tc/crypto/Sha1.c

   1 /* Deprecated/legacy */
   2
   3 /*
   4  ---------------------------------------------------------------------------
   5  Copyright (c) 2002, Dr Brian Gladman, Worcester, UK.   All rights reserved.
   6
   7  LICENSE TERMS
   8
   9  The free distribution and use of this software is allowed (with or without
  10  changes) provided that:
  11
  12   1. source code distributions include the above copyright notice, this
  13      list of conditions and the following disclaimer;
  14
  15   2. binary distributions include the above copyright notice, this list
  16      of conditions and the following disclaimer in their documentation;
  17
  18   3. the name of the copyright holder is not used to endorse products
  19      built using this software without specific written permission.
  20
  21  DISCLAIMER
  22
  23  This software is provided 'as is' with no explicit or implied warranties
  24  in respect of its properties, including, but not limited to, correctness
  25  and/or fitness for purpose.
  26  ---------------------------------------------------------------------------
  27  Issue Date: 18/06/2004
  28
  29  This is a byte oriented version of SHA1 that operates on arrays of bytes
  30  stored in memory.
  31 */
  32
  33 #include <string.h>     /* for memcpy() etc.        */
  34 #include <stdlib.h>     /* for _lrotl with VC++     */
  35
  36 #include "Sha1.h"
  37
  38 #if defined(__cplusplus)
  39 extern "C"
  40 {
  41 #endif
  42
  43 /*
  44     To obtain the highest speed on processors with 32-bit words, this code
  45     needs to determine the order in which bytes are packed into such words.
  46     The following block of code is an attempt to capture the most obvious
  47     ways in which various environemnts specify their endian definitions.
  48     It may well fail, in which case the definitions will need to be set by
  49     editing at the points marked **** EDIT HERE IF NECESSARY **** below.
  50 */
  51
  52 /*  PLATFORM SPECIFIC INCLUDES */
  53
  54 /* Original byte order detection removed */
  55 #include "../Common/Endian.h"
  56
  57 #define BRG_LITTLE_ENDIAN   1234 /* byte 0 is least significant (i386) */
  58 #define BRG_BIG_ENDIAN      4321 /* byte 0 is most significant (mc68k) */
  59
  60 #if BYTE_ORDER == LITTLE_ENDIAN
  61 #  define PLATFORM_BYTE_ORDER BRG_LITTLE_ENDIAN
  62 #endif
  63
  64 #if BYTE_ORDER == BIG_ENDIAN
  65 #  define PLATFORM_BYTE_ORDER BRG_BIG_ENDIAN
  66 #endif
  67
  68 #ifdef _MSC_VER
  69 #pragma intrinsic(memcpy)
  70 #endif
  71
  72 #if 1 && defined(_MSC_VER) && !defined(_DEBUG)
  73 #define rotl32  _rotl
  74 #define rotr32  _rotr
  75 #else
  76 #define rotl32(x,n)   (((x) << n) | ((x) >> (32 - n)))
  77 #define rotr32(x,n)   (((x) >> n) | ((x) << (32 - n)))
  78 #endif
  79
  80 #if !defined(bswap_32)
  81 #define bswap_32(x) (rotr32((x), 24) & 0x00ff00ff | rotr32((x), 8) & 0xff00ff00)
  82 #endif
  83
  84 #if (PLATFORM_BYTE_ORDER == BRG_LITTLE_ENDIAN)
  85 #define SWAP_BYTES
  86 #else
  87 #undef  SWAP_BYTES
  88 #endif
  89
  90 #if defined(SWAP_BYTES)
  91 #define bsw_32(p,n) \
  92     { int _i = (n); while(_i--) ((sha1_32t*)p)[_i] = bswap_32(((sha1_32t*)p)[_i]); }
  93 #else
  94 #define bsw_32(p,n)
  95 #endif
  96
  97 #define SHA1_MASK   (SHA1_BLOCK_SIZE - 1)
  98
  99 #if 0
 100
 101 #define ch(x,y,z)       (((x) & (y)) ^ (~(x) & (z)))
 102 #define parity(x,y,z)   ((x) ^ (y) ^ (z))
