1 /* sha1.c - Functions to compute SHA1 message digest of files or
2 memory blocks according to the NIST specification FIPS-180-1.
4 Copyright (C) 2000-2001, 2003-2006, 2008-2020 Free Software Foundation, Inc.
6 This program is free software; you can redistribute it and/or modify it
7 under the terms of the GNU General Public License as published by the
8 Free Software Foundation; either version 2, or (at your option) any
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, see <https://www.gnu.org/licenses/>. */
19 /* Written by Scott G. Miller
21 Robert Klep <robert@ilse.nl> -- Expansion function fix
27 # define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
37 # include "unlocked-io.h"
41 #ifdef WORDS_BIGENDIAN
44 # define SWAP(n) bswap_32 (n)
47 #define BLOCKSIZE 32768
48 #if BLOCKSIZE % 64 != 0
49 # error "invalid BLOCKSIZE"
52 #if ! HAVE_OPENSSL_SHA1
53 /* This array contains the bytes used to pad the buffer to the next
54 64-byte boundary. (RFC 1321, 3.1: Step 1) */
55 static const unsigned char fillbuf
[64] = { 0x80, 0 /* , 0, 0, ... */ };
58 /* Take a pointer to a 160 bit block of data (five 32 bit ints) and
59 initialize it to the start constants of the SHA1 algorithm. This
60 must be called before using hash in the call to sha1_hash. */
62 sha1_init_ctx (struct sha1_ctx
*ctx
)
70 ctx
->total
[0] = ctx
->total
[1] = 0;
74 /* Copy the 4 byte value from v into the memory location pointed to by *cp,
75 If your architecture allows unaligned access this is equivalent to
76 * (uint32_t *) cp = v */
78 set_uint32 (char *cp
, uint32_t v
)
80 memcpy (cp
, &v
, sizeof v
);
83 /* Put result from CTX in first 20 bytes following RESBUF. The result
84 must be in little endian byte order. */
86 sha1_read_ctx (const struct sha1_ctx
*ctx
, void *resbuf
)
89 set_uint32 (r
+ 0 * sizeof ctx
->A
, SWAP (ctx
->A
));
90 set_uint32 (r
+ 1 * sizeof ctx
->B
, SWAP (ctx
->B
));
91 set_uint32 (r
+ 2 * sizeof ctx
->C
, SWAP (ctx
->C
));
92 set_uint32 (r
+ 3 * sizeof ctx
->D
, SWAP (ctx
->D
));
93 set_uint32 (r
+ 4 * sizeof ctx
->E
, SWAP (ctx
->E
));
98 /* Process the remaining bytes in the internal buffer and the usual
99 prolog according to the standard and write the result to RESBUF. */
101 sha1_finish_ctx (struct sha1_ctx
*ctx
, void *resbuf
)
103 /* Take yet unprocessed bytes into account. */
104 uint32_t bytes
= ctx
->buflen
;
105 size_t size
= (bytes
< 56) ? 64 / 4 : 64 * 2 / 4;
107 /* Now count remaining bytes. */
108 ctx
->total
[0] += bytes
;
109 if (ctx
->total
[0] < bytes
)
112 /* Put the 64-bit file length in *bits* at the end of the buffer. */
113 ctx
->buffer
[size
- 2] = SWAP ((ctx
->total
[1] << 3) | (ctx
->total
[0] >> 29));
114 ctx
->buffer
[size
- 1] = SWAP (ctx
->total
[0] << 3);
116 memcpy (&((char *) ctx
->buffer
)[bytes
], fillbuf
, (size
- 2) * 4 - bytes
);
118 /* Process last bytes. */
119 sha1_process_block (ctx
->buffer
, size
* 4, ctx
);
121 return sha1_read_ctx (ctx
, resbuf
);
125 #ifdef GL_COMPILE_CRYPTO_STREAM
129 /* Compute SHA1 message digest for bytes read from STREAM. The
130 resulting message digest number will be written into the 20 bytes
131 beginning at RESBLOCK. */
133 sha1_stream (FILE *stream
, void *resblock
)
135 switch (afalg_stream (stream
, "sha1", resblock
, SHA1_DIGEST_SIZE
))
141 char *buffer
= malloc (BLOCKSIZE
+ 72);
146 sha1_init_ctx (&ctx
);
149 /* Iterate over full file contents. */
152 /* We read the file in blocks of BLOCKSIZE bytes. One call of the
153 computation function processes the whole buffer so that with the
154 next round of the loop another block can be read. */
158 /* Read block. Take care for partial reads. */
161 /* Either process a partial fread() from this loop,
162 or the fread() in afalg_stream may have gotten EOF.
