]> git.cryptolib.org Git - arm-crypto-lib.git/blob - sha1/sha1.c
fixing bugs reported by Christian Dernehl
[arm-crypto-lib.git] / sha1 / sha1.c
1 /* sha1.c */
2 /*
3     This file is part of the ARM-Crypto-Lib.
4     Copyright (C) 2006-2010  Daniel Otte (daniel.otte@rub.de)
5
6     This program is free software: you can redistribute it and/or modify
7     it under the terms of the GNU General Public License as published by
8     the Free Software Foundation, either version 3 of the License, or
9     (at your option) any later version.
10
11     This program is distributed in the hope that it will be useful,
12     but WITHOUT ANY WARRANTY; without even the implied warranty of
13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14     GNU General Public License for more details.
15
16     You should have received a copy of the GNU General Public License
17     along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 */
19 /**
20  * \file        sha1.c
21  * \author      Daniel Otte
22  * \date        2006-10-08
23  * \license GPLv3 or later
24  * \brief SHA-1 implementation.
25  *
26  */
27
28 #include <string.h> /* memcpy & co */
29 #include <stdint.h>
30 #include "sha1.h"
31
32 #ifdef DEBUG
33 #  undef DEBUG
34 #endif
35
36 #define LITTLE_ENDIAN
37
38 /********************************************************************************************************/
39
40 /**
41  * \brief initialises given SHA-1 context
42  *
43  */
44 void sha1_init(sha1_ctx_t *state){
45         state->h[0] = 0x67452301;
46         state->h[1] = 0xefcdab89;
47         state->h[2] = 0x98badcfe;
48         state->h[3] = 0x10325476;
49         state->h[4] = 0xc3d2e1f0;
50         state->length = 0;
51 }
52
53 /********************************************************************************************************/
54 /* some helping functions */
55 static const
56 uint32_t rotl32(uint32_t n, uint8_t bits){
57         return ((n<<bits) | (n>>(32-bits)));
58 }
59
60 /*
61 static const
62 uint32_t change_endian32(uint32_t x){
63         return (((x)<<24) | ((x)>>24) | (((x)& 0x0000ff00)<<8) | (((x)& 0x00ff0000)>>8));
64 }
65 */
66
67 /* three SHA-1 inner functions */
68 const
69 uint32_t ch(uint32_t x, uint32_t y, uint32_t z){
70         return ((x&y)^((~x)&z));
71 }
72
73 const
74 uint32_t maj(uint32_t x, uint32_t y, uint32_t z){
75         return ((x&y)^(x&z)^(y&z));
76 }
77
78 const
79 uint32_t parity(uint32_t x, uint32_t y, uint32_t z){
80         return ((x^y)^z);
81 }
82
83 /********************************************************************************************************/
84 /**
85  * \brief "add" a block to the hash
86  * This is the core function of the hash algorithm. To understand how it's working
87  * and what thoese variables do, take a look at FIPS-182. This is an "alternativ" implementation
88  */
89
90 #define MASK 0x0000000f
91
92 typedef const uint32_t (*pf_t)(uint32_t x, uint32_t y, uint32_t z);
93
94 static
95 void load_endian32_changed(uint8_t* dest, uint8_t* src, uint16_t words){
96 #if defined LITTLE_ENDIAN
97         while(words--){
98                 *dest++ = src[3];
99                 *dest++ = src[2];
100                 *dest++ = src[1];
101                 *dest++ = src[0];
102                 src += 4;
103         }
104 #elif defined BIG_ENDIAN
105       memcpy(dest, src, words * sizeof(uint32_t));
106 #endif
107 }
108
109
110 void sha1_nextBlock (sha1_ctx_t *state, const void* block){
111         uint32_t a[5];
112         uint32_t w[16];
113         uint32_t temp;
114         uint8_t t,s,fi, fib;
115         pf_t f[] = {ch,parity,maj,parity};
116         uint32_t k[4]={ 0x5a827999,
117                                         0x6ed9eba1,
118                                         0x8f1bbcdc,
119                                         0xca62c1d6};
120         /* load the w array (changing the endian and so) */
