1/* sha1.c - Functions to compute SHA1 message digest of files or 2 memory blocks according to the NIST specification FIPS-180-1. 3 4 Copyright (C) 2000-2001, 2003-2006, 2008-2014 Free Software Foundation, Inc. 5 6 This program is free software; you can redistribute it and/or modify it 7 under the terms of the GNU General Public License as published by the 8 Free Software Foundation; either version 3, or (at your option) any 9 later version. 10 11 This program is distributed in the hope that it will be useful, 12 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 GNU General Public License for more details. 15 16 You should have received a copy of the GNU General Public License 17 along with this program; if not, see <http://www.gnu.org/licenses/>. */ 18 19/* Written by Scott G. Miller 20 Credits: 21 Robert Klep <robert@ilse.nl> -- Expansion function fix 22*/ 23 24#include <config.h> 25 26#if HAVE_OPENSSL_SHA1 27# define GL_OPENSSL_INLINE _GL_EXTERN_INLINE 28#endif 29#include "sha1.h" 30 31#include <stdalign.h> 32#include <stdint.h> 33#include <stdlib.h> 34#include <string.h> 35 36#if USE_UNLOCKED_IO 37# include "unlocked-io.h" 38#endif 39 40#ifdef WORDS_BIGENDIAN 41# define SWAP(n) (n) 42#else 43# define SWAP(n) \ 44 (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24)) 45#endif 46 47#define BLOCKSIZE 32768 48#if BLOCKSIZE % 64 != 0 49# error "invalid BLOCKSIZE" 50#endif 51 52#if ! HAVE_OPENSSL_SHA1 53/* This array contains the bytes used to pad the buffer to the next 54 64-byte boundary. (RFC 1321, 3.1: Step 1) */ 55static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ... */ }; 56 57 58/* Take a pointer to a 160 bit block of data (five 32 bit ints) and 59 initialize it to the start constants of the SHA1 algorithm. This 60 must be called before using hash in the call to sha1_hash. */ 61void 62sha1_init_ctx (struct sha1_ctx *ctx) 63{ 64 ctx->A = 0x67452301; 65 ctx->B = 0xefcdab89; 66 ctx->C = 0x98badcfe; 67 ctx->D = 0x10325476; 68 ctx->E = 0xc3d2e1f0; 69 70 ctx->total[0] = ctx->total[1] = 0; 71 ctx->buflen = 0; 72} 73 74/* Copy the 4 byte value from v into the memory location pointed to by *cp, 75 If your architecture allows unaligned access this is equivalent to 76 * (uint32_t *) cp = v */ 77static void 78set_uint32 (char *cp, uint32_t v) 79{ 80 memcpy (cp, &v, sizeof v); 81} 82 83/* Put result from CTX in first 20 bytes following RESBUF. The result 84 must be in little endian byte order. */ 85void * 86sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf) 87{ 88 char *r = resbuf; 89 set_uint32 (r + 0 * sizeof ctx->A, SWAP (ctx->A)); 90 set_uint32 (r + 1 * sizeof ctx->B, SWAP (ctx->B)); 91 set_uint32 (r + 2 * sizeof ctx->C, SWAP (ctx->C)); 92 set_uint32 (r + 3 * sizeof ctx->D, SWAP (ctx->D)); 93 set_uint32 (r + 4 * sizeof ctx->E, SWAP (ctx->E)); 94 95 return resbuf; 96} 97 98/* Process the remaining bytes in the internal buffer and the usual 99 prolog according to the standard and write the result to RESBUF. */ 100void * 101sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf) 102{ 103 /* Take yet unprocessed bytes into account. */ 104 uint32_t bytes = ctx->buflen; 105 size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4; 106 107 /* Now count remaining