eee16120 |
1 | /* -*-c-*- |
eee16120 |
2 | * |
3 | * Implementation of the SHA-256 hash function |
4 | * |
5 | * (c) 2000 Straylight/Edgeware |
6 | */ |
7 | |
45c0fd36 |
8 | /*----- Licensing notice --------------------------------------------------* |
eee16120 |
9 | * |
10 | * This file is part of Catacomb. |
11 | * |
12 | * Catacomb is free software; you can redistribute it and/or modify |
13 | * it under the terms of the GNU Library General Public License as |
14 | * published by the Free Software Foundation; either version 2 of the |
15 | * License, or (at your option) any later version. |
45c0fd36 |
16 | * |
eee16120 |
17 | * Catacomb is distributed in the hope that it will be useful, |
18 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
20 | * GNU Library General Public License for more details. |
45c0fd36 |
21 | * |
eee16120 |
22 | * You should have received a copy of the GNU Library General Public |
23 | * License along with Catacomb; if not, write to the Free |
24 | * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, |
25 | * MA 02111-1307, USA. |
26 | */ |
27 | |
eee16120 |
28 | /*----- Header files ------------------------------------------------------*/ |
29 | |
30 | #include <mLib/bits.h> |
31 | |
32 | #include "ghash.h" |
33 | #include "ghash-def.h" |
34 | #include "hash.h" |
35 | #include "sha256.h" |
36 | |
37 | /*----- Main code ---------------------------------------------------------*/ |
38 | |
5b69c389 |
39 | /* --- @sha256_compress@, @sha224_compress@ --- * |
eee16120 |
40 | * |
41 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
42 | * @const void *sbuf@ = pointer to buffer of appropriate size |
43 | * |
44 | * Returns: --- |
45 | * |
46 | * Use: SHA-256 compression function. |
47 | */ |
48 | |
49 | void sha256_compress(sha256_ctx *ctx, const void *sbuf) |
50 | { |
51 | uint32 a, b, c, d, e, f, g, h; |
52 | uint32 buf[64]; |
53 | |
54 | /* --- Fetch the chaining variables --- */ |
55 | |
56 | a = ctx->a; |
57 | b = ctx->b; |
58 | c = ctx->c; |
59 | d = ctx->d; |
60 | e = ctx->e; |
61 | f = ctx->f; |
62 | g = ctx->g; |
63 | h = ctx->h; |
64 | |
65 | /* --- Definitions for round functions --- */ |
66 | |
67 | #define CH(x, y, z) (((x) & (y)) | (~(x) & (z))) |
68 | #define MAJ(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z))) |
69 | |
70 | #define S0(x) (ROR32((x), 2) ^ ROR32((x), 13) ^ ROR32((x), 22)) |
71 | #define S1(x) (ROR32((x), 6) ^ ROR32((x), 11) ^ ROR32((x), 25)) |
72 | #define s0(x) (ROR32((x), 7) ^ ROR32((x), 18) ^ LSR32((x), 3)) |
73 | #define s1(x) (ROR32((x), 17) ^ ROR32((x), 19) ^ LSR32((x), 10)) |
74 | |
75 | #define T(a, b, c, d, e, f, g, h, i, k) do { \ |
76 | uint32 t1 = h + S1(e) + CH(e, f, g) + k + buf[i]; \ |
77 | uint32 t2 = S0(a) + MAJ(a, b, c); \ |
78 | d += t1; h = t1 + t2; \ |
79 | } while (0) |
80 | |
81 | /* --- Fetch and expand the buffer contents --- */ |
82 | |
83 | { |
84 | int i; |
85 | const octet *p; |
86 | |
