1/*
2 * Copyright (c) 2001 Markus Friedl.  All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 *    notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 *    notice, this list of conditions and the following disclaimer in the
11 *    documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24/*
25 * Preneel, Bosselaers, Dobbertin, "The Cryptographic Hash Function RIPEMD-160",
26 * RSA Laboratories, CryptoBytes, Volume 3, Number 2, Autumn 1997,
27 * ftp://ftp.rsasecurity.com/pub/cryptobytes/crypto3n2.pdf
28 */
29#include <sys/types.h>
30#include <endian.h>
31#include <string.h>
32#include <rmd160.h>
33
34#define PUT_64BIT_LE(cp, value) do {                                    \
35	(cp)[7] = (value) >> 56;                                        \
36	(cp)[6] = (value) >> 48;                                        \
37	(cp)[5] = (value) >> 40;                                        \
38	(cp)[4] = (value) >> 32;                                        \
39	(cp)[3] = (value) >> 24;                                        \
40	(cp)[2] = (value) >> 16;                                        \
41	(cp)[1] = (value) >> 8;                                         \
42	(cp)[0] = (value); } while (0)
43
44#define PUT_32BIT_LE(cp, value) do {                                    \
45	(cp)[3] = (value) >> 24;                                        \
46	(cp)[2] = (value) >> 16;                                        \
47	(cp)[1] = (value) >> 8;                                         \
48	(cp)[0] = (value); } while (0)
49
50#define	H0	0x67452301U
51#define	H1	0xEFCDAB89U
52#define	H2	0x98BADCFEU
53#define	H3	0x10325476U
54#define	H4	0xC3D2E1F0U
55
56#define	K0	0x00000000U
57#define	K1	0x5A827999U
58#define	K2	0x6ED9EBA1U
59#define	K3	0x8F1BBCDCU
60#define	K4	0xA953FD4EU
61
62#define	KK0	0x50A28BE6U
63#define	KK1	0x5C4DD124U
64#define	KK2	0x6D703EF3U
65#define	KK3	0x7A6D76E9U
66#define	KK4	0x00000000U
67
68/* rotate x left n bits.  */
69#define ROL(n, x) (((x) << (n)) | ((x) >> (32-(n))))
70
71#define F0(x, y, z) ((x) ^ (y) ^ (z))
72#define F1(x, y, z) (((x) & (y)) | ((~x) & (z)))
73#define F2(x, y, z) (((x) | (~y)) ^ (z))
74#define F3(x, y, z) (((x) & (z)) | ((y) & (~z)))
75#define F4(x, y, z) ((x) ^ ((y) | (~z)))
76
77#define R(a, b, c, d, e, Fj, Kj, sj, rj)                                \
78	do {                                                            \
79		a = ROL(sj, a + Fj(b,c,d) + X(rj) + Kj) + e;            \
80		c = ROL(10, c);                                         \
81	} while(0)
82
83#define X(i)	x[i]
84
85static const u_int8_t PADDING[RMD160_BLOCK_LENGTH] = {
86	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
87	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
88	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
89};
90
91void
92RMD160Init(RMD160_CTX *ctx)
93{
94	ctx->count = 0;
95	ctx->state[0] = H0;
96	ctx->state[1] = H1;
97	ctx->state[2] = H2;
98	ctx->state[3] = H3;
99	ctx->state[4] = H4;
100}
101DEF_WEAK(RMD160Init);
