1*f0865ec9SKyle Evans /* 2*f0865ec9SKyle Evans * Copyright (C) 2021 - This file is part of libecc project 3*f0865ec9SKyle Evans * 4*f0865ec9SKyle Evans * Authors: 5*f0865ec9SKyle Evans * Ryad BENADJILA <ryadbenadjila@gmail.com> 6*f0865ec9SKyle Evans * Arnaud EBALARD <arnaud.ebalard@ssi.gouv.fr> 7*f0865ec9SKyle Evans * 8*f0865ec9SKyle Evans * This software is licensed under a dual BSD and GPL v2 license. 9*f0865ec9SKyle Evans * See LICENSE file at the root folder of the project. 10*f0865ec9SKyle Evans */ 11*f0865ec9SKyle Evans #include "sha0.h" 12*f0865ec9SKyle Evans 13*f0865ec9SKyle Evans #define ROTL_SHA0(x, n) ((((u32)(x)) << (n)) | (((u32)(x)) >> (32-(n)))) 14*f0865ec9SKyle Evans 15*f0865ec9SKyle Evans /* All the inner SHA-0 operations */ 16*f0865ec9SKyle Evans #define K1_SHA0 0x5a827999 17*f0865ec9SKyle Evans #define K2_SHA0 0x6ed9eba1 18*f0865ec9SKyle Evans #define K3_SHA0 0x8f1bbcdc 19*f0865ec9SKyle Evans #define K4_SHA0 0xca62c1d6 20*f0865ec9SKyle Evans 21*f0865ec9SKyle Evans #define F1_SHA0(x, y, z) ((z) ^ ((x) & ((y) ^ (z)))) 22*f0865ec9SKyle Evans #define F2_SHA0(x, y, z) ((x) ^ (y) ^ (z)) 23*f0865ec9SKyle Evans #define F3_SHA0(x, y, z) (((x) & (y)) | ((z) & ((x) | (y)))) 24*f0865ec9SKyle Evans #define F4_SHA0(x, y, z) ((x) ^ (y) ^ (z)) 25*f0865ec9SKyle Evans 26*f0865ec9SKyle Evans #define SHA0_EXPAND(W, i) (W[i & 15] = (W[i & 15] ^ W[(i - 14) & 15] ^ W[(i - 8) & 15] ^ W[(i - 3) & 15])) 27*f0865ec9SKyle Evans 28*f0865ec9SKyle Evans #define SHA0_SUBROUND(a, b, c, d, e, F, K, data) do { \ 29*f0865ec9SKyle Evans u32 A_, B_, C_, D_, E_; \ 30*f0865ec9SKyle Evans A_ = (e + ROTL_SHA0(a, 5) + F(b, c, d) + K + data); \ 31*f0865ec9SKyle Evans B_ = a; \ 32*f0865ec9SKyle Evans C_ = ROTL_SHA0(b, 30); \ 33*f0865ec9SKyle Evans D_ = c; \ 34*f0865ec9SKyle Evans E_ = d; \ 35*f0865ec9SKyle Evans /**/ \ 36*f0865ec9SKyle Evans a = A_; b = B_; c = C_; d = D_; e = E_; \ 37*f0865ec9SKyle Evans } while(0) 38*f0865ec9SKyle Evans 39*f0865ec9SKyle Evans /* SHA-0 core processing. Returns 0 on success, -1 on error. */ 40*f0865ec9SKyle Evans ATTRIBUTE_WARN_UNUSED_RET static inline int sha0_process(sha0_context *ctx, 41*f0865ec9SKyle Evans const u8 data[SHA0_BLOCK_SIZE]) 42*f0865ec9SKyle Evans { 43*f0865ec9SKyle Evans u32 A, B, C, D, E; 44*f0865ec9SKyle Evans u32 W[16]; 45*f0865ec9SKyle Evans int ret; 46*f0865ec9SKyle Evans unsigned int i; 47*f0865ec9SKyle Evans 48*f0865ec9SKyle Evans MUST_HAVE((data != NULL), ret, err); 49*f0865ec9SKyle Evans SHA0_HASH_CHECK_INITIALIZED(ctx, ret, err); 50*f0865ec9SKyle Evans 51*f0865ec9SKyle Evans /* Init our