crypt-sha512.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351
  1. // SPDX-License-Identifier: CC0-1.0
  2. /* Based on libxcrypt v4.4.17-0-g6b110bc */
  3. /* One way encryption based on the SHA512-based Unix crypt implementation.
  4. *
  5. * Written by Ulrich Drepper <drepper at redhat.com> in 2007 [1].
  6. * Modified by Zack Weinberg <zackw at panix.com> in 2017, 2018.
  7. * Composed by Björn Esser <besser82 at fedoraproject.org> in 2018.
  8. * Modified by Björn Esser <besser82 at fedoraproject.org> in 2020.
  9. * Modified by Steffen Jaeckel <jaeckel-floss at eyet-services.de> in 2021
  10. * for U-Boot, instead of using the global errno to use a static one
  11. * inside this file.
  12. * To the extent possible under law, the named authors have waived all
  13. * copyright and related or neighboring rights to this work.
  14. *
  15. * See https://creativecommons.org/publicdomain/zero/1.0/ for further
  16. * details.
  17. *
  18. * This file is a modified except from [2], lines 1403 up to 1676.
  19. *
  20. * [1] https://www.akkadia.org/drepper/sha-crypt.html
  21. * [2] https://www.akkadia.org/drepper/SHA-crypt.txt
  22. */
  23. #include "crypt-port.h"
  24. #include "alg-sha512.h"
  25. #include <linux/errno.h>
  26. #include <stdio.h>
  27. #include <stdlib.h>
  28. #if INCLUDE_sha512crypt
  29. /* Define our magic string to mark salt for SHA512 "encryption"
  30. replacement. */
  31. static const char sha512_salt_prefix[] = "$6$";
  32. /* Prefix for optional rounds specification. */
  33. static const char sha512_rounds_prefix[] = "rounds=";
  34. /* Maximum salt string length. */
  35. #define SALT_LEN_MAX 16
  36. /* Default number of rounds if not explicitly specified. */
  37. #define ROUNDS_DEFAULT 5000
  38. /* Minimum number of rounds. */
  39. #define ROUNDS_MIN 1000
  40. /* Maximum number of rounds. */
  41. #define ROUNDS_MAX 999999999
  42. /* The maximum possible length of a SHA512-hashed password string,
  43. including the terminating NUL character. Prefix (including its NUL)
  44. + rounds tag ("rounds=$" = "rounds=\0") + strlen(ROUNDS_MAX)
  45. + salt (up to SALT_LEN_MAX chars) + '$' + hash (86 chars). */
  46. #define LENGTH_OF_NUMBER(n) (sizeof #n - 1)
  47. #define SHA512_HASH_LENGTH \
  48. (sizeof (sha512_salt_prefix) + sizeof (sha512_rounds_prefix) + \
  49. LENGTH_OF_NUMBER (ROUNDS_MAX) + SALT_LEN_MAX + 1 + 86)
  50. static_assert (SHA512_HASH_LENGTH <= CRYPT_OUTPUT_SIZE,
  51. "CRYPT_OUTPUT_SIZE is too small for SHA512");
  52. /* A sha512_buffer holds all of the sensitive intermediate data. */
  53. struct sha512_buffer
  54. {
  55. SHA512_CTX ctx;
  56. uint8_t result[64];
  57. uint8_t p_bytes[64];
  58. uint8_t s_bytes[64];
  59. };
  60. static_assert (sizeof (struct sha512_buffer) <= ALG_SPECIFIC_SIZE,
  61. "ALG_SPECIFIC_SIZE is too small for SHA512");
  62. /* Use this instead of including errno.h */
  63. static int errno;
  64. void crypt_sha512crypt_rn(const char *phrase, size_t phr_size,
  65. const char *setting, size_t ARG_UNUSED(set_size),
  66. uint8_t *output, size_t out_size, void *scratch,
  67. size_t scr_size);
  68. int crypt_sha512crypt_rn_wrapped(const char *phrase, size_t phr_size,
  69. const char *setting, size_t set_size,
  70. u8 *output, size_t out_size, void *scratch,
  71. size_t scr_size)
  72. {
  73. errno = 0;
  74. crypt_sha512crypt_rn(phrase, phr_size, setting, set_size, output,
  75. out_size, scratch, scr_size);
  76. return -errno;
  77. }
  78. /* Subroutine of _xcrypt_crypt_sha512crypt_rn: Feed CTX with LEN bytes of a
  79. virtual byte sequence consisting of BLOCK repeated over and over
  80. indefinitely. */
  81. static void
  82. sha512_process_recycled_bytes (unsigned char block[64], size_t len,
  83. SHA512_CTX *ctx)
  84. {
  85. size_t cnt;
  86. for (cnt = len; cnt >= 64; cnt -= 64)
  87. SHA512_Update (ctx, block, 64);
  88. SHA512_Update (ctx, block, cnt);
  89. }
  90. void
  91. crypt_sha512crypt_rn (const char *phrase, size_t phr_size,
