo, 64);

    memset(foo, 0x5C, 64);
    for (i = 0; i < len && i < 64; i++)
	foo[i] ^= key[i];
    SHA_Init(&keys[1]);
    SHA_Bytes(&keys[1], foo, 64);

    smemclr(foo, 64);		       /* burn the evidence */
}

static void sha1_key(void *handle, unsigned char *key)
{
    sha1_key_internal(handle, key, 20);
}

static void sha1_key_buggy(void *handle, unsigned char *key)
{
    sha1_key_internal(handle, key, 16);
}

static void hmacsha1_start(void *handle)
{
    SHA_State *keys = (SHA_State *)handle;

    keys[2] = keys[0];		      /* structure copy */
}

static void hmacsha1_bytes(void *handle, unsigned char const *blk, int len)
{
    SHA_State *keys = (SHA_State *)handle;
    SHA_Bytes(&keys[2], (void *)blk, len);
}

static void hmacsha1_genresult(void *handle, unsigned char *hmac)
{
    SHA_State *keys = (SHA_State *)handle;
    SHA_State s;
    unsigned char intermediate[20];

    s = keys[2];		       /* structure copy */
    SHA_Final(&s, intermediate);
    s = keys[1];		       /* structure copy */
    SHA_Bytes(&s, intermediate, 20);
    SHA_Final(&s, hmac);
}

static void sha1_do_hmac(void *handle, unsigned char *blk, int len,
			 unsigned long seq, unsigned char *hmac)
{
    unsigned char seqbuf[4];

    PUT_32BIT_MSB_FIRST(seqbuf, seq);
    hmacsha1_start(handle);
    hmacsha1_bytes(handle, seqbuf, 4);
    hmacsha1_bytes(handle, blk, len);
    hmacsha1_genresult(handle, hmac);
}

static void sha1_generate(void *handle, unsigned char *blk, int len,
			  unsigned long seq)
{
    sha1_do_hmac(handle, blk, len, seq, blk + len);
}

static int hmacsha1_verresult(void *handle, unsigned char const *hmac)
{
    unsigned char correct[20];
    hmacsha1_genresult(handle, correct);
    return !memcmp(correct, hmac, 20);
}

static int sha1_verify(void *handle, unsigned char *blk, int len,
		       unsigned long seq)
{
    unsigned char correct[20];
    sha1_do_hmac(handle, blk, len, seq, correct);
    return !memcmp(correct, blk + len, 20);
}

static void hmacsha1_96_genresult(void *handle, unsigned char *hmac)
{
    unsigned char full[20];
    hmacsha1_genresult(handle, full);
    memcpy(hmac, full, 12);
}

static void sha1_96_generate(void *handle, unsigned char *blk, int len,
			     unsigned long seq)
{
    unsigned char full[20];
    sha1_do_hmac(handle, blk, len, seq, full);
    memcpy(blk + len, full, 12);
}

static int hmacsha1_96_verresult(void *handle, unsigned char const *hmac)
{
    unsigned char correct[20];
    hmacsha1_genresult(handle, correct);
    return !memcmp(correct, hmac, 12);
}

static int sha1_96_verify(void *handle, unsigned char *blk, int len,
		       unsigned long seq)
{
    unsigned char correct[20];
    sha1_do_hmac(handle, blk, len, seq, correct);
    return !memcmp(correct, blk + len, 12);
}

void hmac_sha1_simple(void *key, int keylen, void *data, int datalen,
		      unsigned char *output) {
    SHA_State states[2];
    unsigned char intermediate[20];

    sha1_key_internal(states, key, keylen);
    SHA_Bytes(&states[0], data, datalen);
    SHA_Final(&states[0], intermediate);

    SHA_Bytes(&states[1], intermediate, 20);
    SHA_Final(&states[1], output);
}

const struct ssh_mac ssh_hmac_sha1 = {
    sha1_make_context, sha1_free_context, sha1_key,
    sha1_generate, sha1_verify,
    hmacsha1_start, hmacsha1_bytes, hmacsha1_genresult, hmacsha1_verresult,
    "hmac-sha1",
    20,
    "HMAC-SHA1"
};

const struct ssh_mac ssh_hmac_sha1_96 = {
    sha1_make_context, sha1_free_context, sha1_key,
    sha1_96_generate, sha1_96_verify,
    hmacsha1_start, hmacsha1_bytes,
    hmacsha1_96_genresult, hmacsha1_96_verresult,
    "hmac-sha1-96",
    12,
    "HMAC-SHA1-96"
};