inner variables */ 52*f0865ec9SKyle Evans A = ctx->sha0_state[0]; 53*f0865ec9SKyle Evans B = ctx->sha0_state[1]; 54*f0865ec9SKyle Evans C = ctx->sha0_state[2]; 55*f0865ec9SKyle Evans D = ctx->sha0_state[3]; 56*f0865ec9SKyle Evans E = ctx->sha0_state[4]; 57*f0865ec9SKyle Evans 58*f0865ec9SKyle Evans /* Load data */ 59*f0865ec9SKyle Evans for (i = 0; i < 16; i++) { 60*f0865ec9SKyle Evans GET_UINT32_BE(W[i], data, (4 * i)); 61*f0865ec9SKyle Evans } 62*f0865ec9SKyle Evans for (i = 0; i < 80; i++) { 63*f0865ec9SKyle Evans if(i <= 15){ 64*f0865ec9SKyle Evans SHA0_SUBROUND(A, B, C, D, E, F1_SHA0, K1_SHA0, W[i]); 65*f0865ec9SKyle Evans } 66*f0865ec9SKyle Evans else if((i >= 16) && (i <= 19)){ 67*f0865ec9SKyle Evans SHA0_SUBROUND(A, B, C, D, E, F1_SHA0, K1_SHA0, SHA0_EXPAND(W, i)); 68*f0865ec9SKyle Evans } 69*f0865ec9SKyle Evans else if((i >= 20) && (i <= 39)){ 70*f0865ec9SKyle Evans SHA0_SUBROUND(A, B, C, D, E, F2_SHA0, K2_SHA0, SHA0_EXPAND(W, i)); 71*f0865ec9SKyle Evans } 72*f0865ec9SKyle Evans else if((i >= 40) && (i <= 59)){ 73*f0865ec9SKyle Evans SHA0_SUBROUND(A, B, C, D, E, F3_SHA0, K3_SHA0, SHA0_EXPAND(W, i)); 74*f0865ec9SKyle Evans } 75*f0865ec9SKyle Evans else{ 76*f0865ec9SKyle Evans SHA0_SUBROUND(A, B, C, D, E, F4_SHA0, K4_SHA0, SHA0_EXPAND(W, i)); 77*f0865ec9SKyle Evans } 78*f0865ec9SKyle Evans } 79*f0865ec9SKyle Evans 80*f0865ec9SKyle Evans /* Update state */ 81*f0865ec9SKyle Evans ctx->sha0_state[0] += A; 82*f0865ec9SKyle Evans ctx->sha0_state[1] += B; 83*f0865ec9SKyle Evans ctx->sha0_state[2] += C; 84*f0865ec9SKyle Evans ctx->sha0_state[3] += D; 85*f0865ec9SKyle Evans ctx->sha0_state[4] += E; 86*f0865ec9SKyle Evans 87*f0865ec9SKyle Evans ret = 0; 88*f0865ec9SKyle Evans 89*f0865ec9SKyle Evans err: 90*f0865ec9SKyle Evans return ret; 91*f0865ec9SKyle Evans } 92*f0865ec9SKyle Evans 93*f0865ec9SKyle Evans /* Init hash function. Returns 0 on success, -1 on error. */ 94*f0865ec9SKyle Evans ATTRIBUTE_WARN_UNUSED_RET int sha0_init(sha0_context *ctx) 95*f0865ec9SKyle Evans { 96*f0865ec9SKyle Evans int ret; 97*f0865ec9SKyle Evans 98*f0865ec9SKyle Evans MUST_HAVE((ctx != NULL), ret, err); 99*f0865ec9SKyle Evans 100*f0865ec9SKyle Evans /* Sanity check on size */ 101*f0865ec9SKyle Evans MUST_HAVE((SHA0_DIGEST_SIZE <= MAX_DIGEST_SIZE), ret, err); 102*f0865ec9SKyle Evans 103*f0865ec9SKyle Evans ctx->sha0_total = 0; 104*f0865ec9SKyle Evans ctx->sha0_state[0] = 0x67452301; 105*f0865ec9SKyle Evans ctx->sha0_state[1] = 0xefcdab89; 106*f0865ec9SKyle Evans ctx->sha0_state[2] = 0x98badcfe; 107*f0865ec9SKyle Evans ctx->sha0_state[3] = 