lib/sha256.c

   1 /* sha256.c - Functions to compute SHA256 and SHA224 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-2.
   3
   4    Copyright (C) 2005, 2006 Free Software Foundation, Inc.
   5
   6    This program is free software: you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation, either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
  18
  19 /* Written by David Madore, considerably copypasting from
  20    Scott G. Miller's sha1.c
  21 */
  22
  23 #include <config.h>
  24
  25 #include "sha256.h"
  26
  27 #include <stddef.h>
  28 #include <string.h>
  29
  30 #if USE_UNLOCKED_IO
  31 # include "unlocked-io.h"
  32 #endif
  33
  34 #ifdef WORDS_BIGENDIAN
  35 # define SWAP(n) (n)
  36 #else
  37 # define SWAP(n) \
  38     (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
  39 #endif
  40
  41 #define BLOCKSIZE 4096
  42 #if BLOCKSIZE % 64 != 0
  43 # error "invalid BLOCKSIZE"
  44 #endif
  45
  46 /* This array contains the bytes used to pad the buffer to the next
  47    64-byte boundary.  */
  48 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  49
  50
  51 /*
  52   Takes a pointer to a 256 bit block of data (eight 32 bit ints) and
  53   intializes it to the start constants of the SHA256 algorithm.  This
  54   must be called before using hash in the call to sha256_hash
  55 */
  56 void
  57 sha256_init_ctx (struct sha256_ctx *ctx)
  58 {
  59   ctx->state[0] = 0x6a09e667UL;
  60   ctx->state[1] = 0xbb67ae85UL;
  61   ctx->state[2] = 0x3c6ef372UL;
  62   ctx->state[3] = 0xa54ff53aUL;
  63   ctx->state[4] = 0x510e527fUL;
  64   ctx->state[5] = 0x9b05688cUL;
  65   ctx->state[6] = 0x1f83d9abUL;
  66   ctx->state[7] = 0x5be0cd19UL;
  67
  68   ctx->total[0] = ctx->total[1] = 0;
  69   ctx->buflen = 0;
  70 }
  71
  72 void
  73 sha224_init_ctx (struct sha256_ctx *ctx)
  74 {
  75   ctx->state[0] = 0xc1059ed8UL;
  76   ctx->state[1] = 0x367cd507UL;
  77   ctx->state[2] = 0x3070dd17UL;
  78   ctx->state[3] = 0xf70e5939UL;
  79   ctx->state[4] = 0xffc00b31UL;
  80   ctx->state[5] = 0x68581511UL;
  81   ctx->state[6] = 0x64f98fa7UL;
  82   ctx->state[7] = 0xbefa4fa4UL;
  83
  84   ctx->total[0] = ctx->total[1] = 0;
  85   ctx->buflen = 0;
  86 }
  87
  88 /* Put result from CTX in first 32 bytes following RESBUF.  The result
  89    must be in little endian byte order.
  90
  91    IMPORTANT: On some systems it is required that RESBUF is correctly
  92    aligned for a 32-bit value.  */
  93 void *
  94 sha256_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
  95 {
  96   int i;
  97
  98   for (i = 0; i < 8; i++)
  99     ((uint32_t *) resbuf)[i] = SWAP (ctx->state[i]);
 100
 101   return resbuf;
 102 }
 103
 104 void *
 105 sha224_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
 106 {
 107   int i;
 108
 109   for (i = 0; i < 7; i++)
 110     ((uint32_t *) resbuf)[i] = SWAP (ctx->state[i]);
 111
 112   return resbuf;
 113 }
 114
 115 /* Process the remaining bytes in the internal buffer and the usual
 116    prolog according to the standard and write the result to RESBUF.
