1 /*
2 * sha2 128-bit
3 */
4 #include <u.h>
5 #include <libc.h>
6 #include <libsec.h>
7
8 static void encode64(uchar*, u64int*, ulong);
9 static DigestState* sha2_128(uchar *, ulong, uchar *, SHA2_256state *, int);
10
11 extern void _sha2block128(uchar*, ulong, u64int*);
12
13 /*
14 * for sha2_384 and sha2_512, len must be multiple of 128 for all but
15 * the last call. There must be room in the input buffer to pad.
16 *
17 * Note: sha2_384 calls sha2_512block as sha2_384; it just uses a different
18 * initial seed to produce a truncated 384b hash result. otherwise
19 * it's the same as sha2_512.
20 */
21 SHA2_384state*
sha2_384(uchar * p,ulong len,uchar * digest,SHA2_384state * s)22 sha2_384(uchar *p, ulong len, uchar *digest, SHA2_384state *s)
23 {
24 if(s == nil) {
25 s = mallocz(sizeof(*s), 1);
26 if(s == nil)
27 return nil;
28 s->malloced = 1;
29 }
30 if(s->seeded == 0){
31 /*
32 * seed the state with the first 64 bits of the fractional
33 * parts of the square roots of the 9th thru 16th primes.
34 */
35 s->bstate[0] = 0xcbbb9d5dc1059ed8LL;
36 s->bstate[1] = 0x629a292a367cd507LL;
37 s->bstate[2] = 0x9159015a3070dd17LL;
38 s->bstate[3] = 0x152fecd8f70e5939LL;
39 s->bstate[4] = 0x67332667ffc00b31LL;
40 s->bstate[5] = 0x8eb44a8768581511LL;
41 s->bstate[6] = 0xdb0c2e0d64f98fa7LL;
42 s->bstate[7] = 0x47b5481dbefa4fa4LL;
43 s->seeded = 1;
44 }
45 return sha2_128(p, len, digest, s, SHA2_384dlen);
46 }
47
48 SHA2_512state*
sha2_512(uchar * p,ulong len,uchar * digest,SHA2_512state * s)49 sha2_512(uchar *p, ulong len, uchar *digest, SHA2_512state *s)
50 {
51
52 if(s == nil) {
53 s = mallocz(sizeof(*s), 1);
54 if(s == nil)
55 return nil;
56 s->malloced = 1;
57 }
58 if(s->seeded == 0){
59 /*
60 * seed the state with the first 64 bits of the fractional
61 * parts of the square roots of the first 8 primes 2..19).
62 */
63 s->bstate[0] = 0x6a09e667f3bcc908LL;
64 s->bstate[1] = 0xbb67ae8584caa73bLL;
65 s->bstate[2] = 0x3c6ef372fe94f82bLL;
66 s->bstate[3] = 0xa54ff53a5f1d36f1LL;
67 s->bstate[4] = 0x510e527fade682d1LL;
68 s->bstate[5] = 0x9b05688c2b3e6c1fLL;
69 s->bstate[6] = 0x1f83d9abfb41bd6bLL;
70 s->bstate[7] = 0x5be0cd19137e2179LL;
71 s->seeded = 1;
72 }
73 return sha2_128(p, len, digest, s, SHA2_512dlen);
74 }
75
76 /* common 128 byte block padding and count code for SHA2_384 and SHA2_512 */
77 static DigestState*
sha2_128(uchar * p,ulong len,uchar * digest,SHA2_512state * s,int dlen)78 sha2_128(uchar *p, ulong len, uchar *digest, SHA2_512state *s, int dlen)
79 {
80 int i;
81 u64int x[16];
82 uchar buf[256];
83 uchar *e;
84
85 /* fill out the partial 128 byte block from previous calls */
86 if(s->blen){
87 i = 128 - s->blen;
88 if(len < i)
89 i = len;
90 memmove(s->buf + s->blen, p, i);
91 len -= i;
92 s->blen += i;
93 p += i;
94 if(s->blen == 128){
95 _sha2block128(s->buf, s->blen, s->bstate);
96 s->len += s->blen;
97 s->blen = 0;
98 }
99 }
100
101 /* do 128 byte blocks */
102 i = len & ~(128-1);
103 if(i){
104 _sha2block128(p, i, s->bstate);
105 s->len += i;
106 len -= i;
107 p += i;
108 }
109
110 /* save the left overs if not last call */
111 if(digest == 0){
112 if(len){
113 memmove(s->buf, p, len);
114 s->blen += len;
115 }
116 return s;
117 }
118
119 /*
120 * this is the last time through, pad what's left with 0x80,
121 * 0's, and the input count to create a multiple of 128 bytes.
122 */
123 if(s->blen){
124 p = s->buf;
125 len = s->blen;
126 } else {
127 memmove(buf, p, len);
128 p = buf;
129 }
130 s->len += len;
131 e = p + len;
132 if(len < 112)
133 i = 112 - len;
134 else
135 i = 240 - len;
136 memset(e, 0, i);
137 *e = 0x80;
138 len += i;
139
140 /* append the count */
141 x[0] = 0; /* assume 32b length, i.e. < 4GB */
142 x[1] = s->len<<3;
143 encode64(p+len, x, 16);
144
145 /* digest the last part */
146 _sha2block128(p, len+16, s->bstate);
147 s->len += len+16;
148
149 /* return result and free state */
150 encode64(digest, s->bstate, dlen);
151 if(s->malloced == 1)
152 free(s);
153 return nil;
154 }
155
156 /*
157 * Encodes input (ulong long) into output (uchar).
158 * Assumes len is a multiple of 8.
159 */
160 static void
encode64(uchar * output,u64int * input,ulong len)161 encode64(uchar *output, u64int *input, ulong len)
162 {
163 u64int x;
164 uchar *e;
165
166 for(e = output + len; output < e;) {
167 x = *input++;
168 *output++ = x >> 56;
169 *output++ = x >> 48;
170 *output++ = x >> 40;
171 *output++ = x >> 32;
172 *output++ = x >> 24;
173 *output++ = x >> 16;
174 *output++ = x >> 8;
175 *output++ = x;
176 }
177 }
178
179 DigestState*
hmac_sha2_384(uchar * p,ulong len,uchar * key,ulong klen,uchar * digest,DigestState * s)180 hmac_sha2_384(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest,
181 DigestState *s)
182 {
183 return hmac_x(p, len, key, klen, digest, s, sha2_384, SHA2_384dlen);
184 }
185
186 DigestState*
hmac_sha2_512(uchar * p,ulong len,uchar * key,ulong klen,uchar * digest,DigestState * s)187 hmac_sha2_512(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest,
188 DigestState *s)
189 {
190 return hmac_x(p, len, key, klen, digest, s, sha2_512, SHA2_512dlen);
191 }
192