sha1dc/sha1.h

   1 /***
   2 * Copyright 2017 Marc Stevens <marc@marc-stevens.nl>, Dan Shumow <danshu@microsoft.com>
   3 * Distributed under the MIT Software License.
   4 * See accompanying file LICENSE.txt or copy at
   5 * https://opensource.org/licenses/MIT
   6 ***/
   7
   8 #ifndef SHA1DC_SHA1_H
   9 #define SHA1DC_SHA1_H
  10
  11 #if defined(__cplusplus)
  12 extern "C" {
  13 #endif
  14
  15 #ifndef SHA1DC_NO_STANDARD_INCLUDES
  16 #include <stdint.h>
  17 #endif
  18
  19 /* sha-1 compression function that takes an already expanded message, and additionally store intermediate states */
  20 /* only stores states ii (the state between step ii-1 and step ii) when DOSTORESTATEii is defined in ubc_check.h */
  21 void sha1_compression_states(uint32_t[5], const uint32_t[16], uint32_t[80], uint32_t[80][5]);
  22
  23 /*
  24 // Function type for sha1_recompression_step_T (uint32_t ihvin[5], uint32_t ihvout[5], const uint32_t me2[80], const uint32_t state[5]).
  25 // Where 0 <= T < 80
  26 //       me2 is an expanded message (the expansion of an original message block XOR'ed with a disturbance vector's message block difference.)
  27 //       state is the internal state (a,b,c,d,e) before step T of the SHA-1 compression function while processing the original message block.
  28 // The function will return:
  29 //       ihvin: The reconstructed input chaining value.
  30 //       ihvout: The reconstructed output chaining value.
  31 */
  32 typedef void(*sha1_recompression_type)(uint32_t*, uint32_t*, const uint32_t*, const uint32_t*);
  33
  34 /* A callback function type that can be set to be called when a collision block has been found: */
  35 /* void collision_block_callback(uint64_t byteoffset, const uint32_t ihvin1[5], const uint32_t ihvin2[5], const uint32_t m1[80], const uint32_t m2[80]) */
  36 typedef void(*collision_block_callback)(uint64_t, const uint32_t*, const uint32_t*, const uint32_t*, const uint32_t*);
  37
  38 /* The SHA-1 context. */
  39 typedef struct {
  40         uint64_t total;
  41         uint32_t ihv[5];
  42         unsigned char buffer[64];
  43         int found_collision;
  44         int safe_hash;
  45         int detect_coll;
  46         int ubc_check;
  47         int reduced_round_coll;
  48         collision_block_callback callback;
  49
  50         uint32_t ihv1[5];
  51         uint32_t ihv2[5];
  52         uint32_t m1[80];
  53         uint32_t m2[80];
  54         uint32_t states[80][5];
  55 } SHA1_CTX;
  56
  57 /* Initialize SHA-1 context. */
  58 void SHA1DCInit(SHA1_CTX*);
  59
  60 /*
  61     Function to enable safe SHA-1 hashing:
  62     Collision attacks are thwarted by hashing a detected near-collision block 3 times.
  63     Think of it as extending SHA-1 from 80-steps to 240-steps for such blocks:
  64         The best collision attacks against SHA-1 have complexity about 2^60,
  65         thus for 240-steps an immediate lower-bound for the best cryptanalytic attacks would be 2^180.
  66         An attacker would be better off using a generic birthday search of complexity 2^80.
  67
  68    Enabling safe SHA-1 hashing will result in the correct SHA-1 hash for messages where no collision attack was detected,
  69    but it will result in a different SHA-1 hash for messages where a collision attack was detected.
  70    This will automatically invalidate SHA-1 based digital signature forgeries.
  71    Enabled by default.
  72 */
  73 void SHA1DCSetSafeHash(SHA1_CTX*, int);
  74
  75 /*
  76     Function to disable or enable the use of Unavoidable Bitconditions (provides a significant speed up).
  77     Enabled by default
  78  */
  79 void SHA1DCSetUseUBC(SHA1_CTX*, int);
  80
  81 /*
  82     Function to disable or enable the use of Collision Detection.
  83     Enabled by default.
  84  */
  85 void SHA1DCSetUseDetectColl(SHA1_CTX*, int);
  86
  87 /* function to disable or enable the detection of reduced-round SHA-1 collisions */
  88 /* disabled by default */
  89 void SHA1DCSetDetectReducedRoundCollision(SHA1_CTX*, int);
  90
  91 /* function to set a callback function, pass NULL to disable */
  92 /* by default no callback set */
  93 void SHA1DCSetCallback(SHA1_CTX*, collision_block_callback);
  94
  95 /* update SHA-1 context with buffer contents */
  96 void SHA1DCUpdate(SHA1_CTX*, const char*, size_t);
  97
  98 /* obtain SHA-1 hash from SHA-1 context */
  99 /* returns: 0 = no collision detected, otherwise = collision found => warn user for active attack */
 100 int  SHA1DCFinal(unsigned char[20], SHA1_CTX*);
 101
 102 #if defined(__cplusplus)
 103 }
 104 #endif
 105
 106 #ifdef SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H
 107 #include SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H
 108 #endif
 109
 110 #endif