lib/sha1.c

   1 /* sha1.c - Functions to compute SHA1 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-1.
   3
   4    Copyright (C) 2000-2001, 2003-2006, 2008-2015 Free Software
   5    Foundation, Inc.
   6
   7    This program is free software; you can redistribute it and/or modify it
   8    under the terms of the GNU General Public License as published by the
   9    Free Software Foundation; either version 3, or (at your option) any
  10    later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, see <http://www.gnu.org/licenses/>.  */
  19
  20 /* Written by Scott G. Miller
  21    Credits:
  22       Robert Klep <robert@ilse.nl>  -- Expansion function fix
  23 */
  24
  25 #include <config.h>
  26
  27 #if HAVE_OPENSSL_SHA1
  28 # define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
  29 #endif
  30 #include "sha1.h"
  31
  32 #include <stdalign.h>
  33 #include <stdint.h>
  34 #include <stdlib.h>
  35 #include <string.h>
  36
  37 #if USE_UNLOCKED_IO
  38 # include "unlocked-io.h"
  39 #endif
  40
  41 #ifdef WORDS_BIGENDIAN
  42 # define SWAP(n) (n)
  43 #else
  44 # define SWAP(n) \
  45     (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
  46 #endif
  47
  48 #define BLOCKSIZE 32768
  49 #if BLOCKSIZE % 64 != 0
  50 # error "invalid BLOCKSIZE"
  51 #endif
  52
  53 #if ! HAVE_OPENSSL_SHA1
  54 /* This array contains the bytes used to pad the buffer to the next
  55    64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
  56 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  57
  58
  59 /* Take a pointer to a 160 bit block of data (five 32 bit ints) and
  60    initialize it to the start constants of the SHA1 algorithm.  This
  61    must be called before using hash in the call to sha1_hash.  */
  62 void
  63 sha1_init_ctx (struct sha1_ctx *ctx)
  64 {
  65   ctx->A = 0x67452301;
  66   ctx->B = 0xefcdab89;
  67   ctx->C = 0x98badcfe;
  68   ctx->D = 0x10325476;
  69   ctx->E = 0xc3d2e1f0;
  70
  71   ctx->total[0] = ctx->total[1] = 0;
  72   ctx->buflen = 0;
  73 }
  74
  75 /* Copy the 4 byte value from v into the memory location pointed to by *cp,
  76    If your architecture allows unaligned access this is equivalent to
  77    * (uint32_t *) cp = v  */
  78 static void
  79 set_uint32 (char *cp, uint32_t v)
  80 {
  81   memcpy (cp, &v, sizeof v);
  82 }
  83
  84 /* Put result from CTX in first 20 bytes following RESBUF.  The result
  85    must be in little endian byte order.  */
  86 void *
  87 sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
  88 {
  89   char *r = resbuf;
  90   set_uint32 (r + 0 * sizeof ctx->A, SWAP (ctx->A));
  91   set_uint32 (r + 1 * sizeof ctx->B, SWAP (ctx->B));
  92   set_uint32 (r + 2 * sizeof ctx->C, SWAP (ctx->C));
  93   set_uint32 (r + 3 * sizeof ctx->D, SWAP (ctx->D));
  94   set_uint32 (r + 4 * sizeof ctx->E, SWAP (ctx->E));
  95
  96   return resbuf;
  97 }
  98
  99 /* Process the remaining bytes in the internal buffer and the usual
 100    prolog according to the standard and write the result to RESBUF.  */
 101 void *
 102 sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
 103 {
 104   /* Take yet unprocessed bytes into account.  */
 105   uint32_t bytes = ctx->buflen;
 106   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
 107
 108   /* Now count remaining bytes.  */
 109   ctx->total[0] += bytes;
 110   if (ctx->total[0] < bytes)
 111     ++ctx->total[1];
 112
 113   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 114   ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 115   ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
 116
 117   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 118
 119   /* Process last bytes.  */
 120   sha1_process_block (ctx->buffer, size * 4, ctx);
 121
 122   return sha1_read_ctx (ctx, resbuf);
 123 }
 124 #endif
 125
 126 /* Compute SHA1 message digest for bytes read from STREAM.  The
 127    resulting message digest number will be written into the 16 bytes
 128    beginning at RESBLOCK.  */
 129 int
 130 sha1_stream (FILE *stream, void *resblock)
 131 {
 132   struct sha1_ctx ctx;
 133   size_t sum;
 134
 135   char *buffer = malloc (BLOCKSIZE + 72);
 136   if (!buffer)
 137     return 1;
 138
 139   /* Initialize the computation context.  */
 140   sha1_init_ctx (&ctx);
 141
 142   /* Iterate over full file contents.  */
 143   while (1)
 144     {
 145       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 146          computation function processes the whole buffer so that with the
 147          next round of the loop another block can be read.  */
 148       size_t n;
 149       sum = 0;
 150
 151       /* Read block.  Take care for partial reads.  */
 152       while (1)
 153         {
 154           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 155