const struct ssh_mac ssh_hmac_sha1_buggy = {
    sha1_make_context, sha1_free_context, sha1_key_buggy,
    sha1_generate, sha1_verify,
    hmacsha1_start, hmacsha1_bytes, hmacsha1_genresult, hmacsha1_verresult,
    "hmac-sha1",
    20,
    "bug-compatible HMAC-SHA1"
};

const struct ssh_mac ssh_hmac_sha1_96_buggy = {
    sha1_make_context, sha1_free_context, sha1_key_buggy,
    sha1_96_generate, sha1_96_verify,
    hmacsha1_start, hmacsha1_bytes,
    hmacsha1_96_genresult, hmacsha1_96_verresult,
    "hmac-sha1-96",
    12,
    "bug-compatible HMAC-SHA1-96"
};
Commit	Line	Data
374330e2	1	/*
2e85c969	2	* SHA1 hash algorithm. Used in SSH-2 as a MAC, and the transform is
e5574168	3	* also used as a `stirring' function for the PuTTY random number
	4	* pool. Implemented directly from the specification by Simon
	5	* Tatham.
374330e2	6	*/
	7
	8	#include "ssh.h"
	9
e5574168	10	/* ----------------------------------------------------------------------
	11	* Core SHA algorithm: processes 16-word blocks into a message digest.
	12	*/
	13
	14	#define rol(x,y) ( ((x) << (y)) \| (((uint32)x) >> (32-y)) )
	15
d5696ae5	16	static void SHA_Core_Init(uint32 h[5])
32874aea	17	{
e5574168	18	h[0] = 0x67452301;
	19	h[1] = 0xefcdab89;
	20	h[2] = 0x98badcfe;
	21	h[3] = 0x10325476;
	22	h[4] = 0xc3d2e1f0;
	23	}
e9483e66	24
32874aea	25	void SHATransform(word32 * digest, word32 * block)
32874aea	26	{
e9483e66	27	word32 w[80];
32874aea	28	word32 a, b, c, d, e;
e9483e66	29	int t;
	30
	31	for (t = 0; t < 16; t++)
32874aea	32	w[t] = block[t];
e9483e66	33
e9483e66	34	for (t = 16; t < 80; t++) {
32874aea	35	word32 tmp = w[t - 3] ^ w[t - 8] ^ w[t - 14] ^ w[t - 16];
32874aea	36	w[t] = rol(tmp, 1);
e9483e66	37	}
	38
	39	a = digest[0];
	40	b = digest[1];
	41	c = digest[2];
	42	d = digest[3];
	43	e = digest[4];
	44
	45	for (t = 0; t < 20; t++) {
32874aea	46	word32 tmp =
	47	rol(a, 5) + ((b & c) \| (d & ~b)) + e + w[t] + 0x5a827999;
	48	e = d;
	49	d = c;
	50	c = rol(b, 30);
	51	b = a;
	52	a = tmp;
e9483e66	53	}
e9483e66	54	for (t = 20; t < 40; t++) {
32874aea	55	word32 tmp = rol(a, 5) + (b ^ c ^ d) + e + w[t] + 0x6ed9eba1;
	56	e = d;
	57	d = c;
	58	c = rol(b, 30);
	59	b = a;
	60	a = tmp;
e9483e66	61	}
e9483e66	62	for (t = 40; t < 60; t++) {
32874aea	63	word32 tmp = rol(a,
	64	5) + ((b & c) \| (b & d) \| (c & d)) + e + w[t] +
	65	0x8f1bbcdc;
	66	e = d;
	67	d = c;
	68	c = rol(b, 30);
	69	b = a;
	70	a = tmp;
e9483e66	71	}
e9483e66	72	for (t = 60; t < 80; t++) {
32874aea	73	word32 tmp = rol(a, 5) + (b ^ c ^ d) + e + w[t] + 0xca62c1d6;
	74	e = d;
	75	d = c;
	76	c = rol(b, 30);
	77	b = a;
	78	a = tmp;
e9483e66	79	}
	80
	81	digest[0] += a;
	82	digest[1] += b;
	83	digest[2] += c;
	84	digest[3] += d;
	85	digest[4] += e;
374330e2	86	}
e5574168	87
	88	/* ----------------------------------------------------------------------
	89	* Outer SHA algorithm: take an arbitrary length byte string,
	90	* convert it into 16-word blocks with the prescribed padding at
	91	* the end, and pass those blocks to the core SHA algorithm.
	92	*/
	93
32874aea	94	void SHA_Init(SHA_State * s)
32874aea	95	{