121         load_endian32_changed((uint8_t*)w, (uint8_t*)block, 16);
122
123 #if DEBUG
124         uint8_t dbgi;
125         for(dbgi=0; dbgi<16; ++dbgi){
126                 cli_putstr("\r\nBlock:");
127                 cli_hexdump(&dbgi, 1);
128                 cli_putc(':');
129                 cli_hexdump(&(w[dbgi]) ,4);
130         }
131 #endif
132
133         /* load the state */
134         memcpy(a, state->h, 5*sizeof(uint32_t));
135
136
137         /* the fun stuff */
138         for(fi=0,fib=0,t=0; t<=79; ++t){
139                 s = t & MASK;
140                 if(t>=16){
141                         w[s] = rotl32( w[(s+13)&MASK] ^ w[(s+8)&MASK] ^
142                                  w[(s+ 2)&MASK] ^ w[s] ,1);
143                 }
144
145                 uint32_t dtemp;
146                 temp = rotl32(a[0],5) + (dtemp=f[fi](a[1],a[2],a[3])) + a[4] + k[fi] + w[s];
147                 memmove(&(a[1]), &(a[0]), 4*sizeof(uint32_t)); /* e=d; d=c; c=b; b=a; */
148                 a[0] = temp;
149                 a[2] = rotl32(a[2],30); /* we might also do rotr32(c,2) */
150                 fib++;
151                 if(fib==20){
152                         fib=0;
153                         fi = (fi+1)%4;
154                 }
155         }
156
157         /* update the state */
158         for(t=0; t<5; ++t){
159                 state->h[t] += a[t];
160         }
161         state->length += 512;
162 }
163
164 /********************************************************************************************************/
165
166 void sha1_lastBlock(sha1_ctx_t *state, const void* block, uint16_t length){
167         uint8_t lb[SHA1_BLOCK_BYTES]; /* local block */
168         while(length>=SHA1_BLOCK_BITS){
169                 sha1_nextBlock(state, block);
170                 length -= SHA1_BLOCK_BITS;
171                 block = (uint8_t*)block + SHA1_BLOCK_BYTES;
172         }
173         state->length += length;
174         memset(lb, 0, SHA1_BLOCK_BYTES);
175         memcpy (lb, block, (length+7)>>3);
176
177         /* set the final one bit */
178         lb[length>>3] |= 0x80>>(length & 0x07);
179
180         if (length>512-64-1){ /* not enouth space for 64bit length value */
181                 sha1_nextBlock(state, lb);
182                 state->length -= 512;
183                 memset(lb, 0, SHA1_BLOCK_BYTES);
184         }
185         /* store the 64bit length value */
186 #if defined LITTLE_ENDIAN
187                 /* this is now rolled up */
188         uint8_t i;
189         for (i=0; i<8; ++i){
190                 lb[56+i] = ((uint8_t*)&(state->length))[7-i];
191         }
192 #elif defined BIG_ENDIAN
193         *((uint64_t*)&(lb[56])) = state->length;
194 #endif
195         sha1_nextBlock(state, lb);
196 }
197
198 /********************************************************************************************************/
199
200 void sha1_ctx2hash (void *dest, sha1_ctx_t *state){
201 #if defined LITTLE_ENDIAN
202         load_endian32_changed((uint8_t*)dest, (uint8_t*)state->h, 5);
203 #elif defined BIG_ENDIAN
204         if (dest != state->h) {
205                 memcpy(dest, state->h, SHA1_HASH_BITS/8);
206         }
207 #else
208 # error unsupported endian type!
209 #endif
210 }
211
212 /********************************************************************************************************/
213 /**
214  *
215  *
216  */
217 void sha1 (void *dest, const void* msg, uint32_t length){
218         sha1_ctx_t s;
219         sha1_init(&s);
220         while(length & (~0x0001ff)){ /* length>=512 */
221                 sha1_nextBlock(&s, msg);
222                 msg = (uint8_t*)msg + SHA1_BLOCK_BITS/8; /* increment pointer to next block */
223                 length -= SHA1_BLOCK_BITS;
224         }
225         sha1_lastBlock(&s, msg, length);
226         sha1_ctx2hash(dest, &s);
227 }
228
229