lib/sha1.c

   1 /* sha1.c - Functions to compute SHA1 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-1.
   3
   4    Copyright (C) 2000-2001, 2003-2006, 2008-2017 Free Software Foundation, Inc.
   5
   6    This program is free software; you can redistribute it and/or modify it
   7    under the terms of the GNU General Public License as published by the
   8    Free Software Foundation; either version 3, or (at your option) any
   9    later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, see <https://www.gnu.org/licenses/>.  */
  18
  19 /* Written by Scott G. Miller
  20    Credits:
  21       Robert Klep <robert@ilse.nl>  -- Expansion function fix
  22 */
  23
  24 #include <config.h>
  25
  26 #if HAVE_OPENSSL_SHA1
  27 # define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
  28 #endif
  29 #include "sha1.h"
  30
  31 #include <stdalign.h>
  32 #include <stdint.h>
  33 #include <stdlib.h>
  34 #include <string.h>
  35
  36 #if USE_UNLOCKED_IO
  37 # include "unlocked-io.h"
  38 #endif
  39
  40 #ifdef WORDS_BIGENDIAN
  41 # define SWAP(n) (n)
  42 #else
  43 # define SWAP(n) \
  44     (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
  45 #endif
  46
  47 #define BLOCKSIZE 32768
  48 #if BLOCKSIZE % 64 != 0
  49 # error "invalid BLOCKSIZE"
  50 #endif
  51
  52 #if ! HAVE_OPENSSL_SHA1
  53 /* This array contains the bytes used to pad the buffer to the next
  54    64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
  55 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  56
  57
  58 /* Take a pointer to a 160 bit block of data (five 32 bit ints) and
  59    initialize it to the start constants of the SHA1 algorithm.  This
  60    must be called before using hash in the call to sha1_hash.  */
  61 void
  62 sha1_init_ctx (struct sha1_ctx *ctx)
  63 {
  64   ctx->A = 0x67452301;
  65   ctx->B = 0xefcdab89;
  66   ctx->C = 0x98badcfe;
  67   ctx->D = 0x10325476;
  68   ctx->E = 0xc3d2e1f0;
  69
  70   ctx->total[0] = ctx->total[1] = 0;
  71   ctx->buflen = 0;
  72 }
  73
  74 /* Copy the 4 byte value from v into the memory location pointed to by *cp,
  75    If your architecture allows unaligned access this is equivalent to
  76    * (uint32_t *) cp = v  */
  77 static void
  78 set_uint32 (char *cp, uint32_t v)
  79 {
  80   memcpy (cp, &v, sizeof v);
  81 }
  82
  83 /* Put result from CTX in first 20 bytes following RESBUF.  The result
  84    must be in little endian byte order.  */
  85 void *
  86 sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
  87 {
  88   char *r = resbuf;
  89   set_uint32 (r + 0 * sizeof ctx->A, SWAP (ctx->A));
  90   set_uint32 (r + 1 * sizeof ctx->B, SWAP (ctx->B));
  91   set_uint32 (r + 2 * sizeof ctx->C, SWAP (ctx->C));
  92   set_uint32 (r + 3 * sizeof ctx->D, SWAP (ctx->D));
  93   set_uint32 (r + 4 * sizeof ctx->E, SWAP (ctx->E));
  94
  95   return resbuf;
  96 }
  97
  98 /* Process the remaining bytes in the internal buffer and the usual
  99    prolog according to the standard and write the result to RESBUF.  */
 100 void *
 101 sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
 102 {
 103   /* Take yet unprocessed bytes into account.  */
 104   uint32_t bytes = ctx->buflen;
 105   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
 106
 107   /* Now count remaining bytes.  */
 108   ctx->total[0] += bytes;
 109   if (ctx->total[0] < bytes)
 110     ++ctx->total[1];
 111
 112   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 113   ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 114   ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
 115
 116   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 117
 118   /* Process last bytes.  */
 119   sha1_process_block (ctx->buffer, size * 4, ctx);
 120
 121   return sha1_read_ctx (ctx, resbuf);
 122 }
 123 #endif
 124
 125 /* Compute SHA1 message digest for bytes read from STREAM.  The
 126    resulting message digest number will be written into the 16 bytes
 127    beginning at RESBLOCK.  */
 128 int
 129 sha1_stream (FILE *stream, void *resblock)
 130 {
 131   struct sha1_ctx ctx;
 132   size_t sum;
 133
 134   char *buffer = malloc (BLOCKSIZE + 72);
 135   if (!buffer)
 136     return 1;
 137
 138   /* Initialize the computation context.  */
 139   sha1_init_ctx (&ctx);
 140
 141   /* Iterate over full file contents.  */
 142   while (1)
 143     {
 144       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 145          computation function processes the whole buffer so that with the
 146          next round of the loop another block can be read.  */
 147       size_t n;
 148       sum = 0;
 149
 150       /* Read block.  Take care for partial reads.  */
 151       while (1)
 152         {
 153           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 154
 155           sum += n;
 156
 157           if (sum == BLOCKSIZE)
 158             break;
