sha1/sha1.c

   1 /* sha1.c */
   2 /*
   3     This file is part of the ARM-Crypto-Lib.
   4     Copyright (C) 2006-2010  Daniel Otte (daniel.otte@rub.de)
   5
   6     This program is free software: you can redistribute it and/or modify
   7     it under the terms of the GNU General Public License as published by
   8     the Free Software Foundation, either version 3 of the License, or
   9     (at your option) any later version.
  10
  11     This program is distributed in the hope that it will be useful,
  12     but WITHOUT ANY WARRANTY; without even the implied warranty of
  13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14     GNU General Public License for more details.
  15
  16     You should have received a copy of the GNU General Public License
  17     along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19 /**
  20  * \file        sha1.c
  21  * \author      Daniel Otte
  22  * \date        2006-10-08
  23  * \license GPLv3 or later
  24  * \brief SHA-1 implementation.
  25  *
  26  */
  27
  28 #include <string.h> /* memcpy & co */
  29 #include <stdint.h>
  30 #include "sha1.h"
  31
  32 #ifdef DEBUG
  33 #  undef DEBUG
  34 #endif
  35
  36 #define LITTLE_ENDIAN
  37
  38 /********************************************************************************************************/
  39
  40 /**
  41  * \brief initialises given SHA-1 context
  42  *
  43  */
  44 void sha1_init(sha1_ctx_t *state){
  45         state->h[0] = 0x67452301;
  46         state->h[1] = 0xefcdab89;
  47         state->h[2] = 0x98badcfe;
  48         state->h[3] = 0x10325476;
  49         state->h[4] = 0xc3d2e1f0;
  50         state->length = 0;
  51 }
  52
  53 /********************************************************************************************************/
  54 /* some helping functions */
  55 static const
  56 uint32_t rotl32(uint32_t n, uint8_t bits){
  57         return ((n<<bits) | (n>>(32-bits)));
  58 }
  59
  60 /*
  61 static const
  62 uint32_t change_endian32(uint32_t x){
  63         return (((x)<<24) | ((x)>>24) | (((x)& 0x0000ff00)<<8) | (((x)& 0x00ff0000)>>8));
  64 }
  65 */
  66
  67 /* three SHA-1 inner functions */
  68 const
  69 uint32_t ch(uint32_t x, uint32_t y, uint32_t z){
  70         return ((x&y)^((~x)&z));
  71 }
  72
  73 const
  74 uint32_t maj(uint32_t x, uint32_t y, uint32_t z){
  75         return ((x&y)^(x&z)^(y&z));
  76 }
  77
  78 const
  79 uint32_t parity(uint32_t x, uint32_t y, uint32_t z){
  80         return ((x^y)^z);
  81 }
  82
  83 /********************************************************************************************************/
  84 /**
  85  * \brief "add" a block to the hash
  86  * This is the core function of the hash algorithm. To understand how it's working
  87  * and what thoese variables do, take a look at FIPS-182. This is an "alternativ" implementation
  88  */
  89
  90 #define MASK 0x0000000f
  91
  92 typedef const uint32_t (*pf_t)(uint32_t x, uint32_t y, uint32_t z);
  93
  94 static
  95 void load_endian32_changed(uint8_t* dest, uint8_t* src, uint16_t words){
  96         while(words--){
  97                 *dest++ = src[3];
  98                 *dest++ = src[2];
  99                 *dest++ = src[1];
 100                 *dest++ = src[0];
 101                 src += 4;
 102         }
 103 }
 104
 105
 106 void sha1_nextBlock (sha1_ctx_t *state, const void* block){
 107         uint32_t a[5];
 108         uint32_t w[16];
 109         uint32_t temp;
 110         uint8_t t,s,fi, fib;
 111         pf_t f[] = {ch,parity,maj,parity};
 112         uint32_t k[4]={ 0x5a827999,
 113                                         0x6ed9eba1,
 114                                         0x8f1bbcdc,
 115                                         0xca62c1d6};
 116
 117         /* load the w array (changing the endian and so) */
 118         load_endian32_changed((uint8_t*)w, (uint8_t*)block, 16);