e5574168	96	SHA_Core_Init(s->h);
	97	s->blkused = 0;
	98	s->lenhi = s->lenlo = 0;
	99	}
	100
32874aea	101	void SHA_Bytes(SHA_State * s, void *p, int len)
	102	{
	103	unsigned char q = (unsigned char ) p;
e5574168	104	uint32 wordblock[16];
	105	uint32 lenw = len;
	106	int i;
	107
	108	/*
	109	* Update the length field.
	110	*/
	111	s->lenlo += lenw;
	112	s->lenhi += (s->lenlo < lenw);
	113
32874aea	114	if (s->blkused && s->blkused + len < 64) {
	115	/*
	116	* Trivial case: just add to the block.
	117	*/
	118	memcpy(s->block + s->blkused, q, len);
	119	s->blkused += len;
e5574168	120	} else {
32874aea	121	/*
	122	* We must complete and process at least one block.
	123	*/
	124	while (s->blkused + len >= 64) {
	125	memcpy(s->block + s->blkused, q, 64 - s->blkused);
	126	q += 64 - s->blkused;
	127	len -= 64 - s->blkused;
	128	/* Now process the block. Gather bytes big-endian into words */
	129	for (i = 0; i < 16; i++) {
	130	wordblock[i] =
	131	(((uint32) s->block[i * 4 + 0]) << 24) \|
	132	(((uint32) s->block[i * 4 + 1]) << 16) \|
	133	(((uint32) s->block[i * 4 + 2]) << 8) \|
	134	(((uint32) s->block[i * 4 + 3]) << 0);
	135	}
	136	SHATransform(s->h, wordblock);
	137	s->blkused = 0;
	138	}
	139	memcpy(s->block, q, len);
	140	s->blkused = len;
e5574168	141	}
	142	}
	143
32874aea	144	void SHA_Final(SHA_State * s, unsigned char *output)
32874aea	145	{
e5574168	146	int i;
	147	int pad;
	148	unsigned char c[64];
	149	uint32 lenhi, lenlo;
	150
	151	if (s->blkused >= 56)
32874aea	152	pad = 56 + 64 - s->blkused;
e5574168	153	else
32874aea	154	pad = 56 - s->blkused;
e5574168	155
32874aea	156	lenhi = (s->lenhi << 3) \| (s->lenlo >> (32 - 3));
e5574168	157	lenlo = (s->lenlo << 3);
	158
	159	memset(c, 0, pad);
	160	c[0] = 0x80;
	161	SHA_Bytes(s, &c, pad);
	162
	163	c[0] = (lenhi >> 24) & 0xFF;
	164	c[1] = (lenhi >> 16) & 0xFF;
32874aea	165	c[2] = (lenhi >> 8) & 0xFF;
32874aea	166	c[3] = (lenhi >> 0) & 0xFF;
e5574168	167	c[4] = (lenlo >> 24) & 0xFF;
e5574168	168	c[5] = (lenlo >> 16) & 0xFF;
32874aea	169	c[6] = (lenlo >> 8) & 0xFF;
32874aea	170	c[7] = (lenlo >> 0) & 0xFF;
e5574168	171
	172	SHA_Bytes(s, &c, 8);
	173
	174	for (i = 0; i < 5; i++) {
32874aea	175	output[i * 4] = (s->h[i] >> 24) & 0xFF;
	176	output[i * 4 + 1] = (s->h[i] >> 16) & 0xFF;
	177	output[i * 4 + 2] = (s->h[i] >> 8) & 0xFF;
	178	output[i * 4 + 3] = (s->h[i]) & 0xFF;
e5574168	179	}
	180	}
	181
32874aea	182	void SHA_Simple(void p, int len, unsigned char output)
32874aea	183	{
e5574168	184	SHA_State s;
	185
	186	SHA_Init(&s);
	187	SHA_Bytes(&s, p, len);
	188	SHA_Final(&s, output);
	189	}
	190
b672f405	191	/*
	192	* Thin abstraction for things where hashes are pluggable.
	193	*/
	194
	195	static void *sha1_init(void)
	196	{
	197	SHA_State *s;
	198
	199	s = snew(SHA_State);
	200	SHA_Init(s);
	201	return s;
	202	}
	203
	204	static void sha1_bytes(void handle, void p, int len)
	205	{
	206	SHA_State *s = handle;
	207
	208	SHA_Bytes(s, p, len);
	209	}
	210
	211	static void sha1_final(void handle, unsigned char output)
	212	{
	213	SHA_State *s = handle;
	214
	215	SHA_Final(s, output);
	216	sfree(s);