87 | for (i = 0, p = sbuf; i < 16; i++, p += 4) |
88 | buf[i] = LOAD32(p); |
89 | for (i = 16; i < 64; i++) |
90 | buf[i] = s1(buf[i - 2]) + buf[i - 7] + s0(buf[i - 15]) + buf[i - 16]; |
91 | } |
92 | |
93 | /* --- The main compression function --- */ |
45c0fd36 |
94 | |
eee16120 |
95 | T(a, b, c, d, e, f, g, h, 0, 0x428a2f98); |
96 | T(h, a, b, c, d, e, f, g, 1, 0x71374491); |
97 | T(g, h, a, b, c, d, e, f, 2, 0xb5c0fbcf); |
98 | T(f, g, h, a, b, c, d, e, 3, 0xe9b5dba5); |
99 | T(e, f, g, h, a, b, c, d, 4, 0x3956c25b); |
100 | T(d, e, f, g, h, a, b, c, 5, 0x59f111f1); |
101 | T(c, d, e, f, g, h, a, b, 6, 0x923f82a4); |
102 | T(b, c, d, e, f, g, h, a, 7, 0xab1c5ed5); |
103 | T(a, b, c, d, e, f, g, h, 8, 0xd807aa98); |
104 | T(h, a, b, c, d, e, f, g, 9, 0x12835b01); |
105 | T(g, h, a, b, c, d, e, f, 10, 0x243185be); |
106 | T(f, g, h, a, b, c, d, e, 11, 0x550c7dc3); |
107 | T(e, f, g, h, a, b, c, d, 12, 0x72be5d74); |
108 | T(d, e, f, g, h, a, b, c, 13, 0x80deb1fe); |
109 | T(c, d, e, f, g, h, a, b, 14, 0x9bdc06a7); |
110 | T(b, c, d, e, f, g, h, a, 15, 0xc19bf174); |
111 | T(a, b, c, d, e, f, g, h, 16, 0xe49b69c1); |
112 | T(h, a, b, c, d, e, f, g, 17, 0xefbe4786); |
113 | T(g, h, a, b, c, d, e, f, 18, 0x0fc19dc6); |
114 | T(f, g, h, a, b, c, d, e, 19, 0x240ca1cc); |
115 | T(e, f, g, h, a, b, c, d, 20, 0x2de92c6f); |
116 | T(d, e, f, g, h, a, b, c, 21, 0x4a7484aa); |
117 | T(c, d, e, f, g, h, a, b, 22, 0x5cb0a9dc); |
118 | T(b, c, d, e, f, g, h, a, 23, 0x76f988da); |
119 | T(a, b, c, d, e, f, g, h, 24, 0x983e5152); |
120 | T(h, a, b, c, d, e, f, g, 25, 0xa831c66d); |
121 | T(g, h, a, b, c, d, e, f, 26, 0xb00327c8); |
122 | T(f, g, h, a, b, c, d, e, 27, 0xbf597fc7); |
123 | T(e, f, g, h, a, b, c, d, 28, 0xc6e00bf3); |
124 | T(d, e, f, g, h, a, b, c, 29, 0xd5a79147); |
125 | T(c, d, e, f, g, h, a, b, 30, 0x06ca6351); |
126 | T(b, c, d, e, f, g, h, a, 31, 0x14292967); |
127 | T(a, b, c, d, e, f, g, h, 32, 0x27b70a85); |
128 | T(h, a, b, c, d, e, f, g, 33, 0x2e1b2138); |
129 | T(g, h, a, b, c, d, e, f, 34, 0x4d2c6dfc); |
130 | T(f, g, h, a, b, c, d, e, 35, 0x53380d13); |
131 | T(e, f, g, h, a, b, c, d, 36, 0x650a7354); |
132 | T(d, e, f, g, h, a, b, c, 37, 0x766a0abb); |
133 | T(c, d, e, f, g, h, a, b, 38, 0x81c2c92e); |
134 | T(b, c, d, e, f, g, h, a, 39, 0x92722c85); |
135 | T(a, b, c, d, e, f, g, h, 40, 0xa2bfe8a1); |
136 | T(h, a, b, c, d, e, f, g, 41, 0xa81a664b); |
137 | T(g, h, a, b, c, d, e, f, 42, 0xc24b8b70); |
138 | T(f, g, h, a, b, c, d, e, 43, 0xc76c51a3); |
139 | T(e, f, g, h, a, b, c, d, 44, 0xd192e819); |
140 | T(d, e, f, g, h, a, b, c, 45, 0xd6990624); |
141 | T(c, d, e, f, g, h, a, b, 46, 0xf40e3585); |
142 | T(b, c, d, e, f, g, h, a, 47, 0x106aa070); |
143 | T(a, b, c, d, e, f, g, h, 48, 0x19a4c116); |
144 | T(h, a, b, c, d, e, f, g, 49, 0x1e376c08); |
145 | T(g, h, a, b, c, d, e, f, 50, 0x2748774c); |
146 | T(f, g, h, a, b, c, d, e, 51, 0x34b0bcb5); |
147 | T(e, f, g, h, a, b, c, d, 52, 0x391c0cb3); |
