sha1.c 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445
  1. // SPDX-License-Identifier: LGPL-2.1
  2. /*
  3. * Heiko Schocher, DENX Software Engineering, hs@denx.de.
  4. * based on:
  5. * FIPS-180-1 compliant SHA-1 implementation
  6. *
  7. * Copyright (C) 2003-2006 Christophe Devine
  8. */
  9. /*
  10. * The SHA-1 standard was published by NIST in 1993.
  11. *
  12. * http://www.itl.nist.gov/fipspubs/fip180-1.htm
  13. */
  14. #ifndef _CRT_SECURE_NO_DEPRECATE
  15. #define _CRT_SECURE_NO_DEPRECATE 1
  16. #endif
  17. #ifndef USE_HOSTCC
  18. #include <common.h>
  19. #include <linux/string.h>
  20. #else
  21. #include <string.h>
  22. #endif /* USE_HOSTCC */
  23. #include <watchdog.h>
  24. #include <u-boot/sha1.h>
  25. const uint8_t sha1_der_prefix[SHA1_DER_LEN] = {
  26. 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e,
  27. 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14
  28. };
  29. /*
  30. * 32-bit integer manipulation macros (big endian)
  31. */
  32. #ifndef GET_UINT32_BE
  33. #define GET_UINT32_BE(n,b,i) { \
  34. (n) = ( (unsigned long) (b)[(i) ] << 24 ) \
  35. | ( (unsigned long) (b)[(i) + 1] << 16 ) \
  36. | ( (unsigned long) (b)[(i) + 2] << 8 ) \
  37. | ( (unsigned long) (b)[(i) + 3] ); \
  38. }
  39. #endif
  40. #ifndef PUT_UINT32_BE
  41. #define PUT_UINT32_BE(n,b,i) { \
  42. (b)[(i) ] = (unsigned char) ( (n) >> 24 ); \
  43. (b)[(i) + 1] = (unsigned char) ( (n) >> 16 ); \
  44. (b)[(i) + 2] = (unsigned char) ( (n) >> 8 ); \
  45. (b)[(i) + 3] = (unsigned char) ( (n) ); \
  46. }
  47. #endif
  48. /*
  49. * SHA-1 context setup
  50. */
  51. void sha1_starts (sha1_context * ctx)
  52. {
  53. ctx->total[0] = 0;
  54. ctx->total[1] = 0;
  55. ctx->state[0] = 0x67452301;
  56. ctx->state[1] = 0xEFCDAB89;
  57. ctx->state[2] = 0x98BADCFE;
  58. ctx->state[3] = 0x10325476;
  59. ctx->state[4] = 0xC3D2E1F0;
  60. }
  61. static void sha1_process(sha1_context *ctx, const unsigned char data[64])
  62. {
  63. unsigned long temp, W[16], A, B, C, D, E;
  64. GET_UINT32_BE (W[0], data, 0);
  65. GET_UINT32_BE (W[1], data, 4);
  66. GET_UINT32_BE (W[2], data, 8);
  67. GET_UINT32_BE (W[3], data, 12);
  68. GET_UINT32_BE (W[4], data, 16);
  69. GET_UINT32_BE (W[5], data, 20);
  70. GET_UINT32_BE (W[6], data, 24);
  71. GET_UINT32_BE (W[7], data, 28);
  72. GET_UINT32_BE (W[8], data, 32);
  73. GET_UINT32_BE (W[9], data, 36);
  74. GET_UINT32_BE (W[10], data, 40);
  75. GET_UINT32_BE (W[11], data, 44);
  76. GET_UINT32_BE (W[12], data, 48);
  77. GET_UINT32_BE (W[13], data, 52);
  78. GET_UINT32_BE (W[14], data, 56);
  79. GET_UINT32_BE (W[15], data, 60);
  80. #define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n)))
  81. #define R(t) ( \
  82. temp = W[(t - 3) & 0x0F] ^ W[(t - 8) & 0x0F] ^ \
  83. W[(t - 14) & 0x0F] ^ W[ t & 0x0F], \
  84. ( W[t & 0x0F] = S(temp,1) ) \
  85. )
  86. #define P(a,b,c,d,e,x) { \
