lib/libalpm/sha2.c

   1 /*
   2  *  FIPS-180-2 compliant SHA-256 implementation
   3  *
   4  *  Copyright (C) 2006-2010, Brainspark B.V.
   5  *
   6  *  This file is part of PolarSSL (http://www.polarssl.org)
   7  *  Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
   8  *
   9  *  All rights reserved.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23  */
  24 /*
  25  *  The SHA-256 Secure Hash Standard was published by NIST in 2002.
  26  *
  27  *  http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
  28  */
  29 /*
  30  *  Pacman Notes:
  31  *
  32  *  Taken from the PolarSSL project at http://polarssl.org under terms of the
  33  *  GPL. This is from version 1.0.0 of the library, and has been modified
  34  *  as following, which may be helpful for future updates:
  35  *  * remove "polarssl/config.h" include
  36  *  * change include from "polarssl/md5.h" to "md5.h"
  37  *  * removal of HMAC code
  38  *  * removal of SELF_TEST code
  39  *  * removal of ipad and opad from the sha2_context struct in sha2.h
  40  *  * increase the size of buffer for performance reasons
  41  *  * various static changes
  42  */
  43
  44 #include <stdio.h>
  45
  46 #include "sha2.h"
  47
  48 /*
  49  * 32-bit integer manipulation macros (big endian)
  50  */
  51 #ifndef GET_ULONG_BE
  52 #define GET_ULONG_BE(n,b,i)                             \
  53 {                                                       \
  54     (n) = ( (unsigned long) (b)[(i)    ] << 24 )        \
  55         | ( (unsigned long) (b)[(i) + 1] << 16 )        \
  56         | ( (unsigned long) (b)[(i) + 2] <<  8 )        \
  57         | ( (unsigned long) (b)[(i) + 3]       );       \
  58 }
  59 #endif
  60
  61 #ifndef PUT_ULONG_BE
  62 #define PUT_ULONG_BE(n,b,i)                             \
  63 {                                                       \
  64     (b)[(i)    ] = (unsigned char) ( (n) >> 24 );       \
  65     (b)[(i) + 1] = (unsigned char) ( (n) >> 16 );       \
  66     (b)[(i) + 2] = (unsigned char) ( (n) >>  8 );       \
  67     (b)[(i) + 3] = (unsigned char) ( (n)       );       \
  68 }
  69 #endif
  70
  71 /*
  72  * SHA-256 context setup
  73  */
  74 static void sha2_starts( sha2_context *ctx, int is224 )
  75 {
  76     ctx->total[0] = 0;
  77     ctx->total[1] = 0;
  78
  79     if( is224 == 0 )
  80     {
  81         /* SHA-256 */
  82         ctx->state[0] = 0x6A09E667;
  83         ctx->state[1] = 0xBB67AE85;
  84         ctx->state[2] = 0x3C6EF372;
  85         ctx->state[3] = 0xA54FF53A;
  86         ctx->state[4] = 0x510E527F;
  87         ctx->state[5] = 0x9B05688C;
  88         ctx->state[6] = 0x1F83D9AB;
  89         ctx->state[7] = 0x5BE0CD19;
  90     }
  91     else
  92     {
  93         /* SHA-224 */
  94         ctx->state[0] = 0xC1059ED8;
  95         ctx->state[1] = 0x367CD507;
  96         ctx->state[2] = 0x3070DD17;
