2 * SHA512-based Unix crypt implementation.
3 * Released into the Public Domain by Ulrich Drepper <drepper@redhat.com>.
12 #include <sys/endian.h>
13 #include <sys/param.h>
14 #include <sys/types.h>
17 /* Structure to save state of computation between the single steps. */
24 char buffer
[256]; /* NB: always correctly aligned for uint64_t. */
28 #if __BYTE_ORDER == __LITTLE_ENDIAN
31 | (((n) & 0xff00) << 40) \
32 | (((n) & 0xff0000) << 24) \
33 | (((n) & 0xff000000) << 8) \
34 | (((n) >> 8) & 0xff000000) \
35 | (((n) >> 24) & 0xff0000) \
36 | (((n) >> 40) & 0xff00) \
43 /* This array contains the bytes used to pad the buffer to the next
44 64-byte boundary. (FIPS 180-2:5.1.2) */
45 static const unsigned char fillbuf
[128] = { 0x80, 0 /* , 0, 0, ... */ };
48 /* Constants for SHA512 from FIPS 180-2:4.2.3. */
49 static const uint64_t K
[80] =
51 UINT64_C (0x428a2f98d728ae22), UINT64_C (0x7137449123ef65cd),
52 UINT64_C (0xb5c0fbcfec4d3b2f), UINT64_C (0xe9b5dba58189dbbc),
53 UINT64_C (0x3956c25bf348b538), UINT64_C (0x59f111f1b605d019),
54 UINT64_C (0x923f82a4af194f9b), UINT64_C (0xab1c5ed5da6d8118),
55 UINT64_C (0xd807aa98a3030242), UINT64_C (0x12835b0145706fbe),
56 UINT64_C (0x243185be4ee4b28c), UINT64_C (0x550c7dc3d5ffb4e2),
57 UINT64_C (0x72be5d74f27b896f), UINT64_C (0x80deb1fe3b1696b1),
58 UINT64_C (0x9bdc06a725c71235), UINT64_C (0xc19bf174cf692694),
59 UINT64_C (0xe49b69c19ef14ad2), UINT64_C (0xefbe4786384f25e3),
60 UINT64_C (0x0fc19dc68b8cd5b5), UINT64_C (0x240ca1cc77ac9c65),
61 UINT64_C (0x2de92c6f592b0275), UINT64_C (0x4a7484aa6ea6e483),
62 UINT64_C (0x5cb0a9dcbd41fbd4), UINT64_C (0x76f988da831153b5),
63 UINT64_C (0x983e5152ee66dfab), UINT64_C (0xa831c66d2db43210),
64 UINT64_C (0xb00327c898fb213f), UINT64_C (0xbf597fc7beef0ee4),
65 UINT64_C (0xc6e00bf33da88fc2), UINT64_C (0xd5a79147930aa725),
66 UINT64_C (0x06ca6351e003826f), UINT64_C (0x142929670a0e6e70),
67 UINT64_C (0x27b70a8546d22ffc), UINT64_C (0x2e1b21385c26c926),
68 UINT64_C (0x4d2c6dfc5ac42aed), UINT64_C (0x53380d139d95b3df),
69 UINT64_C (0x650a73548baf63de), UINT64_C (0x766a0abb3c77b2a8),
70 UINT64_C (0x81c2c92e47edaee6), UINT64_C (0x92722c851482353b),
71 UINT64_C (0xa2bfe8a14cf10364), UINT64_C (0xa81a664bbc423001),
72 UINT64_C (0xc24b8b70d0f89791), UINT64_C (0xc76c51a30654be30),
73 UINT64_C (0xd192e819d6ef5218), UINT64_C (0xd69906245565a910),
74 UINT64_C (0xf40e35855771202a), UINT64_C (0x106aa07032bbd1b8),
75 UINT64_C (0x19a4c116b8d2d0c8), UINT64_C (0x1e376c085141ab53),
76 UINT64_C (0x2748774cdf8eeb99), UINT64_C (0x34b0bcb5e19b48a8),
77 UINT64_C (0x391c0cb3c5c95a63), UINT64_C (0x4ed8aa4ae3418acb),
78 UINT64_C (0x5b9cca4f7763e373), UINT64_C (0x682e6ff3d6b2b8a3),
79 UINT64_C (0x748f82ee5defb2fc), UINT64_C (0x78a5636f43172f60),
80 UINT64_C (0x84c87814a1f0ab72), UINT64_C (0x8cc702081a6439ec),
81 UINT64_C (0x90befffa23631e28), UINT64_C (0xa4506cebde82bde9),
82 UINT64_C (0xbef9a3f7b2c67915), UINT64_C (0xc67178f2e372532b),
83 UINT64_C (0xca273eceea26619c), UINT64_C (0xd186b8c721c0c207),
84 UINT64_C (0xeada7dd6cde0eb1e), UINT64_C (0xf57d4f7fee6ed178),
85 UINT64_C (0x06f067aa72176fba), UINT64_C (0x0a637dc5a2c898a6),
86 UINT64_C (0x113f9804bef90dae), UINT64_C (0x1b710b35131c471b),
87 UINT64_C (0x28db77f523047d84), UINT64_C (0x32caab7b40c72493),
88 UINT64_C (0x3c9ebe0a15c9bebc), UINT64_C (0x431d67c49c100d4c),
89 UINT64_C (0x4cc5d4becb3e42b6), UINT64_C (0x597f299cfc657e2a),
90 UINT64_C (0x5fcb6fab3ad6faec), UINT64_C (0x6c44198c4a475817)
94 /* Process LEN bytes of BUFFER, accumulating context into CTX.
