Move shared sysdeps files from alpha to arm.
[glibc.git] / crypt / sha256-crypt.c
blobcf0abd2a314050431870fe28a9e5eb086b52c7a6
1 /* One way encryption based on SHA256 sum.
2 Copyright (C) 2007-2014 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4 Contributed by Ulrich Drepper <drepper@redhat.com>, 2007.
6 The GNU C Library is free software; you can redistribute it and/or
7 modify it under the terms of the GNU Lesser General Public
8 License as published by the Free Software Foundation; either
9 version 2.1 of the License, or (at your option) any later version.
11 The GNU C Library is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public
17 License along with the GNU C Library; if not, see
18 <http://www.gnu.org/licenses/>. */
20 #include <assert.h>
21 #include <errno.h>
22 #include <stdbool.h>
23 #include <stdlib.h>
24 #include <string.h>
25 #include <stdint.h>
26 #include <sys/param.h>
28 #include "sha256.h"
31 #ifdef USE_NSS
32 typedef int PRBool;
33 # include <hasht.h>
34 # include <nsslowhash.h>
36 # define sha256_init_ctx(ctxp, nss_ctxp) \
37 do \
38 { \
39 if (((nss_ctxp = NSSLOWHASH_NewContext (nss_ictx, HASH_AlgSHA256)) \
40 == NULL)) \
41 { \
42 if (nss_ctx != NULL) \
43 NSSLOWHASH_Destroy (nss_ctx); \
44 if (nss_alt_ctx != NULL) \
45 NSSLOWHASH_Destroy (nss_alt_ctx); \
46 return NULL; \
47 } \
48 NSSLOWHASH_Begin (nss_ctxp); \
49 } \
50 while (0)
52 # define sha256_process_bytes(buf, len, ctxp, nss_ctxp) \
53 NSSLOWHASH_Update (nss_ctxp, (const unsigned char *) buf, len)
55 # define sha256_finish_ctx(ctxp, nss_ctxp, result) \
56 do \
57 { \
58 unsigned int ret; \
59 NSSLOWHASH_End (nss_ctxp, result, &ret, sizeof (result)); \
60 assert (ret == sizeof (result)); \
61 NSSLOWHASH_Destroy (nss_ctxp); \
62 nss_ctxp = NULL; \
63 } \
64 while (0)
65 #else
66 # define sha256_init_ctx(ctxp, nss_ctxp) \
67 __sha256_init_ctx (ctxp)
69 # define sha256_process_bytes(buf, len, ctxp, nss_ctxp) \
70 __sha256_process_bytes(buf, len, ctxp)
72 # define sha256_finish_ctx(ctxp, nss_ctxp, result) \
73 __sha256_finish_ctx (ctxp, result)
74 #endif
77 /* Define our magic string to mark salt for SHA256 "encryption"
78 replacement. */
79 static const char sha256_salt_prefix[] = "$5$";
81 /* Prefix for optional rounds specification. */
82 static const char sha256_rounds_prefix[] = "rounds=";
84 /* Maximum salt string length. */
85 #define SALT_LEN_MAX 16
86 /* Default number of rounds if not explicitly specified. */
87 #define ROUNDS_DEFAULT 5000
88 /* Minimum number of rounds. */
89 #define ROUNDS_MIN 1000
90 /* Maximum number of rounds. */
91 #define ROUNDS_MAX 999999999
93 /* Table with characters for base64 transformation. */
94 static const char b64t[64] =
95 "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
98 /* Prototypes for local functions. */
99 extern char *__sha256_crypt_r (const char *key, const char *salt,
100 char *buffer, int buflen);
101 extern char *__sha256_crypt (const char *key, const char *salt);
104 char *
105 __sha256_crypt_r (key, salt, buffer, buflen)
106 const char *key;
107 const char *salt;
108 char *buffer;
109 int buflen;
111 unsigned char alt_result[32]
112 __attribute__ ((__aligned__ (__alignof__ (uint32_t))));
113 unsigned char temp_result[32]