 117
 118    IMPORTANT: On some systems it is required that RESBUF is correctly
 119    aligned for a 32-bit value.  */
 120 static void
 121 sha256_conclude_ctx (struct sha256_ctx *ctx)
 122 {
 123   /* Take yet unprocessed bytes into account.  */
 124   uint32_t bytes = ctx->buflen;
 125   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
 126
 127   /* Now count remaining bytes.  */
 128   ctx->total[0] += bytes;
 129   if (ctx->total[0] < bytes)
 130     ++ctx->total[1];
 131
 132   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 133   ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 134   ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
 135
 136   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 137
 138   /* Process last bytes.  */
 139   sha256_process_block (ctx->buffer, size * 4, ctx);
 140 }
 141
 142 void *
 143 sha256_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
 144 {
 145   sha256_conclude_ctx (ctx);
 146   return sha256_read_ctx (ctx, resbuf);
 147 }
 148
 149 void *
 150 sha224_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
 151 {
 152   sha256_conclude_ctx (ctx);
 153   return sha224_read_ctx (ctx, resbuf);
 154 }
 155
 156 /* Compute SHA256 message digest for bytes read from STREAM.  The
 157    resulting message digest number will be written into the 32 bytes
 158    beginning at RESBLOCK.  */
 159 int
 160 sha256_stream (FILE *stream, void *resblock)
 161 {
 162   struct sha256_ctx ctx;
 163   char buffer[BLOCKSIZE + 72];
 164   size_t sum;
 165
 166   /* Initialize the computation context.  */
 167   sha256_init_ctx (&ctx);
 168
 169   /* Iterate over full file contents.  */
 170   while (1)
 171     {
 172       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 173          computation function processes the whole buffer so that with the
 174          next round of the loop another block can be read.  */
 175       size_t n;
 176       sum = 0;
 177
 178       /* Read block.  Take care for partial reads.  */
 179       while (1)
 180         {
 181           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 182
 183           sum += n;
 184
 185           if (sum == BLOCKSIZE)
 186             break;
 187
 188           if (n == 0)
 189             {
 190               /* Check for the error flag IFF N == 0, so that we don't
 191                  exit the loop after a partial read due to e.g., EAGAIN
 192                  or EWOULDBLOCK.  */
 193               if (ferror (stream))
 194                 return 1;
 195               goto process_partial_block;
 196             }
 197
 198           /* We've read at least one byte, so ignore errors.  But always
 199              check for EOF, since feof may be true even though N > 0.
 200              Otherwise, we could end up calling fread after EOF.  */
 201           if (feof (stream))
 202             goto process_partial_block;
 203         }
 204
 205       /* Process buffer with BLOCKSIZE bytes.  Note that
 206                         BLOCKSIZE % 64 == 0
 207        */
 208       sha256_process_block (buffer, BLOCKSIZE, &ctx);
 209     }
 210
 211  process_partial_block:;
 212
 213   /* Process any remaining bytes.  */
 214   if (sum > 0)
 215     sha256_process_bytes (buffer, sum, &ctx);
 216
 217   /* Construct result in desired memory.  */
 218   sha256_finish_ctx (&ctx, resblock);
 219   return 0;
 220 }
 221
 222 /* FIXME: Avoid code duplication */
 223 int
 224 sha224_stream (FILE *stream, void *resblock)
 225 {
 226   struct sha256_ctx ctx;
 227   char buffer[BLOCKSIZE + 72];
 228   size_t sum;
 229
 230   /* Initialize the computation context.  */
 231   sha224_init_ctx (&ctx);
 232
 233   /* Iterate over full file contents.  */
 234   while (1)
 235     {
 236       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 237          computation function processes the whole buffer so that with the
 238          next round of the loop another block can be read.  */
 239       size_t n;
 240       sum = 0;
 241
 242       /* Read block.  Take care for partial reads.  */
 243       while (1)
 244         {
 245           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 246
 247           sum += n;
 248
 249           if (sum == BLOCKSIZE)
 250             break;
 251
 252           if (n == 0)
 253             {
 254               /* Check for the error flag IFF N == 0, so that we don't
 255                  exit the loop after a partial read due to e.g., EAGAIN
 256                  or EWOULDBLOCK.  */
 257               if (ferror (stream))
 258                 return 1;
 259               goto process_partial_block;
 260             }
 261
 262           /* We've read at least one byte, so ignore errors.  But always
 263              check for EOF, since feof may be true even though N > 0.
