tools/hmac-sha1.c

   1 /* sha1.c - Functions to compute SHA1 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-1.
   3
   4    Copyright (C) 2000, 2001, 2003, 2004, 2005, 2006 Free Software
   5    Foundation, Inc.
   6
   7    This program is free software; you can redistribute it and/or modify it
   8    under the terms of the GNU General Public License as published by the
   9    Free Software Foundation; either version 2, or (at your option) any
  10    later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software Foundation,
  19    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  20
  21 /* Written by Scott G. Miller
  22    Credits:
  23       Robert Klep <robert@ilse.nl>  -- Expansion function fix
  24 */
  25
  26 #include "hmac-sha1.h"
  27
  28 #include <stddef.h>
  29 #include <string.h>
  30
  31
  32 #ifdef WORDS_BIGENDIAN
  33 # define SWAP(n) (n)
  34 #else
  35 # define SWAP(n) \
  36     (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
  37 #endif
  38
  39 #define BLOCKSIZE 4096
  40 #if BLOCKSIZE % 64 != 0
  41 # error "invalid BLOCKSIZE"
  42 #endif
  43
  44 /* This array contains the bytes used to pad the buffer to the next
  45    64-byte boundary.  (RFC 1321, 3.1: Step 1)  */
  46 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  47
  48
  49 /* Take a pointer to a 160 bit block of data (five 32 bit ints) and
  50    initialize it to the start constants of the SHA1 algorithm.  This
  51    must be called before using hash in the call to sha1_hash.  */
  52 void
  53 sha1_init_ctx (struct sha1_ctx *ctx)
  54 {
  55   ctx->A = 0x67452301;
  56   ctx->B = 0xefcdab89;
  57   ctx->C = 0x98badcfe;
  58   ctx->D = 0x10325476;
  59   ctx->E = 0xc3d2e1f0;
  60
  61   ctx->total[0] = ctx->total[1] = 0;
  62   ctx->buflen = 0;
  63 }
  64
  65 /* Put result from CTX in first 20 bytes following RESBUF.  The result
  66    must be in little endian byte order.
  67
  68    IMPORTANT: On some systems it is required that RESBUF is correctly
  69    aligned for a 32-bit value.  */
  70 void *
  71 sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
  72 {
  73   ((uint32_t *) resbuf)[0] = SWAP (ctx->A);
  74   ((uint32_t *) resbuf)[1] = SWAP (ctx->B);
  75   ((uint32_t *) resbuf)[2] = SWAP (ctx->C);
  76   ((uint32_t *) resbuf)[3] = SWAP (ctx->D);
  77   ((uint32_t *) resbuf)[4] = SWAP (ctx->E);
  78
  79   return resbuf;
  80 }
  81
  82 /* Process the remaining bytes in the internal buffer and the usual
  83    prolog according to the standard and write the result to RESBUF.
  84
  85    IMPORTANT: On some systems it is required that RESBUF is correctly
  86    aligned for a 32-bit value.  */
  87 void *
  88 sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
  89 {
  90   /* Take yet unprocessed bytes into account.  */
  91   uint32_t bytes = ctx->buflen;
  92   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
  93
  94   /* Now count remaining bytes.  */
  95   ctx->total[0] += bytes;
  96   if (ctx->total[0] < bytes)
  97     ++ctx->total[1];
  98
  99   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 100   ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29));
 101   ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
 102
 103   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 104
 105   /* Process last bytes.  */
 106   sha1_process_block (ctx->buffer, size * 4, ctx);
 107
 108   return sha1_read_ctx (ctx, resbuf);
 109 }
 110
 111 /* Compute SHA1 message digest for bytes read from STREAM.  The
 112    resulting message digest number will be written into the 16 bytes
 113    beginning at RESBLOCK.  */
 114 int
 115 sha1_stream (FILE *stream, void *resblock)
 116 {
 117   struct sha1_ctx ctx;
 118   char buffer[BLOCKSIZE + 72];
 119   size_t sum;
 120
 121   /* Initialize the computation context.  */
 122   sha1_init_ctx (&ctx);
 123
 124   /* Iterate over full file contents.  */
 125   while (1)
 126     {
 127       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 128          computation function processes the whole buffer so that with the
 129          next round of the loop another block can be read.  */
 130       size_t n;
 131       sum = 0;
 132
 133       /* Read block.  Take care for partial reads.  */
 134       while (1)
 135         {
 136           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 137
 138           sum += n;
 139
 140           if (sum == BLOCKSIZE)
 141             break;
 142
 143           if (n == 0)
 144             {
 145               /* Check for the error flag IFF N == 0, so that we don't
 146                  exit the loop after a partial read due to e.g., EAGAIN
 147                  or EWOULDBLOCK.  */
 148               if (ferror (stream))
 149                 return 1;
 150               goto process_partial_block;
 151             }
 152
 153           /* We've read at least one byte, so ignore errors.  But always
 154              check for EOF, since feof may be true even though N > 0.
