libjava/gnu/gcj/io/shs.cc

   1
   2 /* --------------------------------- SHS.CC ------------------------------- */
   3
   4 /*
   5  * NIST proposed Secure Hash Standard.
   6  *
   7  * Written 2 September 1992, Peter C. Gutmann.
   8  * This implementation placed in the public domain.
   9  *
  10  * Comments to pgut1@cs.aukuni.ac.nz
  11  */
  12
  13 // Force C++ compiler to use Java-style EH, so we don't have to link with
  14 // libstdc++.
  15 #pragma GCC java_exceptions
  16
  17 #include <string.h>
  18 #include "shs.h"
  19
  20 /* The SHS f()-functions */
  21
  22 #define f1(x,y,z)   ( ( x & y ) | ( ~x & z ) )            /* Rounds  0-19 */
  23 #define f2(x,y,z)   ( x ^ y ^ z )                         /* Rounds 20-39 */
  24 #define f3(x,y,z)   ( ( x & y ) | ( x & z ) | ( y & z ) ) /* Rounds 40-59 */
  25 #define f4(x,y,z)   ( x ^ y ^ z )                         /* Rounds 60-79 */
  26
  27 /* The SHS Mysterious Constants */
  28
  29 #define K1  0x5A827999L         /* Rounds  0-19 */
  30 #define K2  0x6ED9EBA1L         /* Rounds 20-39 */
  31 #define K3  0x8F1BBCDCL         /* Rounds 40-59 */
  32 #define K4  0xCA62C1D6L         /* Rounds 60-79 */
  33
  34 /* SHS initial values */
  35
  36 #define h0init  0x67452301L
  37 #define h1init  0xEFCDAB89L
  38 #define h2init  0x98BADCFEL
  39 #define h3init  0x10325476L
  40 #define h4init  0xC3D2E1F0L
  41
  42 /* 32-bit rotate - kludged with shifts */
  43
  44 #define S(n,X)  ((X << n) | (X >> (32 - n)))
  45
  46 /* The initial expanding function */
  47
  48 #define expand(count)   W [count] = W [count - 3] ^ W [count - 8] ^ W [count - 14] ^ W [count - 16]
  49
  50 /* The four SHS sub-rounds */
  51
  52 #define subRound1(count)    \
  53         { \
  54                 temp = S (5, A) + f1 (B, C, D) + E + W [count] + K1; \
  55                 E = D; \
  56                 D = C; \
  57                 C = S (30, B); \
  58                 B = A; \
  59                 A = temp; \
  60         }
  61
  62 #define subRound2(count)    \
  63         { \
  64                 temp = S (5, A) + f2 (B, C, D) + E + W [count] + K2; \
  65                 E = D; \
  66                 D = C; \
  67                 C = S (30, B); \
  68                 B = A; \
  69                 A = temp; \
  70         }
  71
  72 #define subRound3(count)    \
  73         { \
  74                 temp = S (5, A) + f3 (B, C, D) + E + W [count] + K3; \
  75                 E = D; \
  76                 D = C; \
  77                 C = S (30, B); \
  78                 B = A; \
  79                 A = temp; \
  80         }
  81
  82 #define subRound4(count)    \
  83         { \
  84                 temp = S (5, A) + f4 (B, C, D) + E + W [count] + K4; \
  85                 E = D; \
  86                 D = C; \
  87                 C = S (30, B); \
  88                 B = A; \
  89                 A = temp; \
  90         }
  91
  92 /* The two buffers of 5 32-bit words */
  93
  94 uint32_t h0, h1, h2, h3, h4;
  95 uint32_t A, B, C, D, E;
  96
  97 local void byteReverse OF((uint32_t *buffer, int byteCount));
  98 void shsTransform OF((SHS_INFO *shsInfo));
  99
 100 /* Initialize the SHS values */
 101
 102 void shsInit (SHS_INFO *shsInfo)
 103 {
 104         /* Set the h-vars to their initial values */
 105         shsInfo->digest [0] = h0init;
 106         shsInfo->digest [1] = h1init;
 107         shsInfo->digest [2] = h2init;
 108         shsInfo->digest [3] = h3init;
 109         shsInfo->digest [4] = h4init;
 110
 111         /* Initialise bit count */
 112         shsInfo->countLo = shsInfo->countHi = 0L;
 113 }
 114
 115 /*
 116  * Perform the SHS transformation.  Note that this code, like MD5, seems to
 117  * break some optimizing compilers - it may be necessary to split it into