  97         ctx->state[3] = 0xF70E5939;
  98         ctx->state[4] = 0xFFC00B31;
  99         ctx->state[5] = 0x68581511;
 100         ctx->state[6] = 0x64F98FA7;
 101         ctx->state[7] = 0xBEFA4FA4;
 102     }
 103
 104     ctx->is224 = is224;
 105 }
 106
 107 static void sha2_process( sha2_context *ctx, const unsigned char data[64] )
 108 {
 109     unsigned long temp1, temp2, W[64];
 110     unsigned long A, B, C, D, E, F, G, H;
 111
 112     GET_ULONG_BE( W[ 0], data,  0 );
 113     GET_ULONG_BE( W[ 1], data,  4 );
 114     GET_ULONG_BE( W[ 2], data,  8 );
 115     GET_ULONG_BE( W[ 3], data, 12 );
 116     GET_ULONG_BE( W[ 4], data, 16 );
 117     GET_ULONG_BE( W[ 5], data, 20 );
 118     GET_ULONG_BE( W[ 6], data, 24 );
 119     GET_ULONG_BE( W[ 7], data, 28 );
 120     GET_ULONG_BE( W[ 8], data, 32 );
 121     GET_ULONG_BE( W[ 9], data, 36 );
 122     GET_ULONG_BE( W[10], data, 40 );
 123     GET_ULONG_BE( W[11], data, 44 );
 124     GET_ULONG_BE( W[12], data, 48 );
 125     GET_ULONG_BE( W[13], data, 52 );
 126     GET_ULONG_BE( W[14], data, 56 );
 127     GET_ULONG_BE( W[15], data, 60 );
 128
 129 #define  SHR(x,n) ((x & 0xFFFFFFFF) >> n)
 130 #define ROTR(x,n) (SHR(x,n) | (x << (32 - n)))
 131
 132 #define S0(x) (ROTR(x, 7) ^ ROTR(x,18) ^  SHR(x, 3))
 133 #define S1(x) (ROTR(x,17) ^ ROTR(x,19) ^  SHR(x,10))
 134
 135 #define S2(x) (ROTR(x, 2) ^ ROTR(x,13) ^ ROTR(x,22))
 136 #define S3(x) (ROTR(x, 6) ^ ROTR(x,11) ^ ROTR(x,25))
 137
 138 #define F0(x,y,z) ((x & y) | (z & (x | y)))
 139 #define F1(x,y,z) (z ^ (x & (y ^ z)))
 140
 141 #define R(t)                                    \
 142 (                                               \
 143     W[t] = S1(W[t -  2]) + W[t -  7] +          \
 144            S0(W[t - 15]) + W[t - 16]            \
 145 )
 146
 147 #define P(a,b,c,d,e,f,g,h,x,K)                  \
 148 {                                               \
 149     temp1 = h + S3(e) + F1(e,f,g) + K + x;      \
 150     temp2 = S2(a) + F0(a,b,c);                  \
 151     d += temp1; h = temp1 + temp2;              \
 152 }
 153
 154     A = ctx->state[0];
 155     B = ctx->state[1];
 156     C = ctx->state[2];
 157     D = ctx->state[3];
 158     E = ctx->state[4];
 159     F = ctx->state[5];
 160     G = ctx->state[6];
 161     H = ctx->state[7];
 162
 163     P( A, B, C, D, E, F, G, H, W[ 0], 0x428A2F98 );
 164     P( H, A, B, C, D, E, F, G, W[ 1], 0x71374491 );
 165     P( G, H, A, B, C, D, E, F, W[ 2], 0xB5C0FBCF );
 166     P( F, G, H, A, B, C, D, E, W[ 3], 0xE9B5DBA5 );
 167     P( E, F, G, H, A, B, C, D, W[ 4], 0x3956C25B );
 168     P( D, E, F, G, H, A, B, C, W[ 5], 0x59F111F1 );
 169     P( C, D, E, F, G, H, A, B, W[ 6], 0x923F82A4 );
 170     P( B, C, D, E, F, G, H, A, W[ 7], 0xAB1C5ED5 );
 171     P( A, B, C, D, E, F, G, H, W[ 8], 0xD807AA98 );
 172     P( H, A, B, C, D, E, F, G, W[ 9], 0x12835B01 );