 155              Otherwise, we could end up calling fread after EOF.  */
 156           if (feof (stream))
 157             goto process_partial_block;
 158         }
 159
 160       /* Process buffer with BLOCKSIZE bytes.  Note that
 161                         BLOCKSIZE % 64 == 0
 162        */
 163       sha1_process_block (buffer, BLOCKSIZE, &ctx);
 164     }
 165
 166  process_partial_block:;
 167
 168   /* Process any remaining bytes.  */
 169   if (sum > 0)
 170     sha1_process_bytes (buffer, sum, &ctx);
 171
 172   /* Construct result in desired memory.  */
 173   sha1_finish_ctx (&ctx, resblock);
 174   return 0;
 175 }
 176
 177 /* Compute SHA1 message digest for LEN bytes beginning at BUFFER.  The
 178    result is always in little endian byte order, so that a byte-wise
 179    output yields to the wanted ASCII representation of the message
 180    digest.  */
 181 void *
 182 sha1_buffer (const char *buffer, size_t len, void *resblock)
 183 {
 184   struct sha1_ctx ctx;
 185
 186   /* Initialize the computation context.  */
 187   sha1_init_ctx (&ctx);
 188
 189   /* Process whole buffer but last len % 64 bytes.  */
 190   sha1_process_bytes (buffer, len, &ctx);
 191
 192   /* Put result in desired memory area.  */
 193   return sha1_finish_ctx (&ctx, resblock);
 194 }
 195
 196 void
 197 sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
 198 {
 199   /* When we already have some bits in our internal buffer concatenate
 200      both inputs first.  */
 201   if (ctx->buflen != 0)
 202     {
 203       size_t left_over = ctx->buflen;
 204       size_t add = 128 - left_over > len ? len : 128 - left_over;
 205
 206       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 207       ctx->buflen += add;
 208
 209       if (ctx->buflen > 64)
 210         {
 211           sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 212
 213           ctx->buflen &= 63;
 214           /* The regions in the following copy operation cannot overlap.  */
 215           memcpy (ctx->buffer,
 216                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 217                   ctx->buflen);
 218         }
 219
 220       buffer = (const char *) buffer + add;
 221       len -= add;
 222     }
 223
 224   /* Process available complete blocks.  */
 225   if (len >= 64)
 226     {
 227 #if !_STRING_ARCH_unaligned
 228 # define alignof(type) offsetof (struct { char c; type x; }, x)
 229 # define UNALIGNED_P(p) (((size_t) p) % alignof (uint32_t) != 0)
 230       if (UNALIGNED_P (buffer))
 231         while (len > 64)
 232           {
 233             sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 234             buffer = (const char *) buffer + 64;
 235             len -= 64;
 236           }
 237       else
 238 #endif
 239         {
 240           sha1_process_block (buffer, len & ~63, ctx);
 241           buffer = (const char *) buffer + (len & ~63);
 242           len &= 63;
 243         }
 244     }
 245
 246   /* Move remaining bytes in internal buffer.  */
 247   if (len > 0)
 248     {
 249       size_t left_over = ctx->buflen;
 250
 251       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 252       left_over += len;
 253       if (left_over >= 64)
 254         {
 255           sha1_process_block (ctx->buffer, 64, ctx);
 256           left_over -= 64;
 257           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 258         }
 259       ctx->buflen = left_over;
 260     }
 261 }
 262
 263 /* --- Code below is the primary difference between md5.c and sha1.c --- */
 264
 265 /* SHA1 round constants */
 266 #define K1 0x5a827999
 267 #define K2 0x6ed9eba1
 268 #define K3 0x8f1bbcdc
 269 #define K4 0xca62c1d6
 270
 271 /* Round functions.  Note that F2 is the same as F4.  */
 272 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
 273 #define F2(B,C,D) (B ^ C ^ D)
 274 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
 275 #define F4(B,C,D) (B ^ C ^ D)
 276
 277 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 278    It is assumed that LEN % 64 == 0.
