lib/libmd/sha256c.c

   1 /*-
   2  * Copyright 2005 Colin Percival
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  *
  26  * $FreeBSD: src/lib/libmd/sha256c.c,v 1.1 2005/03/09 19:23:04 cperciva Exp $
  27  * $DragonFly: src/lib/libmd/sha256c.c,v 1.1 2006/04/29 22:19:26 dillon Exp $
  28  */
  29
  30 #include <sys/cdefs.h>
  31 #include <sys/endian.h>
  32 #include <sys/types.h>
  33
  34 #include <string.h>
  35
  36 #include "sha256.h"
  37
  38 #if BYTE_ORDER == BIG_ENDIAN
  39
  40 /* Copy a vector of big-endian uint32_t into a vector of bytes */
  41 #define be32enc_vect(dst, src, len)     \
  42         memcpy((void *)dst, (const void *)src, (size_t)len)
  43
  44 /* Copy a vector of bytes into a vector of big-endian uint32_t */
  45 #define be32dec_vect(dst, src, len)     \
  46         memcpy((void *)dst, (const void *)src, (size_t)len)
  47
  48 #else /* BYTE_ORDER != BIG_ENDIAN */
  49
  50 /*
  51  * Encode a length len/4 vector of (uint32_t) into a length len vector of
  52  * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
  53  */
  54 static void
  55 be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
  56 {
  57         size_t i;
  58
  59         for (i = 0; i < len / 4; i++)
  60                 be32enc(dst + i * 4, src[i]);
  61 }
  62
  63 /*
  64  * Decode a big-endian length len vector of (unsigned char) into a length
  65  * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
  66  */
  67 static void
  68 be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
  69 {
  70         size_t i;
  71
  72         for (i = 0; i < len / 4; i++)
  73                 dst[i] = be32dec(src + i * 4);
  74 }
  75
  76 #endif /* BYTE_ORDER != BIG_ENDIAN */
  77
  78 /* Elementary functions used by SHA256 */
  79 #define Ch(x, y, z)     ((x & (y ^ z)) ^ z)
  80 #define Maj(x, y, z)    ((x & (y | z)) | (y & z))
  81 #define SHR(x, n)       (x >> n)
  82 #define ROTR(x, n)      ((x >> n) | (x << (32 - n)))
  83 #define S0(x)           (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
  84 #define S1(x)           (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
  85 #define s0(x)           (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
  86 #define s1(x)           (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
  87
  88 /* SHA256 round function */
  89 #define RND(a, b, c, d, e, f, g, h, k)                  \
  90         t0 = h + S1(e) + Ch(e, f, g) + k;               \
  91         t1 = S0(a) + Maj(a, b, c);                      \
  92         d += t0;                                        \
  93         h  = t0 + t1;
  94
  95 /* Adjusted round function for rotating state */
  96 #define RNDr(S, W, i, k)                        \
  97         RND(S[(64 - i) % 8], S[(65 - i) % 8],   \
  98             S[(66 - i) % 8], S[(67 - i) % 8],   \
  99             S[(68 - i) % 8], S[(69 - i) % 8],   \
 100             S[(70 - i) % 8], S[(71 - i) % 8],   \
 101             W[i] + k)
 102
 103 /*
 104  * SHA256 block compression function.  The 256-bit state is transformed via
 105  * the 512-bit input block to produce a new state.
