1/* sha256.c - Functions to compute SHA256 and SHA224 message digest of files or
2   memory blocks according to the NIST specification FIPS-180-2.
3
4   Copyright (C) 2005, 2006, 2008, 2009, 2010 Free Software Foundation, Inc.
5
6   This program is free software: you can redistribute it and/or modify
7   it under the terms of the GNU General Public License as published by
8   the Free Software Foundation, either version 3 of the License, or
9   (at your option) any later version.
10
11   This program is distributed in the hope that it will be useful,
12   but WITHOUT ANY WARRANTY; without even the implied warranty of
13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14   GNU General Public License for more details.
15
16   You should have received a copy of the GNU General Public License
17   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
18
19/* Written by David Madore, considerably copypasting from
20   Scott G. Miller's sha1.c
21*/
22
23#include <config.h>
24
25#include "sha256.h"
26
27#include <stddef.h>
28#include <stdlib.h>
29#include <string.h>
30
31#if USE_UNLOCKED_IO
32# include "unlocked-io.h"
33#endif
34
35#ifdef WORDS_BIGENDIAN
36# define SWAP(n) (n)
37#else
38# define SWAP(n) \
39    (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
40#endif
41
42#define BLOCKSIZE 32768
43#if BLOCKSIZE % 64 != 0
44# error "invalid BLOCKSIZE"
45#endif
46
47/* This array contains the bytes used to pad the buffer to the next
48   64-byte boundary.  */
49static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
50
51
52/*
53  Takes a pointer to a 256 bit block of data (eight 32 bit ints) and
54  intializes it to the start constants of the SHA256 algorithm.  This
55  must be called before using hash in the call to sha256_hash
56*/
57void
58sha256_init_ctx (struct sha256_ctx *ctx)
59{
60  ctx->state[0] = 0x6a09e667UL;
61  ctx->state[1] = 0xbb67ae85UL;
62  ctx->state[2] = 0x3c6ef372UL;
63  ctx->state[3] = 0xa54ff53aUL;
64  ctx->state[4] = 0x510e527fUL;
65  ctx->state[5] = 0x9b05688cUL;
66  ctx->state[6] = 0x1f83d9abUL;
67  ctx->state[7] = 0x5be0cd19UL;
68
69  ctx->total[0] = ctx->total[1] = 0;
70  ctx->buflen = 0;
71}
72
73void
74sha224_init_ctx (struct sha256_ctx *ctx)
75{
76  ctx->state[0] = 0xc1059ed8UL;
77  ctx->state[1] = 0x367cd507UL;
78  ctx->state[2] = 0x3070dd17UL;
79  ctx->state[3] = 0xf70e5939UL;
80  ctx->state[4] = 0xffc00b31UL;
81  ctx->state[5] = 0x68581511UL;
82  ctx->state[6] = 0x64f98fa7UL;
83  ctx->state[7] = 0xbefa4fa4UL;
84
85  ctx->total[0] = ctx->total[1] = 0;
86  ctx->buflen = 0;
87}
88
89/* Copy the value from v into the memory location pointed to by *cp,
90   If your architecture allows unaligned access this is equivalent to
91   * (uint32_t *) cp = v  */
92static inline void
93set_uint32 (char *cp, uint32_t v)
94{
95  memcpy (cp, &v, sizeof v);
96}
97
98/* Put result from CTX in first 32 bytes following RESBUF.  The result
99   must be in little endian byte order.  */
100void *
101sha256_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
102{
103  int i;
104  char *r = resbuf;
105
106  for (i = 0; i < 8; i++)
107    set_uint32 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
108
109  return resbuf;
110}
111
112void *
113sha224_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
114{
115  int i;
116  char *r = resbuf;
117
118  for (i = 0; i < 7; i++)
119    set_uint32 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
120
121  return resbuf;
122}
123
124/* Process the remaining bytes in the internal buffer and the usual
125   prolog according to the standard and write the result to RESBUF.  */
126static void
127sha256_conclude_ctx (struct sha256_ctx *ctx)
128{
129  /* Take yet unprocessed bytes into account.  */
130  size_t bytes = ctx->buflen;
131  size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
132
133  /* Now count remaining bytes.  */
134  ctx->total[0] += bytes;
135  if (ctx->total[0] < bytes)
136    ++ctx->total[1];
137
138  /* Put the 64-bit file length in *bits* at the end of the buffer.