 119 #if DEBUG
 120         uint8_t dbgi;
 121         for(dbgi=0; dbgi<16; ++dbgi){
 122                 cli_putstr("\r\nBlock:");
 123                 cli_hexdump(&dbgi, 1);
 124                 cli_putc(':');
 125                 cli_hexdump(&(w[dbgi]) ,4);
 126         }
 127 #endif
 128
 129         /* load the state */
 130         memcpy(a, state->h, 5*sizeof(uint32_t));
 131
 132
 133         /* the fun stuff */
 134         for(fi=0,fib=0,t=0; t<=79; ++t){
 135                 s = t & MASK;
 136                 if(t>=16){
 137                         w[s] = rotl32( w[(s+13)&MASK] ^ w[(s+8)&MASK] ^
 138                                  w[(s+ 2)&MASK] ^ w[s] ,1);
 139                 }
 140
 141                 uint32_t dtemp;
 142                 temp = rotl32(a[0],5) + (dtemp=f[fi](a[1],a[2],a[3])) + a[4] + k[fi] + w[s];
 143                 memmove(&(a[1]), &(a[0]), 4*sizeof(uint32_t)); /* e=d; d=c; c=b; b=a; */
 144                 a[0] = temp;
 145                 a[2] = rotl32(a[2],30); /* we might also do rotr32(c,2) */
 146                 fib++;
 147                 if(fib==20){
 148                         fib=0;
 149                         fi = (fi+1)%4;
 150                 }
 151         }
 152
 153         /* update the state */
 154         for(t=0; t<5; ++t){
 155                 state->h[t] += a[t];
 156         }
 157         state->length += 512;
 158 }
 159
 160 /********************************************************************************************************/
 161
 162 void sha1_lastBlock(sha1_ctx_t *state, const void* block, uint16_t length){
 163         uint8_t lb[SHA1_BLOCK_BYTES]; /* local block */
 164         while(length>=SHA1_BLOCK_BITS){
 165                 sha1_nextBlock(state, block);
 166                 length -= SHA1_BLOCK_BITS;
 167                 block = (uint8_t*)block + SHA1_BLOCK_BYTES;
 168         }
 169         state->length += length;
 170         memset(lb, 0, SHA1_BLOCK_BYTES);
 171         memcpy (lb, block, (length+7)>>3);
 172
 173         /* set the final one bit */
 174         lb[length>>3] |= 0x80>>(length & 0x07);
 175
 176         if (length>512-64-1){ /* not enouth space for 64bit length value */
 177                 sha1_nextBlock(state, lb);
 178                 state->length -= 512;
 179                 memset(lb, 0, SHA1_BLOCK_BYTES);
 180         }
 181         /* store the 64bit length value */
 182 #if defined LITTLE_ENDIAN
 183                 /* this is now rolled up */
 184         uint8_t i;
 185         for (i=0; i<8; ++i){
 186                 lb[56+i] = ((uint8_t*)&(state->length))[7-i];
 187         }
 188 #elif defined BIG_ENDIAN
 189         *((uint64_t)&(lb[56])) = state->length;
 190 #endif
 191         sha1_nextBlock(state, lb);
 192 }
 193
 194 /********************************************************************************************************/
 195
 196 void sha1_ctx2hash (void *dest, sha1_ctx_t *state){
 197 #if defined LITTLE_ENDIAN
 198         load_endian32_changed((uint8_t*)dest, (uint8_t*)state->h, 5);
 199 #elif BIG_ENDIAN
 200         if (dest != state->h)
 201                 memcpy(dest, state->h, SHA1_HASH_BITS/8);
 202 #else
 203 # error unsupported endian type!
 204 #endif
 205 }
 206
 207 /********************************************************************************************************/
 208 /**
 209  *
 210  *
 211  */
 212 void sha1 (void *dest, const void* msg, uint32_t length){
 213         sha1_ctx_t s;
 214         sha1_init(&s);
 215         while(length & (~0x0001ff)){ /* length>=512 */
 216                 sha1_nextBlock(&s, msg);
 217                 msg = (uint8_t*)msg + SHA1_BLOCK_BITS/8; /* increment pointer to next block */
 218                 length -= SHA1_BLOCK_BITS;
 219         }
 220         sha1_lastBlock(&s, msg, length);
 221         sha1_ctx2hash(dest, &s);
 222 }
 223
 224