0x10325476; 108*f0865ec9SKyle Evans ctx->sha0_state[4] = 0xc3d2e1f0; 109*f0865ec9SKyle Evans 110*f0865ec9SKyle Evans /* Tell that we are initialized */ 111*f0865ec9SKyle Evans ctx->magic = SHA0_HASH_MAGIC; 112*f0865ec9SKyle Evans 113*f0865ec9SKyle Evans ret = 0; 114*f0865ec9SKyle Evans 115*f0865ec9SKyle Evans err: 116*f0865ec9SKyle Evans return ret; 117*f0865ec9SKyle Evans } 118*f0865ec9SKyle Evans 119*f0865ec9SKyle Evans ATTRIBUTE_WARN_UNUSED_RET int sha0_update(sha0_context *ctx, const u8 *input, u32 ilen) 120*f0865ec9SKyle Evans { 121*f0865ec9SKyle Evans const u8 *data_ptr = input; 122*f0865ec9SKyle Evans u32 remain_ilen = ilen; 123*f0865ec9SKyle Evans u16 fill; 124*f0865ec9SKyle Evans u8 left; 125*f0865ec9SKyle Evans int ret; 126*f0865ec9SKyle Evans 127*f0865ec9SKyle Evans MUST_HAVE((input != NULL) || (ilen == 0), ret, err); 128*f0865ec9SKyle Evans SHA0_HASH_CHECK_INITIALIZED(ctx, ret, err); 129*f0865ec9SKyle Evans 130*f0865ec9SKyle Evans /* Nothing to process, return */ 131*f0865ec9SKyle Evans if (ilen == 0) { 132*f0865ec9SKyle Evans ret = 0; 133*f0865ec9SKyle Evans goto err; 134*f0865ec9SKyle Evans } 135*f0865ec9SKyle Evans 136*f0865ec9SKyle Evans /* Get what's left in our local buffer */ 137*f0865ec9SKyle Evans left = (ctx->sha0_total & 0x3F); 138*f0865ec9SKyle Evans fill = (u16)(SHA0_BLOCK_SIZE - left); 139*f0865ec9SKyle Evans 140*f0865ec9SKyle Evans ctx->sha0_total += ilen; 141*f0865ec9SKyle Evans 142*f0865ec9SKyle Evans if ((left > 0) && (remain_ilen >= fill)) { 143*f0865ec9SKyle Evans /* Copy data at the end of the buffer */ 144*f0865ec9SKyle Evans ret = local_memcpy(ctx->sha0_buffer + left, data_ptr, fill); EG(ret, err); 145*f0865ec9SKyle Evans ret = sha0_process(ctx, ctx->sha0_buffer); EG(ret, err); 146*f0865ec9SKyle Evans data_ptr += fill; 147*f0865ec9SKyle Evans remain_ilen -= fill; 148*f0865ec9SKyle Evans left = 0; 149*f0865ec9SKyle Evans } 150*f0865ec9SKyle Evans 151*f0865ec9SKyle Evans while (remain_ilen >= SHA0_BLOCK_SIZE) { 152*f0865ec9SKyle Evans ret = sha0_process(ctx, data_ptr); EG(ret, err); 153*f0865ec9SKyle Evans data_ptr += SHA0_BLOCK_SIZE; 154*f0865ec9SKyle Evans remain_ilen -= SHA0_BLOCK_SIZE; 155*f0865ec9SKyle Evans } 156*f0865ec9SKyle Evans 157*f0865ec9SKyle Evans if (remain_ilen > 0) { 158*f0865ec9SKyle Evans ret = local_memcpy(ctx->sha0_buffer + left, data_ptr, remain_ilen); EG(ret, err); 159*f0865ec9SKyle Evans } 160*f0865ec9SKyle Evans 161*f0865ec9SKyle Evans ret = 0; 162*f0865ec9SKyle Evans 163*f0865ec9SKyle Evans err: 164*f0865ec9SKyle Evans return ret; 165*f0865ec9SKyle Evans } 166*f0865ec9SKyle Evans 167*f0865ec9SKyle Evans /* Finalize. Returns 0 on success, -1 on error.