139     Use set_uint32 rather than a simple assignment, to avoid risk of
140     unaligned access.  */
141  set_uint32 ((char *) &ctx->buffer[size - 2],
142              SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29)));
143  set_uint32 ((char *) &ctx->buffer[size - 1],
144              SWAP (ctx->total[0] << 3));
145
146  memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
147
148  /* Process last bytes.  */
149  sha256_process_block (ctx->buffer, size * 4, ctx);
150}
151
152void *
153sha256_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
154{
155  sha256_conclude_ctx (ctx);
156  return sha256_read_ctx (ctx, resbuf);
157}
158
159void *
160sha224_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
161{
162  sha256_conclude_ctx (ctx);
163  return sha224_read_ctx (ctx, resbuf);
164}
165
166/* Compute SHA256 message digest for bytes read from STREAM.  The
167   resulting message digest number will be written into the 32 bytes
168   beginning at RESBLOCK.  */
169int
170sha256_stream (FILE *stream, void *resblock)
171{
172  struct sha256_ctx ctx;
173  size_t sum;
174
175  char *buffer = malloc (BLOCKSIZE + 72);
176  if (!buffer)
177    return 1;
178
179  /* Initialize the computation context.  */
180  sha256_init_ctx (&ctx);
181
182  /* Iterate over full file contents.  */
183  while (1)
184    {
185      /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
186         computation function processes the whole buffer so that with the
187         next round of the loop another block can be read.  */
188      size_t n;
189      sum = 0;
190
191      /* Read block.  Take care for partial reads.  */
192      while (1)
193        {
194          n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
195
196          sum += n;
197
198          if (sum == BLOCKSIZE)
199            break;
200
201          if (n == 0)
202            {
203              /* Check for the error flag IFF N == 0, so that we don't
204                 exit the loop after a partial read due to e.g., EAGAIN
205                 or EWOULDBLOCK.  */
206              if (ferror (stream))
207                {
208                  free (buffer);
209                  return 1;
210                }
211              goto process_partial_block;
212            }
213
214          /* We've read at least one byte, so ignore errors.  But always
215             check for EOF, since feof may be true even though N > 0.
216             Otherwise, we could end up calling fread after EOF.  */
217          if (feof (stream))
218            goto process_partial_block;
219        }
220
221      /* Process buffer with BLOCKSIZE bytes.  Note that
222                        BLOCKSIZE % 64 == 0
223       */
224      sha256_process_block (buffer, BLOCKSIZE, &ctx);
225    }
226
227 process_partial_block:;
228
229  /* Process any remaining bytes.  */
230  if (sum > 0)
231    sha256_process_bytes (buffer, sum, &ctx);
232
233  /* Construct result in desired memory.  */
234  sha256_finish_ctx (&ctx, resblock);
235  free (buffer);
236  return 0;
237}
238
239/* FIXME: Avoid code duplication */
240int
241sha224_stream (FILE *stream, void *resblock)
242{
243  struct sha256_ctx ctx;
244  size_t sum;
245
246  char *buffer = malloc (BLOCKSIZE + 72);
247  if (!buffer)
248    return 1;
249
250  /* Initialize the computation context.  */
251  sha224_init_ctx (&ctx);
252
253  /* Iterate over full file contents.  */
254  while (1)
255    {
256      /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
257         computation function processes the whole buffer so that with the
258         next round of the loop another block can be read.  */
259      size_t n;
260      sum = 0;
261
262      /* Read block.  Take care for partial reads.  */
263      while (1)
264        {
265          n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
266
267          sum += n;
268
269          if (sum == BLOCKSIZE)
270            break;
271
272          if (n == 0)
273            {
274              /* Check for the error flag IFF N == 0, so that we don't
275                 exit the loop after a partial read due to e.g., EAGAIN
276                 or EWOULDBLOCK.  */
277              if (ferror (stream))
278                {
279                  free (buffer);
280                  return 1;
281                }
282              goto process_partial_block;
283            }
284
285          /* We've read at least one byte, so ignore errors.  But always
286             check for EOF, since feof may be true even though N > 0.
