lib/sha256.c

   1 /* sha256.c - Functions to compute SHA256 and SHA224 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-2.
   3
   4    Copyright (C) 2005-2006, 2008-2024 Free Software Foundation, Inc.
   5
   6    This file is free software: you can redistribute it and/or modify
   7    it under the terms of the GNU Lesser General Public License as
   8    published by the Free Software Foundation; either version 2.1 of the
   9    License, or (at your option) any later version.
  10
  11    This file is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public License
  17    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
  18
  19 /* Written by David Madore, considerably copypasting from
  20    Scott G. Miller's sha1.c
  21 */
  22
  23 #include <config.h>
  24
  25 /* Specification.  */
  26 #if HAVE_OPENSSL_SHA256
  27 # define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
  28 #endif
  29 #include "sha256.h"
  30
  31 #include <stdint.h>
  32 #include <string.h>
  33
  34 #include <byteswap.h>
  35 #ifdef WORDS_BIGENDIAN
  36 # define SWAP(n) (n)
  37 #else
  38 # define SWAP(n) bswap_32 (n)
  39 #endif
  40
  41 #if ! HAVE_OPENSSL_SHA256
  42
  43 /* This array contains the bytes used to pad the buffer to the next
  44    64-byte boundary.  */
  45 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  46
  47
  48 /*
  49   Takes a pointer to a 256 bit block of data (eight 32 bit ints) and
  50   initializes it to the start constants of the SHA256 algorithm.  This
  51   must be called before using hash in the call to sha256_hash
  52 */
  53 void
  54 sha256_init_ctx (struct sha256_ctx *ctx)
  55 {
  56   ctx->state[0] = 0x6a09e667UL;
  57   ctx->state[1] = 0xbb67ae85UL;
  58   ctx->state[2] = 0x3c6ef372UL;
  59   ctx->state[3] = 0xa54ff53aUL;
  60   ctx->state[4] = 0x510e527fUL;
  61   ctx->state[5] = 0x9b05688cUL;
  62   ctx->state[6] = 0x1f83d9abUL;
  63   ctx->state[7] = 0x5be0cd19UL;
  64
  65   ctx->total[0] = ctx->total[1] = 0;
  66   ctx->buflen = 0;
  67 }
  68
  69 void
  70 sha224_init_ctx (struct sha256_ctx *ctx)
  71 {
  72   ctx->state[0] = 0xc1059ed8UL;
  73   ctx->state[1] = 0x367cd507UL;
  74   ctx->state[2] = 0x3070dd17UL;
  75   ctx->state[3] = 0xf70e5939UL;
  76   ctx->state[4] = 0xffc00b31UL;
  77   ctx->state[5] = 0x68581511UL;
  78   ctx->state[6] = 0x64f98fa7UL;
  79   ctx->state[7] = 0xbefa4fa4UL;
  80
  81   ctx->total[0] = ctx->total[1] = 0;
  82   ctx->buflen = 0;
  83 }
  84
  85 /* Copy the value from v into the memory location pointed to by *CP,
  86    If your architecture allows unaligned access, this is equivalent to
  87    * (__typeof__ (v) *) cp = v  */
  88 static void
  89 set_uint32 (char *cp, uint32_t v)
  90 {
  91   memcpy (cp, &v, sizeof v);
  92 }
  93
  94 /* Put result from CTX in first 32 bytes following RESBUF.
  95    The result must be in little endian byte order.  */
  96 void *
  97 sha256_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
  98 {
  99   int i;
 100   char *r = resbuf;
 101
 102   for (i = 0; i < 8; i++)
 103     set_uint32 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
 104
 105   return resbuf;
 106 }
 107
 108 void *
 109 sha224_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
 110 {
 111   int i;
 112   char *r = resbuf;
 113
 114   for (i = 0; i < 7; i++)
 115     set_uint32 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
 116
 117   return resbuf;
 118 }
 119
 120 /* Process the remaining bytes in the internal buffer and the usual
 121    prolog according to the standard and write the result to RESBUF.  */
 122 static void
 123 sha256_conclude_ctx (struct sha256_ctx *ctx)
 124 {
 125   /* Take yet unprocessed bytes into account.  */
 126   size_t bytes = ctx->buflen;
 127   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
 128
 129   /* Now count remaining bytes.  */
 130   ctx->total[0] += bytes;
 131   if (ctx->total[0] < bytes)
 132     ++ctx->total[1];
 133
 134   /* Put the 64-bit file length in *bits* at the end of the buffer.