102
103void
104RMD160Update(RMD160_CTX *ctx, const u_int8_t *input, size_t len)
105{
106	size_t have, off, need;
107
108	have = (ctx->count / 8) % RMD160_BLOCK_LENGTH;
109	need = RMD160_BLOCK_LENGTH - have;
110	ctx->count += 8 * len;
111	off = 0;
112
113	if (len >= need) {
114		if (have) {
115			memcpy(ctx->buffer + have, input, need);
116			RMD160Transform(ctx->state, ctx->buffer);
117			off = need;
118			have = 0;
119		}
120		/* now the buffer is empty */
121		while (off + RMD160_BLOCK_LENGTH <= len) {
122			RMD160Transform(ctx->state, input+off);
123			off += RMD160_BLOCK_LENGTH;
124		}
125	}
126	if (off < len)
127		memcpy(ctx->buffer + have, input+off, len-off);
128}
129DEF_WEAK(RMD160Update);
130
131void
132RMD160Pad(RMD160_CTX *ctx)
133{
134	u_int8_t size[8];
135	size_t padlen;
136
137	PUT_64BIT_LE(size, ctx->count);
138
139	/*
140	 * pad to RMD160_BLOCK_LENGTH byte blocks, at least one byte from
141	 * PADDING plus 8 bytes for the size
142	 */
143	padlen = RMD160_BLOCK_LENGTH - ((ctx->count / 8) % RMD160_BLOCK_LENGTH);
144	if (padlen < 1 + 8)
145		padlen += RMD160_BLOCK_LENGTH;
146	RMD160Update(ctx, PADDING, padlen - 8);		/* padlen - 8 <= 64 */
147	RMD160Update(ctx, size, 8);
148}
149DEF_WEAK(RMD160Pad);
150
151void
152RMD160Final(u_int8_t digest[RMD160_DIGEST_LENGTH], RMD160_CTX *ctx)
153{
154	int i;
155
156	RMD160Pad(ctx);
157	for (i = 0; i < 5; i++)
158		PUT_32BIT_LE(digest + i*4, ctx->state[i]);
159	explicit_bzero(ctx, sizeof (*ctx));
160}
161DEF_WEAK(RMD160Final);
162
163void
164RMD160Transform(u_int32_t state[5], const u_int8_t block[RMD160_BLOCK_LENGTH])
165{
166	u_int32_t a, b, c, d, e, aa, bb, cc, dd, ee, t, x[16];
167
168#if BYTE_ORDER == LITTLE_ENDIAN
169	memcpy(x, block, RMD160_BLOCK_LENGTH);
170#else
171	int i;
172
173	for (i = 0; i < 16; i++)
174		x[i] = (u_int32_t)(
175		    (u_int32_t)(block[i*4 + 0]) |
176		    (u_int32_t)(block[i*4 + 1]) <<  8 |
177		    (u_int32_t)(block[i*4 + 2]) << 16 |
178		    (u_int32_t)(block[i*4 + 3]) << 24);
179#endif
180
181	a = state[0];
182	b = state[1];
183	c = state[2];
184	d = state[3];
185	e = state[4];
186
187	/* Round 1 */
188	R(a, b, c, d, e, F0, K0, 11,  0);
189	R(e, a, b, c, d, F0, K0, 14,  1);
190	R(d, e, a, b, c, F0, K0, 15,  2);
191	R(c, d, e, a, b, F0, K0, 12,  3);
192	R(b, c, d, e, a, F0, K0,  5,  4);
193	R(a, b, c, d, e, F0, K0,  8,  5);
194	R(e, a, b, c, d, F0, K0,  7,  6);
195	R(d, e, a, b, c, F0, K0,  9,  7);
196	R(c, d, e, a, b, F0, K0, 11,  8);
197	R(b, c, d, e, a, F0, K0, 13,  9);
198	R(a, b, c, d, e, F0, K0, 14, 10);
199	R(e, a, b, c, d, F0, K0, 15, 11);
200	R(d, e, a, b, c, F0, K0,  6, 12);
201	R(c, d, e, a, b, F0, K0,  7, 13);
202	R(b, c, d, e, a, F0, K0,  9, 14);
203	R(a, b, c, d, e, F0, K0,  8, 15); /* #15 */
204	/* Round 2 */
205	R(e, a, b, c, d, F1, K1,  7,  7);
206	R(d, e, a, b, c, F1, K1,  6,  4);
207	R(c, d, e, a, b, F1, K1,  8, 13);
208	R(b, c, d, e, a, F1, K1, 13,  1);
209	R(a, b, c, d, e, F1, K1, 11, 10);
210	R(e, a, b, c, d, F1, K1,  9,  6);