 118  * sections, eg based on the four subrounds
 119  */
 120
 121 void shsTransform (SHS_INFO *shsInfo)
 122 {
 123        uint32_t W [80], temp;
 124         int i;
 125
 126         /* Step A.      Copy the data buffer into the local work buffer */
 127         for (i = 0; i < 16; i++)
 128                 W [i] = shsInfo->data [i];
 129
 130         /* Step B.      Expand the 16 words into 64 temporary data words */
 131         expand (16); expand (17); expand (18); expand (19); expand (20);
 132         expand (21); expand (22); expand (23); expand (24); expand (25);
 133         expand (26); expand (27); expand (28); expand (29); expand (30);
 134         expand (31); expand (32); expand (33); expand (34); expand (35);
 135         expand (36); expand (37); expand (38); expand (39); expand (40);
 136         expand (41); expand (42); expand (43); expand (44); expand (45);
 137         expand (46); expand (47); expand (48); expand (49); expand (50);
 138         expand (51); expand (52); expand (53); expand (54); expand (55);
 139         expand (56); expand (57); expand (58); expand (59); expand (60);
 140         expand (61); expand (62); expand (63); expand (64); expand (65);
 141         expand (66); expand (67); expand (68); expand (69); expand (70);
 142         expand (71); expand (72); expand (73); expand (74); expand (75);
 143         expand (76); expand (77); expand (78); expand (79);
 144
 145         /* Step C.      Set up first buffer */
 146         A = shsInfo->digest [0];
 147         B = shsInfo->digest [1];
 148         C = shsInfo->digest [2];
 149         D = shsInfo->digest [3];
 150         E = shsInfo->digest [4];
 151
 152         /* Step D.      Serious mangling, divided into four sub-rounds */
 153         subRound1  (0); subRound1  (1); subRound1  (2); subRound1  (3);
 154         subRound1  (4); subRound1  (5); subRound1  (6); subRound1  (7);
 155         subRound1  (8); subRound1  (9); subRound1 (10); subRound1 (11);
 156         subRound1 (12); subRound1 (13); subRound1 (14); subRound1 (15);
 157         subRound1 (16); subRound1 (17); subRound1 (18); subRound1 (19);
 158
 159         subRound2 (20); subRound2 (21); subRound2 (22); subRound2 (23);
 160         subRound2 (24); subRound2 (25); subRound2 (26); subRound2 (27);
 161         subRound2 (28); subRound2 (29); subRound2 (30); subRound2 (31);
 162         subRound2 (32); subRound2 (33); subRound2 (34); subRound2 (35);
 163         subRound2 (36); subRound2 (37); subRound2 (38); subRound2 (39);
 164
 165         subRound3 (40); subRound3 (41); subRound3 (42); subRound3 (43);
 166         subRound3 (44); subRound3 (45); subRound3 (46); subRound3 (47);
 167         subRound3 (48); subRound3 (49); subRound3 (50); subRound3 (51);
 168         subRound3 (52); subRound3 (53); subRound3 (54); subRound3 (55);
 169         subRound3 (56); subRound3 (57); subRound3 (58); subRound3 (59);
 170
 171         subRound4 (60); subRound4 (61); subRound4 (62); subRound4 (63);
 172         subRound4 (64); subRound4 (65); subRound4 (66); subRound4 (67);
 173         subRound4 (68); subRound4 (69); subRound4 (70); subRound4 (71);
 174         subRound4 (72); subRound4 (73); subRound4 (74); subRound4 (75);
 175         subRound4 (76); subRound4 (77); subRound4 (78); subRound4 (79);
 176
 177         /* Step E.      Build message digest */
 178         shsInfo->digest [0] += A;
 179         shsInfo->digest [1] += B;
 180         shsInfo->digest [2] += C;
 181         shsInfo->digest [3] += D;
 182         shsInfo->digest [4] += E;
 183 }
 184
 185 local void byteReverse (uint32_t *buffer, int byteCount)
 186 {
 187        uint32_t value;
 188         int count;
 189
 190         /*
 191          * Find out what the byte order is on this machine.