 135      Use set_uint32 rather than a simple assignment, to avoid risk of
 136      unaligned access.  */
 137   set_uint32 ((char *) &ctx->buffer[size - 2],
 138               SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29)));
 139   set_uint32 ((char *) &ctx->buffer[size - 1],
 140               SWAP (ctx->total[0] << 3));
 141
 142   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 143
 144   /* Process last bytes.  */
 145   sha256_process_block (ctx->buffer, size * 4, ctx);
 146 }
 147
 148 void *
 149 sha256_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
 150 {
 151   sha256_conclude_ctx (ctx);
 152   return sha256_read_ctx (ctx, resbuf);
 153 }
 154
 155 void *
 156 sha224_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
 157 {
 158   sha256_conclude_ctx (ctx);
 159   return sha224_read_ctx (ctx, resbuf);
 160 }
 161
 162 /* Compute SHA256 message digest for LEN bytes beginning at BUFFER.  The
 163    result is always in little endian byte order, so that a byte-wise
 164    output yields to the wanted ASCII representation of the message
 165    digest.  */
 166 void *
 167 sha256_buffer (const char *buffer, size_t len, void *resblock)
 168 {
 169   struct sha256_ctx ctx;
 170
 171   /* Initialize the computation context.  */
 172   sha256_init_ctx (&ctx);
 173
 174   /* Process whole buffer but last len % 64 bytes.  */
 175   sha256_process_bytes (buffer, len, &ctx);
 176
 177   /* Put result in desired memory area.  */
 178   return sha256_finish_ctx (&ctx, resblock);
 179 }
 180
 181 void *
 182 sha224_buffer (const char *buffer, size_t len, void *resblock)
 183 {
 184   struct sha256_ctx ctx;
 185
 186   /* Initialize the computation context.  */
 187   sha224_init_ctx (&ctx);
 188
 189   /* Process whole buffer but last len % 64 bytes.  */
 190   sha256_process_bytes (buffer, len, &ctx);
 191
 192   /* Put result in desired memory area.  */
 193   return sha224_finish_ctx (&ctx, resblock);
 194 }
 195
 196 void
 197 sha256_process_bytes (const void *buffer, size_t len, struct sha256_ctx *ctx)
 198 {
 199   /* When we already have some bits in our internal buffer concatenate
 200      both inputs first.  */
 201   if (ctx->buflen != 0)
 202     {
 203       size_t left_over = ctx->buflen;
 204       size_t add = 128 - left_over > len ? len : 128 - left_over;
 205
 206       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 207       ctx->buflen += add;
 208
 209       if (ctx->buflen > 64)
 210         {
 211           sha256_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 212
 213           ctx->buflen &= 63;
 214           /* The regions in the following copy operation cannot overlap,
 215              because ctx->buflen < 64 ≤ (left_over + add) & ~63.  */
 216           memcpy (ctx->buffer,
 217                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 218                   ctx->buflen);
 219         }
 220
 221       buffer = (const char *) buffer + add;
 222       len -= add;
 223     }
 224
 225   /* Process available complete blocks.  */
 226   if (len >= 64)
 227     {
 228 #if !(_STRING_ARCH_unaligned || _STRING_INLINE_unaligned)
 229 # define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
 230       if (UNALIGNED_P (buffer))
 231         while (len > 64)
 232           {
 233             sha256_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 234             buffer = (const char *) buffer + 64;
 235             len -= 64;
 236           }
 237       else
 238 #endif
 239         {
 240           sha256_process_block (buffer, len & ~63, ctx);
 241           buffer = (const char *) buffer + (len & ~63);
 242           len &= 63;
 243         }
 244     }
 245
 246   /* Move remaining bytes in internal buffer.  */
 247   if (len > 0)
 248     {
 249       size_t left_over = ctx->buflen;
 250
 251       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 252       left_over += len;
 253       if (left_over >= 64)
 254         {
 255           sha256_process_block (ctx->buffer, 64, ctx);
 256           left_over -= 64;
 257           /* The regions in the following copy operation cannot overlap,
 258              because left_over ≤ 64.  */
 259           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 260         }
 261       ctx->buflen = left_over;
 262     }
 263 }
 264
 265 /* --- Code below is the primary difference between sha1.c and sha256.c --- */
 266
 267 /* SHA256 round constants */
 268 #define K(I) sha256_round_constants[I]
 269 static const uint32_t sha256_round_constants[64] = {
 270   0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
 271   0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
 272   0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
 273   0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
 274   0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
 275   0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
 276   0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
 277   0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
 278   0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
 279   0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
 280   0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
 281   0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
 282   0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
 283   0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
 284   0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
 285   0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL,
 286 };
 287
 288 /* Round functions.  */
 289 #define F2(A,B,C) ( ( A & B ) | ( C & ( A | B ) ) )
 290 #define F1(E,F,G) ( G ^ ( E & ( F ^ G ) ) )
 291
 292 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 293    It is assumed that LEN % 64 == 0.