287             Otherwise, we could end up calling fread after EOF.  */
288          if (feof (stream))
289            goto process_partial_block;
290        }
291
292      /* Process buffer with BLOCKSIZE bytes.  Note that
293                        BLOCKSIZE % 64 == 0
294       */
295      sha256_process_block (buffer, BLOCKSIZE, &ctx);
296    }
297
298 process_partial_block:;
299
300  /* Process any remaining bytes.  */
301  if (sum > 0)
302    sha256_process_bytes (buffer, sum, &ctx);
303
304  /* Construct result in desired memory.  */
305  sha224_finish_ctx (&ctx, resblock);
306  free (buffer);
307  return 0;
308}
309
310/* Compute SHA512 message digest for LEN bytes beginning at BUFFER.  The
311   result is always in little endian byte order, so that a byte-wise
312   output yields to the wanted ASCII representation of the message
313   digest.  */
314void *
315sha256_buffer (const char *buffer, size_t len, void *resblock)
316{
317  struct sha256_ctx ctx;
318
319  /* Initialize the computation context.  */
320  sha256_init_ctx (&ctx);
321
322  /* Process whole buffer but last len % 64 bytes.  */
323  sha256_process_bytes (buffer, len, &ctx);
324
325  /* Put result in desired memory area.  */
326  return sha256_finish_ctx (&ctx, resblock);
327}
328
329void *
330sha224_buffer (const char *buffer, size_t len, void *resblock)
331{
332  struct sha256_ctx ctx;
333
334  /* Initialize the computation context.  */
335  sha224_init_ctx (&ctx);
336
337  /* Process whole buffer but last len % 64 bytes.  */
338  sha256_process_bytes (buffer, len, &ctx);
339
340  /* Put result in desired memory area.  */
341  return sha224_finish_ctx (&ctx, resblock);
342}
343
344void
345sha256_process_bytes (const void *buffer, size_t len, struct sha256_ctx *ctx)
346{
347  /* When we already have some bits in our internal buffer concatenate
348     both inputs first.  */
349  if (ctx->buflen != 0)
350    {
351      size_t left_over = ctx->buflen;
352      size_t add = 128 - left_over > len ? len : 128 - left_over;
353
354      memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
355      ctx->buflen += add;
356
357      if (ctx->buflen > 64)
358        {
359          sha256_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
360
361          ctx->buflen &= 63;
362          /* The regions in the following copy operation cannot overlap.  */
363          memcpy (ctx->buffer,
364                  &((char *) ctx->buffer)[(left_over + add) & ~63],
365                  ctx->buflen);
366        }
367
368      buffer = (const char *) buffer + add;
369      len -= add;
370    }
371
372  /* Process available complete blocks.  */
373  if (len >= 64)
374    {
375#if !_STRING_ARCH_unaligned
376# define alignof(type) offsetof (struct { char c; type x; }, x)
377# define UNALIGNED_P(p) (((size_t) p) % alignof (uint32_t) != 0)
378      if (UNALIGNED_P (buffer))
379        while (len > 64)
380          {
381            sha256_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
382            buffer = (const char *) buffer + 64;
383            len -= 64;
384          }
385      else
386#endif
387        {
388          sha256_process_block (buffer, len & ~63, ctx);
389          buffer = (const char *) buffer + (len & ~63);
390          len &= 63;
391        }
392    }
393
394  /* Move remaining bytes in internal buffer.  */
395  if (len > 0)
396    {
397      size_t left_over = ctx->buflen;
398
399      memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
400      left_over += len;
401      if (left_over >= 64)
402        {
403          sha256_process_block (ctx->buffer, 64, ctx);
404          left_over -= 64;
405          memcpy (ctx->buffer, &ctx->buffer[16], left_over);
406        }
407      ctx->buflen = left_over;
408    }
409}
410
411/* --- Code below is the primary difference between sha1.c and sha256.c --- */
412
413/* SHA256 round constants */
414#define K(I) sha256_round_constants[I]
415static const uint32_t sha256_round_constants[64] = {
416  0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
417  0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
418  0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
419  0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
420  0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
421  0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
422  0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
423  0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
424  0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
425  0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
426  0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
427  0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
428  0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
429  0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
430  0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
431  0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL,
432};
433
434/* Round functions.  */
435#define F2(A,B,C) ( ( A & B ) | ( C & ( A | B ) ) )
436#define F1(E,F,G) ( G ^ ( E & ( F ^ G ) ) )
437
438/* Process LEN bytes of BUFFER, accumulating context into CTX.