114 __attribute__ ((__aligned__ (__alignof__ (uint32_t))));
115 size_t salt_len;
116 size_t key_len;
117 size_t cnt;
118 char *cp;
119 char *copied_key = NULL;
120 char *copied_salt = NULL;
121 char *p_bytes;
122 char *s_bytes;
123 /* Default number of rounds. */
124 size_t rounds = ROUNDS_DEFAULT;
125 bool rounds_custom = false;
126 size_t alloca_used = 0;
127 char *free_key = NULL;
128 char *free_pbytes = NULL;
130 /* Find beginning of salt string. The prefix should normally always
131 be present. Just in case it is not. */
132 if (strncmp (sha256_salt_prefix, salt, sizeof (sha256_salt_prefix) - 1) == 0)
133 /* Skip salt prefix. */
134 salt += sizeof (sha256_salt_prefix) - 1;
136 if (strncmp (salt, sha256_rounds_prefix, sizeof (sha256_rounds_prefix) - 1)
137 == 0)
139 const char *num = salt + sizeof (sha256_rounds_prefix) - 1;
140 char *endp;
141 unsigned long int srounds = strtoul (num, &endp, 10);
142 if (*endp == '$')
144 salt = endp + 1;
145 rounds = MAX (ROUNDS_MIN, MIN (srounds, ROUNDS_MAX));
146 rounds_custom = true;
150 salt_len = MIN (strcspn (salt, "$"), SALT_LEN_MAX);
151 key_len = strlen (key);
153 if ((key - (char *) 0) % __alignof__ (uint32_t) != 0)
155 char *tmp;
157 if (__libc_use_alloca (alloca_used + key_len + __alignof__ (uint32_t)))
158 tmp = alloca_account (key_len + __alignof__ (uint32_t), alloca_used);
159 else
161 free_key = tmp = (char *) malloc (key_len + __alignof__ (uint32_t));
162 if (tmp == NULL)
163 return NULL;
166 key = copied_key =
167 memcpy (tmp + __alignof__ (uint32_t)
168 - (tmp - (char *) 0) % __alignof__ (uint32_t),
169 key, key_len);
170 assert ((key - (char *) 0) % __alignof__ (uint32_t) == 0);
173 if ((salt - (char *) 0) % __alignof__ (uint32_t) != 0)
175 char *tmp = (char *) alloca (salt_len + __alignof__ (uint32_t));
176 alloca_used += salt_len + __alignof__ (uint32_t);
177 salt = copied_salt =
178 memcpy (tmp + __alignof__ (uint32_t)
179 - (tmp - (char *) 0) % __alignof__ (uint32_t),
180 salt, salt_len);
181 assert ((salt - (char *) 0) % __alignof__ (uint32_t) == 0);
184 #ifdef USE_NSS
185 /* Initialize libfreebl3. */
186 NSSLOWInitContext *nss_ictx = NSSLOW_Init ();
187 if (nss_ictx == NULL)
189 free (free_key);
190 return NULL;
192 NSSLOWHASHContext *nss_ctx = NULL;
193 NSSLOWHASHContext *nss_alt_ctx = NULL;
194 #else
195 struct sha256_ctx ctx;
196 struct sha256_ctx alt_ctx;
197 #endif
199 /* Prepare for the real work. */
200 sha256_init_ctx (&ctx, nss_ctx);
202 /* Add the key string. */
203 sha256_process_bytes (key, key_len, &ctx, nss_ctx);
205 /* The last part is the salt string. This must be at most 16
206 characters and it ends at the first `$' character. */
207 sha256_process_bytes (salt, salt_len, &ctx, nss_ctx);
210 /* Compute alternate SHA256 sum with input KEY, SALT, and KEY. The
211 final result will be added to the first context. */
212 sha256_init_ctx (&alt_ctx, nss_alt_ctx);
214 /* Add key. */
215 sha256_process_bytes (key, key_len, &alt_ctx, nss_alt_ctx);
217 /* Add salt. */
218 sha256_process_bytes (salt, salt_len, &alt_ctx, nss_alt_ctx);
220 /* Add key again. */
221 sha256_process_bytes (key, key_len, &alt_ctx, nss_alt_ctx);
223 /* Now get result of this (32 bytes) and add it to the other