95 It is assumed that LEN % 128 == 0. */
97 sha512_process_block (const void *buffer
, size_t len
, struct sha512_ctx
*ctx
)
99 const uint64_t *words
= buffer
;
100 size_t nwords
= len
/ sizeof (uint64_t);
101 uint64_t a
= ctx
->H
[0];
102 uint64_t b
= ctx
->H
[1];
103 uint64_t c
= ctx
->H
[2];
104 uint64_t d
= ctx
->H
[3];
105 uint64_t e
= ctx
->H
[4];
106 uint64_t f
= ctx
->H
[5];
107 uint64_t g
= ctx
->H
[6];
108 uint64_t h
= ctx
->H
[7];
110 /* First increment the byte count. FIPS 180-2 specifies the possible
111 length of the file up to 2^128 bits. Here we only compute the
112 number of bytes. Do a double word increment. */
113 ctx
->total
[0] += len
;
114 if (ctx
->total
[0] < len
)
117 /* Process all bytes in the buffer with 128 bytes in each round of
131 /* Operators defined in FIPS 180-2:4.1.2. */
132 #define Ch(x, y, z) ((x & y) ^ (~x & z))
133 #define Maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
134 #define S0(x) (CYCLIC (x, 28) ^ CYCLIC (x, 34) ^ CYCLIC (x, 39))
135 #define S1(x) (CYCLIC (x, 14) ^ CYCLIC (x, 18) ^ CYCLIC (x, 41))
136 #define R0(x) (CYCLIC (x, 1) ^ CYCLIC (x, 8) ^ (x >> 7))
137 #define R1(x) (CYCLIC (x, 19) ^ CYCLIC (x, 61) ^ (x >> 6))
139 /* It is unfortunate that C does not provide an operator for
140 cyclic rotation. Hope the C compiler is smart enough. */
141 #define CYCLIC(w, s) ((w >> s) | (w << (64 - s)))
143 /* Compute the message schedule according to FIPS 180-2:6.3.2 step 2. */
144 for (unsigned int t
= 0; t
< 16; ++t
)
146 W
[t
] = SWAP (*words
);
149 for (unsigned int t
= 16; t
< 80; ++t
)
150 W
[t
] = R1 (W
[t
- 2]) + W
[t
- 7] + R0 (W
[t
- 15]) + W
[t
- 16];
152 /* The actual computation according to FIPS 180-2:6.3.2 step 3. */
153 for (unsigned int t
= 0; t
< 80; ++t
)
155 uint64_t T1
= h
+ S1 (e
) + Ch (e
, f
, g
) + K
[t
] + W
[t
];
156 uint64_t T2
= S0 (a
) + Maj (a
, b
, c
);
167 /* Add the starting values of the context according to FIPS 180-2:6.3.2
178 /* Prepare for the next round. */
182 /* Put checksum in context given as argument. */
194 /* Initialize structure containing state of computation.