 106  */
 107 static void
 108 SHA256_Transform(uint32_t * state, const unsigned char block[64])
 109 {
 110         uint32_t W[64];
 111         uint32_t S[8];
 112         uint32_t t0, t1;
 113         int i;
 114
 115         /* 1. Prepare message schedule W. */
 116         be32dec_vect(W, block, 64);
 117         for (i = 16; i < 64; i++)
 118                 W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];
 119
 120         /* 2. Initialize working variables. */
 121         memcpy(S, state, 32);
 122
 123         /* 3. Mix. */
 124         RNDr(S, W, 0, 0x428a2f98);
 125         RNDr(S, W, 1, 0x71374491);
 126         RNDr(S, W, 2, 0xb5c0fbcf);
 127         RNDr(S, W, 3, 0xe9b5dba5);
 128         RNDr(S, W, 4, 0x3956c25b);
 129         RNDr(S, W, 5, 0x59f111f1);
 130         RNDr(S, W, 6, 0x923f82a4);
 131         RNDr(S, W, 7, 0xab1c5ed5);
 132         RNDr(S, W, 8, 0xd807aa98);
 133         RNDr(S, W, 9, 0x12835b01);
 134         RNDr(S, W, 10, 0x243185be);
 135         RNDr(S, W, 11, 0x550c7dc3);
 136         RNDr(S, W, 12, 0x72be5d74);
 137         RNDr(S, W, 13, 0x80deb1fe);
 138         RNDr(S, W, 14, 0x9bdc06a7);
 139         RNDr(S, W, 15, 0xc19bf174);
 140         RNDr(S, W, 16, 0xe49b69c1);
 141         RNDr(S, W, 17, 0xefbe4786);
 142         RNDr(S, W, 18, 0x0fc19dc6);
 143         RNDr(S, W, 19, 0x240ca1cc);
 144         RNDr(S, W, 20, 0x2de92c6f);
 145         RNDr(S, W, 21, 0x4a7484aa);
 146         RNDr(S, W, 22, 0x5cb0a9dc);
 147         RNDr(S, W, 23, 0x76f988da);
 148         RNDr(S, W, 24, 0x983e5152);
 149         RNDr(S, W, 25, 0xa831c66d);
 150         RNDr(S, W, 26, 0xb00327c8);
 151         RNDr(S, W, 27, 0xbf597fc7);
 152         RNDr(S, W, 28, 0xc6e00bf3);
 153         RNDr(S, W, 29, 0xd5a79147);
 154         RNDr(S, W, 30, 0x06ca6351);
 155         RNDr(S, W, 31, 0x14292967);
 156         RNDr(S, W, 32, 0x27b70a85);
 157         RNDr(S, W, 33, 0x2e1b2138);
 158         RNDr(S, W, 34, 0x4d2c6dfc);
 159         RNDr(S, W, 35, 0x53380d13);
 160         RNDr(S, W, 36, 0x650a7354);
 161         RNDr(S, W, 37, 0x766a0abb);
 162         RNDr(S, W, 38, 0x81c2c92e);
 163         RNDr(S, W, 39, 0x92722c85);
 164         RNDr(S, W, 40, 0xa2bfe8a1);
 165         RNDr(S, W, 41, 0xa81a664b);
 166         RNDr(S, W, 42, 0xc24b8b70);
 167         RNDr(S, W, 43, 0xc76c51a3);
 168         RNDr(S, W, 44, 0xd192e819);
 169         RNDr(S, W, 45, 0xd6990624);
 170         RNDr(S, W, 46, 0xf40e3585);
 171         RNDr(S, W, 47, 0x106aa070);
 172         RNDr(S, W, 48, 0x19a4c116);
 173         RNDr(S, W, 49, 0x1e376c08);
 174         RNDr(S, W, 50, 0x2748774c);
 175         RNDr(S, W, 51, 0x34b0bcb5);
 176         RNDr(S, W, 52, 0x391c0cb3);
 177         RNDr(S, W, 53, 0x4ed8aa4a);
 178         RNDr(S, W, 54, 0x5b9cca4f);
 179         RNDr(S, W, 55, 0x682e6ff3);
 180         RNDr(S, W, 56, 0x748f82ee);
 181         RNDr(S, W, 57, 0x78a5636f);
 182         RNDr(S, W, 58, 0x84c87814);
 183         RNDr(S, W, 59, 0x8cc70208);
 184         RNDr(S, W, 60, 0x90befffa);
 185         RNDr(S, W, 61, 0xa4506ceb);
 186         RNDr(S, W, 62, 0xbef9a3f7);
 187         RNDr(S, W, 63, 0xc67178f2);
 188
 189         /* 4. Mix local working variables into global state */
 190         for (i = 0; i < 8; i++)
 191                 state[i] += S[i];
 192 }
 193
 194 static unsigned char PAD[64] = {
 195         0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 196         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 197         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 198         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 199 };
 200
 201 /* Add padding and terminating bit-count. */
 202 static void
 203 SHA256_Pad(SHA256_CTX * ctx)
 204 {
 205         unsigned char len[8];
 206         uint32_t r, plen;
 207
 208         /*
 209          * Convert length to a vector of bytes -- we do this now rather
 210          * than later because the length will change after we pad.