 156           sum += n;
 157
 158           if (sum == BLOCKSIZE)
 159             break;
 160
 161           if (n == 0)
 162             {
 163               /* Check for the error flag IFF N == 0, so that we don't
 164                  exit the loop after a partial read due to e.g., EAGAIN
 165                  or EWOULDBLOCK.  */
 166               if (ferror (stream))
 167                 {
 168                   free (buffer);
 169                   return 1;
 170                 }
 171               goto process_partial_block;
 172             }
 173
 174           /* We've read at least one byte, so ignore errors.  But always
 175              check for EOF, since feof may be true even though N > 0.
 176              Otherwise, we could end up calling fread after EOF.  */
 177           if (feof (stream))
 178             goto process_partial_block;
 179         }
 180
 181       /* Process buffer with BLOCKSIZE bytes.  Note that
 182                         BLOCKSIZE % 64 == 0
 183        */
 184       sha1_process_block (buffer, BLOCKSIZE, &ctx);
 185     }
 186
 187  process_partial_block:;
 188
 189   /* Process any remaining bytes.  */
 190   if (sum > 0)
 191     sha1_process_bytes (buffer, sum, &ctx);
 192
 193   /* Construct result in desired memory.  */
 194   sha1_finish_ctx (&ctx, resblock);
 195   free (buffer);
 196   return 0;
 197 }
 198
 199 #if ! HAVE_OPENSSL_SHA1
 200 /* Compute SHA1 message digest for LEN bytes beginning at BUFFER.  The
 201    result is always in little endian byte order, so that a byte-wise
 202    output yields to the wanted ASCII representation of the message
 203    digest.  */
 204 void *
 205 sha1_buffer (const char *buffer, size_t len, void *resblock)
 206 {
 207   struct sha1_ctx ctx;
 208
 209   /* Initialize the computation context.  */
 210   sha1_init_ctx (&ctx);
 211
 212   /* Process whole buffer but last len % 64 bytes.  */
 213   sha1_process_bytes (buffer, len, &ctx);
 214
 215   /* Put result in desired memory area.  */
 216   return sha1_finish_ctx (&ctx, resblock);
 217 }
 218
 219 void
 220 sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
 221 {
 222   /* When we already have some bits in our internal buffer concatenate
 223      both inputs first.  */
 224   if (ctx->buflen != 0)
 225     {
 226       size_t left_over = ctx->buflen;
 227       size_t add = 128 - left_over > len ? len : 128 - left_over;
 228
 229       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 230       ctx->buflen += add;
 231
 232       if (ctx->buflen > 64)
 233         {
 234           sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 235
 236           ctx->buflen &= 63;
 237           /* The regions in the following copy operation cannot overlap.  */
 238           memcpy (ctx->buffer,
 239                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 240                   ctx->buflen);
 241         }
 242
 243       buffer = (const char *) buffer + add;
 244       len -= add;
 245     }
 246
 247   /* Process available complete blocks.  */
 248   if (len >= 64)
 249     {
 250 #if !_STRING_ARCH_unaligned
 251 # define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
 252       if (UNALIGNED_P (buffer))
 253         while (len > 64)
 254           {
 255             sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 256             buffer = (const char *) buffer + 64;
 257             len -= 64;
 258           }
 259       else
 260 #endif
 261         {
 262           sha1_process_block (buffer, len & ~63, ctx);
 263           buffer = (const char *) buffer + (len & ~63);
 264           len &= 63;
 265         }
 266     }
 267
 268   /* Move remaining bytes in internal buffer.  */
 269   if (len > 0)
 270     {
 271       size_t left_over = ctx->buflen;
 272
 273       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 274       left_over += len;
 275       if (left_over >= 64)
 276         {
 277           sha1_process_block (ctx->buffer, 64, ctx);
 278           left_over -= 64;
 279           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 280         }
 281       ctx->buflen = left_over;
 282     }
 283 }
 284
 285 /* --- Code below is the primary difference between md5.c and sha1.c --- */
 286
 287 /* SHA1 round constants */
 288 #define K1 0x5a827999
 289 #define K2 0x6ed9eba1
 290 #define K3 0x8f1bbcdc
 291 #define K4 0xca62c1d6
 292
 293 /* Round functions.  Note that F2 is the same as F4.  */
 294 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
 295 #define F2(B,C,D) (B ^ C ^ D)
 296 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
 297 #define F4(B,C,D) (B ^ C ^ D)
 298
 299 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 300    It is assumed that LEN % 64 == 0.