 279    Most of this code comes from GnuPG's cipher/sha1.c.  */
 280
 281 void
 282 sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
 283 {
 284   const uint32_t *words = buffer;
 285   size_t nwords = len / sizeof (uint32_t);
 286   const uint32_t *endp = words + nwords;
 287   uint32_t x[16];
 288   uint32_t a = ctx->A;
 289   uint32_t b = ctx->B;
 290   uint32_t c = ctx->C;
 291   uint32_t d = ctx->D;
 292   uint32_t e = ctx->E;
 293
 294   /* First increment the byte count.  RFC 1321 specifies the possible
 295      length of the file up to 2^64 bits.  Here we only compute the
 296      number of bytes.  Do a double word increment.  */
 297   ctx->total[0] += len;
 298   if (ctx->total[0] < len)
 299     ++ctx->total[1];
 300
 301 #define rol(x, n) (((x) << (n)) | ((uint32_t) (x) >> (32 - (n))))
 302
 303 #define M(I) ( tm =   x[I&0x0f] ^ x[(I-14)&0x0f] \
 304                     ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
 305                , (x[I&0x0f] = rol(tm, 1)) )
 306
 307 #define R(A,B,C,D,E,F,K,M)  do { E += rol( A, 5 )     \
 308                                       + F( B, C, D )  \
 309                                       + K             \
 310                                       + M;            \
 311                                  B = rol( B, 30 );    \
 312                                } while(0)
 313
 314   while (words < endp)
 315     {
 316       uint32_t tm;
 317       int t;
 318       for (t = 0; t < 16; t++)
 319         {
 320           x[t] = SWAP (*words);
 321           words++;
 322         }
 323
 324       R( a, b, c, d, e, F1, K1, x[ 0] );
 325       R( e, a, b, c, d, F1, K1, x[ 1] );
 326       R( d, e, a, b, c, F1, K1, x[ 2] );
 327       R( c, d, e, a, b, F1, K1, x[ 3] );
 328       R( b, c, d, e, a, F1, K1, x[ 4] );
 329       R( a, b, c, d, e, F1, K1, x[ 5] );
 330       R( e, a, b, c, d, F1, K1, x[ 6] );
 331       R( d, e, a, b, c, F1, K1, x[ 7] );
 332       R( c, d, e, a, b, F1, K1, x[ 8] );
 333       R( b, c, d, e, a, F1, K1, x[ 9] );
 334       R( a, b, c, d, e, F1, K1, x[10] );
 335       R( e, a, b, c, d, F1, K1, x[11] );
 336       R( d, e, a, b, c, F1, K1, x[12] );
 337       R( c, d, e, a, b, F1, K1, x[13] );
 338       R( b, c, d, e, a, F1, K1, x[14] );
 339       R( a, b, c, d, e, F1, K1, x[15] );
 340       R( e, a, b, c, d, F1, K1, M(16) );
 341       R( d, e, a, b, c, F1, K1, M(17) );
 342       R( c, d, e, a, b, F1, K1, M(18) );
 343       R( b, c, d, e, a, F1, K1, M(19) );
 344       R( a, b, c, d, e, F2, K2, M(20) );
 345       R( e, a, b, c, d, F2, K2, M(21) );
 346       R( d, e, a, b, c, F2, K2, M(22) );
 347       R( c, d, e, a, b, F2, K2, M(23) );
 348       R( b, c, d, e, a, F2, K2, M(24) );
 349       R( a, b, c, d, e, F2, K2, M(25) );