 159
 160           if (n == 0)
 161             {
 162               /* Check for the error flag IFF N == 0, so that we don't
 163                  exit the loop after a partial read due to e.g., EAGAIN
 164                  or EWOULDBLOCK.  */
 165               if (ferror (stream))
 166                 {
 167                   free (buffer);
 168                   return 1;
 169                 }
 170               goto process_partial_block;
 171             }
 172
 173           /* We've read at least one byte, so ignore errors.  But always
 174              check for EOF, since feof may be true even though N > 0.
 175              Otherwise, we could end up calling fread after EOF.  */
 176           if (feof (stream))
 177             goto process_partial_block;
 178         }
 179
 180       /* Process buffer with BLOCKSIZE bytes.  Note that
 181                         BLOCKSIZE % 64 == 0
 182        */
 183       sha1_process_block (buffer, BLOCKSIZE, &ctx);
 184     }
 185
 186  process_partial_block:;
 187
 188   /* Process any remaining bytes.  */
 189   if (sum > 0)
 190     sha1_process_bytes (buffer, sum, &ctx);
 191
 192   /* Construct result in desired memory.  */
 193   sha1_finish_ctx (&ctx, resblock);
 194   free (buffer);
 195   return 0;
 196 }
 197
 198 #if ! HAVE_OPENSSL_SHA1
 199 /* Compute SHA1 message digest for LEN bytes beginning at BUFFER.  The
 200    result is always in little endian byte order, so that a byte-wise
 201    output yields to the wanted ASCII representation of the message
 202    digest.  */
 203 void *
 204 sha1_buffer (const char *buffer, size_t len, void *resblock)
 205 {
 206   struct sha1_ctx ctx;
 207
 208   /* Initialize the computation context.  */
 209   sha1_init_ctx (&ctx);
 210
 211   /* Process whole buffer but last len % 64 bytes.  */
 212   sha1_process_bytes (buffer, len, &ctx);
 213
 214   /* Put result in desired memory area.  */
 215   return sha1_finish_ctx (&ctx, resblock);
 216 }
 217
 218 void
 219 sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
 220 {
 221   /* When we already have some bits in our internal buffer concatenate
 222      both inputs first.  */
 223   if (ctx->buflen != 0)
 224     {
 225       size_t left_over = ctx->buflen;
 226       size_t add = 128 - left_over > len ? len : 128 - left_over;
 227
 228       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 229       ctx->buflen += add;
 230
 231       if (ctx->buflen > 64)
 232         {
 233           sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 234
 235           ctx->buflen &= 63;
 236           /* The regions in the following copy operation cannot overlap,
 237              because ctx->buflen < 64 ≤ (left_over + add) & ~63.  */
 238           memcpy (ctx->buffer,
 239                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 240                   ctx->buflen);
 241         }
 242
 243       buffer = (const char *) buffer + add;
 244       len -= add;
 245     }
 246
 247   /* Process available complete blocks.  */
 248   if (len >= 64)
 249     {
 250 #if !(_STRING_ARCH_unaligned || _STRING_INLINE_unaligned)
 251 # define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
 252       if (UNALIGNED_P (buffer))
 253         while (len > 64)
 254           {
 255             sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 256             buffer = (const char *) buffer + 64;
 257             len -= 64;
 258           }
 259       else
 260 #endif
 261         {
 262           sha1_process_block (buffer, len & ~63, ctx);
 263           buffer = (const char *) buffer + (len & ~63);
 264           len &= 63;
 265         }
 266     }
 267
 268   /* Move remaining bytes in internal buffer.  */
 269   if (len > 0)
 270     {
 271       size_t left_over = ctx->buflen;
 272
 273       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 274       left_over += len;
 275       if (left_over >= 64)
 276         {
 277           sha1_process_block (ctx->buffer, 64, ctx);
 278           left_over -= 64;
 279           /* The regions in the following copy operation cannot overlap,
 280              because left_over ≤ 64.  */
 281           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 282         }
 283       ctx->buflen = left_over;
 284     }
 285 }
 286
 287 /* --- Code below is the primary difference between md5.c and sha1.c --- */
 288
 289 /* SHA1 round constants */
 290 #define K1 0x5a827999
 291 #define K2 0x6ed9eba1
 292 #define K3 0x8f1bbcdc
 293 #define K4 0xca62c1d6
 294
 295 /* Round functions.  Note that F2 is the same as F4.  */
 296 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
 297 #define F2(B,C,D) (B ^ C ^ D)
 298 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
 299 #define F4(B,C,D) (B ^ C ^ D)
 300
 301 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 302    It is assumed that LEN % 64 == 0.