148 | T(d, e, f, g, h, a, b, c, 53, 0x4ed8aa4a); |
149 | T(c, d, e, f, g, h, a, b, 54, 0x5b9cca4f); |
150 | T(b, c, d, e, f, g, h, a, 55, 0x682e6ff3); |
151 | T(a, b, c, d, e, f, g, h, 56, 0x748f82ee); |
152 | T(h, a, b, c, d, e, f, g, 57, 0x78a5636f); |
153 | T(g, h, a, b, c, d, e, f, 58, 0x84c87814); |
154 | T(f, g, h, a, b, c, d, e, 59, 0x8cc70208); |
155 | T(e, f, g, h, a, b, c, d, 60, 0x90befffa); |
156 | T(d, e, f, g, h, a, b, c, 61, 0xa4506ceb); |
157 | T(c, d, e, f, g, h, a, b, 62, 0xbef9a3f7); |
158 | T(b, c, d, e, f, g, h, a, 63, 0xc67178f2); |
159 | |
160 | /* --- Update the chaining variables --- */ |
161 | |
162 | ctx->a += a; |
163 | ctx->b += b; |
164 | ctx->c += c; |
165 | ctx->d += d; |
166 | ctx->e += e; |
167 | ctx->f += f; |
168 | ctx->g += g; |
169 | ctx->h += h; |
170 | } |
171 | |
5b69c389 |
172 | /* --- @sha256_init@, @sha224_init@ --- * |
eee16120 |
173 | * |
174 | * Arguments: @sha256_ctx *ctx@ = pointer to context block to initialize |
175 | * |
176 | * Returns: --- |
177 | * |
178 | * Use: Initializes a context block ready for hashing. |
179 | */ |
180 | |
181 | void sha256_init(sha256_ctx *ctx) |
182 | { |
183 | ctx->a = 0x6a09e667; |
184 | ctx->b = 0xbb67ae85; |
185 | ctx->c = 0x3c6ef372; |
186 | ctx->d = 0xa54ff53a; |
187 | ctx->e = 0x510e527f; |
188 | ctx->f = 0x9b05688c; |
189 | ctx->g = 0x1f83d9ab; |
190 | ctx->h = 0x5be0cd19; |
191 | ctx->off = 0; |
192 | ctx->nl = ctx->nh = 0; |
193 | } |
194 | |
5b69c389 |
195 | void sha224_init(sha256_ctx *ctx) |
196 | { |
197 | ctx->a = 0xc1059ed8; |
198 | ctx->b = 0x367cd507; |
199 | ctx->c = 0x3070dd17; |
200 | ctx->d = 0xf70e5939; |
201 | ctx->e = 0xffc00b31; |
202 | ctx->f = 0x68581511; |
203 | ctx->g = 0x64f98fa7; |
204 | ctx->h = 0xbefa4fa4; |
205 | ctx->off = 0; |
206 | ctx->nl = ctx->nh = 0; |
207 | } |
208 | |
209 | /* --- @sha256_set@, @sha224_set@ --- * |
eee16120 |
210 | * |
211 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
212 | * @const void *buf@ = pointer to state buffer |
213 | * @unsigned long count@ = current count of bytes processed |
214 | * |
215 | * Returns: --- |
216 | * |
217 | * Use: Initializes a context block from a given state. This is |
218 | * useful in cases where the initial hash state is meant to be |
219 | * secret, e.g., for NMAC and HMAC support. |
220 | */ |
221 | |
222 | void sha256_set(sha256_ctx *ctx, const void *buf, unsigned long count) |
223 | { |
224 | const octet *p = buf; |
225 | ctx->a = LOAD32(p + 0); |
226 | ctx->b = LOAD32(p + 4); |
227 | ctx->c = LOAD32(p + 8); |
228 | ctx->d = LOAD32(p + 12); |
229 | ctx->e = LOAD32(p + 16); |
230 | ctx->f = LOAD32(p + 20); |
231 | ctx->g = LOAD32(p + 24); |
232 | ctx->h = LOAD32(p + 28); |
233 | ctx->off = 0; |
234 | ctx->nl = U32(count); |
235 | ctx->nh = U32(((count & ~MASK32) >> 16) >> 16); |
236 | } |
237 | |
5b69c389 |
238 | /* --- @sha256_hash@, @sha224_hash@ --- * |
eee16120 |
239 | * |
240 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