 264              Otherwise, we could end up calling fread after EOF.  */
 265           if (feof (stream))
 266             goto process_partial_block;
 267         }
 268
 269       /* Process buffer with BLOCKSIZE bytes.  Note that
 270                         BLOCKSIZE % 64 == 0
 271        */
 272       sha256_process_block (buffer, BLOCKSIZE, &ctx);
 273     }
 274
 275  process_partial_block:;
 276
 277   /* Process any remaining bytes.  */
 278   if (sum > 0)
 279     sha256_process_bytes (buffer, sum, &ctx);
 280
 281   /* Construct result in desired memory.  */
 282   sha224_finish_ctx (&ctx, resblock);
 283   return 0;
 284 }
 285
 286 /* Compute SHA512 message digest for LEN bytes beginning at BUFFER.  The
 287    result is always in little endian byte order, so that a byte-wise
 288    output yields to the wanted ASCII representation of the message
 289    digest.  */
 290 void *
 291 sha256_buffer (const char *buffer, size_t len, void *resblock)
 292 {
 293   struct sha256_ctx ctx;
 294
 295   /* Initialize the computation context.  */
 296   sha256_init_ctx (&ctx);
 297
 298   /* Process whole buffer but last len % 64 bytes.  */
 299   sha256_process_bytes (buffer, len, &ctx);
 300
 301   /* Put result in desired memory area.  */
 302   return sha256_finish_ctx (&ctx, resblock);
 303 }
 304
 305 void *
 306 sha224_buffer (const char *buffer, size_t len, void *resblock)
 307 {
 308   struct sha256_ctx ctx;
 309
 310   /* Initialize the computation context.  */
 311   sha224_init_ctx (&ctx);
 312
 313   /* Process whole buffer but last len % 64 bytes.  */
 314   sha256_process_bytes (buffer, len, &ctx);
 315
 316   /* Put result in desired memory area.  */
 317   return sha224_finish_ctx (&ctx, resblock);
 318 }
 319
 320 void
 321 sha256_process_bytes (const void *buffer, size_t len, struct sha256_ctx *ctx)
 322 {
 323   /* When we already have some bits in our internal buffer concatenate
 324      both inputs first.  */
 325   if (ctx->buflen != 0)
 326     {
 327       size_t left_over = ctx->buflen;
 328       size_t add = 128 - left_over > len ? len : 128 - left_over;
 329
 330       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 331       ctx->buflen += add;
 332
 333       if (ctx->buflen > 64)
 334         {
 335           sha256_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 336
 337           ctx->buflen &= 63;
 338           /* The regions in the following copy operation cannot overlap.  */
 339           memcpy (ctx->buffer,
 340                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 341                   ctx->buflen);
 342         }
 343
 344       buffer = (const char *) buffer + add;
 345       len -= add;
 346     }
 347
 348   /* Process available complete blocks.  */
 349   if (len >= 64)
 350     {
 351 #if !_STRING_ARCH_unaligned
 352 # define alignof(type) offsetof (struct { char c; type x; }, x)
 353 # define UNALIGNED_P(p) (((size_t) p) % alignof (uint32_t) != 0)
 354       if (UNALIGNED_P (buffer))
 355         while (len > 64)
 356           {
 357             sha256_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 358             buffer = (const char *) buffer + 64;
 359             len -= 64;
 360           }
 361       else
 362 #endif
 363         {
 364           sha256_process_block (buffer, len & ~63, ctx);
 365           buffer = (const char *) buffer + (len & ~63);
 366           len &= 63;
 367         }
 368     }
 369
 370   /* Move remaining bytes in internal buffer.  */
 371   if (len > 0)
 372     {
 373       size_t left_over = ctx->buflen;
 374
 375       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 376       left_over += len;
 377       if (left_over >= 64)
 378         {
 379           sha256_process_block (ctx->buffer, 64, ctx);
 380           left_over -= 64;
 381           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 382         }
 383       ctx->buflen = left_over;
 384     }
 385 }
 386
 387 /* --- Code below is the primary difference between sha1.c and sha256.c --- */
 388
 389 /* SHA256 round constants */
 390 #define K(I) sha256_round_constants[I]
 391 static const uint32_t sha256_round_constants[64] = {
 392   0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
 393   0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
 394   0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
 395   0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
 396   0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
 397   0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
 398   0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
 399   0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
 400   0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
 401   0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
 402   0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
 403   0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
 404   0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
 405   0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
 406   0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
 407   0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL,
 408 };
 409
 410 /* Round functions.  */
 411 #define F2(A,B,C) ( ( A & B ) | ( C & ( A | B ) ) )
 412 #define F1(E,F,G) ( G ^ ( E & ( F ^ G ) ) )
 413
 414 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 415    It is assumed that LEN % 64 == 0.
