lib/sha1.c

   1 /* sha1.c - Functions to compute SHA1 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-1.
   3
   4    Copyright (C) 2000-2001, 2003-2006, 2008-2018 Free Software Foundation, Inc.
   5
   6    This program is free software; you can redistribute it and/or modify it
   7    under the terms of the GNU General Public License as published by the
   8    Free Software Foundation; either version 2, or (at your option) any
   9    later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, see <https://www.gnu.org/licenses/>.  */
  18
  19 /* Written by Scott G. Miller
  20    Credits:
  21       Robert Klep <robert@ilse.nl>  -- Expansion function fix
  22 */
  23
  24 #include <config.h>
  25
  26 #if HAVE_OPENSSL_SHA1
  27 # define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
  28 #endif
  29 #include "sha1.h"
  30
  31 #include <stdalign.h>
  32 #include <stdint.h>
  33 #include <stdlib.h>
  34 #include <string.h>
  35
  36 #if USE_UNLOCKED_IO
  37 # include "unlocked-io.h"
  38 #endif
  39
  40 #include <byteswap.h>
  41 #ifdef WORDS_BIGENDIAN
  42 # define SWAP(n) (n)
  43 #else
  44 # define SWAP(n) bswap_32 (n)
  45 #endif
  46
  47 #define BLOCKSIZE 32768
  48 #if BLOCKSIZE % 64 != 0
  49 # error "invalid BLOCKSIZE"
  50 #endif
  51
  52 #if ! HAVE_OPENSSL_SHA1
  53 /* This array contains the bytes used to pad the buffer to the next
  54    64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
  55 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  56
  57
  58 /* Take a pointer to a 160 bit block of data (five 32 bit ints) and
  59    initialize it to the start constants of the SHA1 algorithm.  This
  60    must be called before using hash in the call to sha1_hash.  */
  61 void
  62 sha1_init_ctx (struct sha1_ctx *ctx)
  63 {
  64   ctx->A = 0x67452301;
  65   ctx->B = 0xefcdab89;
  66   ctx->C = 0x98badcfe;
  67   ctx->D = 0x10325476;
  68   ctx->E = 0xc3d2e1f0;
  69
  70   ctx->total[0] = ctx->total[1] = 0;
  71   ctx->buflen = 0;
  72 }
  73
  74 /* Copy the 4 byte value from v into the memory location pointed to by *cp,
  75    If your architecture allows unaligned access this is equivalent to
  76    * (uint32_t *) cp = v  */
  77 static void
  78 set_uint32 (char *cp, uint32_t v)
  79 {
  80   memcpy (cp, &v, sizeof v);
  81 }
  82
  83 /* Put result from CTX in first 20 bytes following RESBUF.  The result
  84    must be in little endian byte order.  */
  85 void *
  86 sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
  87 {
  88   char *r = resbuf;
  89   set_uint32 (r + 0 * sizeof ctx->A, SWAP (ctx->A));
  90   set_uint32 (r + 1 * sizeof ctx->B, SWAP (ctx->B));
  91   set_uint32 (r + 2 * sizeof ctx->C, SWAP (ctx->C));
  92   set_uint32 (r + 3 * sizeof ctx->D, SWAP (ctx->D));
  93   set_uint32 (r + 4 * sizeof ctx->E, SWAP (ctx->E));
  94
  95   return resbuf;
  96 }
  97
  98 /* Process the remaining bytes in the internal buffer and the usual
  99    prolog according to the standard and write the result to RESBUF.  */
 100 void *
 101 sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
 102 {
 103   /* Take yet unprocessed bytes into account.  */
 104   uint32_t bytes = ctx->buflen;
 105   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
 106
 107   /* Now count remaining bytes.  */
 108   ctx->total[0] += bytes;
 109   if (ctx->total[0] < bytes)
 110     ++ctx->total[1];
 111
 112   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 113   ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 114   ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
 115
 116   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 117
 118   /* Process last bytes.  */
 119   sha1_process_block (ctx->buffer, size * 4, ctx);
 120
 121   return sha1_read_ctx (ctx, resbuf);
 122 }
 123 #endif
 124
 125 #ifdef GL_COMPILE_CRYPTO_STREAM
 126
 127 #include "af_alg.h"
 128
 129 /* Compute SHA1 message digest for bytes read from STREAM.  The
 130    resulting message digest number will be written into the 20 bytes
 131    beginning at RESBLOCK.  */
 132 int
 133 sha1_stream (FILE *stream, void *resblock)
 134 {
 135   switch (afalg_stream (stream, "sha1", resblock, SHA1_DIGEST_SIZE))
 136     {
 137     case 0: return 0;
 138     case -EIO: return 1;
 139     }
 140
 141   char *buffer = malloc (BLOCKSIZE + 72);
 142   if (!buffer)
 143     return 1;
 144
 145   struct sha1_ctx ctx;
 146   sha1_init_ctx (&ctx);
 147   size_t sum;
 148
 149   /* Iterate over full file contents.  */
 150   while (1)
 151     {
 152       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 153          computation function processes the whole buffer so that with the
 154          next round of the loop another block can be read.  */
 155       size_t n;
 156       sum = 0;
 157
 158       /* Read block.  Take care for partial reads.  */
 159       while (1)
 160         {
 161           /* Either process a partial fread() from this loop,
 162              or the fread() in afalg_stream may have gotten EOF.