195 (FIPS 180-2:5.3.3) */
197 sha512_init_ctx (struct sha512_ctx
*ctx
)
199 ctx
->H
[0] = UINT64_C (0x6a09e667f3bcc908);
200 ctx
->H
[1] = UINT64_C (0xbb67ae8584caa73b);
201 ctx
->H
[2] = UINT64_C (0x3c6ef372fe94f82b);
202 ctx
->H
[3] = UINT64_C (0xa54ff53a5f1d36f1);
203 ctx
->H
[4] = UINT64_C (0x510e527fade682d1);
204 ctx
->H
[5] = UINT64_C (0x9b05688c2b3e6c1f);
205 ctx
->H
[6] = UINT64_C (0x1f83d9abfb41bd6b);
206 ctx
->H
[7] = UINT64_C (0x5be0cd19137e2179);
208 ctx
->total
[0] = ctx
->total
[1] = 0;
213 /* Process the remaining bytes in the internal buffer and the usual
214 prolog according to the standard and write the result to RESBUF.
216 IMPORTANT: On some systems it is required that RESBUF is correctly
217 aligned for a 32 bits value. */
219 sha512_finish_ctx (struct sha512_ctx
*ctx
, void *resbuf
)
221 /* Take yet unprocessed bytes into account. */
222 uint64_t bytes
= ctx
->buflen
;
225 /* Now count remaining bytes. */
226 ctx
->total
[0] += bytes
;
227 if (ctx
->total
[0] < bytes
)
230 pad
= bytes
>= 112 ? 128 + 112 - bytes
: 112 - bytes
;
231 memcpy (&ctx
->buffer
[bytes
], fillbuf
, pad
);
233 /* Put the 128-bit file length in *bits* at the end of the buffer. */
234 *(uint64_t *) &ctx
->buffer
[bytes
+ pad
+ 8] = SWAP (ctx
->total
[0] << 3);
235 *(uint64_t *) &ctx
->buffer
[bytes
+ pad
] = SWAP ((ctx
->total
[1] << 3) |
236 (ctx
->total
[0] >> 61));
238 /* Process last bytes. */
239 sha512_process_block (ctx
->buffer
, bytes
+ pad
+ 16, ctx
);
241 /* Put result from CTX in first 64 bytes following RESBUF. */
242 for (unsigned int i
= 0; i
< 8; ++i
)
243 ((uint64_t *) resbuf
)[i
] = SWAP (ctx
->H
[i
]);
250 sha512_process_bytes (const void *buffer
, size_t len
, struct sha512_ctx
*ctx
)
252 /* When we already have some bits in our internal buffer concatenate
253 both inputs first. */
254 if (ctx
->buflen
!= 0)
256 size_t left_over
= ctx
->buflen
;
257 size_t add
= 256 - left_over
> len
? len
: 256 - left_over
;
259 memcpy (&ctx
->buffer
[left_over
], buffer
, add
);
262 if (ctx
->buflen
> 128)
264 sha512_process_block (ctx
->buffer
, ctx
->buflen
& ~127, ctx
);
267 /* The regions in the following copy operation cannot overlap. */
268 memcpy (ctx
->buffer
, &ctx
->buffer
[(left_over
+ add
) & ~127],
272 buffer
= (const char *) buffer
+ add
;
276 /* Process available complete blocks. */
279 #if !_STRING_ARCH_unaligned
280 /* To check alignment gcc has an appropriate operator. Other
283 # define UNALIGNED_P(p) (((uintptr_t) p) % __alignof__ (uint64_t) != 0)
285 # define UNALIGNED_P(p) (((uintptr_t) p) % sizeof (uint64_t) != 0)
287 if (UNALIGNED_P (buffer
))
290 sha512_process_block (memcpy (ctx
->buffer
, buffer
, 128), 128,
292 buffer
= (const char *) buffer
+ 128;
298 sha512_process_block (buffer
, len
& ~127, ctx
);
299 buffer
= (const char *) buffer
+ (len
& ~127);
304 /* Move remaining bytes into internal buffer. */
307 size_t left_over
= ctx
->buflen
;
309 memcpy (&ctx
->buffer
[left_over
], buffer
, len
);
311 if (left_over
>= 128)
313 sha512_process_block (ctx
->buffer
, 128, ctx
);
315 memcpy (ctx
