1/* 2 * FILE: sha2.c 3 * AUTHOR: Aaron D. Gifford - http://www.aarongifford.com/ 4 * 5 * Copyright (c) 2000-2001, Aaron D. Gifford 6 * All rights reserved. 7 * 8 * Modified by Jelte Jansen to fit in ldns, and not clash with any 9 * system-defined SHA code. 10 * Changes: 11 * - Renamed (external) functions and constants to fit ldns style 12 * - Removed _End and _Data functions 13 * - Added ldns_shaX(data, len, digest) convenience functions 14 * - Removed prototypes of _Transform functions and made those static 15 * Modified by Wouter, and trimmed, to provide SHA512 for getentropy_fallback. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions 19 * are met: 20 * 1. Redistributions of source code must retain the above copyright 21 * notice, this list of conditions and the following disclaimer. 22 * 2. Redistributions in binary form must reproduce the above copyright 23 * notice, this list of conditions and the following disclaimer in the 24 * documentation and/or other materials provided with the distribution. 25 * 3. Neither the name of the copyright holder nor the names of contributors 26 * may be used to endorse or promote products derived from this software 27 * without specific prior written permission. 28 * 29 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND 30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 32 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTOR(S) BE LIABLE 33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 39 * SUCH DAMAGE. 40 * 41 * $Id: sha2.c,v 1.1 2001/11/08 00:01:51 adg Exp adg $ 42 */ 43#include "config.h" 44 45#include <string.h> /* memcpy()/memset() or bcopy()/bzero() */ 46#include <assert.h> /* assert() */ 47 48/* do we have sha512 header defs */ 49#ifndef SHA512_DIGEST_LENGTH 50#define SHA512_BLOCK_LENGTH 128 51#define SHA512_DIGEST_LENGTH 64 52#define SHA512_DIGEST_STRING_LENGTH (SHA512_DIGEST_LENGTH * 2 + 1) 53typedef struct _SHA512_CTX { 54 uint64_t state[8]; 55 uint64_t bitcount[2]; 56 uint8_t buffer[SHA512_BLOCK_LENGTH]; 57} SHA512_CTX; 58#endif /* do we have sha512 header defs */ 59 60void SHA512_Init(SHA512_CTX*); 61void SHA512_Update(SHA512_CTX*, void*, size_t); 62void SHA512_Final(uint8_t[SHA512_DIGEST_LENGTH], SHA512_CTX*); 63unsigned char *SHA512(void *data, unsigned int data_len, unsigned char *digest); 64 65 66/*** SHA-256/384/512 Machine Architecture Definitions *****************/ 67/* 68 * BYTE_ORDER NOTE: 69 * 70 * Please make sure that your system defines BYTE_ORDER. If your 71 * architecture is little-endian, make sure it also defines 72 * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are 73 * equivalent. 74 * 75 * If your system does not define the above, then you can do so by 76 * hand like this: 77 * 78 * #define LITTLE_ENDIAN 1234 79 * #define BIG_ENDIAN 4321 80 * 81 * And for little-endian machines, add: 82 * 83 * #define BYTE_ORDER LITTLE_ENDIAN 84 * 85 * Or for big-endian machines: 86 * 87 * #define BYTE_ORDER BIG_ENDIAN 88 * 89 * The FreeBSD machine this was written on defines BYTE_ORDER 90 * appropriately by including <sys/types.h> (which in turn includes 91 * <machine/endian.h> where the appropriate definitions are actually 92 * made). 93 */ 94#if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN) 95#error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN 96#endif 97 98typedef uint8_t sha2_byte; /* Exactly 1 byte */ 99typedef uint32_t sha2_word32; /* Exactly 4 bytes */ 100#ifdef S_SPLINT_S 101typedef unsigned long long sha2_word64; /* lint 8 bytes */ 102#else 103typedef uint64_t sha2_word64; /* Exactly 8 bytes */ 104#endif 105 106/*** SHA-256/384/512 Various Length Definitions ***********************/ 107#define SHA512_SHORT_BLOCK_LENGTH (SHA512_BLOCK_LENGTH - 16) 108 109 110/*** ENDIAN REVERSAL MACROS *******************************************/ 111#if BYTE_ORDER == LITTLE_ENDIAN 112#define REVERSE32(w,x) { \ 113 sha2_word32 tmp = (w); \ 114 tmp = (tmp >> 16) | (tmp << 16); \ 115 (x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \ 116} 117#ifndef S_SPLINT_S 118#define REVERSE64(w,x) { \ 119 sha2_word64 tmp = (w); \ 120 tmp = (tmp >> 32) | (tmp << 32); \ 121 tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \ 122 ((tmp & 0x00ff00ff00ff00ffULL) << 8); \ 123 (x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \ 124 ((tmp & 0x0000ffff0000ffffULL) << 16); \ 125} 126#else /* splint */ 127#define REVERSE64(w,x) /* splint */ 128#endif /* splint */ 129#endif /* BYTE_ORDER == LITTLE_ENDIAN */ 130 131/* 132 * Macro for incrementally adding the unsigned 64-bit integer n to the 133 * unsigned 128-bit integer (represented using a two-element array of 134 * 64-bit words): 135 */ 136#define ADDINC128(w,n) { \ 137 (w)[0] += (sha2_word64)(n); \ 138 if ((w)[0] < (n)) { \ 139 (w)[1]++; \ 140 } \ 141} 142#ifdef S_SPLINT_S 143#undef ADDINC128 144#define ADDINC128(w,n) /* splint */ 145#endif 146 147/* 148 * Macros for copying blocks of memory and for zeroing out ranges 149 * of memory. Using these macros makes it easy to switch from 150 * using memset()/memcpy() and using bzero()/bcopy(). 151 * 152 * Please define either SHA2_USE_MEMSET_MEMCPY or define 153 * SHA2_USE_BZERO_BCOPY depending on which function set you 154 * choose to use: 155 */ 156#if !defined(SHA2_USE_MEMSET_MEMCPY) && !defined(SHA2_USE_BZERO_BCOPY) 157/* Default to memset()/memcpy() if no option is specified */ 158#define SHA2_USE_MEMSET_MEMCPY 1 159#endif 160#if defined(SHA2_USE_MEMSET_MEMCPY) && defined(SHA2_USE_BZERO_BCOPY) 161/* Abort with an error if BOTH options are defined */ 162#error Define either SHA2_USE_MEMSET_MEMCPY or SHA2_USE_BZERO_BCOPY, not both! 163#endif 164 165#ifdef SHA2_USE_MEMSET_MEMCPY 166#define MEMSET_BZERO(p,l) memset((p), 0, (l)) 167#define MEMCPY_BCOPY(d,s,l) memcpy((d), (s), (l)) 168#endif 169#ifdef SHA2_USE_BZERO_BCOPY 170#define MEMSET_BZERO(p,l) bzero((p), (l)) 171#define MEMCPY_BCOPY(d,s,l) bcopy((s), (d), (l)) 172#endif 173 174 175/*** THE SIX LOGICAL FUNCTIONS ****************************************/ 176/* 177 * Bit shifting and rotation (used by the six SHA-XYZ logical functions: 178 * 179 * NOTE: The naming of R and S appears backwards here (R is a SHIFT and 180 * S is a ROTATION) because the SHA-256/384/512 description document 181 * (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this 182 * same "backwards" definition. 183 */ 184/* Shift-right (used in SHA-256, SHA-384, and SHA-512): */ 185#define R(b,x) ((x) >> (b)) 186/* 64-bit Rotate-right (used in SHA-384 and SHA-512): */ 187#define S64(b,x) (((x) >> (b)) | ((x) << (64 - (b)))) 188 189/* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */ 190#define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z))) 191#define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) 192 193/* Four of six logical functions used in SHA-384 and SHA-512: */ 194#define Sigma0_512(x) (S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x))) 195#define Sigma1_512(x) (S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x))) 196#define sigma0_512(x) (S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7, (x))) 197#define sigma1_512(x) (S64(19, (x)) ^ S64(61, (x)) ^ R( 6, (x))) 198 199/*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/ 200/* Hash constant words K for SHA-384 and SHA-512: */ 201static const sha2_word64 K512[80] = { 202 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 203 0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL, 204 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL, 205 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 206 0xd807aa98a3030242ULL, 0x12835b0145706fbeULL, 207 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL, 208 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 209 0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL, 210 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL, 211 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 212 0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL, 213 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL, 214 0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 215 0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL, 216 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL, 217 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 218 0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL, 219 