241 | * @const void *buf@ = buffer of data to hash |
242 | * @size_t sz@ = size of buffer to hash |
243 | * |
244 | * Returns: --- |
245 | * |
246 | * Use: Hashes a buffer of data. The buffer may be of any size and |
247 | * alignment. |
248 | */ |
249 | |
250 | void sha256_hash(sha256_ctx *ctx, const void *buf, size_t sz) |
251 | { |
252 | HASH_BUFFER(SHA256, sha256, ctx, buf, sz); |
253 | } |
254 | |
5b69c389 |
255 | /* --- @sha256_done, @sha224_done@ --- * |
eee16120 |
256 | * |
257 | * Arguments: @sha256_ctx *ctx@ = pointer to context block |
258 | * @void *hash@ = pointer to output buffer |
259 | * |
260 | * Returns: --- |
261 | * |
262 | * Use: Returns the hash of the data read so far. |
263 | */ |
264 | |
5b69c389 |
265 | static void final(sha256_ctx *ctx) |
eee16120 |
266 | { |
eee16120 |
267 | HASH_PAD(SHA256, sha256, ctx, 0x80, 0, 8); |
268 | STORE32(ctx->buf + SHA256_BUFSZ - 8, (ctx->nl >> 29) | (ctx->nh << 3)); |
269 | STORE32(ctx->buf + SHA256_BUFSZ - 4, ctx->nl << 3); |
45c0fd36 |
270 | sha256_compress(ctx, ctx->buf); |
5b69c389 |
271 | } |
272 | |
273 | void sha256_done(sha256_ctx *ctx, void *hash) |
274 | { |
275 | octet *p = hash; |
276 | final(ctx); |
eee16120 |
277 | STORE32(p + 0, ctx->a); |
278 | STORE32(p + 4, ctx->b); |
279 | STORE32(p + 8, ctx->c); |
280 | STORE32(p + 12, ctx->d); |
281 | STORE32(p + 16, ctx->e); |
282 | STORE32(p + 20, ctx->f); |
283 | STORE32(p + 24, ctx->g); |
284 | STORE32(p + 28, ctx->h); |
285 | } |
286 | |
5b69c389 |
287 | void sha224_done(sha224_ctx *ctx, void *hash) |
288 | { |
289 | octet *p = hash; |
290 | final(ctx); |
291 | STORE32(p + 0, ctx->a); |
292 | STORE32(p + 4, ctx->b); |
293 | STORE32(p + 8, ctx->c); |
294 | STORE32(p + 12, ctx->d); |
295 | STORE32(p + 16, ctx->e); |
296 | STORE32(p + 20, ctx->f); |
297 | STORE32(p + 24, ctx->g); |
298 | } |
299 | |
300 | /* --- @sha256_state@, @sha224_state@ --- * |
eee16120 |
301 | * |
302 | * Arguments: @sha256_ctx *ctx@ = pointer to context |
303 | * @void *state@ = pointer to buffer for current state |
304 | * |
305 | * Returns: Number of bytes written to the hash function so far. |
306 | * |
307 | * Use: Returns the current state of the hash function such that |
308 | * it can be passed to @sha256_set@. |
309 | */ |
310 | |
311 | unsigned long sha256_state(sha256_ctx *ctx, void *state) |
312 | { |
313 | octet *p = state; |
314 | STORE32(p + 0, ctx->a); |
315 | STORE32(p + 4, ctx->b); |
316 | STORE32(p + 8, ctx->c); |
317 | STORE32(p + 12, ctx->d); |
318 | STORE32(p + 16, ctx->e); |
319 | STORE32(p + 20, ctx->f); |
320 | STORE32(p + 24, ctx->g); |
321 | STORE32(p + 28, ctx->h); |
322 | return (ctx->nl | ((ctx->nh << 16) << 16)); |
323 | } |
324 | |
325 | /* --- Generic interface --- */ |
326 | |
327 | GHASH_DEF(SHA256, sha256) |
328 | |
329 | /* --- Test code --- */ |
330 | |
331 | HASH_TEST(SHA256, sha256) |
332 | |
333 | /*----- That's all, folks -------------------------------------------------*/ |