sha1dc/sha1.h

   1 /***
   2 * Copyright 2017 Marc Stevens <marc@marc-stevens.nl>, Dan Shumow <danshu@microsoft.com>
   3 * Distributed under the MIT Software License.
   4 * See accompanying file LICENSE.txt or copy at
   5 * https://opensource.org/licenses/MIT
   6 ***/
   7 #ifndef SHA1DC_SHA1_H
   8 #define SHA1DC_SHA1_H
   9
  10 #if defined(__cplusplus)
  11 extern "C" {
  12 #endif
  13
  14 /* uses SHA-1 message expansion to expand the first 16 words of W[] to 80 words */
  15 /* void sha1_message_expansion(uint32_t W[80]); */
  16
  17 /* sha-1 compression function; first version takes a message block pre-parsed as 16 32-bit integers, second version takes an already expanded message) */
  18 /* void sha1_compression(uint32_t ihv[5], const uint32_t m[16]);
  19 void sha1_compression_W(uint32_t ihv[5], const uint32_t W[80]); */
  20
  21 /* same as sha1_compression_W, but additionally store intermediate states */
  22 /* only stores states ii (the state between step ii-1 and step ii) when DOSTORESTATEii is defined in ubc_check.h */
  23 void sha1_compression_states(uint32_t[5], const uint32_t[16], uint32_t[80], uint32_t[80][5]);
  24
  25 /*
  26 // function type for sha1_recompression_step_T (uint32_t ihvin[5], uint32_t ihvout[5], const uint32_t me2[80], const uint32_t state[5])
  27 // where 0 <= T < 80
  28 //       me2 is an expanded message (the expansion of an original message block XOR'ed with a disturbance vector's message block difference)
  29 //       state is the internal state (a,b,c,d,e) before step T of the SHA-1 compression function while processing the original message block
  30 // the function will return:
  31 //       ihvin: the reconstructed input chaining value
  32 //       ihvout: the reconstructed output chaining value
  33 */
  34 typedef void(*sha1_recompression_type)(uint32_t*, uint32_t*, const uint32_t*, const uint32_t*);
  35
  36 /* table of sha1_recompression_step_0, ... , sha1_recompression_step_79 */
  37 /* extern sha1_recompression_type sha1_recompression_step[80];*/
  38
  39 /* a callback function type that can be set to be called when a collision block has been found: */
  40 /* void collision_block_callback(uint64_t byteoffset, const uint32_t ihvin1[5], const uint32_t ihvin2[5], const uint32_t m1[80], const uint32_t m2[80]) */
  41 typedef void(*collision_block_callback)(uint64_t, const uint32_t*, const uint32_t*, const uint32_t*, const uint32_t*);
  42
  43 /* the SHA-1 context */
  44 typedef struct {
  45         uint64_t total;
  46         uint32_t ihv[5];
  47         unsigned char buffer[64];
  48         int found_collision;
  49         int safe_hash;
  50         int detect_coll;
  51         int ubc_check;
  52         int reduced_round_coll;
  53         collision_block_callback callback;
  54
  55         uint32_t ihv1[5];
  56         uint32_t ihv2[5];
  57         uint32_t m1[80];
  58         uint32_t m2[80];
  59         uint32_t states[80][5];
  60 } SHA1_CTX;
  61
  62 /* initialize SHA-1 context */
  63 void SHA1DCInit(SHA1_CTX*);
  64
  65 /*
  66 // function to enable safe SHA-1 hashing:
  67 // collision attacks are thwarted by hashing a detected near-collision block 3 times
  68 // think of it as extending SHA-1 from 80-steps to 240-steps for such blocks:
  69 //   the best collision attacks against SHA-1 have complexity about 2^60,
  70 //   thus for 240-steps an immediate lower-bound for the best cryptanalytic attacks would 2^180
  71 //   an attacker would be better off using a generic birthday search of complexity 2^80
  72 //
  73 // enabling safe SHA-1 hashing will result in the correct SHA-1 hash for messages where no collision attack was detected
  74 // but it will result in a different SHA-1 hash for messages where a collision attack was detected
  75 // this will automatically invalidate SHA-1 based digital signature forgeries
  76 // enabled by default
  77 */
  78 void SHA1DCSetSafeHash(SHA1_CTX*, int);
  79
  80 /* function to disable or enable the use of Unavoidable Bitconditions (provides a significant speed up) */
  81 /* enabled by default */
  82 void SHA1DCSetUseUBC(SHA1_CTX*, int);
  83
  84 /* function to disable or enable the use of Collision Detection */
  85 /* enabled by default */
  86 void SHA1DCSetUseDetectColl(SHA1_CTX*, int);
  87
  88 /* function to disable or enable the detection of reduced-round SHA-1 collisions */
  89 /* disabled by default */
  90 void SHA1DCSetDetectReducedRoundCollision(SHA1_CTX*, int);
  91
  92 /* function to set a callback function, pass NULL to disable */
  93 /* by default no callback set */
  94 void SHA1DCSetCallback(SHA1_CTX*, collision_block_callback);
  95
  96 /* update SHA-1 context with buffer contents */
  97 void SHA1DCUpdate(SHA1_CTX*, const char*, size_t);
  98
  99 /* obtain SHA-1 hash from SHA-1 context */
 100 /* returns: 0 = no collision detected, otherwise = collision found => warn user for active attack */
 101 int  SHA1DCFinal(unsigned char[20], SHA1_CTX*);
 102
 103 /*
 104  * Same as SHA1DCFinal, but convert collision attack case into a verbose die().
 105  */
 106 void git_SHA1DCFinal(unsigned char [20], SHA1_CTX *);
 107
 108 /*
 109  * Same as SHA1DCUpdate, but adjust types to match git's usual interface.
 110  */
 111 void git_SHA1DCUpdate(SHA1_CTX *ctx, const void *data, unsigned long len);
 112
 113 #define platform_SHA_CTX SHA1_CTX
 114 #define platform_SHA1_Init SHA1DCInit
 115 #define platform_SHA1_Update git_SHA1DCUpdate
 116 #define platform_SHA1_Final git_SHA1DCFinal
 117
 118 #if defined(__cplusplus)
 119 }
 120 #endif
 121
 122 #endif /* SHA1DC_SHA1_H */