	217	}
	218
	219	const struct ssh_hash ssh_sha1 = {
c6daaa1a	220	sha1_init, sha1_bytes, sha1_final, 20, "SHA-1"
b672f405	221	};
b672f405	222
e5574168	223	/* ----------------------------------------------------------------------
	224	* The above is the SHA-1 algorithm itself. Now we implement the
	225	* HMAC wrapper on it.
	226	*/
	227
e0e1a00d	228	static void *sha1_make_context(void)
e0e1a00d	229	{
9916cc1e	230	return snewn(3, SHA_State);
e0e1a00d	231	}
	232
	233	static void sha1_free_context(void *handle)
	234	{
	235	sfree(handle);
	236	}
e5574168	237
e0e1a00d	238	static void sha1_key_internal(void handle, unsigned char key, int len)
32874aea	239	{
e0e1a00d	240	SHA_State keys = (SHA_State )handle;
e5574168	241	unsigned char foo[64];
	242	int i;
	243
	244	memset(foo, 0x36, 64);
	245	for (i = 0; i < len && i < 64; i++)
32874aea	246	foo[i] ^= key[i];
e0e1a00d	247	SHA_Init(&keys[0]);
e0e1a00d	248	SHA_Bytes(&keys[0], foo, 64);
e5574168	249
	250	memset(foo, 0x5C, 64);
	251	for (i = 0; i < len && i < 64; i++)
32874aea	252	foo[i] ^= key[i];
e0e1a00d	253	SHA_Init(&keys[1]);
e0e1a00d	254	SHA_Bytes(&keys[1], foo, 64);
e5574168	255
dfb88efd	256	smemclr(foo, 64); /* burn the evidence */
e5574168	257	}
e5574168	258
e0e1a00d	259	static void sha1_key(void handle, unsigned char key)
32874aea	260	{
e0e1a00d	261	sha1_key_internal(handle, key, 20);
7591b9ff	262	}
7591b9ff	263
e0e1a00d	264	static void sha1_key_buggy(void handle, unsigned char key)
32874aea	265	{
e0e1a00d	266	sha1_key_internal(handle, key, 16);
7591b9ff	267	}
7591b9ff	268
9916cc1e	269	static void hmacsha1_start(void *handle)
	270	{
	271	SHA_State keys = (SHA_State )handle;
	272
	273	keys[2] = keys[0]; /* structure copy */
	274	}
	275
	276	static void hmacsha1_bytes(void handle, unsigned char const blk, int len)
	277	{
	278	SHA_State keys = (SHA_State )handle;
	279	SHA_Bytes(&keys[2], (void *)blk, len);
	280	}
	281
	282	static void hmacsha1_genresult(void handle, unsigned char hmac)
32874aea	283	{
e0e1a00d	284	SHA_State keys = (SHA_State )handle;
e5574168	285	SHA_State s;
	286	unsigned char intermediate[20];
	287
9916cc1e	288	s = keys[2]; /* structure copy */
e5574168	289	SHA_Final(&s, intermediate);
e0e1a00d	290	s = keys[1]; /* structure copy */
e5574168	291	SHA_Bytes(&s, intermediate, 20);
	292	SHA_Final(&s, hmac);
	293	}
	294
9916cc1e	295	static void sha1_do_hmac(void handle, unsigned char blk, int len,
	296	unsigned long seq, unsigned char *hmac)
	297	{
	298	unsigned char seqbuf[4];
	299
bb4a3bb6	300	PUT_32BIT_MSB_FIRST(seqbuf, seq);
9916cc1e	301	hmacsha1_start(handle);
	302	hmacsha1_bytes(handle, seqbuf, 4);
	303	hmacsha1_bytes(handle, blk, len);
	304	hmacsha1_genresult(handle, hmac);
	305	}
	306
e0e1a00d	307	static void sha1_generate(void handle, unsigned char blk, int len,
e0e1a00d	308	unsigned long seq)
32874aea	309	{
e0e1a00d	310	sha1_do_hmac(handle, blk, len, seq, blk + len);
e5574168	311	}
e5574168	312
9916cc1e	313	static int hmacsha1_verresult(void handle, unsigned char const hmac)
	314	{
	315	unsigned char correct[20];
	316	hmacsha1_genresult(handle, correct);