->buffer
, &ctx
->buffer
[128], left_over
);
317 ctx
->buflen
= left_over
;
322 /* Define our magic string to mark salt for SHA512 "encryption"
324 static const char sha512_salt_prefix
[] = "$6$";
326 /* Prefix for optional rounds specification. */
327 static const char sha512_rounds_prefix
[] = "rounds=";
329 /* Maximum salt string length. */
330 #define SALT_LEN_MAX 16
331 /* Default number of rounds if not explicitly specified. */
332 #define ROUNDS_DEFAULT 5000
333 /* Minimum number of rounds. */
334 #define ROUNDS_MIN 1000
335 /* Maximum number of rounds. */
336 #define ROUNDS_MAX 999999999
338 /* Table with characters for base64 transformation. */
339 static const char b64t
[64] =
340 "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
344 crypt_sha512_r (const char *key
, const char *salt
, char *buffer
, int buflen
)
346 unsigned char alt_result
[64]
347 __attribute__ ((__aligned__ (__alignof__ (uint64_t))));
348 unsigned char temp_result
[64]
349 __attribute__ ((__aligned__ (__alignof__ (uint64_t))));
350 struct sha512_ctx ctx
;
351 struct sha512_ctx alt_ctx
;
356 char *copied_key
= NULL
;
357 char *copied_salt
= NULL
;
360 /* Default number of rounds. */
361 size_t rounds
= ROUNDS_DEFAULT
;
362 bool rounds_custom
= false;
364 /* Find beginning of salt string. The prefix should normally always
365 be present. Just in case it is not. */
366 if (strncmp (sha512_salt_prefix
, salt
, sizeof (sha512_salt_prefix
) - 1) == 0)
367 /* Skip salt prefix. */
368 salt
+= sizeof (sha512_salt_prefix
) - 1;
370 if (strncmp (salt
, sha512_rounds_prefix
, sizeof (sha512_rounds_prefix
) - 1)
373 const char *num
= salt
+ sizeof (sha512_rounds_prefix
) - 1;
375 unsigned long int srounds
= strtoul (num
, &endp
, 10);
379 rounds
= MAX (ROUNDS_MIN
, MIN (srounds
, ROUNDS_MAX
));
380 rounds_custom
= true;
384 salt_len
= MIN (strcspn (salt
, "$"), SALT_LEN_MAX
);
385 key_len
= strlen (key
);
387 if ((key
- (char *) 0) % __alignof__ (uint64_t) != 0)
389 char *tmp
= (char *) alloca (key_len
+ __alignof__ (uint64_t));
391 memcpy (tmp
+ __alignof__ (uint64_t)
392 - (tmp
- (char *) 0) % __alignof__ (uint64_t),
396 if ((salt
- (char *) 0) % __alignof__ (uint64_t) != 0)
398 char *tmp
= (char *) alloca (salt_len
+ __alignof__ (uint64_t));
400 memcpy (tmp
+ __alignof__ (uint64_t)
401 - (tmp
- (char *) 0) % __alignof__ (uint64_t),
405 /* Prepare for the real work. */
406 sha512_init_ctx (&ctx
);
408 /* Add the key string. */
409 sha512_process_bytes (key
, key_len
, &ctx
);
411 /* The last part is the salt string. This must be at most 16
412 characters and it ends at the first `$' character (for
413 compatibility with existing implementations). */
414 sha512_process_bytes (salt
, salt_len
, &ctx
);
417 /* Compute alternate SHA512 sum with input KEY, SALT, and KEY. The
418 final result will be added to the first context. */
419 sha512_init_ctx (&alt_ctx
);
422 sha512_process_bytes (key
, key_len
, &alt_ctx
);
425 sha512_process_bytes (salt
, salt_len
, &alt_ctx
);
428 sha512_process_bytes (key
, key_len
, &alt_ctx
);