 163              We need to avoid a subsequent fread() as EOF may
 164              not be sticky.  For details of such systems, see:
 165              https://sourceware.org/bugzilla/show_bug.cgi?id=1190  */
 166           if (feof (stream))
 167             goto process_partial_block;
 168
 169           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 170
 171           sum += n;
 172
 173           if (sum == BLOCKSIZE)
 174             break;
 175
 176           if (n == 0)
 177             {
 178               /* Check for the error flag IFF N == 0, so that we don't
 179                  exit the loop after a partial read due to e.g., EAGAIN
 180                  or EWOULDBLOCK.  */
 181               if (ferror (stream))
 182                 {
 183                   free (buffer);
 184                   return 1;
 185                 }
 186               goto process_partial_block;
 187             }
 188         }
 189
 190       /* Process buffer with BLOCKSIZE bytes.  Note that
 191                         BLOCKSIZE % 64 == 0
 192        */
 193       sha1_process_block (buffer, BLOCKSIZE, &ctx);
 194     }
 195
 196  process_partial_block:;
 197
 198   /* Process any remaining bytes.  */
 199   if (sum > 0)
 200     sha1_process_bytes (buffer, sum, &ctx);
 201
 202   /* Construct result in desired memory.  */
 203   sha1_finish_ctx (&ctx, resblock);
 204   free (buffer);
 205   return 0;
 206 }
 207 #endif
 208
 209 #if ! HAVE_OPENSSL_SHA1
 210 /* Compute SHA1 message digest for LEN bytes beginning at BUFFER.  The
 211    result is always in little endian byte order, so that a byte-wise
 212    output yields to the wanted ASCII representation of the message
 213    digest.  */
 214 void *
 215 sha1_buffer (const char *buffer, size_t len, void *resblock)
 216 {
 217   struct sha1_ctx ctx;
 218
 219   /* Initialize the computation context.  */
 220   sha1_init_ctx (&ctx);
 221
 222   /* Process whole buffer but last len % 64 bytes.  */
 223   sha1_process_bytes (buffer, len, &ctx);
 224
 225   /* Put result in desired memory area.  */
 226   return sha1_finish_ctx (&ctx, resblock);
 227 }
 228
 229 void
 230 sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
 231 {
 232   /* When we already have some bits in our internal buffer concatenate
 233      both inputs first.  */
 234   if (ctx->buflen != 0)
 235     {
 236       size_t left_over = ctx->buflen;
 237       size_t add = 128 - left_over > len ? len : 128 - left_over;
 238
 239       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 240       ctx->buflen += add;
 241
 242       if (ctx->buflen > 64)
 243         {
 244           sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 245
 246           ctx->buflen &= 63;
 247           /* The regions in the following copy operation cannot overlap,
 248              because ctx->buflen < 64 ≤ (left_over + add) & ~63.  */
 249           memcpy (ctx->buffer,
 250                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 251                   ctx->buflen);
 252         }
 253
 254       buffer = (const char *) buffer + add;
 255       len -= add;
 256     }
 257
 258   /* Process available complete blocks.  */
 259   if (len >= 64)
 260     {
 261 #if !(_STRING_ARCH_unaligned || _STRING_INLINE_unaligned)
 262 # define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
 263       if (UNALIGNED_P (buffer))
 264         while (len > 64)
 265           {
 266             sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 267             buffer = (const char *) buffer + 64;