  87. e += S(a,5) + F(b,c,d) + K + x; b = S(b,30); \
  88. }
  89. A = ctx->state[0];
  90. B = ctx->state[1];
  91. C = ctx->state[2];
  92. D = ctx->state[3];
  93. E = ctx->state[4];
  94. #define F(x,y,z) (z ^ (x & (y ^ z)))
  95. #define K 0x5A827999
  96. P (A, B, C, D, E, W[0]);
  97. P (E, A, B, C, D, W[1]);
  98. P (D, E, A, B, C, W[2]);
  99. P (C, D, E, A, B, W[3]);
  100. P (B, C, D, E, A, W[4]);
  101. P (A, B, C, D, E, W[5]);
  102. P (E, A, B, C, D, W[6]);
  103. P (D, E, A, B, C, W[7]);
  104. P (C, D, E, A, B, W[8]);
  105. P (B, C, D, E, A, W[9]);
  106. P (A, B, C, D, E, W[10]);
  107. P (E, A, B, C, D, W[11]);
  108. P (D, E, A, B, C, W[12]);
  109. P (C, D, E, A, B, W[13]);
  110. P (B, C, D, E, A, W[14]);
  111. P (A, B, C, D, E, W[15]);
  112. P (E, A, B, C, D, R (16));
  113. P (D, E, A, B, C, R (17));
  114. P (C, D, E, A, B, R (18));
  115. P (B, C, D, E, A, R (19));
  116. #undef K
  117. #undef F
  118. #define F(x,y,z) (x ^ y ^ z)
  119. #define K 0x6ED9EBA1
  120. P (A, B, C, D, E, R (20));
  121. P (E, A, B, C, D, R (21));
  122. P (D, E, A, B, C, R (22));
  123. P (C, D, E, A, B, R (23));
  124. P (B, C, D, E, A, R (24));
  125. P (A, B, C, D, E, R (25));
  126. P (E, A, B, C, D, R (26));
  127. P (D, E, A, B, C, R (27));
  128. P (C, D, E, A, B, R (28));
  129. P (B, C, D, E, A, R (29));
  130. P (A, B, C, D, E, R (30));
  131. P (E, A, B, C, D, R (31));
  132. P (D, E, A, B, C, R (32));
  133. P (C, D, E, A, B, R (33));
  134. P (B, C, D, E, A, R (34));
  135. P (A, B, C, D, E, R (35));
  136. P (E, A, B, C, D, R (36));
  137. P (D, E, A, B, C, R (37));
  138. P (C, D, E, A, B, R (38));
  139. P (B, C, D, E, A, R (39));
  140. #undef K
  141. #undef F
  142. #define F(x,y,z) ((x & y) | (z & (x | y)))
  143. #define K 0x8F1BBCDC
  144. P (A, B, C, D, E, R (40));
  145. P (E, A, B, C, D, R (41));
  146. P (D, E, A, B, C, R (42));
  147. P (C, D, E, A, B, R (43));
  148. P (B, C, D, E, A, R (44));
  149. P (A, B, C, D, E, R (45));
  150. P (E, A, B, C, D, R (46));
  151. P (D, E, A, B, C, R (47));
  152. P (C, D, E, A, B, R (48));
  153. P (B, C, D, E, A, R (49));
  154. P (A, B, C, D, E, R (50));
  155. P (E, A, B, C, D, R (51));
  156. P (D, E, A, B, C, R (52));
  157. P (C, D, E, A, B, R (53));
  158. P (B, C, D, E, A, R (54));
  159. P (A, B, C, D, E, R (55));
  160. P (E, A, B, C, D, R (56));
  161. P (D, E, A, B, C, R (57));
  162. P (C, D, E, A, B, R (58));
  163. P (B, C, D, E, A, R (59));
  164. #undef K
  165. #undef F
  166. #define F(x,y,z) (x ^ y ^ z)
  167. #define K 0xCA62C1D6
  168. P (A, B, C, D, E, R (60));
  169. P (E, A, B, C, D, R (61));
  170. P (D, E, A, B, C, R (62));
  171. P (C, D, E, A, B, R (63));
  172. P (B, C, D, E, A, R (64));
  173. P (A, B, C, D, E, R (65));
  174. P (E, A, B, C, D, R (66));
  175. P (D, E, A, B, C, R (67));
  176. P (C, D, E, A, B, R (68));
  177. P (B, C, D, E, A, R (69));
  178. P (A, B, C, D, E, R (70));