430 /* Now get result of this (64 bytes) and add it to the other
432 sha512_finish_ctx (&alt_ctx
, alt_result
);
434 /* Add for any character in the key one byte of the alternate sum. */
435 for (cnt
= key_len
; cnt
> 64; cnt
-= 64)
436 sha512_process_bytes (alt_result
, 64, &ctx
);
437 sha512_process_bytes (alt_result
, cnt
, &ctx
);
439 /* Take the binary representation of the length of the key and for every
440 1 add the alternate sum, for every 0 the key. */
441 for (cnt
= key_len
; cnt
> 0; cnt
>>= 1)
443 sha512_process_bytes (alt_result
, 64, &ctx
);
445 sha512_process_bytes (key
, key_len
, &ctx
);
447 /* Create intermediate result. */
448 sha512_finish_ctx (&ctx
, alt_result
);
450 /* Start computation of P byte sequence. */
451 sha512_init_ctx (&alt_ctx
);
453 /* For every character in the password add the entire password. */
454 for (cnt
= 0; cnt
< key_len
; ++cnt
)
455 sha512_process_bytes (key
, key_len
, &alt_ctx
);
457 /* Finish the digest. */
458 sha512_finish_ctx (&alt_ctx
, temp_result
);
460 /* Create byte sequence P. */
461 cp
= p_bytes
= alloca (key_len
);
462 for (cnt
= key_len
; cnt
>= 64; cnt
-= 64)
463 cp
= mempcpy (cp
, temp_result
, 64);
464 memcpy (cp
, temp_result
, cnt
);
466 /* Start computation of S byte sequence. */
467 sha512_init_ctx (&alt_ctx
);
469 /* For every character in the password add the entire password. */
470 for (cnt
= 0; cnt
< 16 + alt_result
[0]; ++cnt
)
471 sha512_process_bytes (salt
, salt_len
, &alt_ctx
);
473 /* Finish the digest. */
474 sha512_finish_ctx (&alt_ctx
, temp_result
);
476 /* Create byte sequence S. */
477 cp
= s_bytes
= alloca (salt_len
);
478 for (cnt
= salt_len
; cnt
>= 64; cnt
-= 64)
479 cp
= mempcpy (cp
, temp_result
, 64);
480 memcpy (cp
, temp_result
, cnt
);
482 /* Repeatedly run the collected hash value through SHA512 to burn
484 for (cnt
= 0; cnt
< rounds
; ++cnt
)
487 sha512_init_ctx (&ctx
);
489 /* Add key or last result. */
491 sha512_process_bytes (p_bytes
, key_len
, &ctx
);
493 sha512_process_bytes (alt_result
, 64, &ctx
);
495 /* Add salt for numbers not divisible by 3. */
497 sha512_process_bytes (s_bytes
, salt_len
, &ctx
);
499 /* Add key for numbers not divisible by 7. */
501 sha512_process_bytes (p_bytes
, key_len
, &ctx
);
503 /* Add key or last result. */
505 sha512_process_bytes (alt_result
, 64, &ctx
);
507 sha512_process_bytes (p_bytes
, key_len
, &ctx
);
509 /* Create intermediate result. */
510 sha512_finish_ctx (&ctx
, alt_result
);
513 /* Now we can construct the result string. It consists of three
515 cp
= stpncpy (buffer
, sha512_salt_prefix
, MAX (0, buflen
));
516 buflen
-= sizeof (sha512_salt_prefix
) - 1;
520 int n
= snprintf (cp
, MAX (0, buflen
), "%s%zu$",
521 sha512_rounds_prefix
, rounds
);
526 cp
= stpncpy (cp
, salt
, MIN ((size_t) MAX (0, buflen
), salt_len
));
527 buflen
-= MIN ((size_t) MAX (0, buflen
), salt_len
);
535 #define b64_from_24bit(B2, B1, B0, N) \
537 unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0); \
539 while (n-- > 0 && buflen > 0) \
541 *cp++ = b64t[w & 0x3f]; \
547 b64_from_24bit (alt_result