439   It is assumed that LEN % 64 == 0.
440   Most of this code comes from GnuPG's cipher/sha1.c.  */
441
442void
443sha256_process_block (const void *buffer, size_t len, struct sha256_ctx *ctx)
444{
445  const uint32_t *words = buffer;
446  size_t nwords = len / sizeof (uint32_t);
447  const uint32_t *endp = words + nwords;
448  uint32_t x[16];
449  uint32_t a = ctx->state[0];
450  uint32_t b = ctx->state[1];
451  uint32_t c = ctx->state[2];
452  uint32_t d = ctx->state[3];
453  uint32_t e = ctx->state[4];
454  uint32_t f = ctx->state[5];
455  uint32_t g = ctx->state[6];
456  uint32_t h = ctx->state[7];
457
458  /* First increment the byte count.  FIPS PUB 180-2 specifies the possible
459     length of the file up to 2^64 bits.  Here we only compute the
460     number of bytes.  Do a double word increment.  */
461  ctx->total[0] += len;
462  if (ctx->total[0] < len)
463    ++ctx->total[1];
464
465#define rol(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
466#define S0(x) (rol(x,25)^rol(x,14)^(x>>3))
467#define S1(x) (rol(x,15)^rol(x,13)^(x>>10))
468#define SS0(x) (rol(x,30)^rol(x,19)^rol(x,10))
469#define SS1(x) (rol(x,26)^rol(x,21)^rol(x,7))
470
471#define M(I) ( tm =   S1(x[(I-2)&0x0f]) + x[(I-7)&0x0f] \
472                    + S0(x[(I-15)&0x0f]) + x[I&0x0f]    \
473               , x[I&0x0f] = tm )
474
475#define R(A,B,C,D,E,F,G,H,K,M)  do { t0 = SS0(A) + F2(A,B,C); \
476                                     t1 = H + SS1(E)  \
477                                      + F1(E,F,G)     \
478                                      + K             \
479                                      + M;            \
480                                     D += t1;  H = t0 + t1; \
481                               } while(0)
482
483  while (words < endp)
484    {
485      uint32_t tm;
486      uint32_t t0, t1;
487      int t;
488      /* FIXME: see sha1.c for a better implementation.  */
489      for (t = 0; t < 16; t++)
490        {
491          x[t] = SWAP (*words);
492          words++;
493        }
494
495      R( a, b, c, d, e, f, g, h, K( 0), x[ 0] );
496      R( h, a, b, c, d, e, f, g, K( 1), x[ 1] );
497      R( g, h, a, b, c, d, e, f, K( 2), x[ 2] );
498      R( f, g, h, a, b, c, d, e, K( 3), x[ 3] );
499      R( e, f, g, h, a, b, c, d, K( 4), x[ 4] );
500      R( d, e, f, g, h, a, b, c, K( 5), x[ 5] );
501      R( c, d, e, f, g, h, a, b, K( 6), x[ 6] );
502      R( b, c, d, e, f, g, h, a, K( 7), x[ 7] );
503      R( a, b, c, d, e, f, g, h, K( 8), x[ 8] );
504      R( h, a, b, c, d, e, f, g, K( 9), x[ 9] );
505      R( g, h, a, b, c, d, e, f, K(10), x[10] );
506      R( f, g, h, a, b, c, d, e, K(11), x[11] );
507      R( e, f, g, h, a, b, c, d, K(12), x[12] );
508      R( d, e, f, g, h, a, b, c, K(13), x[13] );
509      R( c, d, e, f, g, h, a, b, K(14), x[14] );