 173     P( G, H, A, B, C, D, E, F, W[10], 0x243185BE );
 174     P( F, G, H, A, B, C, D, E, W[11], 0x550C7DC3 );
 175     P( E, F, G, H, A, B, C, D, W[12], 0x72BE5D74 );
 176     P( D, E, F, G, H, A, B, C, W[13], 0x80DEB1FE );
 177     P( C, D, E, F, G, H, A, B, W[14], 0x9BDC06A7 );
 178     P( B, C, D, E, F, G, H, A, W[15], 0xC19BF174 );
 179     P( A, B, C, D, E, F, G, H, R(16), 0xE49B69C1 );
 180     P( H, A, B, C, D, E, F, G, R(17), 0xEFBE4786 );
 181     P( G, H, A, B, C, D, E, F, R(18), 0x0FC19DC6 );
 182     P( F, G, H, A, B, C, D, E, R(19), 0x240CA1CC );
 183     P( E, F, G, H, A, B, C, D, R(20), 0x2DE92C6F );
 184     P( D, E, F, G, H, A, B, C, R(21), 0x4A7484AA );
 185     P( C, D, E, F, G, H, A, B, R(22), 0x5CB0A9DC );
 186     P( B, C, D, E, F, G, H, A, R(23), 0x76F988DA );
 187     P( A, B, C, D, E, F, G, H, R(24), 0x983E5152 );
 188     P( H, A, B, C, D, E, F, G, R(25), 0xA831C66D );
 189     P( G, H, A, B, C, D, E, F, R(26), 0xB00327C8 );
 190     P( F, G, H, A, B, C, D, E, R(27), 0xBF597FC7 );
 191     P( E, F, G, H, A, B, C, D, R(28), 0xC6E00BF3 );
 192     P( D, E, F, G, H, A, B, C, R(29), 0xD5A79147 );
 193     P( C, D, E, F, G, H, A, B, R(30), 0x06CA6351 );
 194     P( B, C, D, E, F, G, H, A, R(31), 0x14292967 );
 195     P( A, B, C, D, E, F, G, H, R(32), 0x27B70A85 );
 196     P( H, A, B, C, D, E, F, G, R(33), 0x2E1B2138 );
 197     P( G, H, A, B, C, D, E, F, R(34), 0x4D2C6DFC );
 198     P( F, G, H, A, B, C, D, E, R(35), 0x53380D13 );
 199     P( E, F, G, H, A, B, C, D, R(36), 0x650A7354 );
 200     P( D, E, F, G, H, A, B, C, R(37), 0x766A0ABB );
 201     P( C, D, E, F, G, H, A, B, R(38), 0x81C2C92E );
 202     P( B, C, D, E, F, G, H, A, R(39), 0x92722C85 );
 203     P( A, B, C, D, E, F, G, H, R(40), 0xA2BFE8A1 );
 204     P( H, A, B, C, D, E, F, G, R(41), 0xA81A664B );
 205     P( G, H, A, B, C, D, E, F, R(42), 0xC24B8B70 );
 206     P( F, G, H, A, B, C, D, E, R(43), 0xC76C51A3 );
 207     P( E, F, G, H, A, B, C, D, R(44), 0xD192E819 );
 208     P( D, E, F, G, H, A, B, C, R(45), 0xD6990624 );
 209     P( C, D, E, F, G, H, A, B, R(46), 0xF40E3585 );
 210     P( B, C, D, E, F, G, H, A, R(47), 0x106AA070 );
 211     P( A, B, C, D, E, F, G, H, R(48), 0x19A4C116 );
 212     P( H, A, B, C, D, E, F, G, R(49), 0x1E376C08 );
 213     P( G, H, A, B, C, D, E, F, R(50), 0x2748774C );
 214     P( F, G, H, A, B, C, D, E, R(51), 0x34B0BCB5 );
 215     P( E, F, G, H, A, B, C, D, R(52), 0x391C0CB3 );
 216     P( D, E, F, G, H, A, B, C, R(53), 0x4ED8AA4A );
 217     P( C, D, E, F, G, H, A, B, R(54), 0x5B9CCA4F );
 218     P( B, C, D, E, F, G, H, A, R(55), 0x682E6FF3 );
 219     P( A, B, C, D, E, F, G, H, R(56), 0x748F82EE );
 220     P( H, A, B, C, D, E, F, G, R(57), 0x78A5636F );
 221     P( G, H, A, B, C, D, E, F, R(58), 0x84C87814 );
 222     P( F, G, H, A, B, C, D, E, R(59), 0x8CC70208 );
 223     P( E, F, G, H, A, B, C, D, R(60), 0x90BEFFFA );