	317	return !memcmp(correct, hmac, 20);
	318	}
	319
e0e1a00d	320	static int sha1_verify(void handle, unsigned char blk, int len,
e0e1a00d	321	unsigned long seq)
32874aea	322	{
e5574168	323	unsigned char correct[20];
e0e1a00d	324	sha1_do_hmac(handle, blk, len, seq, correct);
32874aea	325	return !memcmp(correct, blk + len, 20);
e5574168	326	}
e5574168	327
9916cc1e	328	static void hmacsha1_96_genresult(void handle, unsigned char hmac)
	329	{
	330	unsigned char full[20];
	331	hmacsha1_genresult(handle, full);
	332	memcpy(hmac, full, 12);
	333	}
	334
6668a75e	335	static void sha1_96_generate(void handle, unsigned char blk, int len,
	336	unsigned long seq)
	337	{
	338	unsigned char full[20];
	339	sha1_do_hmac(handle, blk, len, seq, full);
	340	memcpy(blk + len, full, 12);
	341	}
	342
9916cc1e	343	static int hmacsha1_96_verresult(void handle, unsigned char const hmac)
	344	{
	345	unsigned char correct[20];
	346	hmacsha1_genresult(handle, correct);
	347	return !memcmp(correct, hmac, 12);
	348	}
	349
6668a75e	350	static int sha1_96_verify(void handle, unsigned char blk, int len,
	351	unsigned long seq)
	352	{
	353	unsigned char correct[20];
	354	sha1_do_hmac(handle, blk, len, seq, correct);
	355	return !memcmp(correct, blk + len, 12);
	356	}
	357
5c72ca61	358	void hmac_sha1_simple(void key, int keylen, void data, int datalen,
5c72ca61	359	unsigned char *output) {
e0e1a00d	360	SHA_State states[2];
5c72ca61	361	unsigned char intermediate[20];
5c72ca61	362
e0e1a00d	363	sha1_key_internal(states, key, keylen);
	364	SHA_Bytes(&states[0], data, datalen);
	365	SHA_Final(&states[0], intermediate);
5c72ca61	366
e0e1a00d	367	SHA_Bytes(&states[1], intermediate, 20);
e0e1a00d	368	SHA_Final(&states[1], output);
5c72ca61	369	}
5c72ca61	370
1993f323	371	const struct ssh_mac ssh_hmac_sha1 = {
e0e1a00d	372	sha1_make_context, sha1_free_context, sha1_key,
e0e1a00d	373	sha1_generate, sha1_verify,
9916cc1e	374	hmacsha1_start, hmacsha1_bytes, hmacsha1_genresult, hmacsha1_verresult,
e5574168	375	"hmac-sha1",
6c135243	376	20,
6c135243	377	"HMAC-SHA1"
e5574168	378	};
7591b9ff	379
6668a75e	380	const struct ssh_mac ssh_hmac_sha1_96 = {
	381	sha1_make_context, sha1_free_context, sha1_key,
	382	sha1_96_generate, sha1_96_verify,
9916cc1e	383	hmacsha1_start, hmacsha1_bytes,
9916cc1e	384	hmacsha1_96_genresult, hmacsha1_96_verresult,
6668a75e	385	"hmac-sha1-96",
	386	12,
	387	"HMAC-SHA1-96"
	388	};
	389
1993f323	390	const struct ssh_mac ssh_hmac_sha1_buggy = {
e0e1a00d	391	sha1_make_context, sha1_free_context, sha1_key_buggy,
e0e1a00d	392	sha1_generate, sha1_verify,
9916cc1e	393	hmacsha1_start, hmacsha1_bytes, hmacsha1_genresult, hmacsha1_verresult,
7591b9ff	394	"hmac-sha1",
6c135243	395	20,
6c135243	396	"bug-compatible HMAC-SHA1"
7591b9ff	397	};
6668a75e	398
	399	const struct ssh_mac ssh_hmac_sha1_96_buggy = {
	400	sha1_make_context, sha1_free_context, sha1_key_buggy,
	401	sha1_96_generate, sha1_96_verify,
9916cc1e	402	hmacsha1_start, hmacsha1_bytes,
9916cc1e	403	hmacsha1_96_genresult, hmacsha1_96_verresult,
6668a75e	404	"hmac-sha1-96",
	405	12,
	406	"bug-compatible HMAC-SHA1-96"
	407	};