 301    Most of this code comes from GnuPG's cipher/sha1.c.  */
 302
 303 void
 304 sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
 305 {
 306   const uint32_t *words = buffer;
 307   size_t nwords = len / sizeof (uint32_t);
 308   const uint32_t *endp = words + nwords;
 309   uint32_t x[16];
 310   uint32_t a = ctx->A;
 311   uint32_t b = ctx->B;
 312   uint32_t c = ctx->C;
 313   uint32_t d = ctx->D;
 314   uint32_t e = ctx->E;
 315   uint32_t lolen = len;
 316
 317   /* First increment the byte count.  RFC 1321 specifies the possible
 318      length of the file up to 2^64 bits.  Here we only compute the
 319      number of bytes.  Do a double word increment.  */
 320   ctx->total[0] += lolen;
 321   ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen);
 322
 323 #define rol(x, n) (((x) << (n)) | ((uint32_t) (x) >> (32 - (n))))
 324
 325 #define M(I) ( tm =   x[I&0x0f] ^ x[(I-14)&0x0f] \
 326                     ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
 327                , (x[I&0x0f] = rol(tm, 1)) )
 328
 329 #define R(A,B,C,D,E,F,K,M)  do { E += rol( A, 5 )     \
 330                                       + F( B, C, D )  \
 331                                       + K             \
 332                                       + M;            \
 333                                  B = rol( B, 30 );    \
 334                                } while(0)
 335
 336   while (words < endp)
 337     {
 338       uint32_t tm;
 339       int t;
 340       for (t = 0; t < 16; t++)
 341         {
 342           x[t] = SWAP (*words);
 343           words++;
 344         }
 345
 346       R( a, b, c, d, e, F1, K1, x[ 0] );
 347       R( e, a, b, c, d, F1, K1, x[ 1] );
 348       R( d, e, a, b, c, F1, K1, x[ 2] );
 349       R( c, d, e, a, b, F1, K1, x[ 3] );
 350       R( b, c, d, e, a, F1, K1, x[ 4] );
 351       R( a, b, c, d, e, F1, K1, x[ 5] );
 352       R( e, a, b, c, d, F1, K1, x[ 6] );
 353       R( d, e, a, b, c, F1, K1, x[ 7] );
 354       R( c, d, e, a, b, F1, K1, x[ 8] );
 355       R( b, c, d, e, a, F1, K1, x[ 9] );
 356       R( a, b, c, d, e, F1, K1, x[10] );
 357       R( e, a, b, c, d, F1, K1, x[11] );
 358       R( d, e, a, b, c, F1, K1, x[12] );
 359       R( c, d, e, a, b, F1, K1, x[13] );
 360       R( b, c, d, e, a, F1, K1, x[14] );
 361       R( a, b, c, d, e, F1, K1, x[15] );
 362       R( e, a, b, c, d, F1, K1, M(16) );
 363       R( d, e, a, b, c, F1, K1, M(17) );
 364       R( c, d, e, a, b, F1, K1, M(18) );
 365       R( b, c, d, e, a, F1, K1, M(19) );
 366       R( a, b, c, d, e, F2, K2, M(20) );
 367       R( e, a, b, c, d, F2, K2, M(21) );
 368       R( d, e, a, b, c, F2, K2, M(22) );
 369       R( c, d, e, a, b, F2, K2, M(23) );