 192          * Big endian is for machines that place the most significant byte
 193          * first (eg. Sun SPARC). Little endian is for machines that place
 194          * the least significant byte first (eg. VAX).
 195          *
 196          * We figure out the byte order by stuffing a 2 byte string into a
 197          * short and examining the left byte. '@' = 0x40  and  'P' = 0x50
 198          * If the left byte is the 'high' byte, then it is 'big endian'.
 199          * If the left byte is the 'low' byte, then the machine is 'little
 200          * endian'.
 201          *
 202          *                          -- Shawn A. Clifford (sac@eng.ufl.edu)
 203          */
 204
 205         /*
 206          * Several bugs fixed       -- Pat Myrto (pat@rwing.uucp)
 207          */
 208
 209         if ((*(unsigned short *) ("@P") >> 8) == '@')
 210                 return;
 211
 212        byteCount /= sizeof (uint32_t);
 213         for (count = 0; count < byteCount; count++) {
 214                 value = (buffer [count] << 16) | (buffer [count] >> 16);
 215                 buffer [count] = ((value & 0xFF00FF00L) >> 8) | ((value & 0x00FF00FFL) << 8);
 216         }
 217 }
 218
 219 /*
 220  * Update SHS for a block of data.  This code assumes that the buffer size is
 221  * a multiple of SHS_BLOCKSIZE bytes long, which makes the code a lot more
 222  * efficient since it does away with the need to handle partial blocks
 223  * between calls to shsUpdate()
 224  */
 225
 226 void shsUpdate (SHS_INFO *shsInfo, uint8_t *buffer, int count)
 227 {
 228         /* Update bitcount */
 229        if ((shsInfo->countLo + ((uint32_t) count << 3)) < shsInfo->countLo)
 230                  shsInfo->countHi++;    /* Carry from low to high bitCount */
 231        shsInfo->countLo += ((uint32_t) count << 3);
 232        shsInfo->countHi += ((uint32_t) count >> 29);
 233
 234         /* Process data in SHS_BLOCKSIZE chunks */
 235         while (count >= SHS_BLOCKSIZE) {
 236                 memcpy (shsInfo->data, buffer, SHS_BLOCKSIZE);
 237                 byteReverse (shsInfo->data, SHS_BLOCKSIZE);
 238                 shsTransform (shsInfo);
 239                 buffer += SHS_BLOCKSIZE;
 240                 count -= SHS_BLOCKSIZE;
 241         }
 242
 243         /*
 244          * Handle any remaining bytes of data.
 245          * This should only happen once on the final lot of data
 246          */
 247         memcpy (shsInfo->data, buffer, count);
 248 }
 249
 250 void shsFinal (SHS_INFO *shsInfo)
 251 {
 252         int count;
 253        uint32_t lowBitcount = shsInfo->countLo, highBitcount = shsInfo->countHi;
 254
 255         /* Compute number of bytes mod 64 */
 256         count = (int) ((shsInfo->countLo >> 3) & 0x3F);
 257
 258         /*
 259          * Set the first char of padding to 0x80.
 260          * This is safe since there is always at least one byte free
 261          */
 262        ((uint8_t *) shsInfo->data) [count++] = 0x80;
 263
 264         /* Pad out to 56 mod 64 */
 265         if (count > 56) {
 266                 /* Two lots of padding:  Pad the first block to 64 bytes */
 267                memset ((uint8_t *) shsInfo->data + count, 0, 64 - count);
 268                 byteReverse (shsInfo->data, SHS_BLOCKSIZE);
 269                 shsTransform (shsInfo);
 270
 271                 /* Now fill the next block with 56 bytes */
 272                 memset (shsInfo->data, 0, 56);
 273         } else
 274                 /* Pad block to 56 bytes */
 275                memset ((uint8_t *) shsInfo->data + count, 0, 56 - count);
 276         byteReverse (shsInfo->data, SHS_BLOCKSIZE);
 277
 278         /* Append length in bits and transform */
 279         shsInfo->data [14] = highBitcount;
 280         shsInfo->data [15] = lowBitcount;
 281
 282         shsTransform (shsInfo);
 283         byteReverse (shsInfo->data, SHS_DIGESTSIZE);
 284 }