1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2  * All rights reserved.
3  *
4  * This package is an SSL implementation written
5  * by Eric Young (eay@cryptsoft.com).
6  * The implementation was written so as to conform with Netscapes SSL.
7  *
8  * This library is free for commercial and non-commercial use as long as
9  * the following conditions are aheared to.  The following conditions
10  * apply to all code found in this distribution, be it the RC4, RSA,
11  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
12  * included with this distribution is covered by the same copyright terms
13  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14  *
15  * Copyright remains Eric Young's, and as such any Copyright notices in
16  * the code are not to be removed.
17  * If this package is used in a product, Eric Young should be given attribution
18  * as the author of the parts of the library used.
19  * This can be in the form of a textual message at program startup or
20  * in documentation (online or textual) provided with the package.
21  *
22  * Redistribution and use in source and binary forms, with or without
23  * modification, are permitted provided that the following conditions
24  * are met:
25  * 1. Redistributions of source code must retain the copyright
26  *    notice, this list of conditions and the following disclaimer.
27  * 2. Redistributions in binary form must reproduce the above copyright
28  *    notice, this list of conditions and the following disclaimer in the
29  *    documentation and/or other materials provided with the distribution.
30  * 3. All advertising materials mentioning features or use of this software
31  *    must display the following acknowledgement:
32  *    "This product includes cryptographic software written by
33  *     Eric Young (eay@cryptsoft.com)"
34  *    The word 'cryptographic' can be left out if the rouines from the library
35  *    being used are not cryptographic related :-).
36  * 4. If you include any Windows specific code (or a derivative thereof) from
37  *    the apps directory (application code) you must include an acknowledgement:
38  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39  *
40  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50  * SUCH DAMAGE.
51  *
52  * The licence and distribution terms for any publically available version or
53  * derivative of this code cannot be changed.  i.e. this code cannot simply be
54  * copied and put under another distribution licence
55  * [including the GNU Public Licence.] */
56 
57 #include <openssl/sha.h>
58 
59 #include <string.h>
60 
61 #include <openssl/mem.h>
62 
63 
64 #if !defined(OPENSSL_NO_ASM) &&                         \
65     (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) || \
66      defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64))
67 #define SHA256_ASM
68 #endif
69 
SHA224_Init(SHA256_CTX * sha)70 int SHA224_Init(SHA256_CTX *sha) {
71   memset(sha, 0, sizeof(SHA256_CTX));
72   sha->h[0] = 0xc1059ed8UL;
73   sha->h[1] = 0x367cd507UL;
74   sha->h[2] = 0x3070dd17UL;
75   sha->h[3] = 0xf70e5939UL;
76   sha->h[4] = 0xffc00b31UL;
77   sha->h[5] = 0x68581511UL;
78   sha->h[6] = 0x64f98fa7UL;
79   sha->h[7] = 0xbefa4fa4UL;
80   sha->md_len = SHA224_DIGEST_LENGTH;
81   return 1;
82 }
83 
SHA256_Init(SHA256_CTX * sha)84 int SHA256_Init(SHA256_CTX *sha) {
85   memset(sha, 0, sizeof(SHA256_CTX));
86   sha->h[0] = 0x6a09e667UL;
87   sha->h[1] = 0xbb67ae85UL;
88   sha->h[2] = 0x3c6ef372UL;
89   sha->h[3] = 0xa54ff53aUL;
90   sha->h[4] = 0x510e527fUL;
91   sha->h[5] = 0x9b05688cUL;
92   sha->h[6] = 0x1f83d9abUL;
93   sha->h[7] = 0x5be0cd19UL;
94   sha->md_len = SHA256_DIGEST_LENGTH;
95   return 1;
96 }
97 
SHA224(const uint8_t * data,size_t len,uint8_t * out)98 uint8_t *SHA224(const uint8_t *data, size_t len, uint8_t *out) {
99   SHA256_CTX ctx;
100   static uint8_t buf[SHA224_DIGEST_LENGTH];
101 
102   /* TODO(fork): remove this static buffer. */
103   if (out == NULL) {
104     out = buf;
105   }
106   SHA224_Init(&ctx);
107   SHA256_Update(&ctx, data, len);
108   SHA256_Final(out, &ctx);
109   OPENSSL_cleanse(&ctx, sizeof(ctx));
110   return out;
111 }
112 
SHA256(const uint8_t * data,size_t len,uint8_t * out)113 uint8_t *SHA256(const uint8_t *data, size_t len, uint8_t *out) {
114   SHA256_CTX ctx;
115   static uint8_t buf[SHA256_DIGEST_LENGTH];
116 
117   /* TODO(fork): remove this static buffer. */
118   if (out == NULL) {
119     out = buf;
120   }
121   SHA256_Init(&ctx);
122   SHA256_Update(&ctx, data, len);
123   SHA256_Final(out, &ctx);
124   OPENSSL_cleanse(&ctx, sizeof(ctx));
125   return out;
126 }
127 
SHA224_Update(SHA256_CTX * ctx,const void * data,size_t len)128 int SHA224_Update(SHA256_CTX *ctx, const void *data, size_t len) {
129   return SHA256_Update(ctx, data, len);
130 }
131 
SHA224_Final(uint8_t * md,SHA256_CTX * ctx)132 int SHA224_Final(uint8_t *md, SHA256_CTX *ctx) {
133   return SHA256_Final(md, ctx);
134 }
135 
136 #define DATA_ORDER_IS_BIG_ENDIAN
137 
138 #define HASH_CTX SHA256_CTX
139 #define HASH_CBLOCK 64
140 
141 /* Note that FIPS180-2 discusses "Truncation of the Hash Function Output."