163 We need to avoid a subsequent fread() as EOF may
164 not be sticky. For details of such systems, see:
165 https://sourceware.org/bugzilla/show_bug.cgi?id=1190 */
167 goto process_partial_block
;
169 n
= fread (buffer
+ sum
, 1, BLOCKSIZE
- sum
, stream
);
173 if (sum
== BLOCKSIZE
)
178 /* Check for the error flag IFF N == 0, so that we don't
179 exit the loop after a partial read due to e.g., EAGAIN
186 goto process_partial_block
;
190 /* Process buffer with BLOCKSIZE bytes. Note that
193 sha1_process_block (buffer
, BLOCKSIZE
, &ctx
);
196 process_partial_block
:;
198 /* Process any remaining bytes. */
200 sha1_process_bytes (buffer
, sum
, &ctx
);
202 /* Construct result in desired memory. */
203 sha1_finish_ctx (&ctx
, resblock
);
209 #if ! HAVE_OPENSSL_SHA1
210 /* Compute SHA1 message digest for LEN bytes beginning at BUFFER. The
211 result is always in little endian byte order, so that a byte-wise
212 output yields to the wanted ASCII representation of the message
215 sha1_buffer (const char *buffer
, size_t len
, void *resblock
)
219 /* Initialize the computation context. */
220 sha1_init_ctx (&ctx
);
222 /* Process whole buffer but last len % 64 bytes. */
223 sha1_process_bytes (buffer
, len
, &ctx
);
225 /* Put result in desired memory area. */
226 return sha1_finish_ctx (&ctx
, resblock
);
230 sha1_process_bytes (const void *buffer
, size_t len
, struct sha1_ctx
*ctx
)
232 /* When we already have some bits in our internal buffer concatenate
233 both inputs first. */
234 if (ctx
->buflen
!= 0)
236 size_t left_over
= ctx
->buflen
;
237 size_t add
= 128 - left_over
> len
? len
: 128 - left_over
;
239 memcpy (&((char *) ctx
->buffer
)[left_over
], buffer
, add
);
242 if (ctx
->buflen
> 64)
244 sha1_process_block (ctx
->buffer
, ctx
->buflen
& ~63, ctx
);
247 /* The regions in the following copy operation cannot overlap,
248 because ctx->buflen < 64 ≤ (left_over + add) & ~63. */
250 &((char *) ctx
->buffer
)[(left_over
+ add
) & ~63],
254 buffer
= (const char *) buffer
+ add
;
258 /* Process available complete blocks. */
261 #if !(_STRING_ARCH_unaligned || _STRING_INLINE_unaligned)
262 # define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
263 if (UNALIGNED_P (buffer
))
266 sha1_process_block (memcpy (ctx
->buffer
, buffer
, 64), 64, ctx
);
267 buffer
= (const char *) buffer
+ 64;
273 sha1_process_block (buffer
, len
& ~63, ctx
);
274 buffer
= (const char *) buffer
+ (len
& ~63);
279 /* Move remaining bytes in internal buffer. */
282 size_t left_over
= ctx
->buflen
;
284 memcpy (&((char *) ctx
->buffer
)[left_over
], buffer
, len
);
288 sha1_process_block (ctx
->buffer
, 64, ctx
);
290 /* The regions in the following copy operation cannot overlap,
291 because left_over ≤ 64. */
292 memcpy (ctx
->buffer
, &ctx
->buffer
[16], left_over
);
294 ctx
->buflen
= left_over
;
298 /* --- Code below is the primary difference between md5.c and sha1.c --- */
300 /* SHA1 round constants */
301 #define K1 0x5a827999
302 #define K2 0x6ed9eba1
303 #define K3 0x8f1bbcdc
304 #define K4 0xca62c1d6
306 /* Round functions. Note that F2 is the same as F4. */
307 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
308 #define F2(B,C,D) (B ^ C ^ D)
309 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
310 #define F4(B,C,D) (B ^ C ^ D)
312 /* Process LEN bytes of BUFFER, accumulating context into CTX.