  179. P (E, A, B, C, D, R (71));
  180. P (D, E, A, B, C, R (72));
  181. P (C, D, E, A, B, R (73));
  182. P (B, C, D, E, A, R (74));
  183. P (A, B, C, D, E, R (75));
  184. P (E, A, B, C, D, R (76));
  185. P (D, E, A, B, C, R (77));
  186. P (C, D, E, A, B, R (78));
  187. P (B, C, D, E, A, R (79));
  188. #undef K
  189. #undef F
  190. ctx->state[0] += A;
  191. ctx->state[1] += B;
  192. ctx->state[2] += C;
  193. ctx->state[3] += D;
  194. ctx->state[4] += E;
  195. }
  196. /*
  197. * SHA-1 process buffer
  198. */
  199. void sha1_update(sha1_context *ctx, const unsigned char *input,
  200. unsigned int ilen)
  201. {
  202. int fill;
  203. unsigned long left;
  204. if (ilen <= 0)
  205. return;
  206. left = ctx->total[0] & 0x3F;
  207. fill = 64 - left;
  208. ctx->total[0] += ilen;
  209. ctx->total[0] &= 0xFFFFFFFF;
  210. if (ctx->total[0] < (unsigned long) ilen)
  211. ctx->total[1]++;
  212. if (left && ilen >= fill) {
  213. memcpy ((void *) (ctx->buffer + left), (void *) input, fill);
  214. sha1_process (ctx, ctx->buffer);
  215. input += fill;
  216. ilen -= fill;
  217. left = 0;
  218. }
  219. while (ilen >= 64) {
  220. sha1_process (ctx, input);
  221. input += 64;
  222. ilen -= 64;
  223. }
  224. if (ilen > 0) {
  225. memcpy ((void *) (ctx->buffer + left), (void *) input, ilen);
  226. }
  227. }
  228. static const unsigned char sha1_padding[64] = {
  229. 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  230. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  231. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  232. 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
  233. };
  234. /*
  235. * SHA-1 final digest
  236. */
  237. void sha1_finish (sha1_context * ctx, unsigned char output[20])
  238. {
  239. unsigned long last, padn;
  240. unsigned long high, low;
  241. unsigned char msglen[8];
  242. high = (ctx->total[0] >> 29)
  243. | (ctx->total[1] << 3);
  244. low = (ctx->total[0] << 3);
  245. PUT_UINT32_BE (high, msglen, 0);
  246. PUT_UINT32_BE (low, msglen, 4);
  247. last = ctx->total[0] & 0x3F;
  248. padn = (last < 56) ? (56 - last) : (120 - last);
  249. sha1_update (ctx, (unsigned char *) sha1_padding, padn);
  250. sha1_update (ctx, msglen, 8);
  251. PUT_UINT32_BE (ctx->state[0], output, 0);
  252. PUT_UINT32_BE (ctx->state[1], output, 4);
  253. PUT_UINT32_BE (ctx->state[2], output, 8);
  254. PUT_UINT32_BE (ctx->state[3], output, 12);
  255. PUT_UINT32_BE (ctx->state[4], output, 16);
  256. }
  257. /*
  258. * Output = SHA-1( input buffer )
  259. */
  260. void sha1_csum(const unsigned char *input, unsigned int ilen,
  261. unsigned char *output)
  262. {
  263. sha1_context ctx;
  264. sha1_starts (&ctx);
  265. sha1_update (&ctx, input, ilen);
  266. sha1_finish (&ctx, output);
  267. }
  268. /*
  269. * Output = SHA-1( input buffer ). Trigger the watchdog every 'chunk_sz'
  270. * bytes of input processed.