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL, 220 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 221 0x81c2c92e47edaee6ULL, 0x92722c851482353bULL, 222 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL, 223 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 224 0xd192e819d6ef5218ULL, 0xd69906245565a910ULL, 225 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL, 226 0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 227 0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL, 228 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL, 229 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 230 0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL, 231 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL, 232 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 233 0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL, 234 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL, 235 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 236 0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL, 237 0x113f9804bef90daeULL, 0x1b710b35131c471bULL, 238 0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 239 0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL, 240 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL, 241 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL 242}; 243 244/* initial hash value H for SHA-512 */ 245static const sha2_word64 sha512_initial_hash_value[8] = { 246 0x6a09e667f3bcc908ULL, 247 0xbb67ae8584caa73bULL, 248 0x3c6ef372fe94f82bULL, 249 0xa54ff53a5f1d36f1ULL, 250 0x510e527fade682d1ULL, 251 0x9b05688c2b3e6c1fULL, 252 0x1f83d9abfb41bd6bULL, 253 0x5be0cd19137e2179ULL 254}; 255 256typedef union _ldns_sha2_buffer_union { 257 uint8_t* theChars; 258 uint64_t* theLongs; 259} ldns_sha2_buffer_union; 260 261/*** SHA-512: *********************************************************/ 262void SHA512_Init(SHA512_CTX* context) { 263 if (context == (SHA512_CTX*)0) { 264 return; 265 } 266 MEMCPY_BCOPY(context->state, sha512_initial_hash_value, SHA512_DIGEST_LENGTH); 267 MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH); 268 context->bitcount[0] = context->bitcount[1] = 0; 269} 270 271static void SHA512_Transform(SHA512_CTX* context, 272 const sha2_word64* data) { 273 sha2_word64 a, b, c, d, e, f, g, h, s0, s1; 274 sha2_word64 T1, T2, *W512 = (sha2_word64*)context->buffer; 275 int j; 276 277 /* initialize registers with the prev. intermediate value */ 278 a = context->state[0]; 279 b = context->state[1]; 280 c = context->state[2]; 281 d = context->state[3]; 282 e = context->state[4]; 283 f = context->state[5]; 284 g = context->state[6]; 285 h = context->state[7]; 286 287 j = 0; 288 do { 289#if BYTE_ORDER == LITTLE_ENDIAN 290 /* Convert TO host byte order */ 291 REVERSE64(*data++, W512[j]); 292 /* Apply the SHA-512 compression function to update a..h */ 293 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j]; 294#else /* BYTE_ORDER == LITTLE_ENDIAN */ 295 /* Apply the SHA-512 compression function to update a..h with copy */ 296 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + (W512[j] = *data++); 297#endif /* BYTE_ORDER == LITTLE_ENDIAN */ 298 T2 = Sigma0_512(a) + Maj(a, b, c); 299 h = g; 300 g = f; 301 f = e; 302 e = d + T1; 303 d = c; 304 c = b; 305 b = a; 306 a = T1 + T2; 307 308 j++; 309 } while (j < 16); 310 311 do { 312 /* Part of the message block expansion: */ 313 s0 = W512[(j+1)&0x0f]; 314 s0 = sigma0_512(s0); 315 s1 = W512[(j+14)&0x0f]; 316 s1 = sigma1_512(s1); 317 318 /* Apply the SHA-512 compression function to update a..h */ 319 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + 320 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); 321 T2 = Sigma0_512(a) + Maj(a, b, c); 322 h = g; 323 g = f; 324 f = e; 325 e = d + T1; 326 d = c; 327 c = b; 328 b = a; 329 a = T1 + T2; 330 331 j++; 332 } while (j < 80); 333 334 /* Compute the current intermediate hash value */ 335 context->state[0] += a; 336 context->state[1] += b; 337 context->state[2] += c; 338 context->state[3] += d; 339 context->state[4] += e; 340 context->state[5] += f; 341 context->state[6] += g; 342 context->state[7] += h; 343 344 /* Clean up */ 345 a = b = c = d = e = f = g = h = T1 = T2 = 0; 346} 347 348void SHA512_Update(SHA512_CTX* context, void *datain, size_t len) { 349 size_t freespace, usedspace; 350 const sha2_byte* data = (const sha2_byte*)datain; 351 352 if (len == 0) { 353 /* Calling with no data is valid - we do nothing */ 354 return; 355 } 356 357 /* Sanity check: */ 358 assert(context != (SHA512_CTX*)0 && data != (sha2_byte*)0); 359 360 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH; 361 if (usedspace > 0) { 362 /* Calculate how much free space is available in the buffer */ 363 freespace = SHA512_BLOCK_LENGTH - usedspace; 364 365 if (len >= freespace) { 366 /* Fill the buffer completely and process it */ 367 MEMCPY_BCOPY(&context->buffer[usedspace], data, freespace); 368 ADDINC128(context->bitcount, freespace << 3); 369 len -= freespace; 370 data += freespace; 371 SHA512_Transform(context, (sha2_word64*)context->buffer); 372 } else { 373 /* The buffer is not yet full */ 374 MEMCPY_BCOPY(&context->buffer[usedspace], data, len); 375 ADDINC128(context->bitcount, len << 3); 376 /* Clean up: */ 377 usedspace = freespace = 0; 378 return; 379 } 380 } 381 while (len >= SHA512_BLOCK_LENGTH) { 382 /* Process as many complete blocks as we can */ 383 SHA512_Transform(context, (sha2_word64*)data); 384 ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3); 385 len -= SHA512_BLOCK_LENGTH; 386 data += SHA512_BLOCK_LENGTH; 387 } 388 if (len > 0) { 389 /* There's left-overs, so save 'em */ 390 MEMCPY_BCOPY(context->buffer, data, len); 391 ADDINC128(context->bitcount, len << 3); 392 } 393 /* Clean up: */ 394 usedspace = freespace = 0; 395} 396 397static void SHA512_Last(SHA512_CTX* context) { 398 size_t usedspace; 399 ldns_sha2_buffer_union cast_var; 400 401 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH; 402#if BYTE_ORDER == LITTLE_ENDIAN 403 /* Convert FROM host byte order */ 404 REVERSE64(context->bitcount[0],context->bitcount[0]); 405 REVERSE64(context->bitcount[1],context->bitcount[1]); 406#endif 407 if (usedspace > 0) { 408 /* Begin padding with a 1 bit: */ 409 context->buffer[usedspace++] = 0x80; 410 411 if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) { 412 /* Set-up for the last transform: */ 413 MEMSET_BZERO(&context->buffer[usedspace], SHA512_SHORT_BLOCK_LENGTH - usedspace); 414 } else { 415 if (usedspace < SHA512_BLOCK_LENGTH) { 416 MEMSET_BZERO(&context->buffer[usedspace], SHA512_BLOCK_LENGTH - usedspace); 417 } 418 /* Do second-to-last transform: */ 419 SHA512_Transform(context, (sha2_word64*)context->buffer); 420 421 /* And set-up for the last transform: */ 422 MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH - 2); 423 } 424 } else { 425 /* Prepare for final transform: */ 426 MEMSET_BZERO(context->buffer, SHA512_SHORT_BLOCK_LENGTH); 427 428 /* Begin padding with a 1 bit: */ 429 *context->buffer = 0x80; 430 } 431 /* Store the length of input data (in bits): */ 432 cast_var.theChars = context->buffer; 433 cast_var.theLongs[SHA512_SHORT_BLOCK_LENGTH / 8] = context->bitcount[1]; 434 cast_var.theLongs[SHA512_SHORT_BLOCK_LENGTH / 8 + 1] = context->bitcount[0]; 435 436 /* final transform: */ 437 SHA512_Transform(context, (sha2_word64*)context->buffer); 438} 439 440void SHA512_Final(sha2_byte digest[], SHA512_CTX* context) { 441 sha2_word64 *d = (sha2_word64*)digest; 442 443 /* Sanity check: */ 444 assert(context != (SHA512_CTX*)0); 445 446 /* If no digest buffer is passed, we don't bother doing this: */ 447 if (digest != (sha2_byte*)0) { 448 SHA512_Last(context); 449 450 /* Save the hash data for output: */ 451#if BYTE_ORDER == LITTLE_ENDIAN 452 { 453 /* Convert TO host byte order */ 454 int j; 455 for (j = 0; j < 8; j++) { 456 REVERSE64(context->state[j],context->state[j]); 457 *d++ = context->state[j]; 458 } 459 } 460#else 461 MEMCPY_BCOPY(d, context->state, SHA512_DIGEST_LENGTH); 462#endif 463 } 464 465 /* Zero out state data */ 466 MEMSET_BZERO(context, sizeof(SHA512_CTX)); 467} 468 469unsigned char * 470SHA512(void *data, unsigned int data_len, unsigned char *digest) 471{ 472 SHA512_CTX ctx; 473 SHA512_Init(&ctx); 474 SHA512_Update(&ctx, data, data_len); 475 SHA512_Final(digest, &ctx); 476 return digest; 477} 478