sha.c 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307
  1. /* sha.c
  2. **
  3. ** Copyright 2008, The Android Open Source Project
  4. **
  5. ** Redistribution and use in source and binary forms, with or without
  6. ** modification, are permitted provided that the following conditions are met:
  7. ** * Redistributions of source code must retain the above copyright
  8. ** notice, this list of conditions and the following disclaimer.
  9. ** * Redistributions in binary form must reproduce the above copyright
  10. ** notice, this list of conditions and the following disclaimer in the
  11. ** documentation and/or other materials provided with the distribution.
  12. ** * Neither the name of Google Inc. nor the names of its contributors may
  13. ** be used to endorse or promote products derived from this software
  14. ** without specific prior written permission.
  15. **
  16. ** THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR
  17. ** IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  18. ** MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
  19. ** EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  20. ** SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  21. ** PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  22. ** OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  23. ** WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  24. ** OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  25. ** ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  26. */
  27. #include "mincrypt/sha.h"
  28. // Some machines lack byteswap.h and endian.h. These have to use the
  29. // slower code, even if they're little-endian.
  30. #if defined(HAVE_ENDIAN_H) && defined(HAVE_LITTLE_ENDIAN)
  31. #include <byteswap.h>
  32. #include <memory.h>
  33. // This version is about 28% faster than the generic version below,
  34. // but assumes little-endianness.
  35. static inline uint32_t ror27(uint32_t val) {
  36. return (val >> 27) | (val << 5);
  37. }
  38. static inline uint32_t ror2(uint32_t val) {
  39. return (val >> 2) | (val << 30);
  40. }
  41. static inline uint32_t ror31(uint32_t val) {
  42. return (val >> 31) | (val << 1);
  43. }
  44. static void SHA1_Transform(SHA_CTX* ctx) {
  45. uint32_t W[80];
  46. register uint32_t A, B, C, D, E;
  47. int t;
  48. A = ctx->state[0];
  49. B = ctx->state[1];
  50. C = ctx->state[2];
  51. D = ctx->state[3];
  52. E = ctx->state[4];
  53. #define SHA_F1(A,B,C,D,E,t) \
  54. E += ror27(A) + \
  55. (W[t] = bswap_32(ctx->buf.w[t])) + \
  56. (D^(B&(C^D))) + 0x5A827999; \
  57. B = ror2(B);
  58. for (t = 0; t < 15; t += 5) {
  59. SHA_F1(A,B,C,D,E,t + 0);
  60. SHA_F1(E,A,B,C,D,t + 1);
  61. SHA_F1(D,E,A,B,C,t + 2);
  62. SHA_F1(C,D,E,A,B,t + 3);
  63. SHA_F1(B,C,D,E,A,t + 4);
  64. }
  65. SHA_F1(A,B,C,D,E,t + 0); // 16th one, t == 15
  66. #undef SHA_F1
  67. #define SHA_F1(A,B,C,D,E,t) \
  68. E += ror27(A) + \
  69. (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
  70. (D^(B&(C^D))) + 0x5A827999; \
  71. B = ror2(B);
  72. SHA_F1(E,A,B,C,D,t + 1);
  73. SHA_F1(D,E,A,B,C,t + 2);
  74. SHA_F1(C,D,E,A,B,t + 3);
  75. SHA_F1(B,C,D,E,A,t + 4);
  76. #undef SHA_F1
  77. #define SHA_F2(A,B,C,D,E,t) \
  78. E += ror27(A) + \
  79. (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
  80. (B^C^D) + 0x6ED9EBA1; \
  81. B = ror2(B);
  82. for (t = 20; t < 40; t += 5) {
  83. SHA_F2(A,B,C,D,E,t + 0);
  84. SHA_F2(E,A,B,C,D,t + 1);
  85. SHA_F2(D,E,A,B,C,t + 2);
  86. SHA_F2(C,D,E,A,B,t + 3);
  87. SHA_F2(B,C,D,E,A,t + 4);
  88. }
  89. #undef SHA_F2
  90. #define SHA_F3(A,B,C,D,E,t) \
  91. E += ror27(A) + \
  92. (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
  93. ((B&C)|(D&(B|C))) + 0x8F1BBCDC; \
  94. B = ror2(B);
  95. for (; t < 60; t += 5) {
  96. SHA_F3(A,B,C,D,E,t + 0);
  97. SHA_F3(E,A,B,C,D,t + 1);
  98. SHA_F3(D,E,A,B,C,t + 2);
  99. SHA_F3(C,D,E,A,B,t + 3);
  100. SHA_F3(B,C,D,E,A,t + 4);
  101. }
  102. #undef SHA_F3
  103. #define SHA_F4(A,B,C,D,E,t) \
  104. E += ror27(A) + \
  105. (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
  106. (B^C^D) + 0xCA62C1D6; \
  107. B = ror2(B);
  108. for (; t < 80; t += 5) {
  109. SHA_F4(A,B,C,D,E,t + 0);