 303    Most of this code comes from GnuPG's cipher/sha1.c.  */
 304
 305 void
 306 sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
 307 {
 308   const uint32_t *words = buffer;
 309   size_t nwords = len / sizeof (uint32_t);
 310   const uint32_t *endp = words + nwords;
 311   uint32_t x[16];
 312   uint32_t a = ctx->A;
 313   uint32_t b = ctx->B;
 314   uint32_t c = ctx->C;
 315   uint32_t d = ctx->D;
 316   uint32_t e = ctx->E;
 317   uint32_t lolen = len;
 318
 319   /* First increment the byte count.  RFC 1321 specifies the possible
 320      length of the file up to 2^64 bits.  Here we only compute the
 321      number of bytes.  Do a double word increment.  */
 322   ctx->total[0] += lolen;
 323   ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen);
 324
 325 #define rol(x, n) (((x) << (n)) | ((uint32_t) (x) >> (32 - (n))))
 326
 327 #define M(I) ( tm =   x[I&0x0f] ^ x[(I-14)&0x0f] \
 328                     ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
 329                , (x[I&0x0f] = rol(tm, 1)) )
 330
 331 #define R(A,B,C,D,E,F,K,M)  do { E += rol( A, 5 )     \
 332                                       + F( B, C, D )  \
 333                                       + K             \
 334                                       + M;            \
 335                                  B = rol( B, 30 );    \
 336                                } while(0)
 337
 338   while (words < endp)
 339     {
 340       uint32_t tm;
 341       int t;
 342       for (t = 0; t < 16; t++)
 343         {
 344           x[t] = SWAP (*words);
 345           words++;
 346         }
 347
 348       R( a, b, c, d, e, F1, K1, x[ 0] );
 349       R( e, a, b, c, d, F1, K1, x[ 1] );
 350       R( d, e, a, b, c, F1, K1, x[ 2] );
 351       R( c, d, e, a, b, F1, K1, x[ 3] );
 352       R( b, c, d, e, a, F1, K1, x[ 4] );
 353       R( a, b, c, d, e, F1, K1, x[ 5] );
 354       R( e, a, b, c, d, F1, K1, x[ 6] );
 355       R( d, e, a, b, c, F1, K1, x[ 7] );
 356       R( c, d, e, a, b, F1, K1, x[ 8] );
 357       R( b, c, d, e, a, F1, K1, x[ 9] );
 358       R( a, b, c, d, e, F1, K1, x[10] );
 359       R( e, a, b, c, d, F1, K1, x[11] );
 360       R( d, e, a, b, c, F1, K1, x[12] );
 361       R( c, d, e, a, b, F1, K1, x[13] );
 362       R( b, c, d, e, a, F1, K1, x[14] );
 363       R( a, b, c, d, e, F1, K1, x[15] );
 364       R( e, a, b, c, d, F1, K1, M(16) );
 365       R( d, e, a, b, c, F1, K1, M(17) );
 366       R( c, d, e, a, b, F1, K1, M(18) );
 367       R( b, c, d, e, a, F1, K1, M(19) );
 368       R( a, b, c, d, e, F2, K2, M(20) );
 369       R( e, a, b, c, d, F2, K2, M(21) );
 370       R( d, e, a, b, c, F2, K2, M(22) );
 371       R( c, d, e, a, b, F2, K2, M(23) );