 294    Most of this code comes from GnuPG's cipher/sha1.c.  */
 295
 296 void
 297 sha256_process_block (const void *buffer, size_t len, struct sha256_ctx *ctx)
 298 {
 299   const uint32_t *words = buffer;
 300   size_t nwords = len / sizeof (uint32_t);
 301   const uint32_t *endp = words + nwords;
 302   uint32_t x[16];
 303   uint32_t a = ctx->state[0];
 304   uint32_t b = ctx->state[1];
 305   uint32_t c = ctx->state[2];
 306   uint32_t d = ctx->state[3];
 307   uint32_t e = ctx->state[4];
 308   uint32_t f = ctx->state[5];
 309   uint32_t g = ctx->state[6];
 310   uint32_t h = ctx->state[7];
 311   uint32_t lolen = len;
 312
 313   /* First increment the byte count.  FIPS PUB 180-2 specifies the possible
 314      length of the file up to 2^64 bits.  Here we only compute the
 315      number of bytes.  Do a double word increment.  */
 316   ctx->total[0] += lolen;
 317   ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen);
 318
 319 #define rol(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
 320 #define S0(x) (rol(x,25)^rol(x,14)^(x>>3))
 321 #define S1(x) (rol(x,15)^rol(x,13)^(x>>10))
 322 #define SS0(x) (rol(x,30)^rol(x,19)^rol(x,10))
 323 #define SS1(x) (rol(x,26)^rol(x,21)^rol(x,7))
 324
 325 #define M(I) ( tm =   S1(x[(I-2)&0x0f]) + x[(I-7)&0x0f] \
 326                     + S0(x[(I-15)&0x0f]) + x[I&0x0f]    \
 327                , x[I&0x0f] = tm )
 328
 329 #define R(A,B,C,D,E,F,G,H,K,M)  do { t0 = SS0(A) + F2(A,B,C); \
 330                                      t1 = H + SS1(E)  \
 331                                       + F1(E,F,G)     \
 332                                       + K             \
 333                                       + M;            \
 334                                      D += t1;  H = t0 + t1; \
 335                                } while(0)
 336
 337   while (words < endp)
 338     {
 339       uint32_t tm;
 340       uint32_t t0, t1;
 341       int t;
 342       /* FIXME: see sha1.c for a better implementation.  */
 343       for (t = 0; t < 16; t++)
 344         {
 345           x[t] = SWAP (*words);
 346           words++;
 347         }
 348
 349       R( a, b, c, d, e, f, g, h, K( 0), x[ 0] );
 350       R( h, a, b, c, d, e, f, g, K( 1), x[ 1] );
 351       R( g, h, a, b, c, d, e, f, K( 2), x[ 2] );
 352       R( f, g, h, a, b, c, d, e, K( 3), x[ 3] );
 353       R( e, f, g, h, a, b, c, d, K( 4), x[ 4] );
 354       R( d, e, f, g, h, a, b, c, K( 5), x[ 5] );
 355       R( c, d, e, f, g, h, a, b, K( 6), x[ 6] );
 356       R( b, c, d, e, f, g, h, a, K( 7), x[ 7] );
 357       R( a, b, c, d, e, f, g, h, K( 8), x[ 8] );
 358       R( h, a, b, c, d, e, f, g, K( 9), x[ 9] );
 359       R( g, h, a, b, c, d, e, f, K(10), x[10] );
 360       R( f, g, h, a, b, c, d, e, K(11), x[11] );
 361       R( e, f, g, h, a, b, c, d, K(12), x[12] );
 362       R( d, e, f, g, h, a, b, c, K(13), x[13] );
 363       R( c, d, e, f, g, h, a, b, K(14), x[14] );
 364       R( b, c, d, e, f, g, h, a, K(15), x[15] );