142  * default: case below covers for it. It's not clear however if it's permitted
143  * to truncate to amount of bytes not divisible by 4. I bet not, but if it is,
144  * then default: case shall be extended. For reference. Idea behind separate
145  * cases for pre-defined lenghts is to let the compiler decide if it's
146  * appropriate to unroll small loops.
147  *
148  * TODO(davidben): The small |md_len| case is one of the few places a low-level
149  * hash 'final' function can fail. This should never happen. */
150 #define HASH_MAKE_STRING(c, s)                              \
151   do {                                                      \
152     uint32_t ll;                                            \
153     unsigned int nn;                                        \
154     switch ((c)->md_len) {                                  \
155       case SHA224_DIGEST_LENGTH:                            \
156         for (nn = 0; nn < SHA224_DIGEST_LENGTH / 4; nn++) { \
157           ll = (c)->h[nn];                                  \
158           HOST_l2c(ll, (s));                                \
159         }                                                   \
160         break;                                              \
161       case SHA256_DIGEST_LENGTH:                            \
162         for (nn = 0; nn < SHA256_DIGEST_LENGTH / 4; nn++) { \
163           ll = (c)->h[nn];                                  \
164           HOST_l2c(ll, (s));                                \
165         }                                                   \
166         break;                                              \
167       default:                                              \
168         if ((c)->md_len > SHA256_DIGEST_LENGTH) {           \
169           return 0;                                         \
170         }                                                   \
171         for (nn = 0; nn < (c)->md_len / 4; nn++) {          \
172           ll = (c)->h[nn];                                  \
173           HOST_l2c(ll, (s));                                \
174         }                                                   \
175         break;                                              \
176     }                                                       \
177   } while (0)
178 
179 
180 #define HASH_UPDATE SHA256_Update
181 #define HASH_TRANSFORM SHA256_Transform
182 #define HASH_FINAL SHA256_Final
183 #define HASH_BLOCK_DATA_ORDER sha256_block_data_order
184 #ifndef SHA256_ASM
185 static
186 #endif
187 void sha256_block_data_order(uint32_t *state, const uint8_t *in, size_t num);
188 
189 #include "../digest/md32_common.h"
190 
191 #ifndef SHA256_ASM
192 static const uint32_t K256[64] = {
193     0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
194     0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
195     0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
196     0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
197     0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
198     0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
199     0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
200     0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
201     0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
202     0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
203     0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
204     0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
205     0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL};
206 
207 #define ROTATE(a, n) (((a) << (n)) | ((a) >> (32 - (n))))
208 
209 /* FIPS specification refers to right rotations, while our ROTATE macro
210  * is left one. This is why you might notice that rotation coefficients
211  * differ from those observed in FIPS document by 32-N... */
212 #define Sigma0(x) (ROTATE((x), 30) ^ ROTATE((x), 19) ^ ROTATE((x), 10))
213 #define Sigma1(x) (ROTATE((x), 26) ^ ROTATE((x), 21) ^ ROTATE((x), 7))