 211          */
 212         be32enc_vect(len, ctx->count, 8);
 213
 214         /* Add 1--64 bytes so that the resulting length is 56 mod 64 */
 215         r = (ctx->count[1] >> 3) & 0x3f;
 216         plen = (r < 56) ? (56 - r) : (120 - r);
 217         SHA256_Update(ctx, PAD, (size_t)plen);
 218
 219         /* Add the terminating bit-count */
 220         SHA256_Update(ctx, len, 8);
 221 }
 222
 223 /* SHA-256 initialization.  Begins a SHA-256 operation. */
 224 void
 225 SHA256_Init(SHA256_CTX * ctx)
 226 {
 227
 228         /* Zero bits processed so far */
 229         ctx->count[0] = ctx->count[1] = 0;
 230
 231         /* Magic initialization constants */
 232         ctx->state[0] = 0x6A09E667;
 233         ctx->state[1] = 0xBB67AE85;
 234         ctx->state[2] = 0x3C6EF372;
 235         ctx->state[3] = 0xA54FF53A;
 236         ctx->state[4] = 0x510E527F;
 237         ctx->state[5] = 0x9B05688C;
 238         ctx->state[6] = 0x1F83D9AB;
 239         ctx->state[7] = 0x5BE0CD19;
 240 }
 241
 242 /* Add bytes into the hash */
 243 void
 244 SHA256_Update(SHA256_CTX * ctx, const unsigned char *src, size_t len)
 245 {
 246         uint32_t bitlen[2];
 247         uint32_t r;
 248
 249         /* Number of bytes left in the buffer from previous updates */
 250         r = (ctx->count[1] >> 3) & 0x3f;
 251
 252         /* Convert the length into a number of bits */
 253         bitlen[1] = ((uint32_t)len) << 3;
 254         bitlen[0] = (uint32_t)(len >> 29);
 255
 256         /* Update number of bits */
 257         if ((ctx->count[1] += bitlen[1]) < bitlen[1])
 258                 ctx->count[0]++;
 259         ctx->count[0] += bitlen[0];
 260
 261         /* Handle the case where we don't need to perform any transforms */
 262         if (len < 64 - r) {
 263                 memcpy(&ctx->buf[r], src, len);
 264                 return;
 265         }
 266
 267         /* Finish the current block */
 268         memcpy(&ctx->buf[r], src, 64 - r);
 269         SHA256_Transform(ctx->state, ctx->buf);
 270         src += 64 - r;
 271         len -= 64 - r;
 272
 273         /* Perform complete blocks */
 274         while (len >= 64) {
 275                 SHA256_Transform(ctx->state, src);
 276                 src += 64;
 277                 len -= 64;
 278         }
 279
 280         /* Copy left over data into buffer */
 281         memcpy(ctx->buf, src, len);
 282 }
 283
 284 /*
 285  * SHA-256 finalization.  Pads the input data, exports the hash value,
 286  * and clears the context state.
 287  */
 288 void
 289 SHA256_Final(unsigned char digest[32], SHA256_CTX * ctx)
 290 {
 291
 292         /* Add padding */
 293         SHA256_Pad(ctx);
 294
 295         /* Write the hash */
 296         be32enc_vect(digest, ctx->state, 32);
 297
 298         /* Clear the context state */
 299         memset((void *)ctx, 0, sizeof(*ctx));
 300 }