  92. const char *setting, size_t ARG_UNUSED (set_size),
  93. uint8_t *output, size_t out_size,
  94. void *scratch, size_t scr_size)
  95. {
  96. /* This shouldn't ever happen, but... */
  97. if (out_size < SHA512_HASH_LENGTH
  98. || scr_size < sizeof (struct sha512_buffer))
  99. {
  100. errno = ERANGE;
  101. return;
  102. }
  103. struct sha512_buffer *buf = scratch;
  104. SHA512_CTX *ctx = &buf->ctx;
  105. uint8_t *result = buf->result;
  106. uint8_t *p_bytes = buf->p_bytes;
  107. uint8_t *s_bytes = buf->s_bytes;
  108. char *cp = (char *)output;
  109. const char *salt = setting;
  110. size_t salt_size;
  111. size_t cnt;
  112. /* Default number of rounds. */
  113. size_t rounds = ROUNDS_DEFAULT;
  114. bool rounds_custom = false;
  115. /* Find beginning of salt string. The prefix should normally always
  116. be present. Just in case it is not. */
  117. if (strncmp (sha512_salt_prefix, salt, sizeof (sha512_salt_prefix) - 1) == 0)
  118. /* Skip salt prefix. */
  119. salt += sizeof (sha512_salt_prefix) - 1;
  120. if (strncmp (salt, sha512_rounds_prefix, sizeof (sha512_rounds_prefix) - 1)
  121. == 0)
  122. {
  123. const char *num = salt + sizeof (sha512_rounds_prefix) - 1;
  124. /* Do not allow an explicit setting of zero rounds, nor of the
  125. default number of rounds, nor leading zeroes on the rounds. */
  126. if (!(*num >= '1' && *num <= '9'))
  127. {
  128. errno = EINVAL;
  129. return;
  130. }
  131. errno = 0;
  132. char *endp;
  133. rounds = strtoul (num, &endp, 10);
  134. if (endp == num || *endp != '$'
  135. || rounds < ROUNDS_MIN
  136. || rounds > ROUNDS_MAX
  137. || errno)
  138. {
  139. errno = EINVAL;
  140. return;
  141. }
  142. salt = endp + 1;
  143. rounds_custom = true;
  144. }
  145. /* The salt ends at the next '$' or the end of the string.
  146. Ensure ':' does not appear in the salt (it is used as a separator in /etc/passwd).
  147. Also check for '\n', as in /etc/passwd the whole parameters of the user data must
  148. be on a single line. */
  149. salt_size = strcspn (salt, "$:\n");
  150. if (!(salt[salt_size] == '$' || !salt[salt_size]))
  151. {
  152. errno = EINVAL;
  153. return;
  154. }
  155. /* Ensure we do not use more salt than SALT_LEN_MAX. */
  156. if (salt_size > SALT_LEN_MAX)
  157. salt_size = SALT_LEN_MAX;
  158. /* Compute alternate SHA512 sum with input PHRASE, SALT, and PHRASE. The
  159. final result will be added to the first context. */
  160. SHA512_Init (ctx);
  161. /* Add phrase. */
  162. SHA512_Update (ctx, phrase, phr_size);
  163. /* Add salt. */
  164. SHA512_Update (ctx, salt, salt_size);
  165. /* Add phrase again. */
  166. SHA512_Update (ctx, phrase, phr_size);
  167. /* Now get result of this (64 bytes) and add it to the other
  168. context. */
  169. SHA512_Final (result, ctx);
  170. /* Prepare for the real work. */
  171. SHA512_Init (ctx);
  172. /* Add the phrase string. */
  173. SHA512_Update (ctx, phrase, phr_size);
  174. /* The last part is the salt string. This must be at most 8
  175. characters and it ends at the first `$' character (for
  176. compatibility with existing implementations). */
  177. SHA512_Update (ctx, salt, salt_size);
  178. /* Add for any character in the phrase one byte of the alternate sum. */
  179. for (cnt = phr_size; cnt > 64; cnt -= 64)
  180. SHA512_Update (ctx, result, 64);
  181. SHA512_Update (ctx, result, cnt);
  182. /* Take the binary representation of the length of the phrase and for every
  183. 1 add the alternate sum, for every 0 the phrase. */
  184. for (cnt = phr_size; cnt > 0; cnt >>= 1)
  185. if ((cnt & 1) != 0)
  186. SHA512_Update (ctx, result, 64);
  187. else
  188. SHA512_Update (ctx, phrase, phr_size);
  189. /* Create intermediate result. */
  190. SHA512_Final (result, ctx);
  191. /* Start computation of P byte sequence. */
  192. SHA512_Init (ctx);
  193. /* For every character in the password add the entire password. */
  194. for (cnt = 0; cnt < phr_size; ++cnt)
  195. SHA512_Update (ctx, phrase, phr_size);
  196. /* Finish the digest. */