*/ 168*f0865ec9SKyle Evans ATTRIBUTE_WARN_UNUSED_RET int sha0_final(sha0_context *ctx, u8 output[SHA0_DIGEST_SIZE]) 169*f0865ec9SKyle Evans { 170*f0865ec9SKyle Evans unsigned int block_present = 0; 171*f0865ec9SKyle Evans u8 last_padded_block[2 * SHA0_BLOCK_SIZE]; 172*f0865ec9SKyle Evans int ret; 173*f0865ec9SKyle Evans 174*f0865ec9SKyle Evans MUST_HAVE((output != NULL), ret, err); 175*f0865ec9SKyle Evans SHA0_HASH_CHECK_INITIALIZED(ctx, ret, err); 176*f0865ec9SKyle Evans 177*f0865ec9SKyle Evans /* Fill in our last block with zeroes */ 178*f0865ec9SKyle Evans ret = local_memset(last_padded_block, 0, sizeof(last_padded_block)); EG(ret, err); 179*f0865ec9SKyle Evans 180*f0865ec9SKyle Evans /* This is our final step, so we proceed with the padding */ 181*f0865ec9SKyle Evans block_present = ctx->sha0_total % SHA0_BLOCK_SIZE; 182*f0865ec9SKyle Evans if (block_present != 0) { 183*f0865ec9SKyle Evans /* Copy what's left in our temporary context buffer */ 184*f0865ec9SKyle Evans ret = local_memcpy(last_padded_block, ctx->sha0_buffer, 185*f0865ec9SKyle Evans block_present); EG(ret, err); 186*f0865ec9SKyle Evans } 187*f0865ec9SKyle Evans 188*f0865ec9SKyle Evans /* Put the 0x80 byte, beginning of padding */ 189*f0865ec9SKyle Evans last_padded_block[block_present] = 0x80; 190*f0865ec9SKyle Evans 191*f0865ec9SKyle Evans /* Handle possible additional block */ 192*f0865ec9SKyle Evans if (block_present > (SHA0_BLOCK_SIZE - 1 - sizeof(u64))) { 193*f0865ec9SKyle Evans /* We need an additional block */ 194*f0865ec9SKyle Evans PUT_UINT64_BE(8 * ctx->sha0_total, last_padded_block, 195*f0865ec9SKyle Evans (2 * SHA0_BLOCK_SIZE) - sizeof(u64)); 196*f0865ec9SKyle Evans ret = sha0_process(ctx, last_padded_block); EG(ret, err); 197*f0865ec9SKyle Evans ret = sha0_process(ctx, last_padded_block + SHA0_BLOCK_SIZE); EG(ret, err); 198*f0865ec9SKyle Evans } else { 199*f0865ec9SKyle Evans /* We do not need an additional block */ 200*f0865ec9SKyle Evans PUT_UINT64_BE(8 * ctx->sha0_total, last_padded_block, 201*f0865ec9SKyle Evans SHA0_BLOCK_SIZE - sizeof(u64)); 202*f0865ec9SKyle Evans ret = sha0_process(ctx, last_padded_block); EG(ret, err); 203*f0865ec9SKyle Evans } 204*f0865ec9SKyle Evans 205*f0865ec9SKyle Evans /* Output the hash result */ 206*f0865ec9SKyle Evans PUT_UINT32_BE(ctx->sha0_state[0], output, 0); 207*f0865ec9SKyle Evans PUT_UINT32_BE(ctx->sha0_state[1], output, 4); 208*f0865ec9SKyle Evans PUT_UINT32_BE(ctx->sha0_state[2], output, 8); 209*f0865ec9SKyle Evans