 103 #define maj(x,y,z)      (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
 104
 105 #else   /* Discovered by Rich Schroeppel and Colin Plumb   */
 106
 107 #define ch(x,y,z)       ((z) ^ ((x) & ((y) ^ (z))))
 108 #define parity(x,y,z)   ((x) ^ (y) ^ (z))
 109 #define maj(x,y,z)      (((x) & (y)) | ((z) & ((x) ^ (y))))
 110
 111 #endif
 112
 113 /* Compile 64 bytes of hash data into SHA1 context. Note    */
 114 /* that this routine assumes that the byte order in the     */
 115 /* ctx->wbuf[] at this point is in such an order that low   */
 116 /* address bytes in the ORIGINAL byte stream will go in     */
 117 /* this buffer to the high end of 32-bit words on BOTH big  */
 118 /* and little endian systems                                */
 119
 120 #ifdef ARRAY
 121 #define q(v,n)  v[n]
 122 #else
 123 #define q(v,n)  v##n
 124 #endif
 125
 126 #define one_cycle(v,a,b,c,d,e,f,k,h)            \
 127     q(v,e) += rotr32(q(v,a),27) +               \
 128               f(q(v,b),q(v,c),q(v,d)) + k + h;  \
 129     q(v,b)  = rotr32(q(v,b), 2)
 130
 131 #define five_cycle(v,f,k,i)                 \
 132     one_cycle(v, 0,1,2,3,4, f,k,hf(i  ));   \
 133     one_cycle(v, 4,0,1,2,3, f,k,hf(i+1));   \
 134     one_cycle(v, 3,4,0,1,2, f,k,hf(i+2));   \
 135     one_cycle(v, 2,3,4,0,1, f,k,hf(i+3));   \
 136     one_cycle(v, 1,2,3,4,0, f,k,hf(i+4))
 137
 138 void sha1_compile(sha1_ctx ctx[1])
 139 {   sha1_32t    *w = ctx->wbuf;
 140
 141 #ifdef ARRAY
 142     sha1_32t    v[5];
 143     memcpy(v, ctx->hash, 5 * sizeof(sha1_32t));
 144 #else
 145     sha1_32t    v0, v1, v2, v3, v4;
 146     v0 = ctx->hash[0]; v1 = ctx->hash[1];
 147     v2 = ctx->hash[2]; v3 = ctx->hash[3];
 148     v4 = ctx->hash[4];
 149 #endif
 150
 151 #define hf(i)   w[i]
 152
 153     five_cycle(v, ch, 0x5a827999,  0);
 154     five_cycle(v, ch, 0x5a827999,  5);
 155     five_cycle(v, ch, 0x5a827999, 10);
 156     one_cycle(v,0,1,2,3,4, ch, 0x5a827999, hf(15)); \
 157
 158 #undef  hf
 159 #define hf(i) (w[(i) & 15] = rotl32(                    \
 160                  w[((i) + 13) & 15] ^ w[((i) + 8) & 15] \
 161                ^ w[((i) +  2) & 15] ^ w[(i) & 15], 1))
 162
 163     one_cycle(v,4,0,1,2,3, ch, 0x5a827999, hf(16));
 164     one_cycle(v,3,4,0,1,2, ch, 0x5a827999, hf(17));
 165     one_cycle(v,2,3,4,0,1, ch, 0x5a827999, hf(18));
 166     one_cycle(v,1,2,3,4,0, ch, 0x5a827999, hf(19));
 167
 168     five_cycle(v, parity, 0x6ed9eba1,  20);
 169     five_cycle(v, parity, 0x6ed9eba1,  25);
 170     five_cycle(v, parity, 0x6ed9eba1,  30);
 171     five_cycle(v, parity, 0x6ed9eba1,  35);
 172
 173     five_cycle(v, maj, 0x8f1bbcdc,  40);
 174     five_cycle(v, maj, 0x8f1bbcdc,  45);
 175     five_cycle(v, maj, 0x8f1bbcdc,  50);
 176     five_cycle(v, maj, 0x8f1bbcdc,  55);
 177
 178     five_cycle(v, parity, 0xca62c1d6,  60);
 179     five_cycle(v, parity, 0xca62c1d6,  65);
 180     five_cycle(v, parity, 0xca62c1d6,  70);
 181     five_cycle(v, parity, 0xca62c1d6,  75);
 182
 183 #ifdef ARRAY
 184     ctx->hash[0] += v[0]; ctx->hash[1] += v[1];
 185     ctx->hash[2] += v[2]; ctx->hash[3] += v[3];
 186     ctx->hash[4] += v[4];
 187 #else
 188     ctx->hash[0] += v0; ctx->hash[1] += v1;
 189     ctx->hash[2] += v2; ctx->hash[3] += v3;
 190     ctx->hash[4] += v4;
 191 #endif
 192 }
 193
 194 void sha1_begin(sha1_ctx ctx[1])
 195 {
 196     ctx->count[0] = ctx->count[1] = 0;
 197     ctx->hash[0] = 0x67452301;
 198     ctx->hash[1] = 0xefcdab89;