211	R(d, e, a, b, c, F1, K1,  7, 15);
212	R(c, d, e, a, b, F1, K1, 15,  3);
213	R(b, c, d, e, a, F1, K1,  7, 12);
214	R(a, b, c, d, e, F1, K1, 12,  0);
215	R(e, a, b, c, d, F1, K1, 15,  9);
216	R(d, e, a, b, c, F1, K1,  9,  5);
217	R(c, d, e, a, b, F1, K1, 11,  2);
218	R(b, c, d, e, a, F1, K1,  7, 14);
219	R(a, b, c, d, e, F1, K1, 13, 11);
220	R(e, a, b, c, d, F1, K1, 12,  8); /* #31 */
221	/* Round 3 */
222	R(d, e, a, b, c, F2, K2, 11,  3);
223	R(c, d, e, a, b, F2, K2, 13, 10);
224	R(b, c, d, e, a, F2, K2,  6, 14);
225	R(a, b, c, d, e, F2, K2,  7,  4);
226	R(e, a, b, c, d, F2, K2, 14,  9);
227	R(d, e, a, b, c, F2, K2,  9, 15);
228	R(c, d, e, a, b, F2, K2, 13,  8);
229	R(b, c, d, e, a, F2, K2, 15,  1);
230	R(a, b, c, d, e, F2, K2, 14,  2);
231	R(e, a, b, c, d, F2, K2,  8,  7);
232	R(d, e, a, b, c, F2, K2, 13,  0);
233	R(c, d, e, a, b, F2, K2,  6,  6);
234	R(b, c, d, e, a, F2, K2,  5, 13);
235	R(a, b, c, d, e, F2, K2, 12, 11);
236	R(e, a, b, c, d, F2, K2,  7,  5);
237	R(d, e, a, b, c, F2, K2,  5, 12); /* #47 */
238	/* Round 4 */
239	R(c, d, e, a, b, F3, K3, 11,  1);
240	R(b, c, d, e, a, F3, K3, 12,  9);
241	R(a, b, c, d, e, F3, K3, 14, 11);
242	R(e, a, b, c, d, F3, K3, 15, 10);
243	R(d, e, a, b, c, F3, K3, 14,  0);
244	R(c, d, e, a, b, F3, K3, 15,  8);
245	R(b, c, d, e, a, F3, K3,  9, 12);
246	R(a, b, c, d, e, F3, K3,  8,  4);
247	R(e, a, b, c, d, F3, K3,  9, 13);
248	R(d, e, a, b, c, F3, K3, 14,  3);
249	R(c, d, e, a, b, F3, K3,  5,  7);
250	R(b, c, d, e, a, F3, K3,  6, 15);
251	R(a, b, c, d, e, F3, K3,  8, 14);
252	R(e, a, b, c, d, F3, K3,  6,  5);
253	R(d, e, a, b, c, F3, K3,  5,  6);
254	R(c, d, e, a, b, F3, K3, 12,  2); /* #63 */
255	/* Round 5 */
256	R(b, c, d, e, a, F4, K4,  9,  4);
257	R(a, b, c, d, e, F4, K4, 15,  0);
258	R(e, a, b, c, d, F4, K4,  5,  5);
259	R(d, e, a, b, c, F4, K4, 11,  9);
260	R(c, d, e, a, b, F4, K4,  6,  7);
261	R(b, c, d, e, a, F4, K4,  8, 12);
262	R(a, b, c, d, e, F4, K4, 13,  2);
263	R(e, a, b, c, d, F4, K4, 12, 10);
264	R(d, e, a, b, c, F4, K4,  5, 14);
265	R(c, d, e, a, b, F4, K4, 12,  1);
266	R(b, c, d, e, a, F4, K4, 13,  3);
267	R(a, b, c, d, e, F4, K4, 14,  8);
268	R(e, a, b, c, d, F4, K4, 11, 11);
269	R(d, e, a, b, c, F4, K4,  8,  6);
270	R(c, d, e, a, b, F4, K4,  5, 15);
271	R(b, c, d, e, a, F4, K4,  6, 13); /* #79 */
272
273	aa = a ; bb = b; cc = c; dd = d; ee = e;
274
275	a = state[0];
276	b = state[1];
277	c = state[2];
278	d = state[3];
279	e = state[4];
280
281	/* Parallel round 1 */
282	R(a, b, c, d, e, F4, KK0,  8,  5);
283	R(e, a, b, c, d, F4, KK0,  9, 14);
284	R(d, e, a, b, c, F4, KK0,  9,  7);
285	R(c, d, e, a, b, F4, KK0, 11,  0);
286	R(b, c, d, e, a, F4, KK0, 13,  9);
287	R(a, b, c, d, e, F4, KK0, 15,  2);
288	R(e, a, b, c, d, F4, KK0, 15, 11);
289	R(d, e, a, b, c, F4, KK0,  5,  4);
290	R(c, d, e, a, b, F4, KK0,  7, 13);
291	R(b, c, d, e, a, F4, KK0,  7,  6);
292	R(a, b, c, d, e, F4, KK0,  8, 15);
293	R(e, a, b, c, d, F4, KK0, 11,  8);
294	R(d, e, a, b, c, F4, KK0, 14,  1);