224 context. */
225 sha256_finish_ctx (&alt_ctx, nss_alt_ctx, alt_result);
227 /* Add for any character in the key one byte of the alternate sum. */
228 for (cnt = key_len; cnt > 32; cnt -= 32)
229 sha256_process_bytes (alt_result, 32, &ctx, nss_ctx);
230 sha256_process_bytes (alt_result, cnt, &ctx, nss_ctx);
232 /* Take the binary representation of the length of the key and for every
233 1 add the alternate sum, for every 0 the key. */
234 for (cnt = key_len; cnt > 0; cnt >>= 1)
235 if ((cnt & 1) != 0)
236 sha256_process_bytes (alt_result, 32, &ctx, nss_ctx);
237 else
238 sha256_process_bytes (key, key_len, &ctx, nss_ctx);
240 /* Create intermediate result. */
241 sha256_finish_ctx (&ctx, nss_ctx, alt_result);
243 /* Start computation of P byte sequence. */
244 sha256_init_ctx (&alt_ctx, nss_alt_ctx);
246 /* For every character in the password add the entire password. */
247 for (cnt = 0; cnt < key_len; ++cnt)
248 sha256_process_bytes (key, key_len, &alt_ctx, nss_alt_ctx);
250 /* Finish the digest. */
251 sha256_finish_ctx (&alt_ctx, nss_alt_ctx, temp_result);
253 /* Create byte sequence P. */
254 if (__libc_use_alloca (alloca_used + key_len))
255 cp = p_bytes = (char *) alloca (key_len);
256 else
258 free_pbytes = cp = p_bytes = (char *)malloc (key_len);
259 if (free_pbytes == NULL)
261 free (free_key);
262 return NULL;
266 for (cnt = key_len; cnt >= 32; cnt -= 32)
267 cp = mempcpy (cp, temp_result, 32);
268 memcpy (cp, temp_result, cnt);
270 /* Start computation of S byte sequence. */
271 sha256_init_ctx (&alt_ctx, nss_alt_ctx);
273 /* For every character in the password add the entire password. */
274 for (cnt = 0; cnt < 16 + alt_result[0]; ++cnt)
275 sha256_process_bytes (salt, salt_len, &alt_ctx, nss_alt_ctx);
277 /* Finish the digest. */
278 sha256_finish_ctx (&alt_ctx, nss_alt_ctx, temp_result);
280 /* Create byte sequence S. */
281 cp = s_bytes = alloca (salt_len);
282 for (cnt = salt_len; cnt >= 32; cnt -= 32)
283 cp = mempcpy (cp, temp_result, 32);
284 memcpy (cp, temp_result, cnt);
286 /* Repeatedly run the collected hash value through SHA256 to burn
287 CPU cycles. */
288 for (cnt = 0; cnt < rounds; ++cnt)
290 /* New context. */
291 sha256_init_ctx (&ctx, nss_ctx);
293 /* Add key or last result. */
294 if ((cnt & 1) != 0)
295 sha256_process_bytes (p_bytes, key_len, &ctx, nss_ctx);
296 else
297 sha256_process_bytes (alt_result, 32, &ctx, nss_ctx);
299 /* Add salt for numbers not divisible by 3. */
300 if (cnt % 3 != 0)
301 sha256_process_bytes (s_bytes, salt_len, &ctx, nss_ctx);
303 /* Add key for numbers not divisible by 7. */
304 if (cnt % 7 != 0)
305 sha256_process_bytes (p_bytes, key_len, &ctx, nss_ctx);
307 /* Add key or last result. */
308 if ((cnt & 1) != 0)
309 sha256_process_bytes (alt_result, 32, &ctx, nss_ctx);
310 else
311 sha256_process_bytes (p_bytes, key_len, &ctx, nss_ctx);
313 /* Create intermediate result. */
314 sha256_finish_ctx (&ctx, nss_ctx, alt_result);
317 #ifdef USE_NSS
318 /* Free libfreebl3 resources. */
319 NSSLOW_Shutdown (nss_ictx);
320 #endif
322 /* Now we can construct the result string. It consists of three
323 parts. */
324 cp = __stpncpy (buffer, sha256_salt_prefix, MAX (0, buflen));