 199     ctx->hash[2] = 0x98badcfe;
 200     ctx->hash[3] = 0x10325476;
 201     ctx->hash[4] = 0xc3d2e1f0;
 202 }
 203
 204 /* SHA1 hash data in an array of bytes into hash buffer and */
 205 /* call the hash_compile function as required.              */
 206
 207 void sha1_hash(const unsigned char data[], unsigned __int32 len, sha1_ctx ctx[1])
 208 {   sha1_32t pos = (sha1_32t)(ctx->count[0] & SHA1_MASK),
 209             space = SHA1_BLOCK_SIZE - pos;
 210     const unsigned char *sp = data;
 211
 212     if((ctx->count[0] += len) < len)
 213         ++(ctx->count[1]);
 214
 215     while(len >= space)     /* tranfer whole blocks if possible  */
 216     {
 217         memcpy(((unsigned char*)ctx->wbuf) + pos, sp, space);
 218         sp += space; len -= space; space = SHA1_BLOCK_SIZE; pos = 0;
 219         bsw_32(ctx->wbuf, SHA1_BLOCK_SIZE >> 2);
 220         sha1_compile(ctx);
 221     }
 222
 223     memcpy(((unsigned char*)ctx->wbuf) + pos, sp, len);
 224 }
 225
 226 /* SHA1 final padding and digest calculation  */
 227
 228 void sha1_end(unsigned char hval[], sha1_ctx ctx[1])
 229 {   sha1_32t    i = (sha1_32t)(ctx->count[0] & SHA1_MASK);
 230
 231     /* put bytes in the buffer in an order in which references to   */
 232     /* 32-bit words will put bytes with lower addresses into the    */
 233     /* top of 32 bit words on BOTH big and little endian machines   */
 234     bsw_32(ctx->wbuf, (i + 3) >> 2);
 235
 236     /* we now need to mask valid bytes and add the padding which is */
 237     /* a single 1 bit and as many zero bits as necessary. Note that */
 238     /* we can always add the first padding byte here because the    */
 239     /* buffer always has at least one empty slot                    */
 240     ctx->wbuf[i >> 2] &= 0xffffff80 << 8 * (~i & 3);
 241     ctx->wbuf[i >> 2] |= 0x00000080 << 8 * (~i & 3);
 242
 243     /* we need 9 or more empty positions, one for the padding byte  */
 244     /* (above) and eight for the length count. If there is not      */
 245     /* enough space, pad and empty the buffer                       */
 246     if(i > SHA1_BLOCK_SIZE - 9)
 247     {
 248         if(i < 60) ctx->wbuf[15] = 0;
 249         sha1_compile(ctx);
 250         i = 0;
 251     }
 252     else    /* compute a word index for the empty buffer positions  */
 253         i = (i >> 2) + 1;
 254
 255     while(i < 14) /* and zero pad all but last two positions        */
 256         ctx->wbuf[i++] = 0;
 257
 258     /* the following 32-bit length fields are assembled in the      */
 259     /* wrong byte order on little endian machines but this is       */
 260     /* corrected later since they are only ever used as 32-bit      */
 261     /* word values.                                                 */
 262     ctx->wbuf[14] = (ctx->count[1] << 3) | (ctx->count[0] >> 29);
 263     ctx->wbuf[15] = ctx->count[0] << 3;
 264     sha1_compile(ctx);
 265
 266     /* extract the hash value as bytes in case the hash buffer is   */
 267     /* misaligned for 32-bit words                                  */
 268     for(i = 0; i < SHA1_DIGEST_SIZE; ++i)
 269         hval[i] = (unsigned char)(ctx->hash[i >> 2] >> (8 * (~i & 3)));
 270 }
 271
 272 void sha1(unsigned char hval[], const unsigned char data[], unsigned __int32 len)
 273 {   sha1_ctx    cx[1];
 274
 275     sha1_begin(cx); sha1_hash(data, len, cx); sha1_end(hval, cx);
 276 }
 277
 278 #if defined(__cplusplus)
 279 }
 280 #endif