3 This file is part of the ARM-Crypto-Lib.
4 Copyright (C) 2006-2010 Daniel Otte (daniel.otte@rub.de)
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 * \license GPLv3 or later
24 * \brief SHA-1 implementation.
28 #include <string.h> /* memcpy & co */
38 /********************************************************************************************************/
41 * \brief initialises given SHA-1 context
44 void sha1_init(sha1_ctx_t *state){
45 state->h[0] = 0x67452301;
46 state->h[1] = 0xefcdab89;
47 state->h[2] = 0x98badcfe;
48 state->h[3] = 0x10325476;
49 state->h[4] = 0xc3d2e1f0;
53 /********************************************************************************************************/
54 /* some helping functions */
56 uint32_t rotl32(uint32_t n, uint8_t bits){
57 return ((n<<bits) | (n>>(32-bits)));
62 uint32_t change_endian32(uint32_t x){
63 return (((x)<<24) | ((x)>>24) | (((x)& 0x0000ff00)<<8) | (((x)& 0x00ff0000)>>8));
67 /* three SHA-1 inner functions */
69 uint32_t ch(uint32_t x, uint32_t y, uint32_t z){
70 return ((x&y)^((~x)&z));
74 uint32_t maj(uint32_t x, uint32_t y, uint32_t z){
75 return ((x&y)^(x&z)^(y&z));
79 uint32_t parity(uint32_t x, uint32_t y, uint32_t z){
83 /********************************************************************************************************/
85 * \brief "add" a block to the hash
86 * This is the core function of the hash algorithm. To understand how it's working
87 * and what thoese variables do, take a look at FIPS-182. This is an "alternativ" implementation
90 #define MASK 0x0000000f
92 typedef const uint32_t (*pf_t)(uint32_t x, uint32_t y, uint32_t z);
95 void load_endian32_changed(uint8_t* dest, uint8_t* src, uint16_t words){
96 #if defined LITTLE_ENDIAN
104 #elif defined BIG_ENDIAN
105 memcpy(dest, src, words * sizeof(uint32_t));
110 void sha1_nextBlock (sha1_ctx_t *state, const void* block){
115 pf_t f[] = {ch,parity,maj,parity};
116 uint32_t k[4]={ 0x5a827999,
120 /* load the w array (changing the endian and so) */
121 load_endian32_changed((uint8_t*)w, (uint8_t*)block, 16);
125 for(dbgi=0; dbgi<16; ++dbgi){
126 cli_putstr("\r\nBlock:");
127 cli_hexdump(&dbgi, 1);
129 cli_hexdump(&(w[dbgi]) ,4);
134 memcpy(a, state->h, 5*sizeof(uint32_t));
138 for(fi=0,fib=0,t=0; t<=79; ++t){
141 w[s] = rotl32( w[(s+13)&MASK] ^ w[(s+8)&MASK] ^
142 w[(s+ 2)&MASK] ^ w[s] ,1);
146 temp = rotl32(a[0],5) + (dtemp=f[fi](a[1],a[2],a[3])) + a[4] + k[fi] + w[s];
147 memmove(&(a[1]), &(a[0]), 4*sizeof(uint32_t)); /* e=d; d=c; c=b; b=a; */
149 a[2] = rotl32(a[2],30); /* we might also do rotr32(c,2) */
157 /* update the state */
161 state->length += 512;
164 /********************************************************************************************************/
166 void sha1_lastBlock(sha1_ctx_t *state, const void* block, uint16_t length){
167 uint8_t lb[SHA1_BLOCK_BYTES]; /* local block */
168 while(length>=SHA1_BLOCK_BITS){
169 sha1_nextBlock(state, block);
170 length -= SHA1_BLOCK_BITS;
171 block = (uint8_t*)block + SHA1_BLOCK_BYTES;
173 state->length += length;
174 memset(lb, 0, SHA1_BLOCK_BYTES);
175 memcpy (lb, block, (length+7)>>3);
177 /* set the final one bit */
178 lb[length>>3] |= 0x80>>(length & 0x07);
180 if (length>512-64-1){ /* not enouth space for 64bit length value */
181 sha1_nextBlock(state, lb);
182 state->length -= 512;
183 memset(lb, 0, SHA1_BLOCK_BYTES);
185 /* store the 64bit length value */
186 #if defined LITTLE_ENDIAN
187 /* this is now rolled up */
190 lb[56+i] = ((uint8_t*)&(state->length))[7-i];
192 #elif defined BIG_ENDIAN
193 *((uint64_t*)&(lb[56])) = state->length;
195 sha1_nextBlock(state, lb);
198 /********************************************************************************************************/
200 void sha1_ctx2hash (void *dest, sha1_ctx_t *state){
201 #if defined LITTLE_ENDIAN
202 load_endian32_changed((uint8_t*)dest, (uint8_t*)state->h, 5);
203 #elif defined BIG_ENDIAN
204 if (dest != state->h) {
205 memcpy(dest, state->h, SHA1_HASH_BITS/8);
208 # error unsupported endian type!
212 /********************************************************************************************************/
217 void sha1 (void *dest, const void* msg, uint32_t length){
220 while(length & (~0x0001ff)){ /* length>=512 */
221 sha1_nextBlock(&s, msg);
222 msg = (uint8_t*)msg + SHA1_BLOCK_BITS/8; /* increment pointer to next block */
223 length -= SHA1_BLOCK_BITS;
225 sha1_lastBlock(&s, msg, length);
226 sha1_ctx2hash(dest, &s);