 350       R( e, a, b, c, d, F2, K2, M(26) );
 351       R( d, e, a, b, c, F2, K2, M(27) );
 352       R( c, d, e, a, b, F2, K2, M(28) );
 353       R( b, c, d, e, a, F2, K2, M(29) );
 354       R( a, b, c, d, e, F2, K2, M(30) );
 355       R( e, a, b, c, d, F2, K2, M(31) );
 356       R( d, e, a, b, c, F2, K2, M(32) );
 357       R( c, d, e, a, b, F2, K2, M(33) );
 358       R( b, c, d, e, a, F2, K2, M(34) );
 359       R( a, b, c, d, e, F2, K2, M(35) );
 360       R( e, a, b, c, d, F2, K2, M(36) );
 361       R( d, e, a, b, c, F2, K2, M(37) );
 362       R( c, d, e, a, b, F2, K2, M(38) );
 363       R( b, c, d, e, a, F2, K2, M(39) );
 364       R( a, b, c, d, e, F3, K3, M(40) );
 365       R( e, a, b, c, d, F3, K3, M(41) );
 366       R( d, e, a, b, c, F3, K3, M(42) );
 367       R( c, d, e, a, b, F3, K3, M(43) );
 368       R( b, c, d, e, a, F3, K3, M(44) );
 369       R( a, b, c, d, e, F3, K3, M(45) );
 370       R( e, a, b, c, d, F3, K3, M(46) );
 371       R( d, e, a, b, c, F3, K3, M(47) );
 372       R( c, d, e, a, b, F3, K3, M(48) );
 373       R( b, c, d, e, a, F3, K3, M(49) );
 374       R( a, b, c, d, e, F3, K3, M(50) );
 375       R( e, a, b, c, d, F3, K3, M(51) );
 376       R( d, e, a, b, c, F3, K3, M(52) );
 377       R( c, d, e, a, b, F3, K3, M(53) );
 378       R( b, c, d, e, a, F3, K3, M(54) );
 379       R( a, b, c, d, e, F3, K3, M(55) );
 380       R( e, a, b, c, d, F3, K3, M(56) );
 381       R( d, e, a, b, c, F3, K3, M(57) );
 382       R( c, d, e, a, b, F3, K3, M(58) );
 383       R( b, c, d, e, a, F3, K3, M(59) );
 384       R( a, b, c, d, e, F4, K4, M(60) );
 385       R( e, a, b, c, d, F4, K4, M(61) );
 386       R( d, e, a, b, c, F4, K4, M(62) );
 387       R( c, d, e, a, b, F4, K4, M(63) );
 388       R( b, c, d, e, a, F4, K4, M(64) );
 389       R( a, b, c, d, e, F4, K4, M(65) );
 390       R( e, a, b, c, d, F4, K4, M(66) );
 391       R( d, e, a, b, c, F4, K4, M(67) );
 392       R( c, d, e, a, b, F4, K4, M(68) );
 393       R( b, c, d, e, a, F4, K4, M(69) );
 394       R( a, b, c, d, e, F4, K4, M(70) );
 395       R( e, a, b, c, d, F4, K4, M(71) );
 396       R( d, e, a, b, c, F4, K4, M(72) );
 397       R( c, d, e, a, b, F4, K4, M(73) );
 398       R( b, c, d, e, a, F4, K4, M(74) );
 399       R( a, b, c, d, e, F4, K4, M(75) );
 400       R( e, a, b, c, d, F4, K4, M(76) );
 401       R( d, e, a, b, c, F4, K4, M(77) );
 402       R( c, d, e, a, b, F4, K4, M(78) );
 403       R( b, c, d, e, a, F4, K4, M(79) );
 404
 405       a = ctx->A += a;
 406       b = ctx->B += b;
 407       c = ctx->C += c;
 408       d = ctx->D += d;
 409       e = ctx->E += e;
 410     }
 411 }
 412
 413 /* memxor.c -- perform binary exclusive OR operation of two memory blocks.