[0], alt_result
[21], alt_result
[42], 4);
548 b64_from_24bit (alt_result
[22], alt_result
[43], alt_result
[1], 4);
549 b64_from_24bit (alt_result
[44], alt_result
[2], alt_result
[23], 4);
550 b64_from_24bit (alt_result
[3], alt_result
[24], alt_result
[45], 4);
551 b64_from_24bit (alt_result
[25], alt_result
[46], alt_result
[4], 4);
552 b64_from_24bit (alt_result
[47], alt_result
[5], alt_result
[26], 4);
553 b64_from_24bit (alt_result
[6], alt_result
[27], alt_result
[48], 4);
554 b64_from_24bit (alt_result
[28], alt_result
[49], alt_result
[7], 4);
555 b64_from_24bit (alt_result
[50], alt_result
[8], alt_result
[29], 4);
556 b64_from_24bit (alt_result
[9], alt_result
[30], alt_result
[51], 4);
557 b64_from_24bit (alt_result
[31], alt_result
[52], alt_result
[10], 4);
558 b64_from_24bit (alt_result
[53], alt_result
[11], alt_result
[32], 4);
559 b64_from_24bit (alt_result
[12], alt_result
[33], alt_result
[54], 4);
560 b64_from_24bit (alt_result
[34], alt_result
[55], alt_result
[13], 4);
561 b64_from_24bit (alt_result
[56], alt_result
[14], alt_result
[35], 4);
562 b64_from_24bit (alt_result
[15], alt_result
[36], alt_result
[57], 4);
563 b64_from_24bit (alt_result
[37], alt_result
[58], alt_result
[16], 4);
564 b64_from_24bit (alt_result
[59], alt_result
[17], alt_result
[38], 4);
565 b64_from_24bit (alt_result
[18], alt_result
[39], alt_result
[60], 4);
566 b64_from_24bit (alt_result
[40], alt_result
[61], alt_result
[19], 4);
567 b64_from_24bit (alt_result
[62], alt_result
[20], alt_result
[41], 4);
568 b64_from_24bit (0, 0, alt_result
[63], 2);
576 *cp
= '\0'; /* Terminate the string. */
578 /* Clear the buffer for the intermediate result so that people
579 attaching to processes or reading core dumps cannot get any
580 information. We do it in this way to clear correct_words[]
581 inside the SHA512 implementation as well. */
582 sha512_init_ctx (&ctx
);
583 sha512_finish_ctx (&ctx
, alt_result
);
584 memset (temp_result
, '\0', sizeof (temp_result
));
585 memset (p_bytes
, '\0', key_len
);
586 memset (s_bytes
, '\0', salt_len
);
587 memset (&ctx
, '\0', sizeof (ctx
));
588 memset (&alt_ctx
, '\0', sizeof (alt_ctx
));
589 if (copied_key
!= NULL
)
590 memset (copied_key
, '\0', key_len
);
591 if (copied_salt
!= NULL
)
592 memset (copied_salt
, '\0', salt_len
);
598 /* This entry point is equivalent to the `crypt' function in Unix
601 crypt_sha512 (const char *key
, const char *salt
)
603 /* We don't want to have an arbitrary limit in the size of the
604 password. We can compute an upper bound for the size of the
605 result in advance and so we can prepare the buffer we pass to
609 int needed
= (sizeof (sha512_salt_prefix
) - 1
610 + sizeof (sha512_rounds_prefix
) + 9 + 1
611 + strlen (salt
) + 1 + 86 + 1);
615 char *new_buffer
= (char *) realloc (buffer
, needed
);
616 if (new_buffer
== NULL
)
623 return crypt_sha512_r (key
, salt
, buffer
, buflen
);
631 const char result
[64];
634 /* Test vectors from FIPS 180-2: appendix C.1. */
636 "\xdd\xaf\x35\xa1\x93\x61\x7a\xba\xcc\x41\x73\x49\xae\x20\x41\x31"
