1/*-
2 * Copyright 2005 Colin Percival
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD$");
29
30#include <sys/endian.h>
31#include <sys/types.h>
32
33#ifdef _KERNEL
34#include <sys/systm.h>
35#else
36#include <string.h>
37#endif
38
39#include "sha224.h"
40#include "sha256.h"
41
42#if BYTE_ORDER == BIG_ENDIAN
43
44/* Copy a vector of big-endian uint32_t into a vector of bytes */
45#define be32enc_vect(dst, src, len)	\
46	memcpy((void *)dst, (const void *)src, (size_t)len)
47
48/* Copy a vector of bytes into a vector of big-endian uint32_t */
49#define be32dec_vect(dst, src, len)	\
50	memcpy((void *)dst, (const void *)src, (size_t)len)
51
52#else /* BYTE_ORDER != BIG_ENDIAN */
53
54/*
55 * Encode a length len/4 vector of (uint32_t) into a length len vector of
56 * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
57 */
58static void
59be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
60{
61	size_t i;
62
63	for (i = 0; i < len / 4; i++)
64		be32enc(dst + i * 4, src[i]);
65}
66
67/*
68 * Decode a big-endian length len vector of (unsigned char) into a length
69 * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
70 */
71static void
72be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
73{
74	size_t i;
75
76	for (i = 0; i < len / 4; i++)
77		dst[i] = be32dec(src + i * 4);
78}
79
80#endif /* BYTE_ORDER != BIG_ENDIAN */
81
82/* SHA256 round constants. */
83static const uint32_t K[64] = {
84	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
85	0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
86	0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
87	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
88	0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
89	0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
90	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
91	0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
92	0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
93	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
94	0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
95	0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
96	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
97	0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
98	0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
99	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
100};
101
102/* Elementary functions used by SHA256 */
103#define Ch(x, y, z)	((x & (y ^ z)) ^ z)
104#define Maj(x, y, z)	((x & (y | z)) | (y & z))
105#define SHR(x, n)	(x >> n)
106#define ROTR(x, n)	((x >> n) | (x << (32 - n)))
107#define S0(x)		(ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
108#define S1(x)		(ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
109#define s0(x)		(ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
110#define s1(x)		(ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
111
112/* SHA256 round function */
113#define RND(a, b, c, d, e, f, g, h, k)			\
114	h += S1(e) + Ch(e, f, g) + k;			\
115	d += h;						\
116	h += S0(a) + Maj(a, b, c);
117
118/* Adjusted round function for rotating state */
119#define RNDr(S, W, i, ii)			\
120	RND(S[(64 - i) % 8], S[(65 - i) % 8],	\
121	    S[(66 - i) % 8], S[(67 - i) % 8],	\
122	    S[(68 - i) % 8], S[(69 - i) % 8],	\
123	    S[(70 - i) % 8], S[(71 - i) % 8],	\
124	    W[i + ii] + K[i + ii])
125
126/* Message schedule computation */
127#define MSCH(W, ii, i)				\
128	W[i + ii + 16] = s1(W[i + ii + 14]) + W[i + ii + 9] + s0(W[i + ii + 1]) + W[i + ii]
129
130/*
131 * SHA256 block compression function.  The 256-bit state is transformed via
132 * the 512-bit input block to produce a new state.
133 */
134static void
135SHA256_Transform(uint32_t * state, const unsigned char block[64])
136{
137	uint32_t W[64];
138	uint32_t S[8];
139	int i;
140
141	/* 1. Prepare the first part of the message schedule W. */
142	be32dec_vect(W, block, 64);
143
144	/* 2. Initialize working variables. */
145	memcpy(S, state, 32);
146
147	/* 3. Mix. */
148	for (i = 0; i < 64; i += 16) {
149		RNDr(S, W, 0, i);
150		RNDr(S, W, 1, i);
151		RNDr(S, W, 2, i);
152		RNDr(S, W, 3, i);
153		RNDr(S, W, 4, i);
154		RNDr(S, W, 5, i);
155		RNDr(S, W, 6, i);
156		RNDr(S, W, 7, i);
157		RNDr(S, W, 8, i);
158		RNDr(S, W, 9, i);
159		RNDr(S, W, 10, i);
160		RNDr(S, W, 11, i);
161		RNDr(S, W, 12, i);
162		RNDr(S, W, 13, i);
163		RNDr(S, W, 14, i);
164		RNDr(S, W, 15, i);
165
166		if (i == 48)
167			break;
168		MSCH(W, 0, i);
169		MSCH(W, 1, i);
170		MSCH(W, 2, i);
171		MSCH(W, 3, i);
172		MSCH(W, 4, i);
173		MSCH(W, 5, i);
174		MSCH(W, 6, i);
175		MSCH(W, 7, i);
176		MSCH(W, 8, i);
177		MSCH(W, 9, i);
178		MSCH(W, 10, i);
179		MSCH(W, 11, i);
180		MSCH(W, 12, i);
181		MSCH(W, 13, i);
182		MSCH(W, 14, i);
183		MSCH(W, 15, i);
184	}
185
186	/* 4. Mix local working variables into global state */
187	for (i = 0; i < 8; i++)