bytes. */ 108 ctx->total[0] += bytes; 109 if (ctx->total[0] < bytes) 110 ++ctx->total[1]; 111 112 /* Put the 64-bit file length in *bits* at the end of the buffer. */ 113 ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29)); 114 ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3); 115 116 memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes); 117 118 /* Process last bytes. */ 119 sha1_process_block (ctx->buffer, size * 4, ctx); 120 121 return sha1_read_ctx (ctx, resbuf); 122} 123#endif 124 125/* Compute SHA1 message digest for bytes read from STREAM. The 126 resulting message digest number will be written into the 16 bytes 127 beginning at RESBLOCK. */ 128int 129sha1_stream (FILE *stream, void *resblock) 130{ 131 struct sha1_ctx ctx; 132 size_t sum; 133 134 char *buffer = malloc (BLOCKSIZE + 72); 135 if (!buffer) 136 return 1; 137 138 /* Initialize the computation context. */ 139 sha1_init_ctx (&ctx); 140 141 /* Iterate over full file contents. */ 142 while (1) 143 { 144 /* We read the file in blocks of BLOCKSIZE bytes. One call of the 145 computation function processes the whole buffer so that with the 146 next round of the loop another block can be read. */ 147 size_t n; 148 sum = 0; 149 150 /* Read block. Take care for partial reads. */ 151 while (1) 152 { 153 n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream); 154 155 sum += n; 156 157 if (sum == BLOCKSIZE) 158 break; 159 160 if (n == 0) 161 { 162 /* Check for the error flag IFF N == 0, so that we don't 163 exit the loop after a partial read due to e.g., EAGAIN 164 or EWOULDBLOCK. */ 165 if (ferror (stream)) 166 { 167 free (buffer); 168 return 1; 169 } 170 goto process_partial_block; 171 } 172 173 /* We've read at least one byte, so ignore errors. But always 174 check for EOF, since feof may be true even though N > 0. 175 Otherwise, we could end up calling fread after EOF. */ 176 if (feof (stream)) 177 goto process_partial_block; 178 } 179 180 /* Process buffer with BLOCKSIZE bytes. Note that 181 BLOCKSIZE % 64 == 0 182 */ 183 sha1_process_block (buffer, BLOCKSIZE, &ctx); 184 } 185 186 process_partial_block:; 187 188 /* Process any remaining bytes. */ 189 if (sum > 0) 190 sha1_process_bytes (buffer, sum, &ctx); 191 192 /* Construct result in desired memory. */ 193 sha1_finish_ctx (&ctx, resblock); 194 free (buffer); 195 return 0; 196} 197 198#if ! HAVE_OPENSSL_SHA1 199/* Compute SHA1 message digest for LEN bytes beginning at BUFFER. The 200 result is always in little endian byte order, so that a byte-wise 201 output yields to the wanted ASCII representation of the message 202 digest. */ 203void * 204sha1_buffer (const char *buffer, size_t len, void *resblock) 205{ 206 struct sha1_ctx ctx; 207 208 /* Initialize the computation context. */ 209 sha1_init_ctx (&ctx); 210 211 /* Process whole buffer but last len % 64 bytes. */ 212 sha1_process_bytes (buffer, len, &ctx); 213 214 /* Put result in desired memory area. */ 215 return sha1_finish_ctx (&ctx, resblock); 216} 217 218void 219sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx) 220{ 221 /* When we already have some bits in our internal buffer concatenate 222 both inputs first. */ 223 if (ctx->buflen != 0) 224 { 225 size_t left_over = ctx->buflen; 226 