 268             len -= 64;
 269           }
 270       else
 271 #endif
 272         {
 273           sha1_process_block (buffer, len & ~63, ctx);
 274           buffer = (const char *) buffer + (len & ~63);
 275           len &= 63;
 276         }
 277     }
 278
 279   /* Move remaining bytes in internal buffer.  */
 280   if (len > 0)
 281     {
 282       size_t left_over = ctx->buflen;
 283
 284       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 285       left_over += len;
 286       if (left_over >= 64)
 287         {
 288           sha1_process_block (ctx->buffer, 64, ctx);
 289           left_over -= 64;
 290           /* The regions in the following copy operation cannot overlap,
 291              because left_over ≤ 64.  */
 292           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 293         }
 294       ctx->buflen = left_over;
 295     }
 296 }
 297
 298 /* --- Code below is the primary difference between md5.c and sha1.c --- */
 299
 300 /* SHA1 round constants */
 301 #define K1 0x5a827999
 302 #define K2 0x6ed9eba1
 303 #define K3 0x8f1bbcdc
 304 #define K4 0xca62c1d6
 305
 306 /* Round functions.  Note that F2 is the same as F4.  */
 307 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
 308 #define F2(B,C,D) (B ^ C ^ D)
 309 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
 310 #define F4(B,C,D) (B ^ C ^ D)
 311
 312 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 313    It is assumed that LEN % 64 == 0.
 314    Most of this code comes from GnuPG's cipher/sha1.c.  */
 315
 316 void
 317 sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
 318 {
 319   const uint32_t *words = buffer;
 320   size_t nwords = len / sizeof (uint32_t);
 321   const uint32_t *endp = words + nwords;
 322   uint32_t x[16];
 323   uint32_t a = ctx->A;
 324   uint32_t b = ctx->B;
 325   uint32_t c = ctx->C;
 326   uint32_t d = ctx->D;
 327   uint32_t e = ctx->E;
 328   uint32_t lolen = len;
 329
 330   /* First increment the byte count.  RFC 1321 specifies the possible
 331      length of the file up to 2^64 bits.  Here we only compute the
 332      number of bytes.  Do a double word increment.  */
 333   ctx->total[0] += lolen;
 334   ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen);
 335
 336 #define rol(x, n) (((x) << (n)) | ((uint32_t) (x) >> (32 - (n))))
 337
 338 #define M(I) ( tm =   x[I&0x0f] ^ x[(I-14)&0x0f] \
 339                     ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
 340                , (x[I&0x0f] = rol(tm, 1)) )
 341
 342 #define R(A,B,C,D,E,F,K,M)  do { E += rol( A, 5 )     \
 343                                       + F( B, C, D )  \
 344                                       + K             \
 345                                       + M;            \
 346                                  B = rol( B, 30 );    \
 347                                } while(0)
 348
 349   while (words < endp)
 350     {
 351       uint32_t tm;
 352       int t;
 353       for (t = 0; t < 16; t++)
 354         {
 355           x[t] = SWAP (*words);
 356           words++;
 357         }
 358
 359       R( a, b, c, d, e, F1, K1, x[ 0] );
 360       R( e, a, b, c, d, F1, K1, x[ 1] );
 361       R( d, e, a, b, c, F1, K1, x[ 2] );
 362       R( c, d, e, a, b, F1, K1, x[ 3] );
 363       R( b, c, d, e, a, F1, K1, x[ 4] );
 364       R( a, b, c, d, e, F1, K1, x[ 5] );
 365       R( e, a, b, c, d, F1, K1, x[ 6] );
 366       R( d, e, a, b, c, F1, K1, x[ 7] );
 367       R( c, d, e, a, b, F1, K1, x[ 8] );