295	R(c, d, e, a, b, F4, KK0, 14, 10);
296	R(b, c, d, e, a, F4, KK0, 12,  3);
297	R(a, b, c, d, e, F4, KK0,  6, 12); /* #15 */
298	/* Parallel round 2 */
299	R(e, a, b, c, d, F3, KK1,  9,  6);
300	R(d, e, a, b, c, F3, KK1, 13, 11);
301	R(c, d, e, a, b, F3, KK1, 15,  3);
302	R(b, c, d, e, a, F3, KK1,  7,  7);
303	R(a, b, c, d, e, F3, KK1, 12,  0);
304	R(e, a, b, c, d, F3, KK1,  8, 13);
305	R(d, e, a, b, c, F3, KK1,  9,  5);
306	R(c, d, e, a, b, F3, KK1, 11, 10);
307	R(b, c, d, e, a, F3, KK1,  7, 14);
308	R(a, b, c, d, e, F3, KK1,  7, 15);
309	R(e, a, b, c, d, F3, KK1, 12,  8);
310	R(d, e, a, b, c, F3, KK1,  7, 12);
311	R(c, d, e, a, b, F3, KK1,  6,  4);
312	R(b, c, d, e, a, F3, KK1, 15,  9);
313	R(a, b, c, d, e, F3, KK1, 13,  1);
314	R(e, a, b, c, d, F3, KK1, 11,  2); /* #31 */
315	/* Parallel round 3 */
316	R(d, e, a, b, c, F2, KK2,  9, 15);
317	R(c, d, e, a, b, F2, KK2,  7,  5);
318	R(b, c, d, e, a, F2, KK2, 15,  1);
319	R(a, b, c, d, e, F2, KK2, 11,  3);
320	R(e, a, b, c, d, F2, KK2,  8,  7);
321	R(d, e, a, b, c, F2, KK2,  6, 14);
322	R(c, d, e, a, b, F2, KK2,  6,  6);
323	R(b, c, d, e, a, F2, KK2, 14,  9);
324	R(a, b, c, d, e, F2, KK2, 12, 11);
325	R(e, a, b, c, d, F2, KK2, 13,  8);
326	R(d, e, a, b, c, F2, KK2,  5, 12);
327	R(c, d, e, a, b, F2, KK2, 14,  2);
328	R(b, c, d, e, a, F2, KK2, 13, 10);
329	R(a, b, c, d, e, F2, KK2, 13,  0);
330	R(e, a, b, c, d, F2, KK2,  7,  4);
331	R(d, e, a, b, c, F2, KK2,  5, 13); /* #47 */
332	/* Parallel round 4 */
333	R(c, d, e, a, b, F1, KK3, 15,  8);
334	R(b, c, d, e, a, F1, KK3,  5,  6);
335	R(a, b, c, d, e, F1, KK3,  8,  4);
336	R(e, a, b, c, d, F1, KK3, 11,  1);
337	R(d, e, a, b, c, F1, KK3, 14,  3);
338	R(c, d, e, a, b, F1, KK3, 14, 11);
339	R(b, c, d, e, a, F1, KK3,  6, 15);
340	R(a, b, c, d, e, F1, KK3, 14,  0);
341	R(e, a, b, c, d, F1, KK3,  6,  5);
342	R(d, e, a, b, c, F1, KK3,  9, 12);
343	R(c, d, e, a, b, F1, KK3, 12,  2);
344	R(b, c, d, e, a, F1, KK3,  9, 13);
345	R(a, b, c, d, e, F1, KK3, 12,  9);
346	R(e, a, b, c, d, F1, KK3,  5,  7);
347	R(d, e, a, b, c, F1, KK3, 15, 10);
348	R(c, d, e, a, b, F1, KK3,  8, 14); /* #63 */
349	/* Parallel round 5 */
350	R(b, c, d, e, a, F0, KK4,  8, 12);
351	R(a, b, c, d, e, F0, KK4,  5, 15);
352	R(e, a, b, c, d, F0, KK4, 12, 10);
353	R(d, e, a, b, c, F0, KK4,  9,  4);
354	R(c, d, e, a, b, F0, KK4, 12,  1);
355	R(b, c, d, e, a, F0, KK4,  5,  5);
356	R(a, b, c, d, e, F0, KK4, 14,  8);
357	R(e, a, b, c, d, F0, KK4,  6,  7);
358	R(d, e, a, b, c, F0, KK4,  8,  6);
359	R(c, d, e, a, b, F0, KK4, 13,  2);
360	R(b, c, d, e, a, F0, KK4,  6, 13);
361	R(a, b, c, d, e, F0, KK4,  5, 14);
362	R(e, a, b, c, d, F0, KK4, 15,  0);
363	R(d, e, a, b, c, F0, KK4, 13,  3);
364	R(c, d, e, a, b, F0, KK4, 11,  9);
365	R(b, c, d, e, a, F0, KK4, 11, 11); /* #79 */
366
367	t =        state[1] + cc + d;
368	state[1] = state[2] + dd + e;
369	state[2] = state[3] + ee + a;
370	state[3] = state[4] + aa + b;
371	state[4] = state[0] + bb + c;
372	state[0] = t;
373}
374DEF_WEAK(RMD160Transform);
375