 416    Most of this code comes from GnuPG's cipher/sha1.c.  */
 417
 418 void
 419 sha256_process_block (const void *buffer, size_t len, struct sha256_ctx *ctx)
 420 {
 421   const uint32_t *words = buffer;
 422   size_t nwords = len / sizeof (uint32_t);
 423   const uint32_t *endp = words + nwords;
 424   uint32_t x[16];
 425   uint32_t a = ctx->state[0];
 426   uint32_t b = ctx->state[1];
 427   uint32_t c = ctx->state[2];
 428   uint32_t d = ctx->state[3];
 429   uint32_t e = ctx->state[4];
 430   uint32_t f = ctx->state[5];
 431   uint32_t g = ctx->state[6];
 432   uint32_t h = ctx->state[7];
 433
 434   /* First increment the byte count.  FIPS PUB 180-2 specifies the possible
 435      length of the file up to 2^64 bits.  Here we only compute the
 436      number of bytes.  Do a double word increment.  */
 437   ctx->total[0] += len;
 438   if (ctx->total[0] < len)
 439     ++ctx->total[1];
 440
 441 #define rol(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
 442 #define S0(x) (rol(x,25)^rol(x,14)^(x>>3))
 443 #define S1(x) (rol(x,15)^rol(x,13)^(x>>10))
 444 #define SS0(x) (rol(x,30)^rol(x,19)^rol(x,10))
 445 #define SS1(x) (rol(x,26)^rol(x,21)^rol(x,7))
 446
 447 #define M(I) ( tm =   S1(x[(I-2)&0x0f]) + x[(I-7)&0x0f] \
 448                     + S0(x[(I-15)&0x0f]) + x[I&0x0f]    \
 449                , x[I&0x0f] = tm )
 450
 451 #define R(A,B,C,D,E,F,G,H,K,M)  do { t0 = SS0(A) + F2(A,B,C); \
 452                                      t1 = H + SS1(E)  \
 453                                       + F1(E,F,G)     \
 454                                       + K             \
 455                                       + M;            \
 456                                      D += t1;  H = t0 + t1; \
 457                                } while(0)
 458
 459   while (words < endp)
 460     {
 461       uint32_t tm;
 462       uint32_t t0, t1;
 463       int t;
 464       /* FIXME: see sha1.c for a better implementation.  */
 465       for (t = 0; t < 16; t++)
 466         {
 467           x[t] = SWAP (*words);
 468           words++;
 469         }
 470
 471       R( a, b, c, d, e, f, g, h, K( 0), x[ 0] );
 472       R( h, a, b, c, d, e, f, g, K( 1), x[ 1] );
 473       R( g, h, a, b, c, d, e, f, K( 2), x[ 2] );
 474       R( f, g, h, a, b, c, d, e, K( 3), x[ 3] );
 475       R( e, f, g, h, a, b, c, d, K( 4), x[ 4] );
 476       R( d, e, f, g, h, a, b, c, K( 5), x[ 5] );
 477       R( c, d, e, f, g, h, a, b, K( 6), x[ 6] );
 478       R( b, c, d, e, f, g, h, a, K( 7), x[ 7] );
 479       R( a, b, c, d, e, f, g, h, K( 8), x[ 8] );
 480       R( h, a, b, c, d, e, f, g, K( 9), x[ 9] );
 481       R( g, h, a, b, c, d, e, f, K(10), x[10] );
 482       R( f, g, h, a, b, c, d, e, K(11), x[11] );
 483       R( e, f, g, h, a, b, c, d, K(12), x[12] );
 484       R( d, e, f, g, h, a, b, c, K(13), x[13] );
 485       R( c, d, e, f, g, h, a, b, K(14), x[14] );