637 "\x12\xe6\xfa\x4e\x89\xa9\x7e\xa2\x0a\x9e\xee\xe6\x4b\x55\xd3\x9a"
638 "\x21\x92\x99\x2a\x27\x4f\xc1\xa8\x36\xba\x3c\x23\xa3\xfe\xeb\xbd"
639 "\x45\x4d\x44\x23\x64\x3c\xe8\x0e\x2a\x9a\xc9\x4f\xa5\x4c\xa4\x9f" },
640 /* Test vectors from FIPS 180-2: appendix C.2. */
641 { "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"
642 "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu",
643 "\x8e\x95\x9b\x75\xda\xe3\x13\xda\x8c\xf4\xf7\x28\x14\xfc\x14\x3f"
644 "\x8f\x77\x79\xc6\xeb\x9f\x7f\xa1\x72\x99\xae\xad\xb6\x88\x90\x18"
645 "\x50\x1d\x28\x9e\x49\x00\xf7\xe4\x33\x1b\x99\xde\xc4\xb5\x43\x3a"
646 "\xc7\xd3\x29\xee\xb6\xdd\x26\x54\x5e\x96\xe5\x5b\x87\x4b\xe9\x09" },
647 /* Test vectors from the NESSIE project. */
649 "\xcf\x83\xe1\x35\x7e\xef\xb8\xbd\xf1\x54\x28\x50\xd6\x6d\x80\x07"
650 "\xd6\x20\xe4\x05\x0b\x57\x15\xdc\x83\xf4\xa9\x21\xd3\x6c\xe9\xce"
651 "\x47\xd0\xd1\x3c\x5d\x85\xf2\xb0\xff\x83\x18\xd2\x87\x7e\xec\x2f"
652 "\x63\xb9\x31\xbd\x47\x41\x7a\x81\xa5\x38\x32\x7a\xf9\x27\xda\x3e" },
654 "\x1f\x40\xfc\x92\xda\x24\x16\x94\x75\x09\x79\xee\x6c\xf5\x82\xf2"
655 "\xd5\xd7\xd2\x8e\x18\x33\x5d\xe0\x5a\xbc\x54\xd0\x56\x0e\x0f\x53"
656 "\x02\x86\x0c\x65\x2b\xf0\x8d\x56\x02\x52\xaa\x5e\x74\x21\x05\x46"
657 "\xf3\x69\xfb\xbb\xce\x8c\x12\xcf\xc7\x95\x7b\x26\x52\xfe\x9a\x75" },
659 "\x10\x7d\xbf\x38\x9d\x9e\x9f\x71\xa3\xa9\x5f\x6c\x05\x5b\x92\x51"
660 "\xbc\x52\x68\xc2\xbe\x16\xd6\xc1\x34\x92\xea\x45\xb0\x19\x9f\x33"
661 "\x09\xe1\x64\x55\xab\x1e\x96\x11\x8e\x8a\x90\x5d\x55\x97\xb7\x20"
662 "\x38\xdd\xb3\x72\xa8\x98\x26\x04\x6d\xe6\x66\x87\xbb\x42\x0e\x7c" },
663 { "abcdefghijklmnopqrstuvwxyz",
664 "\x4d\xbf\xf8\x6c\xc2\xca\x1b\xae\x1e\x16\x46\x8a\x05\xcb\x98\x81"
665 "\xc9\x7f\x17\x53\xbc\xe3\x61\x90\x34\x89\x8f\xaa\x1a\xab\xe4\x29"
666 "\x95\x5a\x1b\xf8\xec\x48\x3d\x74\x21\xfe\x3c\x16\x46\x61\x3a\x59"
667 "\xed\x54\x41\xfb\x0f\x32\x13\x89\xf7\x7f\x48\xa8\x79\xc7\xb1\xf1" },
668 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
669 "\x20\x4a\x8f\xc6\xdd\xa8\x2f\x0a\x0c\xed\x7b\xeb\x8e\x08\xa4\x16"
670 "\x57\xc1\x6e\xf4\x68\xb2\x28\xa8\x27\x9b\xe3\x31\xa7\x03\xc3\x35"
671 "\x96\xfd\x15\xc1\x3b\x1b\x07\xf9\xaa\x1d\x3b\xea\x57\x78\x9c\xa0"
672 "\x31\xad\x85\xc7\xa7\x1d\xd7\x03\x54\xec\x63\x12\x38\xca\x34\x45" },
673 { "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
674 "\x1e\x07\xbe\x23\xc2\x6a\x86\xea\x37\xea\x81\x0c\x8e\xc7\x80\x93"
675 "\x52\x51\x5a\x97\x0e\x92\x53\xc2\x6f\x53\x6c\xfc\x7a\x99\x96\xc4"
676 "\x5c\x83\x70\x58\x3e\x0a\x78\xfa\x4a\x90\x04\x1d\x71\xa4\xce\xab"
677 "\x74\x23\xf1\x9c\x71\xb9\xd5\xa3\xe0\x12\x49\xf0\xbe\xbd\x58\x94" },
678 { "123456789012345678901234567890123456789012345678901234567890"
679 "12345678901234567890",
680 "\x72\xec\x1e\xf1\x12\x4a\x45\xb0\x47\xe8\xb7\xc7\x5a\x93\x21\x95"
681 "\x13\x5b\xb6\x1d\xe2\x4e\xc0\xd1\x91\x40\x42\x24\x6e\x0a\xec\x3a"
682 "\x23\x54\xe0\x93\xd7\x6f\x30\x48\xb4\x56\x76\x43\x46\x90\x0c\xb1"
683 "\x30\xd2\xa4\xfd\x5d\xd1\x6a\xbb\x5e\x30\xbc\xb8\x50\xde\xe8\x43" }
685 #define ntests (sizeof (tests) / sizeof (tests[0]))
692 const char *expected