313 It is assumed that LEN % 64 == 0.
314 Most of this code comes from GnuPG's cipher/sha1.c. */
317 sha1_process_block (const void *buffer
, size_t len
, struct sha1_ctx
*ctx
)
319 const uint32_t *words
= buffer
;
320 size_t nwords
= len
/ sizeof (uint32_t);
321 const uint32_t *endp
= words
+ nwords
;
328 uint32_t lolen
= len
;
330 /* First increment the byte count. RFC 1321 specifies the possible
331 length of the file up to 2^64 bits. Here we only compute the
332 number of bytes. Do a double word increment. */
333 ctx
->total
[0] += lolen
;
334 ctx
->total
[1] += (len
>> 31 >> 1) + (ctx
->total
[0] < lolen
);
336 #define rol(x, n) (((x) << (n)) | ((uint32_t) (x) >> (32 - (n))))
338 #define M(I) ( tm = x[I&0x0f] ^ x[(I-14)&0x0f] \
339 ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
340 , (x[I&0x0f] = rol(tm, 1)) )
342 #define R(A,B,C,D,E,F,K,M) do { E += rol( A, 5 ) \
353 for (t
= 0; t
< 16; t
++)
355 x
[t
] = SWAP (*words
);
359 R( a
, b
, c
, d
, e
, F1
, K1
, x
[ 0] );
360 R( e
, a
, b
, c
, d
, F1
, K1
, x
[ 1] );
361 R( d
, e
, a
, b
, c
, F1
, K1
, x
[ 2] );
362 R( c
, d
, e
, a
, b
, F1
, K1
, x
[ 3] );
363 R( b
, c
, d
, e
, a
, F1
, K1
, x
[ 4] );
364 R( a
, b
, c
, d
, e
, F1
, K1
, x
[ 5] );
365 R( e
, a
, b
, c
, d
, F1
, K1
, x
[ 6] );
366 R( d
, e
, a
, b
, c
, F1
, K1
, x
[ 7] );
367 R( c
, d
, e
, a
, b
, F1
, K1
, x
[ 8] );
368 R( b
, c
, d
, e
, a
, F1
, K1
, x
[ 9] );
369 R( a
, b
, c
, d
, e
, F1
, K1
, x
[10] );
370 R( e
, a
, b
, c
, d
, F1
, K1
, x
[11] );
371 R( d
, e
, a
, b
, c
, F1
, K1
, x
[12] );
372 R( c
, d
, e
, a
, b
, F1
, K1
, x
[13] );
373 R( b
, c
, d
, e
, a
, F1
, K1
, x
[14] );
374 R( a
, b
, c
, d
, e
, F1
, K1
, x
[15] );
375 R( e
, a
, b
, c
, d
, F1
, K1
, M(16) );
376 R( d
, e
, a
, b
, c
, F1
, K1
, M(17) );
377 R( c
, d
, e
, a
, b
, F1
, K1
, M(18) );
378 R( b
, c
, d
, e
, a
, F1
, K1
, M(19) );
379 R( a
, b
, c
, d
, e
, F2
, K2
, M(20) );
380 R( e
, a
, b
, c
, d
, F2
, K2
, M(21) );
381 R( d
, e
, a
, b
, c
, F2
, K2
, M(22) );
382 R( c
, d
, e
, a
, b
, F2
, K2
, M(23) );
383 R( b
, c
, d
, e
, a
, F2
, K2
, M(24) );
384 R( a
, b
, c
, d
, e
, F2
, K2
, M(25) );
385 R( e
, a
, b
, c
, d
, F2
, K2
, M(26) );
386 R( d
, e
, a
, b
, c
, F2
, K2
, M(27) );
387 R( c
, d
, e
, a
, b
, F2
, K2
, M(28) );
388 R( b
, c
, d
, e
, a