325 buflen -= sizeof (sha256_salt_prefix) - 1;
327 if (rounds_custom)
329 int n = snprintf (cp, MAX (0, buflen), "%s%zu$",
330 sha256_rounds_prefix, rounds);
331 cp += n;
332 buflen -= n;
335 cp = __stpncpy (cp, salt, MIN ((size_t) MAX (0, buflen), salt_len));
336 buflen -= MIN ((size_t) MAX (0, buflen), salt_len);
338 if (buflen > 0)
340 *cp++ = '$';
341 --buflen;
344 void b64_from_24bit (unsigned int b2, unsigned int b1, unsigned int b0,
345 int n)
347 unsigned int w = (b2 << 16) | (b1 << 8) | b0;
348 while (n-- > 0 && buflen > 0)
350 *cp++ = b64t[w & 0x3f];
351 --buflen;
352 w >>= 6;
356 b64_from_24bit (alt_result[0], alt_result[10], alt_result[20], 4);
357 b64_from_24bit (alt_result[21], alt_result[1], alt_result[11], 4);
358 b64_from_24bit (alt_result[12], alt_result[22], alt_result[2], 4);
359 b64_from_24bit (alt_result[3], alt_result[13], alt_result[23], 4);
360 b64_from_24bit (alt_result[24], alt_result[4], alt_result[14], 4);
361 b64_from_24bit (alt_result[15], alt_result[25], alt_result[5], 4);
362 b64_from_24bit (alt_result[6], alt_result[16], alt_result[26], 4);
363 b64_from_24bit (alt_result[27], alt_result[7], alt_result[17], 4);
364 b64_from_24bit (alt_result[18], alt_result[28], alt_result[8], 4);
365 b64_from_24bit (alt_result[9], alt_result[19], alt_result[29], 4);
366 b64_from_24bit (0, alt_result[31], alt_result[30], 3);
367 if (buflen <= 0)
369 __set_errno (ERANGE);
370 buffer = NULL;
372 else
373 *cp = '\0'; /* Terminate the string. */
375 /* Clear the buffer for the intermediate result so that people
376 attaching to processes or reading core dumps cannot get any
377 information. We do it in this way to clear correct_words[]
378 inside the SHA256 implementation as well. */
379 #ifndef USE_NSS
380 __sha256_init_ctx (&ctx);
381 __sha256_finish_ctx (&ctx, alt_result);
382 memset (&ctx, '\0', sizeof (ctx));
383 memset (&alt_ctx, '\0', sizeof (alt_ctx));
384 #endif
385 memset (temp_result, '\0', sizeof (temp_result));
386 memset (p_bytes, '\0', key_len);
387 memset (s_bytes, '\0', salt_len);
388 if (copied_key != NULL)
389 memset (copied_key, '\0', key_len);
390 if (copied_salt != NULL)
391 memset (copied_salt, '\0', salt_len);
393 free (free_key);
394 free (free_pbytes);
395 return buffer;
398 #ifndef _LIBC
399 # define libc_freeres_ptr(decl) decl
400 #endif
401 libc_freeres_ptr (static char *buffer);
403 /* This entry point is equivalent to the `crypt' function in Unix
404 libcs. */
405 char *
406 __sha256_crypt (const char *key, const char *salt)
408 /* We don't want to have an arbitrary limit in the size of the
409 password. We can compute an upper bound for the size of the
410 result in advance and so we can prepare the buffer we pass to
411 `sha256_crypt_r'. */
412 static int buflen;
413 int needed = (sizeof (sha256_salt_prefix) - 1
414 + sizeof (sha256_rounds_prefix) + 9 + 1
415 + strlen (salt) + 1 + 43 + 1);
417 if (buflen < needed)
419 char *new_buffer = (char *) realloc (buffer, needed);
420 if (new_buffer == NULL)
421 return NULL;
423 buffer = new_buffer;
424 buflen = needed;
427 return __sha256_crypt_r (key, salt, buffer, buflen);
430 #ifndef _LIBC
431 static void
432 __attribute__ ((__destructor__))
433 free_mem (void)
435 free (buffer);
437 #endif