 372       R( b, c, d, e, a, F2, K2, M(24) );
 373       R( a, b, c, d, e, F2, K2, M(25) );
 374       R( e, a, b, c, d, F2, K2, M(26) );
 375       R( d, e, a, b, c, F2, K2, M(27) );
 376       R( c, d, e, a, b, F2, K2, M(28) );
 377       R( b, c, d, e, a, F2, K2, M(29) );
 378       R( a, b, c, d, e, F2, K2, M(30) );
 379       R( e, a, b, c, d, F2, K2, M(31) );
 380       R( d, e, a, b, c, F2, K2, M(32) );
 381       R( c, d, e, a, b, F2, K2, M(33) );
 382       R( b, c, d, e, a, F2, K2, M(34) );
 383       R( a, b, c, d, e, F2, K2, M(35) );
 384       R( e, a, b, c, d, F2, K2, M(36) );
 385       R( d, e, a, b, c, F2, K2, M(37) );
 386       R( c, d, e, a, b, F2, K2, M(38) );
 387       R( b, c, d, e, a, F2, K2, M(39) );
 388       R( a, b, c, d, e, F3, K3, M(40) );
 389       R( e, a, b, c, d, F3, K3, M(41) );
 390       R( d, e, a, b, c, F3, K3, M(42) );
 391       R( c, d, e, a, b, F3, K3, M(43) );
 392       R( b, c, d, e, a, F3, K3, M(44) );
 393       R( a, b, c, d, e, F3, K3, M(45) );
 394       R( e, a, b, c, d, F3, K3, M(46) );
 395       R( d, e, a, b, c, F3, K3, M(47) );
 396       R( c, d, e, a, b, F3, K3, M(48) );
 397       R( b, c, d, e, a, F3, K3, M(49) );
 398       R( a, b, c, d, e, F3, K3, M(50) );
 399       R( e, a, b, c, d, F3, K3, M(51) );
 400       R( d, e, a, b, c, F3, K3, M(52) );
 401       R( c, d, e, a, b, F3, K3, M(53) );
 402       R( b, c, d, e, a, F3, K3, M(54) );
 403       R( a, b, c, d, e, F3, K3, M(55) );
 404       R( e, a, b, c, d, F3, K3, M(56) );
 405       R( d, e, a, b, c, F3, K3, M(57) );
 406       R( c, d, e, a, b, F3, K3, M(58) );
 407       R( b, c, d, e, a, F3, K3, M(59) );
 408       R( a, b, c, d, e, F4, K4, M(60) );
 409       R( e, a, b, c, d, F4, K4, M(61) );
 410       R( d, e, a, b, c, F4, K4, M(62) );
 411       R( c, d, e, a, b, F4, K4, M(63) );
 412       R( b, c, d, e, a, F4, K4, M(64) );
 413       R( a, b, c, d, e, F4, K4, M(65) );
 414       R( e, a, b, c, d, F4, K4, M(66) );
 415       R( d, e, a, b, c, F4, K4, M(67) );
 416       R( c, d, e, a, b, F4, K4, M(68) );
 417       R( b, c, d, e, a, F4, K4, M(69) );
 418       R( a, b, c, d, e, F4, K4, M(70) );
 419       R( e, a, b, c, d, F4, K4, M(71) );
 420       R( d, e, a, b, c, F4, K4, M(72) );
 421       R( c, d, e, a, b, F4, K4, M(73) );
 422       R( b, c, d, e, a, F4, K4, M(74) );
 423       R( a, b, c, d, e, F4, K4, M(75) );
 424       R( e, a, b, c, d, F4, K4, M(76) );
 425       R( d, e, a, b, c, F4, K4, M(77) );
 426       R( c, d, e, a, b, F4, K4, M(78) );
 427       R( b, c, d, e, a, F4, K4, M(79) );
 428
 429       a = ctx->A += a;
 430       b = ctx->B += b;
 431       c = ctx->C += c;
 432       d = ctx->D += d;
 433       e = ctx->E += e;
 434     }
 435 }
 436 #endif