188		state[i] += S[i];
189}
190
191static unsigned char PAD[64] = {
192	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
196};
197
198/* Add padding and terminating bit-count. */
199static void
200SHA256_Pad(SHA256_CTX * ctx)
201{
202	size_t r;
203
204	/* Figure out how many bytes we have buffered. */
205	r = (ctx->count >> 3) & 0x3f;
206
207	/* Pad to 56 mod 64, transforming if we finish a block en route. */
208	if (r < 56) {
209		/* Pad to 56 mod 64. */
210		memcpy(&ctx->buf[r], PAD, 56 - r);
211	} else {
212		/* Finish the current block and mix. */
213		memcpy(&ctx->buf[r], PAD, 64 - r);
214		SHA256_Transform(ctx->state, ctx->buf);
215
216		/* The start of the final block is all zeroes. */
217		memset(&ctx->buf[0], 0, 56);
218	}
219
220	/* Add the terminating bit-count. */
221	be64enc(&ctx->buf[56], ctx->count);
222
223	/* Mix in the final block. */
224	SHA256_Transform(ctx->state, ctx->buf);
225}
226
227/* SHA-256 initialization.  Begins a SHA-256 operation. */
228void
229SHA256_Init(SHA256_CTX * ctx)
230{
231
232	/* Zero bits processed so far */
233	ctx->count = 0;
234
235	/* Magic initialization constants */
236	ctx->state[0] = 0x6A09E667;
237	ctx->state[1] = 0xBB67AE85;
238	ctx->state[2] = 0x3C6EF372;
239	ctx->state[3] = 0xA54FF53A;
240	ctx->state[4] = 0x510E527F;
241	ctx->state[5] = 0x9B05688C;
242	ctx->state[6] = 0x1F83D9AB;
243	ctx->state[7] = 0x5BE0CD19;
244}
245
246/* Add bytes into the hash */
247void
248SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len)
249{
250	uint64_t bitlen;
251	uint32_t r;
252	const unsigned char *src = in;
253
254	/* Number of bytes left in the buffer from previous updates */
255	r = (ctx->count >> 3) & 0x3f;
256
257	/* Convert the length into a number of bits */
258	bitlen = len << 3;
259
260	/* Update number of bits */
261	ctx->count += bitlen;
262
263	/* Handle the case where we don't need to perform any transforms */
264	if (len < 64 - r) {
265		memcpy(&ctx->buf[r], src, len);
266		return;
267	}
268
269	/* Finish the current block */
270	memcpy(&ctx->buf[r], src, 64 - r);
271	SHA256_Transform(ctx->state, ctx->buf);
272	src += 64 - r;
273	len -= 64 - r;
274
275	/* Perform complete blocks */
276	while (len >= 64) {
277		SHA256_Transform(ctx->state, src);
278		src += 64;
279		len -= 64;
280	}
281
282	/* Copy left over data into buffer */
283	memcpy(ctx->buf, src, len);
284}
285
286/*
287 * SHA-256 finalization.  Pads the input data, exports the hash value,
288 * and clears the context state.
289 */
290void
291SHA256_Final(unsigned char digest[static SHA256_DIGEST_LENGTH], SHA256_CTX *ctx)
292{
293
294	/* Add padding */
295	SHA256_Pad(ctx);
296
297	/* Write the hash */
298	be32enc_vect(digest, ctx->state, SHA256_DIGEST_LENGTH);
299
300	/* Clear the context state */
301	explicit_bzero(ctx, sizeof(*ctx));
302}
303
304/*** SHA-224: *********************************************************/
305/*
306 * the SHA224 and SHA256 transforms are identical
307 */
308
309/* SHA-224 initialization.  Begins a SHA-224 operation. */
310void
311SHA224_Init(SHA224_CTX * ctx)
312{
313
314	/* Zero bits processed so far */
315	ctx->count = 0;
316
317	/* Magic initialization constants */
318	ctx->state[0] = 0xC1059ED8;
319	ctx->state[1] = 0x367CD507;
320	ctx->state[2] = 0x3070DD17;
321	ctx->state[3] = 0xF70E5939;
322	ctx->state[4] = 0xFFC00B31;
323	ctx->state[5] = 0x68581511;
324	ctx->state[6] = 0x64f98FA7;
325	ctx->state[7] = 0xBEFA4FA4;
326}
327
328/* Add bytes into the SHA-224 hash */
329void
330SHA224_Update(SHA224_CTX * ctx, const void *in, size_t len)
331{
332
333	SHA256_Update((SHA256_CTX *)ctx, in, len);
334}
335
336/*
337 * SHA-224 finalization.  Pads the input data, exports the hash value,
338 * and clears the context state.
339 */
340void
341SHA224_Final(unsigned char digest[static SHA224_DIGEST_LENGTH], SHA224_CTX *ctx)
342{
343
344	/* Add padding */
345	SHA256_Pad((SHA256_CTX *)ctx);
346
347	/* Write the hash */
348	be32enc_vect(digest, ctx->state, SHA224_DIGEST_LENGTH);
349
350	/* Clear the context state */
351	explicit_bzero(ctx, sizeof(*ctx));
352}
353
354#ifdef WEAK_REFS
355/* When building libmd, provide weak references. Note: this is not
356   activated in the context of compiling these sources for internal
357   use in libcrypt.
358 */
359#undef SHA256_Init
360__weak_reference(_libmd_SHA256_Init, SHA256_Init);
361#undef SHA256_Update
362__weak_reference(_libmd_SHA256_Update, SHA256_Update);
363#undef SHA256_Final
364__weak_reference(_libmd_SHA256_Final, SHA256_Final);
365#undef SHA256_Transform
366__weak_reference(_libmd_SHA256_Transform, SHA256_Transform);
367
368#undef SHA224_Init
369__weak_reference(_libmd_SHA224_Init, SHA224_Init);
370#undef SHA224_Update
371__weak_reference(_libmd_SHA224_Update, SHA224_Update);
372#undef SHA224_Final
373__weak_reference(_libmd_SHA224_Final, SHA224_Final);
374#endif
375