  197. SHA512_Final (p_bytes, ctx);
  198. /* Start computation of S byte sequence. */
  199. SHA512_Init (ctx);
  200. /* For every character in the password add the entire password. */
  201. for (cnt = 0; cnt < (size_t) 16 + (size_t) result[0]; ++cnt)
  202. SHA512_Update (ctx, salt, salt_size);
  203. /* Finish the digest. */
  204. SHA512_Final (s_bytes, ctx);
  205. /* Repeatedly run the collected hash value through SHA512 to burn
  206. CPU cycles. */
  207. for (cnt = 0; cnt < rounds; ++cnt)
  208. {
  209. /* New context. */
  210. SHA512_Init (ctx);
  211. /* Add phrase or last result. */
  212. if ((cnt & 1) != 0)
  213. sha512_process_recycled_bytes (p_bytes, phr_size, ctx);
  214. else
  215. SHA512_Update (ctx, result, 64);
  216. /* Add salt for numbers not divisible by 3. */
  217. if (cnt % 3 != 0)
  218. sha512_process_recycled_bytes (s_bytes, salt_size, ctx);
  219. /* Add phrase for numbers not divisible by 7. */
  220. if (cnt % 7 != 0)
  221. sha512_process_recycled_bytes (p_bytes, phr_size, ctx);
  222. /* Add phrase or last result. */
  223. if ((cnt & 1) != 0)
  224. SHA512_Update (ctx, result, 64);
  225. else
  226. sha512_process_recycled_bytes (p_bytes, phr_size, ctx);
  227. /* Create intermediate result. */
  228. SHA512_Final (result, ctx);
  229. }
  230. /* Now we can construct the result string. It consists of four
  231. parts, one of which is optional. We already know that buflen is
  232. at least sha512_hash_length, therefore none of the string bashing
  233. below can overflow the buffer. */
  234. memcpy (cp, sha512_salt_prefix, sizeof (sha512_salt_prefix) - 1);
  235. cp += sizeof (sha512_salt_prefix) - 1;
  236. if (rounds_custom)
  237. {
  238. int n = snprintf (cp,
  239. SHA512_HASH_LENGTH - (sizeof (sha512_salt_prefix) - 1),
  240. "%s%zu$", sha512_rounds_prefix, rounds);
  241. cp += n;
  242. }
  243. memcpy (cp, salt, salt_size);
  244. cp += salt_size;
  245. *cp++ = '$';
  246. #define b64_from_24bit(B2, B1, B0, N) \
  247. do { \
  248. unsigned int w = ((((unsigned int)(B2)) << 16) | \
  249. (((unsigned int)(B1)) << 8) | \
  250. ((unsigned int)(B0))); \
  251. int n = (N); \
  252. while (n-- > 0) \
  253. { \
  254. *cp++ = b64t[w & 0x3f]; \
  255. w >>= 6; \
  256. } \
  257. } while (0)
  258. b64_from_24bit (result[0], result[21], result[42], 4);
  259. b64_from_24bit (result[22], result[43], result[1], 4);
  260. b64_from_24bit (result[44], result[2], result[23], 4);
  261. b64_from_24bit (result[3], result[24], result[45], 4);
  262. b64_from_24bit (result[25], result[46], result[4], 4);
  263. b64_from_24bit (result[47], result[5], result[26], 4);
  264. b64_from_24bit (result[6], result[27], result[48], 4);
  265. b64_from_24bit (result[28], result[49], result[7], 4);
  266. b64_from_24bit (result[50], result[8], result[29], 4);
  267. b64_from_24bit (result[9], result[30], result[51], 4);
  268. b64_from_24bit (result[31], result[52], result[10], 4);
  269. b64_from_24bit (result[53], result[11], result[32], 4);
  270. b64_from_24bit (result[12], result[33], result[54], 4);
  271. b64_from_24bit (result[34], result[55], result[13], 4);
  272. b64_from_24bit (result[56], result[14], result[35], 4);
  273. b64_from_24bit (result[15], result[36], result[57], 4);
  274. b64_from_24bit (result[37], result[58], result[16], 4);
  275. b64_from_24bit (result[59], result[17], result[38], 4);
  276. b64_from_24bit (result[18], result[39], result[60], 4);
  277. b64_from_24bit (result[40], result[61], result[19], 4);
  278. b64_from_24bit (result[62], result[20], result[41], 4);
  279. b64_from_24bit (0, 0, result[63], 2);
  280. *cp = '\0';
  281. }
  282. #ifndef NO_GENSALT
  283. void
  284. gensalt_sha512crypt_rn (unsigned long count,
  285. const uint8_t *rbytes, size_t nrbytes,
  286. uint8_t *output, size_t output_size)
  287. {
  288. gensalt_sha_rn ('6', SALT_LEN_MAX, ROUNDS_DEFAULT, ROUNDS_MIN, ROUNDS_MAX,
  289. count, rbytes, nrbytes, output, output_size);
  290. }
  291. #endif
  292. #endif