 486       R( b, c, d, e, f, g, h, a, K(15), x[15] );
 487       R( a, b, c, d, e, f, g, h, K(16), M(16) );
 488       R( h, a, b, c, d, e, f, g, K(17), M(17) );
 489       R( g, h, a, b, c, d, e, f, K(18), M(18) );
 490       R( f, g, h, a, b, c, d, e, K(19), M(19) );
 491       R( e, f, g, h, a, b, c, d, K(20), M(20) );
 492       R( d, e, f, g, h, a, b, c, K(21), M(21) );
 493       R( c, d, e, f, g, h, a, b, K(22), M(22) );
 494       R( b, c, d, e, f, g, h, a, K(23), M(23) );
 495       R( a, b, c, d, e, f, g, h, K(24), M(24) );
 496       R( h, a, b, c, d, e, f, g, K(25), M(25) );
 497       R( g, h, a, b, c, d, e, f, K(26), M(26) );
 498       R( f, g, h, a, b, c, d, e, K(27), M(27) );
 499       R( e, f, g, h, a, b, c, d, K(28), M(28) );
 500       R( d, e, f, g, h, a, b, c, K(29), M(29) );
 501       R( c, d, e, f, g, h, a, b, K(30), M(30) );
 502       R( b, c, d, e, f, g, h, a, K(31), M(31) );
 503       R( a, b, c, d, e, f, g, h, K(32), M(32) );
 504       R( h, a, b, c, d, e, f, g, K(33), M(33) );
 505       R( g, h, a, b, c, d, e, f, K(34), M(34) );
 506       R( f, g, h, a, b, c, d, e, K(35), M(35) );
 507       R( e, f, g, h, a, b, c, d, K(36), M(36) );
 508       R( d, e, f, g, h, a, b, c, K(37), M(37) );
 509       R( c, d, e, f, g, h, a, b, K(38), M(38) );
 510       R( b, c, d, e, f, g, h, a, K(39), M(39) );
 511       R( a, b, c, d, e, f, g, h, K(40), M(40) );
 512       R( h, a, b, c, d, e, f, g, K(41), M(41) );
 513       R( g, h, a, b, c, d, e, f, K(42), M(42) );
 514       R( f, g, h, a, b, c, d, e, K(43), M(43) );
 515       R( e, f, g, h, a, b, c, d, K(44), M(44) );
 516       R( d, e, f, g, h, a, b, c, K(45), M(45) );
 517       R( c, d, e, f, g, h, a, b, K(46), M(46) );
 518       R( b, c, d, e, f, g, h, a, K(47), M(47) );
 519       R( a, b, c, d, e, f, g, h, K(48), M(48) );
 520       R( h, a, b, c, d, e, f, g, K(49), M(49) );
 521       R( g, h, a, b, c, d, e, f, K(50), M(50) );
 522       R( f, g, h, a, b, c, d, e, K(51), M(51) );
 523       R( e, f, g, h, a, b, c, d, K(52), M(52) );
 524       R( d, e, f, g, h, a, b, c, K(53), M(53) );
 525       R( c, d, e, f, g, h, a, b, K(54), M(54) );
 526       R( b, c, d, e, f, g, h, a, K(55), M(55) );
 527       R( a, b, c, d, e, f, g, h, K(56), M(56) );
 528       R( h, a, b, c, d, e, f, g, K(57), M(57) );
 529       R( g, h, a, b, c, d, e, f, K(58), M(58) );
 530       R( f, g, h, a, b, c, d, e, K(59), M(59) );
 531       R( e, f, g, h, a, b, c, d, K(60), M(60) );
 532       R( d, e, f, g, h, a, b, c, K(61), M(61) );
 533       R( c, d, e, f, g, h, a, b, K(62), M(62) );
 534       R( b, c, d, e, f, g, h, a, K(63), M(63) );
 535
 536       a = ctx->state[0] += a;
 537       b = ctx->state[1] += b;
 538       c = ctx->state[2] += c;
 539       d = ctx->state[3] += d;
 540       e = ctx->state[4] += e;
 541       f = ctx->state[5] += f;
 542       g = ctx->state[6] += g;
 543       h = ctx->state[7] += h;
 544     }
 545 }