 365       R( a, b, c, d, e, f, g, h, K(16), M(16) );
 366       R( h, a, b, c, d, e, f, g, K(17), M(17) );
 367       R( g, h, a, b, c, d, e, f, K(18), M(18) );
 368       R( f, g, h, a, b, c, d, e, K(19), M(19) );
 369       R( e, f, g, h, a, b, c, d, K(20), M(20) );
 370       R( d, e, f, g, h, a, b, c, K(21), M(21) );
 371       R( c, d, e, f, g, h, a, b, K(22), M(22) );
 372       R( b, c, d, e, f, g, h, a, K(23), M(23) );
 373       R( a, b, c, d, e, f, g, h, K(24), M(24) );
 374       R( h, a, b, c, d, e, f, g, K(25), M(25) );
 375       R( g, h, a, b, c, d, e, f, K(26), M(26) );
 376       R( f, g, h, a, b, c, d, e, K(27), M(27) );
 377       R( e, f, g, h, a, b, c, d, K(28), M(28) );
 378       R( d, e, f, g, h, a, b, c, K(29), M(29) );
 379       R( c, d, e, f, g, h, a, b, K(30), M(30) );
 380       R( b, c, d, e, f, g, h, a, K(31), M(31) );
 381       R( a, b, c, d, e, f, g, h, K(32), M(32) );
 382       R( h, a, b, c, d, e, f, g, K(33), M(33) );
 383       R( g, h, a, b, c, d, e, f, K(34), M(34) );
 384       R( f, g, h, a, b, c, d, e, K(35), M(35) );
 385       R( e, f, g, h, a, b, c, d, K(36), M(36) );
 386       R( d, e, f, g, h, a, b, c, K(37), M(37) );
 387       R( c, d, e, f, g, h, a, b, K(38), M(38) );
 388       R( b, c, d, e, f, g, h, a, K(39), M(39) );
 389       R( a, b, c, d, e, f, g, h, K(40), M(40) );
 390       R( h, a, b, c, d, e, f, g, K(41), M(41) );
 391       R( g, h, a, b, c, d, e, f, K(42), M(42) );
 392       R( f, g, h, a, b, c, d, e, K(43), M(43) );
 393       R( e, f, g, h, a, b, c, d, K(44), M(44) );
 394       R( d, e, f, g, h, a, b, c, K(45), M(45) );
 395       R( c, d, e, f, g, h, a, b, K(46), M(46) );
 396       R( b, c, d, e, f, g, h, a, K(47), M(47) );
 397       R( a, b, c, d, e, f, g, h, K(48), M(48) );
 398       R( h, a, b, c, d, e, f, g, K(49), M(49) );
 399       R( g, h, a, b, c, d, e, f, K(50), M(50) );
 400       R( f, g, h, a, b, c, d, e, K(51), M(51) );
 401       R( e, f, g, h, a, b, c, d, K(52), M(52) );
 402       R( d, e, f, g, h, a, b, c, K(53), M(53) );
 403       R( c, d, e, f, g, h, a, b, K(54), M(54) );
 404       R( b, c, d, e, f, g, h, a, K(55), M(55) );
 405       R( a, b, c, d, e, f, g, h, K(56), M(56) );
 406       R( h, a, b, c, d, e, f, g, K(57), M(57) );
 407       R( g, h, a, b, c, d, e, f, K(58), M(58) );
 408       R( f, g, h, a, b, c, d, e, K(59), M(59) );
 409       R( e, f, g, h, a, b, c, d, K(60), M(60) );
 410       R( d, e, f, g, h, a, b, c, K(61), M(61) );
 411       R( c, d, e, f, g, h, a, b, K(62), M(62) );
 412       R( b, c, d, e, f, g, h, a, K(63), M(63) );
 413
 414       a = ctx->state[0] += a;
 415       b = ctx->state[1] += b;
 416       c = ctx->state[2] += c;
 417       d = ctx->state[3] += d;
 418       e = ctx->state[4] += e;
 419       f = ctx->state[5] += f;
 420       g = ctx->state[6] += g;
 421       h = ctx->state[7] += h;
 422     }
 423 }
 424
 425 #endif
 426
 427 /*
 428  * Hey Emacs!
 429  * Local Variables:
 430  * coding: utf-8
 431  * End:
 432  */