, F2
, K2
, M(29) );
389 R( a
, b
, c
, d
, e
, F2
, K2
, M(30) );
390 R( e
, a
, b
, c
, d
, F2
, K2
, M(31) );
391 R( d
, e
, a
, b
, c
, F2
, K2
, M(32) );
392 R( c
, d
, e
, a
, b
, F2
, K2
, M(33) );
393 R( b
, c
, d
, e
, a
, F2
, K2
, M(34) );
394 R( a
, b
, c
, d
, e
, F2
, K2
, M(35) );
395 R( e
, a
, b
, c
, d
, F2
, K2
, M(36) );
396 R( d
, e
, a
, b
, c
, F2
, K2
, M(37) );
397 R( c
, d
, e
, a
, b
, F2
, K2
, M(38) );
398 R( b
, c
, d
, e
, a
, F2
, K2
, M(39) );
399 R( a
, b
, c
, d
, e
, F3
, K3
, M(40) );
400 R( e
, a
, b
, c
, d
, F3
, K3
, M(41) );
401 R( d
, e
, a
, b
, c
, F3
, K3
, M(42) );
402 R( c
, d
, e
, a
, b
, F3
, K3
, M(43) );
403 R( b
, c
, d
, e
, a
, F3
, K3
, M(44) );
404 R( a
, b
, c
, d
, e
, F3
, K3
, M(45) );
405 R( e
, a
, b
, c
, d
, F3
, K3
, M(46) );
406 R( d
, e
, a
, b
, c
, F3
, K3
, M(47) );
407 R( c
, d
, e
, a
, b
, F3
, K3
, M(48) );
408 R( b
, c
, d
, e
, a
, F3
, K3
, M(49) );
409 R( a
, b
, c
, d
, e
, F3
, K3
, M(50) );
410 R( e
, a
, b
, c
, d
, F3
, K3
, M(51) );
411 R( d
, e
, a
, b
, c
, F3
, K3
, M(52) );
412 R( c
, d
, e
, a
, b
, F3
, K3
, M(53) );
413 R( b
, c
, d
, e
, a
, F3
, K3
, M(54) );
414 R( a
, b
, c
, d
, e
, F3
, K3
, M(55) );
415 R( e
, a
, b
, c
, d
, F3
, K3
, M(56) );
416 R( d
, e
, a
, b
, c
, F3
, K3
, M(57) );
417 R( c
, d
, e
, a
, b
, F3
, K3
, M(58) );
418 R( b
, c
, d
, e
, a
, F3
, K3
, M(59) );
419 R( a
, b
, c
, d
, e
, F4
, K4
, M(60) );
420 R( e
, a
, b
, c
, d
, F4
, K4
, M(61) );
421 R( d
, e
, a
, b
, c
, F4
, K4
, M(62) );
422 R( c
, d
, e
, a
, b
, F4
, K4
, M(63) );
423 R( b
, c
, d
, e
, a
, F4
, K4
, M(64) );
424 R( a
, b
, c
, d
, e
, F4
, K4
, M(65) );
425 R( e
, a
, b
, c
, d
, F4
, K4
, M(66) );
426 R( d
, e
, a
, b
, c
, F4
, K4
, M(67) );
427 R( c
, d
, e
, a
, b
, F4
, K4
, M(68) );
428 R( b
, c
, d
, e
, a
, F4
, K4
, M(69) );
429 R( a
, b
, c
, d
, e
, F4
, K4
, M(70) );
430 R( e
, a
, b
, c
, d
, F4
, K4
, M(71) );
431 R( d
, e
, a
, b
, c
, F4
, K4
, M(72) );
432 R( c
, d
, e
, a
, b
, F4
, K4
, M(73) );
433 R( b
, c
, d
, e
, a
, F4
, K4
, M(74) );
434 R( a
, b
, c
, d
, e
, F4
, K4
, M(75) );
435 R( e
, a
, b
, c
, d
, F4
, K4
, M(76) );
436 R( d
, e
, a
, b
, c
, F4
, K4
, M(77) );
437 R( c
, d
, e
, a
, b
, F4
, K4
, M(78) );
438 R( b
, c
, d
, e
, a
, F4
, K4
, M(79) );