 414    Copyright (C) 2005, 2006 Free Software Foundation, Inc.
 415
 416    This program is free software; you can redistribute it and/or modify
 417    it under the terms of the GNU General Public License as published by
 418    the Free Software Foundation; either version 2, or (at your option)
 419    any later version.
 420
 421    This program is distributed in the hope that it will be useful,
 422    but WITHOUT ANY WARRANTY; without even the implied warranty of
 423    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 424    GNU General Public License for more details.
 425
 426    You should have received a copy of the GNU General Public License
 427    along with this program; if not, write to the Free Software Foundation,
 428    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
 429
 430 /* Written by Simon Josefsson.  The interface was inspired by memxor
 431    in Niels Möller's Nettle. */
 432
 433 void *
 434 memxor (void * dest, const void * src, size_t n)
 435 {
 436   char const *s = src;
 437   char *d = dest;
 438
 439   for (; n > 0; n--)
 440     *d++ ^= *s++;
 441
 442   return dest;
 443 }
 444
 445 /* hmac-sha1.c -- hashed message authentication codes
 446    Copyright (C) 2005, 2006 Free Software Foundation, Inc.
 447
 448    This program is free software; you can redistribute it and/or modify
 449    it under the terms of the GNU General Public License as published by
 450    the Free Software Foundation; either version 2, or (at your option)
 451    any later version.
 452
 453    This program is distributed in the hope that it will be useful,
 454    but WITHOUT ANY WARRANTY; without even the implied warranty of
 455    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 456    GNU General Public License for more details.
 457
 458    You should have received a copy of the GNU General Public License
 459    along with this program; if not, write to the Free Software Foundation,
 460    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
 461
 462 /* Written by Simon Josefsson.  */
 463
 464 #define IPAD 0x36
 465 #define OPAD 0x5c
 466
 467 int
 468 hmac_sha1 (const void *key, size_t keylen,
 469            const void *in, size_t inlen, void *resbuf)
 470 {
 471   struct sha1_ctx inner;
 472   struct sha1_ctx outer;
 473   char optkeybuf[20];
 474   char block[64];
 475   char innerhash[20];
 476
 477   /* Reduce the key's size, so that it becomes <= 64 bytes large.  */
 478
 479   if (keylen > 64)
 480     {
 481       struct sha1_ctx keyhash;
 482
 483       sha1_init_ctx (&keyhash);
 484       sha1_process_bytes (key, keylen, &keyhash);
 485       sha1_finish_ctx (&keyhash, optkeybuf);
 486
 487       key = optkeybuf;
 488       keylen = 20;
 489     }
 490
 491   /* Compute INNERHASH from KEY and IN.  */
 492
 493   sha1_init_ctx (&inner);
 494
 495   memset (block, IPAD, sizeof (block));
 496   memxor (block, key, keylen);
 497
 498   sha1_process_block (block, 64, &inner);
 499   sha1_process_bytes (in, inlen, &inner);
 500
 501   sha1_finish_ctx (&inner, innerhash);
 502
 503   /* Compute result from KEY and INNERHASH.  */
 504
 505   sha1_init_ctx (&outer);
 506
 507   memset (block, OPAD, sizeof (block));
 508   memxor (block, key, keylen);
 509
 510   sha1_process_block (block, 64, &outer);
 511   sha1_process_bytes (innerhash, 20, &outer);
 512
 513   sha1_finish_ctx (&outer, resbuf);
 514
 515   return 0;
 516 }