;
695 { "$6$saltstring", "Hello world!",
696 "$6$saltstring$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu"
697 "esI68u4OTLiBFdcbYEdFCoEOfaS35inz1" },
698 { "$6$rounds=10000$saltstringsaltstring", "Hello world!",
699 "$6$rounds=10000$saltstringsaltst$OW1/O6BYHV6BcXZu8QVeXbDWra3Oeqh0sb"
700 "HbbMCVNSnCM/UrjmM0Dp8vOuZeHBy/YTBmSK6H9qs/y3RnOaw5v." },
701 { "$6$rounds=5000$toolongsaltstring", "This is just a test",
702 "$6$rounds=5000$toolongsaltstrin$lQ8jolhgVRVhY4b5pZKaysCLi0QBxGoNeKQ"
703 "zQ3glMhwllF7oGDZxUhx1yxdYcz/e1JSbq3y6JMxxl8audkUEm0" },
704 { "$6$rounds=1400$anotherlongsaltstring",
705 "a very much longer text to encrypt. This one even stretches over more"
707 "$6$rounds=1400$anotherlongsalts$POfYwTEok97VWcjxIiSOjiykti.o/pQs.wP"
708 "vMxQ6Fm7I6IoYN3CmLs66x9t0oSwbtEW7o7UmJEiDwGqd8p4ur1" },
709 { "$6$rounds=77777$short",
710 "we have a short salt string but not a short password",
711 "$6$rounds=77777$short$WuQyW2YR.hBNpjjRhpYD/ifIw05xdfeEyQoMxIXbkvr0g"
712 "ge1a1x3yRULJ5CCaUeOxFmtlcGZelFl5CxtgfiAc0" },
713 { "$6$rounds=123456$asaltof16chars..", "a short string",
714 "$6$rounds=123456$asaltof16chars..$BtCwjqMJGx5hrJhZywWvt0RLE8uZ4oPwc"
715 "elCjmw2kSYu.Ec6ycULevoBK25fs2xXgMNrCzIMVcgEJAstJeonj1" },
716 { "$6$rounds=10$roundstoolow", "the minimum number is still observed",
717 "$6$rounds=1000$roundstoolow$kUMsbe306n21p9R.FRkW3IGn.S9NPN0x50YhH1x"
718 "hLsPuWGsUSklZt58jaTfF4ZEQpyUNGc0dqbpBYYBaHHrsX." },
720 #define ntests2 (sizeof (tests2) / sizeof (tests2[0]))
726 struct sha512_ctx ctx
;
731 for (cnt
= 0; cnt
< (int) ntests
; ++cnt
)
733 sha512_init_ctx (&ctx
);
734 sha512_process_bytes (tests
[cnt
].input
, strlen (tests
[cnt
].input
), &ctx
);
735 sha512_finish_ctx (&ctx
, sum
);
736 if (memcmp (tests
[cnt
].result
, sum
, 64) != 0)
738 printf ("test %d run %d failed\n", cnt
, 1);
742 sha512_init_ctx (&ctx
);
743 for (int i
= 0; tests
[cnt
].input
[i
] != '\0'; ++i
)
744 sha512_process_bytes (&tests
[cnt
].input
[i
], 1, &ctx
);
745 sha512_finish_ctx (&ctx
, sum
);
746 if (memcmp (tests
[cnt
].result
, sum
, 64) != 0)
748 printf ("test %d run %d failed\n", cnt
, 2);
753 /* Test vector from FIPS 180-2: appendix C.3. */
755 memset (buf
, 'a', sizeof (buf
));
756 sha512_init_ctx (&ctx
);
757 for (int i
= 0; i
< 1000; ++i
)
758 sha512_process_bytes (buf
, sizeof (buf
), &ctx
);
759 sha512_finish_ctx (&ctx
, sum
);
760 static const char expected
[64] =
761 "\xe7\x18\x48\x3d\x0c\xe7\x69\x64\x4e\x2e\x42\xc7\xbc\x15\xb4\x63"
762 "\x8e\x1f\x98\xb1\x3b\x20\x44\x28\x56\x32\xa8\x03\xaf\xa9\x73\xeb"
763 "\xde\x0f\xf2\x44\x87\x7e\xa6\x0a\x4c\xb0\x43\x2c\xe5\x77\xc3\x1b"
764 "\xeb\x00\x9c\x5c\x2c\x49\xaa\x2e\x4e\xad\xb2\x17\xad\x8c\xc0\x9b";
765 if (memcmp (expected
, sum
, 64) != 0)
767 printf ("test %d failed\n", cnt
);
771 for (cnt
= 0; cnt
< ntests2
; ++cnt
)
773 char *cp
= crypt_sha512 (tests2
[cnt
].input
, tests2
[cnt
].salt
);
775 if (strcmp (cp
, tests2
[cnt
].expected
) != 0)
777 printf ("test %d: expected \"%s\", got \"%s\"\n",
778 cnt
, tests2
[cnt
].expected
, cp
);
784 puts ("all tests OK");