size_t add = 128 - left_over > len ? len : 128 - left_over; 227 228 memcpy (&((char *) ctx->buffer)[left_over], buffer, add); 229 ctx->buflen += add; 230 231 if (ctx->buflen > 64) 232 { 233 sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx); 234 235 ctx->buflen &= 63; 236 /* The regions in the following copy operation cannot overlap. */ 237 memcpy (ctx->buffer, 238 &((char *) ctx->buffer)[(left_over + add) & ~63], 239 ctx->buflen); 240 } 241 242 buffer = (const char *) buffer + add; 243 len -= add; 244 } 245 246 /* Process available complete blocks. */ 247 if (len >= 64) 248 { 249#if !_STRING_ARCH_unaligned 250# define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0) 251 if (UNALIGNED_P (buffer)) 252 while (len > 64) 253 { 254 sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx); 255 buffer = (const char *) buffer + 64; 256 len -= 64; 257 } 258 else 259#endif 260 { 261 sha1_process_block (buffer, len & ~63, ctx); 262 buffer = (const char *) buffer + (len & ~63); 263 len &= 63; 264 } 265 } 266 267 /* Move remaining bytes in internal buffer. */ 268 if (len > 0) 269 { 270 size_t left_over = ctx->buflen; 271 272 memcpy (&((char *) ctx->buffer)[left_over], buffer, len); 273 left_over += len; 274 if (left_over >= 64) 275 { 276 sha1_process_block (ctx->buffer, 64, ctx); 277 left_over -= 64; 278 memcpy (ctx->buffer, &ctx->buffer[16], left_over); 279 } 280 ctx->buflen = left_over; 281 } 282} 283 284/* --- Code below is the primary difference between md5.c and sha1.c --- */ 285 286/* SHA1 round constants */ 287#define K1 0x5a827999 288#define K2 0x6ed9eba1 289#define K3 0x8f1bbcdc 290#define K4 0xca62c1d6 291 292/* Round functions. Note that F2 is the same as F4. */ 293#define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) ) 294#define F2(B,C,D) (B ^ C ^ D) 295#define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) ) 296#define F4(B,C,D) (B ^ C ^ D) 297 298/* Process LEN bytes of BUFFER, accumulating context into CTX. 299 It is assumed that LEN % 64 == 0. 300 Most of this code comes from GnuPG's cipher/sha1.c. */ 301 302void 303sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx) 304{ 305 const uint32_t *words = buffer; 306 size_t nwords = len / sizeof (uint32_t); 307 const uint32_t *endp = words + nwords; 308 uint32_t x[16]; 309 uint32_t a = ctx->A; 310 uint32_t b = ctx->B; 311 uint32_t c = ctx->C; 312 uint32_t d = ctx->D; 313 uint32_t e = ctx->E; 314 uint32_t lolen = len; 315 316 /* First increment the byte count. RFC 1321 specifies the possible 317 length of the file up to 2^64 bits. Here we only compute the 318 number of bytes. Do a double word increment. */ 319 ctx->total[0] += lolen; 320 ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen); 321 322#define rol(x, n) (((x) << (n)) | ((uint32_t) (x) >> (32 - (n)))) 323 324#define M(I) ( tm = x[I&0x0f] ^ x[(I-14)&0x0f] \ 325 ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \ 326 , (x[I&0x0f] = rol(tm, 1)) ) 327 328#define R(A,B,C,D,E,F,K,M) do { E += rol( A, 5 ) \ 329 + F( B, C, D ) \ 330 + K \ 331 + M; \ 332 B = rol( B, 30 ); \ 333 } while(0) 334 335 while (words < endp) 336 { 337 uint32_t tm; 338 int t; 339 for (t = 0; t < 16; t++) 340 { 341 x[t] = SWAP (*words); 342 words++; 343 } 344 345 