  271. */
  272. void sha1_csum_wd(const unsigned char *input, unsigned int ilen,
  273. unsigned char *output, unsigned int chunk_sz)
  274. {
  275. sha1_context ctx;
  276. #if defined(CONFIG_HW_WATCHDOG) || defined(CONFIG_WATCHDOG)
  277. const unsigned char *end, *curr;
  278. int chunk;
  279. #endif
  280. sha1_starts (&ctx);
  281. #if defined(CONFIG_HW_WATCHDOG) || defined(CONFIG_WATCHDOG)
  282. curr = input;
  283. end = input + ilen;
  284. while (curr < end) {
  285. chunk = end - curr;
  286. if (chunk > chunk_sz)
  287. chunk = chunk_sz;
  288. sha1_update (&ctx, curr, chunk);
  289. curr += chunk;
  290. WATCHDOG_RESET ();
  291. }
  292. #else
  293. sha1_update (&ctx, input, ilen);
  294. #endif
  295. sha1_finish (&ctx, output);
  296. }
  297. /*
  298. * Output = HMAC-SHA-1( input buffer, hmac key )
  299. */
  300. void sha1_hmac(const unsigned char *key, int keylen,
  301. const unsigned char *input, unsigned int ilen,
  302. unsigned char *output)
  303. {
  304. int i;
  305. sha1_context ctx;
  306. unsigned char k_ipad[64];
  307. unsigned char k_opad[64];
  308. unsigned char tmpbuf[20];
  309. memset (k_ipad, 0x36, 64);
  310. memset (k_opad, 0x5C, 64);
  311. for (i = 0; i < keylen; i++) {
  312. if (i >= 64)
  313. break;
  314. k_ipad[i] ^= key[i];
  315. k_opad[i] ^= key[i];
  316. }
  317. sha1_starts (&ctx);
  318. sha1_update (&ctx, k_ipad, 64);
  319. sha1_update (&ctx, input, ilen);
  320. sha1_finish (&ctx, tmpbuf);
  321. sha1_starts (&ctx);
  322. sha1_update (&ctx, k_opad, 64);
  323. sha1_update (&ctx, tmpbuf, 20);
  324. sha1_finish (&ctx, output);
  325. memset (k_ipad, 0, 64);
  326. memset (k_opad, 0, 64);
  327. memset (tmpbuf, 0, 20);
  328. memset (&ctx, 0, sizeof (sha1_context));
  329. }
  330. #ifdef SELF_TEST
  331. /*
  332. * FIPS-180-1 test vectors
  333. */
  334. static const char sha1_test_str[3][57] = {
  335. {"abc"},
  336. {"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"},
  337. {""}
  338. };
  339. static const unsigned char sha1_test_sum[3][20] = {
  340. {0xA9, 0x99, 0x3E, 0x36, 0x47, 0x06, 0x81, 0x6A, 0xBA, 0x3E,
  341. 0x25, 0x71, 0x78, 0x50, 0xC2, 0x6C, 0x9C, 0xD0, 0xD8, 0x9D},
  342. {0x84, 0x98, 0x3E, 0x44, 0x1C, 0x3B, 0xD2, 0x6E, 0xBA, 0xAE,
  343. 0x4A, 0xA1, 0xF9, 0x51, 0x29, 0xE5, 0xE5, 0x46, 0x70, 0xF1},
  344. {0x34, 0xAA, 0x97, 0x3C, 0xD4, 0xC4, 0xDA, 0xA4, 0xF6, 0x1E,
  345. 0xEB, 0x2B, 0xDB, 0xAD, 0x27, 0x31, 0x65, 0x34, 0x01, 0x6F}
  346. };
  347. /*
  348. * Checkup routine
  349. */
  350. int sha1_self_test (void)
  351. {
  352. int i, j;
  353. unsigned char buf[1000];
  354. unsigned char sha1sum[20];
  355. sha1_context ctx;
  356. for (i = 0; i < 3; i++) {
  357. printf (" SHA-1 test #%d: ", i + 1);
  358. sha1_starts (&ctx);
  359. if (i < 2)
  360. sha1_update (&ctx, (unsigned char *) sha1_test_str[i],
  361. strlen (sha1_test_str[i]));
  362. else {
  363. memset (buf, 'a', 1000);
  364. for (j = 0; j < 1000; j++)
  365. sha1_update (&ctx, buf, 1000);
  366. }
  367. sha1_finish (&ctx, sha1sum);
  368. if (memcmp (sha1sum, sha1_test_sum[i], 20) != 0) {
  369. printf ("failed\n");
  370. return (1);
  371. }
  372. printf ("passed\n");
  373. }
  374. printf ("\n");
  375. return (0);
  376. }
  377. #else
  378. int sha1_self_test (void)
  379. {
  380. return (0);
  381. }
  382. #endif