PUT_UINT32_BE(ctx->sha0_state[3], output, 12); 210*f0865ec9SKyle Evans PUT_UINT32_BE(ctx->sha0_state[4], output, 16); 211*f0865ec9SKyle Evans 212*f0865ec9SKyle Evans /* Tell that we are uninitialized */ 213*f0865ec9SKyle Evans ctx->magic = WORD(0); 214*f0865ec9SKyle Evans 215*f0865ec9SKyle Evans ret = 0; 216*f0865ec9SKyle Evans 217*f0865ec9SKyle Evans err: 218*f0865ec9SKyle Evans return ret; 219*f0865ec9SKyle Evans } 220*f0865ec9SKyle Evans 221*f0865ec9SKyle Evans 222*f0865ec9SKyle Evans /* 223*f0865ec9SKyle Evans * Scattered version performing init/update/finalize on a vector of buffers 224*f0865ec9SKyle Evans * 'inputs' with the length of each buffer passed via 'ilens'. The function 225*f0865ec9SKyle Evans * loops on pointers in 'inputs' until it finds a NULL pointer. The function 226*f0865ec9SKyle Evans * returns 0 on success, -1 on error. 227*f0865ec9SKyle Evans */ 228*f0865ec9SKyle Evans ATTRIBUTE_WARN_UNUSED_RET int sha0_scattered(const u8 **inputs, const u32 *ilens, 229*f0865ec9SKyle Evans u8 output[SHA0_DIGEST_SIZE]) 230*f0865ec9SKyle Evans { 231*f0865ec9SKyle Evans sha0_context ctx; 232*f0865ec9SKyle Evans int ret, pos = 0; 233*f0865ec9SKyle Evans 234*f0865ec9SKyle Evans MUST_HAVE((inputs != NULL) && (ilens != NULL) && (output != NULL), ret, err); 235*f0865ec9SKyle Evans 236*f0865ec9SKyle Evans ret = sha0_init(&ctx); EG(ret, err); 237*f0865ec9SKyle Evans 238*f0865ec9SKyle Evans while (inputs[pos] != NULL) { 239*f0865ec9SKyle Evans ret = sha0_update(&ctx, inputs[pos], ilens[pos]); EG(ret, err); 240*f0865ec9SKyle Evans pos += 1; 241*f0865ec9SKyle Evans } 242*f0865ec9SKyle Evans 243*f0865ec9SKyle Evans ret = sha0_final(&ctx, output); 244*f0865ec9SKyle Evans 245*f0865ec9SKyle Evans err: 246*f0865ec9SKyle Evans return ret; 247*f0865ec9SKyle Evans } 248*f0865ec9SKyle Evans 249*f0865ec9SKyle Evans /* 250*f0865ec9SKyle Evans * Single call version performing init/update/final on given input. 251*f0865ec9SKyle Evans * Returns 0 on success, -1 on error. 252*f0865ec9SKyle Evans */ 253*f0865ec9SKyle Evans ATTRIBUTE_WARN_UNUSED_RET int sha0(const u8 *input, u32 ilen, u8 output[SHA0_DIGEST_SIZE]) 254*f0865ec9SKyle Evans { 255*f0865ec9SKyle Evans sha0_context ctx; 256*f0865ec9SKyle Evans int ret; 257*f0865ec9SKyle Evans 258*f0865ec9SKyle Evans ret = sha0_init(&ctx); EG(ret, err); 259*f0865ec9SKyle Evans ret = sha0_update(&ctx, input, ilen); EG(ret, err); 260*f0865ec9SKyle Evans ret = sha0_final(&ctx, output); 261*f0865ec9SKyle Evans 262*f0865ec9SKyle Evans err: 263*f0865ec9SKyle Evans return ret; 264*f0865ec9SKyle Evans } 265