R( a, b, c, d, e, F1, K1, x[ 0] ); 346 R( e, a, b, c, d, F1, K1, x[ 1] ); 347 R( d, e, a, b, c, F1, K1, x[ 2] ); 348 R( c, d, e, a, b, F1, K1, x[ 3] ); 349 R( b, c, d, e, a, F1, K1, x[ 4] ); 350 R( a, b, c, d, e, F1, K1, x[ 5] ); 351 R( e, a, b, c, d, F1, K1, x[ 6] ); 352 R( d, e, a, b, c, F1, K1, x[ 7] ); 353 R( c, d, e, a, b, F1, K1, x[ 8] ); 354 R( b, c, d, e, a, F1, K1, x[ 9] ); 355 R( a, b, c, d, e, F1, K1, x[10] ); 356 R( e, a, b, c, d, F1, K1, x[11] ); 357 R( d, e, a, b, c, F1, K1, x[12] ); 358 R( c, d, e, a, b, F1, K1, x[13] ); 359 R( b, c, d, e, a, F1, K1, x[14] ); 360 R( a, b, c, d, e, F1, K1, x[15] ); 361 R( e, a, b, c, d, F1, K1, M(16) ); 362 R( d, e, a, b, c, F1, K1, M(17) ); 363 R( c, d, e, a, b, F1, K1, M(18) ); 364 R( b, c, d, e, a, F1, K1, M(19) ); 365 R( a, b, c, d, e, F2, K2, M(20) ); 366 R( e, a, b, c, d, F2, K2, M(21) ); 367 R( d, e, a, b, c, F2, K2, M(22) ); 368 R( c, d, e, a, b, F2, K2, M(23) ); 369 R( b, c, d, e, a, F2, K2, M(24) ); 370 R( a, b, c, d, e, F2, K2, M(25) ); 371 R( e, a, b, c, d, F2, K2, M(26) ); 372 R( d, e, a, b, c, F2, K2, M(27) ); 373 R( c, d, e, a, b, F2, K2, M(28) ); 374 R( b, c, d, e, a, F2, K2, M(29) ); 375 R( a, b, c, d, e, F2, K2, M(30) ); 376 R( e, a, b, c, d, F2, K2, M(31) ); 377 R( d, e, a, b, c, F2, K2, M(32) ); 378 R( c, d, e, a, b, F2, K2, M(33) ); 379 R( b, c, d, e, a, F2, K2, M(34) ); 380 R( a, b, c, d, e, F2, K2, M(35) ); 381 R( e, a, b, c, d, F2, K2, M(36) ); 382 R( d, e, a, b, c, F2, K2, M(37) ); 383 R( c, d, e, a, b, F2, K2, M(38) ); 384 R( b, c, d, e, a, F2, K2, M(39) ); 385 R( a, b, c, d, e, F3, K3, M(40) ); 386 R( e, a, b, c, d, F3, K3, M(41) ); 387 R( d, e, a, b, c, F3, K3, M(42) ); 388 R( c, d, e, a, b, F3, K3, M(43) ); 389 R( b, c, d, e, a, F3, K3, M(44) ); 390 R( a, b, c, d, e, F3, K3, M(45) ); 391 R( e, a, b, c, d, F3, K3, M(46) ); 392 R( d, e, a, b, c, F3, K3, M(47) ); 393 R( c, d, e, a, b, F3, K3, M(48) ); 394 R( b, c, d, e, a, F3, K3, M(49) ); 395 R( a, b, c, d, e, F3, K3, M(50) ); 396 R( e, a, b, c, d, F3, K3, M(51) ); 397 R( d, e, a, b, c, F3, K3, M(52) ); 398 R( c, d, e, a, b, F3, K3, M(53) ); 399 R( b, c, d, e, a, F3, K3, M(54) ); 400 R( a, b, c, d, e, F3, K3, M(55) ); 401 R( e, a, b, c, d, F3, K3, M(56) ); 402 R( d, e, a, b, c, F3, K3, M(57) ); 403 R( c, d, e, a, b, F3, K3, M(58) ); 404 R( b, c, d, e, a, F3, K3, M(59) ); 405 R( a, b, c, d, e, F4, K4, M(60) ); 406 R( e, a, b, c, d, F4, K4, M(61) ); 407 R( d, e, a, b, c, F4, K4, M(62) ); 408 R( c, d, e, a, b, F4, K4, M(63) ); 409 R( b, c, d, e, a, F4, K4, M(64) ); 410 R( a, b, c, d, e, F4, K4, M(65) ); 411 R( e, a, b, c, d, F4, K4, M(66) ); 412 R( d, e, a, b, c, F4, K4, M(67) ); 413 R( c, d, e, a, b, F4, K4, M(68) ); 414 R( b, c, d, e, a, F4, K4, M(69) ); 415 R( a, b, c, d, e, F4, K4, M(70) ); 416 R( e, a, b, c, d, F4, K4, M(71) ); 417 R( d, e, a, b, c, F4, K4, M(72) ); 418 R( c, d, e, a, b, F4, K4, M(73) ); 419 R( b, c, d, e, a, F4, K4, M(74) ); 420 R( a, b, c, d, e, F4, K4, M(75) ); 421 R( e, a, b, c, d, F4, K4, M(76) ); 422 R( d, e, a, b, c, F4, K4, M(77) ); 423 R( c, d, e, a, b, F4, K4, M(78) ); 424 R( b, c, d, e, a, F4, K4, M(79) ); 425 426 a = ctx->A += a; 427 b = ctx->B += b; 428 c = ctx->C += c; 429 d = ctx->D += d; 430 e = ctx->E += e; 431 } 432} 433#endif 434