214 #define sigma0(x) (ROTATE((x), 25) ^ ROTATE((x), 14) ^ ((x) >> 3))
215 #define sigma1(x) (ROTATE((x), 15) ^ ROTATE((x), 13) ^ ((x) >> 10))
216 
217 #define Ch(x, y, z) (((x) & (y)) ^ ((~(x)) & (z)))
218 #define Maj(x, y, z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
219 
220 #define ROUND_00_15(i, a, b, c, d, e, f, g, h)   \
221   do {                                           \
222     T1 += h + Sigma1(e) + Ch(e, f, g) + K256[i]; \
223     h = Sigma0(a) + Maj(a, b, c);                \
224     d += T1;                                     \
225     h += T1;                                     \
226   } while (0)
227 
228 #define ROUND_16_63(i, a, b, c, d, e, f, g, h, X)      \
229   do {                                                 \
230     s0 = X[(i + 1) & 0x0f];                            \
231     s0 = sigma0(s0);                                   \
232     s1 = X[(i + 14) & 0x0f];                           \
233     s1 = sigma1(s1);                                   \
234     T1 = X[(i) & 0x0f] += s0 + s1 + X[(i + 9) & 0x0f]; \
235     ROUND_00_15(i, a, b, c, d, e, f, g, h);            \
236   } while (0)
237 
sha256_block_data_order(uint32_t * state,const uint8_t * data,size_t num)238 static void sha256_block_data_order(uint32_t *state, const uint8_t *data,
239                                     size_t num) {
240   uint32_t a, b, c, d, e, f, g, h, s0, s1, T1;
241   uint32_t X[16];
242   int i;
243 
244   while (num--) {
245     a = state[0];
246     b = state[1];
247     c = state[2];
248     d = state[3];
249     e = state[4];
250     f = state[5];
251     g = state[6];
252     h = state[7];
253 
254     uint32_t l;
255 
256     HOST_c2l(data, l);
257     T1 = X[0] = l;
258     ROUND_00_15(0, a, b, c, d, e, f, g, h);
259     HOST_c2l(data, l);
260     T1 = X[1] = l;
261     ROUND_00_15(1, h, a, b, c, d, e, f, g);
262     HOST_c2l(data, l);
263     T1 = X[2] = l;
264     ROUND_00_15(2, g, h, a, b, c, d, e, f);
265     HOST_c2l(data, l);
266     T1 = X[3] = l;
267     ROUND_00_15(3, f, g, h, a, b, c, d, e);
268     HOST_c2l(data, l);
269     T1 = X[4] = l;
270     ROUND_00_15(4, e, f, g, h, a, b, c, d);
271     HOST_c2l(data, l);
272     T1 = X[5] = l;
273     ROUND_00_15(5, d, e, f, g, h, a, b, c);
274     HOST_c2l(data, l);
275     T1 = X[6] = l;
276     ROUND_00_15(6, c, d, e, f, g, h, a, b);
277     HOST_c2l(data, l);
278     T1 = X[7] = l;
279     ROUND_00_15(7, b, c, d, e, f, g, h, a);
280     HOST_c2l(data, l);
281     T1 = X[8] = l;
282     ROUND_00_15(8, a, b, c, d, e, f, g, h);
283     HOST_c2l(data, l);
284     T1 = X[9] = l;
285     ROUND_00_15(9, h, a, b, c, d, e, f, g);
286     HOST_c2l(data, l);
287     T1 = X[10] = l;
288     ROUND_00_15(10, g, h, a, b, c, d, e, f);
289     HOST_c2l(data, l);
290     T1 = X[11] = l;
291     ROUND_00_15(11, f, g, h, a, b, c, d, e);
292     HOST_c2l(data, l);
293     T1 = X[12] = l;
294     ROUND_00_15(12, e, f, g, h, a, b, c, d);
295     HOST_c2l(data, l);
296     T1 = X[13] = l;
297     ROUND_00_15(13, d, e, f, g, h, a, b, c);
298     HOST_c2l(data, l);
299     T1 = X[14] = l;
300     ROUND_00_15(14, c, d, e, f, g, h, a, b);
301     HOST_c2l(data, l);
302     T1 = X[15] = l;
303     ROUND_00_15(15, b, c, d, e, f, g, h, a);
304 
305     for (i = 16; i < 64; i += 8) {
306       ROUND_16_63(i + 0, a, b, c, d, e, f, g, h, X);
307       ROUND_16_63(i + 1, h, a, b, c, d, e, f, g, X);
308       ROUND_16_63(i + 2, g, h, a, b, c, d, e, f, X);
309       ROUND_16_63(i + 3, f, g, h, a, b, c, d, e, X);
310       ROUND_16_63(i + 4, e, f, g, h, a, b, c, d, X);
311       ROUND_16_63(i + 5, d, e, f, g, h, a, b, c, X);
312       ROUND_16_63(i + 6, c, d, e, f, g, h, a, b, X);
313       ROUND_16_63(i + 7, b, c, d, e, f, g, h, a, X);
314     }
315 
316     state[0] += a;
317     state[1] += b;
318     state[2] += c;
319     state[3] += d;
320     state[4] += e;
321     state[5] += f;
322     state[6] += g;
323     state[7] += h;
324   }
325 }
326 
327 #endif /* SHA256_ASM */
328