510      R( b, c, d, e, f, g, h, a, K(15), x[15] );
511      R( a, b, c, d, e, f, g, h, K(16), M(16) );
512      R( h, a, b, c, d, e, f, g, K(17), M(17) );
513      R( g, h, a, b, c, d, e, f, K(18), M(18) );
514      R( f, g, h, a, b, c, d, e, K(19), M(19) );
515      R( e, f, g, h, a, b, c, d, K(20), M(20) );
516      R( d, e, f, g, h, a, b, c, K(21), M(21) );
517      R( c, d, e, f, g, h, a, b, K(22), M(22) );
518      R( b, c, d, e, f, g, h, a, K(23), M(23) );
519      R( a, b, c, d, e, f, g, h, K(24), M(24) );
520      R( h, a, b, c, d, e, f, g, K(25), M(25) );
521      R( g, h, a, b, c, d, e, f, K(26), M(26) );
522      R( f, g, h, a, b, c, d, e, K(27), M(27) );
523      R( e, f, g, h, a, b, c, d, K(28), M(28) );
524      R( d, e, f, g, h, a, b, c, K(29), M(29) );
525      R( c, d, e, f, g, h, a, b, K(30), M(30) );
526      R( b, c, d, e, f, g, h, a, K(31), M(31) );
527      R( a, b, c, d, e, f, g, h, K(32), M(32) );
528      R( h, a, b, c, d, e, f, g, K(33), M(33) );
529      R( g, h, a, b, c, d, e, f, K(34), M(34) );
530      R( f, g, h, a, b, c, d, e, K(35), M(35) );
531      R( e, f, g, h, a, b, c, d, K(36), M(36) );
532      R( d, e, f, g, h, a, b, c, K(37), M(37) );
533      R( c, d, e, f, g, h, a, b, K(38), M(38) );
534      R( b, c, d, e, f, g, h, a, K(39), M(39) );
535      R( a, b, c, d, e, f, g, h, K(40), M(40) );
536      R( h, a, b, c, d, e, f, g, K(41), M(41) );
537      R( g, h, a, b, c, d, e, f, K(42), M(42) );
538      R( f, g, h, a, b, c, d, e, K(43), M(43) );
539      R( e, f, g, h, a, b, c, d, K(44), M(44) );
540      R( d, e, f, g, h, a, b, c, K(45), M(45) );
541      R( c, d, e, f, g, h, a, b, K(46), M(46) );
542      R( b, c, d, e, f, g, h, a, K(47), M(47) );
543      R( a, b, c, d, e, f, g, h, K(48), M(48) );
544      R( h, a, b, c, d, e, f, g, K(49), M(49) );
545      R( g, h, a, b, c, d, e, f, K(50), M(50) );
546      R( f, g, h, a, b, c, d, e, K(51), M(51) );
547      R( e, f, g, h, a, b, c, d, K(52), M(52) );
548      R( d, e, f, g, h, a, b, c, K(53), M(53) );
549      R( c, d, e, f, g, h, a, b, K(54), M(54) );
550      R( b, c, d, e, f, g, h, a, K(55), M(55) );
551      R( a, b, c, d, e, f, g, h, K(56), M(56) );
552      R( h, a, b, c, d, e, f, g, K(57), M(57) );
553      R( g, h, a, b, c, d, e, f, K(58), M(58) );
554      R( f, g, h, a, b, c, d, e, K(59), M(59) );
555      R( e, f, g, h, a, b, c, d, K(60), M(60) );
556      R( d, e, f, g, h, a, b, c, K(61), M(61) );
557      R( c, d, e, f, g, h, a, b, K(62), M(62) );
558      R( b, c, d, e, f, g, h, a, K(63), M(63) );
559
560      a = ctx->state[0] += a;
561      b = ctx->state[1] += b;
562      c = ctx->state[2] += c;
563      d = ctx->state[3] += d;
564      e = ctx->state[4] += e;
565      f = ctx->state[5] += f;
566      g = ctx->state[6] += g;
567      h = ctx->state[7] += h;
568    }
569}
570