  110. SHA_F4(E,A,B,C,D,t + 1);
  111. SHA_F4(D,E,A,B,C,t + 2);
  112. SHA_F4(C,D,E,A,B,t + 3);
  113. SHA_F4(B,C,D,E,A,t + 4);
  114. }
  115. #undef SHA_F4
  116. ctx->state[0] += A;
  117. ctx->state[1] += B;
  118. ctx->state[2] += C;
  119. ctx->state[3] += D;
  120. ctx->state[4] += E;
  121. }
  122. void SHA_update(SHA_CTX* ctx, const void* data, int len) {
  123. int i = ctx->count % sizeof(ctx->buf);
  124. const uint8_t* p = (const uint8_t*)data;
  125. ctx->count += len;
  126. while (len > sizeof(ctx->buf) - i) {
  127. memcpy(&ctx->buf.b[i], p, sizeof(ctx->buf) - i);
  128. len -= sizeof(ctx->buf) - i;
  129. p += sizeof(ctx->buf) - i;
  130. SHA1_Transform(ctx);
  131. i = 0;
  132. }
  133. while (len--) {
  134. ctx->buf.b[i++] = *p++;
  135. if (i == sizeof(ctx->buf)) {
  136. SHA1_Transform(ctx);
  137. i = 0;
  138. }
  139. }
  140. }
  141. const uint8_t* SHA_final(SHA_CTX* ctx) {
  142. uint64_t cnt = ctx->count * 8;
  143. int i;
  144. SHA_update(ctx, (uint8_t*)"\x80", 1);
  145. while ((ctx->count % sizeof(ctx->buf)) != (sizeof(ctx->buf) - 8)) {
  146. SHA_update(ctx, (uint8_t*)"\0", 1);
  147. }
  148. for (i = 0; i < 8; ++i) {
  149. uint8_t tmp = cnt >> ((7 - i) * 8);
  150. SHA_update(ctx, &tmp, 1);
  151. }
  152. for (i = 0; i < 5; i++) {
  153. ctx->buf.w[i] = bswap_32(ctx->state[i]);
  154. }
  155. return ctx->buf.b;
  156. }
  157. #else // #if defined(HAVE_ENDIAN_H) && defined(HAVE_LITTLE_ENDIAN)
  158. #define rol(bits, value) (((value) << (bits)) | ((value) >> (32 - (bits))))
  159. static void SHA1_transform(SHA_CTX *ctx) {
  160. uint32_t W[80];
  161. uint32_t A, B, C, D, E;
  162. uint8_t *p = ctx->buf;
  163. int t;
  164. for(t = 0; t < 16; ++t) {
  165. uint32_t tmp = *p++ << 24;
  166. tmp |= *p++ << 16;
  167. tmp |= *p++ << 8;
  168. tmp |= *p++;
  169. W[t] = tmp;
  170. }
  171. for(; t < 80; t++) {
  172. W[t] = rol(1,W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16]);
  173. }
  174. A = ctx->state[0];
  175. B = ctx->state[1];
  176. C = ctx->state[2];
  177. D = ctx->state[3];
  178. E = ctx->state[4];
  179. for(t = 0; t < 80; t++) {
  180. uint32_t tmp = rol(5,A) + E + W[t];
  181. if (t < 20)
  182. tmp += (D^(B&(C^D))) + 0x5A827999;
  183. else if ( t < 40)
  184. tmp += (B^C^D) + 0x6ED9EBA1;
  185. else if ( t < 60)
  186. tmp += ((B&C)|(D&(B|C))) + 0x8F1BBCDC;
  187. else
  188. tmp += (B^C^D) + 0xCA62C1D6;
  189. E = D;
  190. D = C;
  191. C = rol(30,B);
  192. B = A;
  193. A = tmp;
  194. }
  195. ctx->state[0] += A;
  196. ctx->state[1] += B;
  197. ctx->state[2] += C;
  198. ctx->state[3] += D;
  199. ctx->state[4] += E;
  200. }
  201. void SHA_update(SHA_CTX *ctx, const void *data, int len) {
  202. int i = ctx->count % sizeof(ctx->buf);
  203. const uint8_t* p = (const uint8_t*)data;
  204. ctx->count += len;
  205. while (len--) {
  206. ctx->buf[i++] = *p++;
  207. if (i == sizeof(ctx->buf)) {
  208. SHA1_transform(ctx);
  209. i = 0;
  210. }
  211. }
  212. }
  213. const uint8_t *SHA_final(SHA_CTX *ctx) {
  214. uint8_t *p = ctx->buf;
  215. uint64_t cnt = ctx->count * 8;
  216. int i;
  217. SHA_update(ctx, (uint8_t*)"\x80", 1);
  218. while ((ctx->count % sizeof(ctx->buf)) != (sizeof(ctx->buf) - 8)) {
  219. SHA_update(ctx, (uint8_t*)"\0", 1);
  220. }
  221. for (i = 0; i < 8; ++i) {
  222. uint8_t tmp = cnt >> ((7 - i) * 8);
  223. SHA_update(ctx, &tmp, 1);
  224. }
  225. for (i = 0; i < 5; i++) {
  226. uint32_t tmp = ctx->state[i];
  227. *p++ = tmp >> 24;
  228. *p++ = tmp >> 16;
  229. *p++ = tmp >> 8;
  230. *p++ = tmp >> 0;
  231. }
  232. return ctx->buf;
  233. }
  234. #endif // endianness
  235. void SHA_init(SHA_CTX* ctx) {
  236. ctx->state[0] = 0x67452301;
  237. ctx->state[1] = 0xEFCDAB89;
  238. ctx->state[2] = 0x98BADCFE;
  239. ctx->state[3] = 0x10325476;
  240. ctx->state[4] = 0xC3D2E1F0;
  241. ctx->count = 0;
  242. }
  243. /* Convenience function */
  244. const uint8_t* SHA(const void *data, int len, uint8_t *digest) {
  245. const uint8_t *p;
  246. int i;
  247. SHA_CTX ctx;
  248. SHA_init(&ctx);
  249. SHA_update(&ctx, data, len);
  250. p = SHA_final(&ctx);
  251. for (i = 0; i < SHA_DIGEST_SIZE; ++i) {
  252. digest[i] = *p++;
  253. }
  254. return digest;
  255. }