 370       R( b, c, d, e, a, F2, K2, M(24) );
 371       R( a, b, c, d, e, F2, K2, M(25) );
 372       R( e, a, b, c, d, F2, K2, M(26) );
 373       R( d, e, a, b, c, F2, K2, M(27) );
 374       R( c, d, e, a, b, F2, K2, M(28) );
 375       R( b, c, d, e, a, F2, K2, M(29) );
 376       R( a, b, c, d, e, F2, K2, M(30) );
 377       R( e, a, b, c, d, F2, K2, M(31) );
 378       R( d, e, a, b, c, F2, K2, M(32) );
 379       R( c, d, e, a, b, F2, K2, M(33) );
 380       R( b, c, d, e, a, F2, K2, M(34) );
 381       R( a, b, c, d, e, F2, K2, M(35) );
 382       R( e, a, b, c, d, F2, K2, M(36) );
 383       R( d, e, a, b, c, F2, K2, M(37) );
 384       R( c, d, e, a, b, F2, K2, M(38) );
 385       R( b, c, d, e, a, F2, K2, M(39) );
 386       R( a, b, c, d, e, F3, K3, M(40) );
 387       R( e, a, b, c, d, F3, K3, M(41) );
 388       R( d, e, a, b, c, F3, K3, M(42) );
 389       R( c, d, e, a, b, F3, K3, M(43) );
 390       R( b, c, d, e, a, F3, K3, M(44) );
 391       R( a, b, c, d, e, F3, K3, M(45) );
 392       R( e, a, b, c, d, F3, K3, M(46) );
 393       R( d, e, a, b, c, F3, K3, M(47) );
 394       R( c, d, e, a, b, F3, K3, M(48) );
 395       R( b, c, d, e, a, F3, K3, M(49) );
 396       R( a, b, c, d, e, F3, K3, M(50) );
 397       R( e, a, b, c, d, F3, K3, M(51) );
 398       R( d, e, a, b, c, F3, K3, M(52) );
 399       R( c, d, e, a, b, F3, K3, M(53) );
 400       R( b, c, d, e, a, F3, K3, M(54) );
 401       R( a, b, c, d, e, F3, K3, M(55) );
 402       R( e, a, b, c, d, F3, K3, M(56) );
 403       R( d, e, a, b, c, F3, K3, M(57) );
 404       R( c, d, e, a, b, F3, K3, M(58) );
 405       R( b, c, d, e, a, F3, K3, M(59) );
 406       R( a, b, c, d, e, F4, K4, M(60) );
 407       R( e, a, b, c, d, F4, K4, M(61) );
 408       R( d, e, a, b, c, F4, K4, M(62) );
 409       R( c, d, e, a, b, F4, K4, M(63) );
 410       R( b, c, d, e, a, F4, K4, M(64) );
 411       R( a, b, c, d, e, F4, K4, M(65) );
 412       R( e, a, b, c, d, F4, K4, M(66) );
 413       R( d, e, a, b, c, F4, K4, M(67) );
 414       R( c, d, e, a, b, F4, K4, M(68) );
 415       R( b, c, d, e, a, F4, K4, M(69) );
 416       R( a, b, c, d, e, F4, K4, M(70) );
 417       R( e, a, b, c, d, F4, K4, M(71) );
 418       R( d, e, a, b, c, F4, K4, M(72) );
 419       R( c, d, e, a, b, F4, K4, M(73) );
 420       R( b, c, d, e, a, F4, K4, M(74) );
 421       R( a, b, c, d, e, F4, K4, M(75) );
 422       R( e, a, b, c, d, F4, K4, M(76) );
 423       R( d, e, a, b, c, F4, K4, M(77) );
 424       R( c, d, e, a, b, F4, K4, M(78) );
 425       R( b, c, d, e, a, F4, K4, M(79) );
 426
 427       a = ctx->A += a;
 428       b = ctx->B += b;
 429       c = ctx->C += c;
 430       d = ctx->D += d;
 431       e = ctx->E += e;
 432     }
 433 }
 434 #endif