 368       R( b, c, d, e, a, F1, K1, x[ 9] );
 369       R( a, b, c, d, e, F1, K1, x[10] );
 370       R( e, a, b, c, d, F1, K1, x[11] );
 371       R( d, e, a, b, c, F1, K1, x[12] );
 372       R( c, d, e, a, b, F1, K1, x[13] );
 373       R( b, c, d, e, a, F1, K1, x[14] );
 374       R( a, b, c, d, e, F1, K1, x[15] );
 375       R( e, a, b, c, d, F1, K1, M(16) );
 376       R( d, e, a, b, c, F1, K1, M(17) );
 377       R( c, d, e, a, b, F1, K1, M(18) );
 378       R( b, c, d, e, a, F1, K1, M(19) );
 379       R( a, b, c, d, e, F2, K2, M(20) );
 380       R( e, a, b, c, d, F2, K2, M(21) );
 381       R( d, e, a, b, c, F2, K2, M(22) );
 382       R( c, d, e, a, b, F2, K2, M(23) );
 383       R( b, c, d, e, a, F2, K2, M(24) );
 384       R( a, b, c, d, e, F2, K2, M(25) );
 385       R( e, a, b, c, d, F2, K2, M(26) );
 386       R( d, e, a, b, c, F2, K2, M(27) );
 387       R( c, d, e, a, b, F2, K2, M(28) );
 388       R( b, c, d, e, a, F2, K2, M(29) );
 389       R( a, b, c, d, e, F2, K2, M(30) );
 390       R( e, a, b, c, d, F2, K2, M(31) );
 391       R( d, e, a, b, c, F2, K2, M(32) );
 392       R( c, d, e, a, b, F2, K2, M(33) );
 393       R( b, c, d, e, a, F2, K2, M(34) );
 394       R( a, b, c, d, e, F2, K2, M(35) );
 395       R( e, a, b, c, d, F2, K2, M(36) );
 396       R( d, e, a, b, c, F2, K2, M(37) );
 397       R( c, d, e, a, b, F2, K2, M(38) );
 398       R( b, c, d, e, a, F2, K2, M(39) );
 399       R( a, b, c, d, e, F3, K3, M(40) );
 400       R( e, a, b, c, d, F3, K3, M(41) );
 401       R( d, e, a, b, c, F3, K3, M(42) );
 402       R( c, d, e, a, b, F3, K3, M(43) );
 403       R( b, c, d, e, a, F3, K3, M(44) );
 404       R( a, b, c, d, e, F3, K3, M(45) );
 405       R( e, a, b, c, d, F3, K3, M(46) );
 406       R( d, e, a, b, c, F3, K3, M(47) );
 407       R( c, d, e, a, b, F3, K3, M(48) );
 408       R( b, c, d, e, a, F3, K3, M(49) );
 409       R( a, b, c, d, e, F3, K3, M(50) );
 410       R( e, a, b, c, d, F3, K3, M(51) );
 411       R( d, e, a, b, c, F3, K3, M(52) );
 412       R( c, d, e, a, b, F3, K3, M(53) );
 413       R( b, c, d, e, a, F3, K3, M(54) );
 414       R( a, b, c, d, e, F3, K3, M(55) );
 415       R( e, a, b, c, d, F3, K3, M(56) );
 416       R( d, e, a, b, c, F3, K3, M(57) );
 417       R( c, d, e, a, b, F3, K3, M(58) );
 418       R( b, c, d, e, a, F3, K3, M(59) );
 419       R( a, b, c, d, e, F4, K4, M(60) );
 420       R( e, a, b, c, d, F4, K4, M(61) );
 421       R( d, e, a, b, c, F4, K4, M(62) );
 422       R( c, d, e, a, b, F4, K4, M(63) );
 423       R( b, c, d, e, a, F4, K4, M(64) );
 424       R( a, b, c, d, e, F4, K4, M(65) );
 425       R( e, a, b, c, d, F4, K4, M(66) );
 426       R( d, e, a, b, c, F4, K4, M(67) );
 427       R( c, d, e, a, b, F4, K4, M(68) );
 428       R( b, c, d, e, a, F4, K4, M(69) );
 429       R( a, b, c, d, e, F4, K4, M(70) );
 430       R( e, a, b, c, d, F4, K4, M(71) );
 431       R( d, e, a, b, c, F4, K4, M(72) );
 432       R( c, d, e, a, b, F4, K4, M(73) );
 433       R( b, c, d, e, a, F4, K4, M(74) );
 434       R( a, b, c, d, e, F4, K4, M(75) );
 435       R( e, a, b, c, d, F4, K4, M(76) );
 436       R( d, e, a, b, c, F4, K4, M(77) );
 437       R( c, d, e, a, b, F4, K4, M(78) );
 438       R( b, c, d, e, a, F4, K4, M(79) );
 439
 440       a = ctx->A += a;
 441       b = ctx->B += b;
 442       c = ctx->C += c;
 443       d = ctx->D += d;
 444       e = ctx->E += e;
 445     }
 446 }
 447 #endif
 448
 449 /*
 450  * Hey Emacs!
 451  * Local Variables:
 452  * coding: utf-8
 453  * End:
 454  */