 224     P( D, E, F, G, H, A, B, C, R(61), 0xA4506CEB );
 225     P( C, D, E, F, G, H, A, B, R(62), 0xBEF9A3F7 );
 226     P( B, C, D, E, F, G, H, A, R(63), 0xC67178F2 );
 227
 228     ctx->state[0] += A;
 229     ctx->state[1] += B;
 230     ctx->state[2] += C;
 231     ctx->state[3] += D;
 232     ctx->state[4] += E;
 233     ctx->state[5] += F;
 234     ctx->state[6] += G;
 235     ctx->state[7] += H;
 236 }
 237
 238 /*
 239  * SHA-256 process buffer
 240  */
 241 static void sha2_update( sha2_context *ctx, const unsigned char *input, size_t ilen )
 242 {
 243     size_t fill;
 244     unsigned long left;
 245
 246     if( ilen <= 0 )
 247         return;
 248
 249     left = ctx->total[0] & 0x3F;
 250     fill = 64 - left;
 251
 252     ctx->total[0] += (unsigned long) ilen;
 253     ctx->total[0] &= 0xFFFFFFFF;
 254
 255     if( ctx->total[0] < (unsigned long) ilen )
 256         ctx->total[1]++;
 257
 258     if( left && ilen >= fill )
 259     {
 260         memcpy( (void *) (ctx->buffer + left),
 261                 (void *) input, fill );
 262         sha2_process( ctx, ctx->buffer );
 263         input += fill;
 264         ilen  -= fill;
 265         left = 0;
 266     }
 267
 268     while( ilen >= 64 )
 269     {
 270         sha2_process( ctx, input );
 271         input += 64;
 272         ilen  -= 64;
 273     }
 274
 275     if( ilen > 0 )
 276     {
 277         memcpy( (void *) (ctx->buffer + left),
 278                 (void *) input, ilen );
 279     }
 280 }
 281
 282 static const unsigned char sha2_padding[64] =
 283 {
 284  0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 285     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 286     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 287     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 288 };
 289
 290 /*
 291  * SHA-256 final digest
 292  */
 293 static void sha2_finish( sha2_context *ctx, unsigned char output[32] )
 294 {
 295     unsigned long last, padn;
 296     unsigned long high, low;
 297     unsigned char msglen[8];
 298
 299     high = ( ctx->total[0] >> 29 )
 300          | ( ctx->total[1] <<  3 );
 301     low  = ( ctx->total[0] <<  3 );
 302
 303     PUT_ULONG_BE( high, msglen, 0 );
 304     PUT_ULONG_BE( low,  msglen, 4 );
 305
 306     last = ctx->total[0] & 0x3F;
 307     padn = ( last < 56 ) ? ( 56 - last ) : ( 120 - last );
 308
 309     sha2_update( ctx, (unsigned char *) sha2_padding, padn );
 310     sha2_update( ctx, msglen, 8 );
 311
 312     PUT_ULONG_BE( ctx->state[0], output,  0 );
 313     PUT_ULONG_BE( ctx->state[1], output,  4 );
 314     PUT_ULONG_BE( ctx->state[2], output,  8 );
 315     PUT_ULONG_BE( ctx->state[3], output, 12 );
 316     PUT_ULONG_BE( ctx->state[4], output, 16 );
 317     PUT_ULONG_BE( ctx->state[5], output, 20 );
 318     PUT_ULONG_BE( ctx->state[6], output, 24 );
 319
 320     if( ctx->is224 == 0 )
 321         PUT_ULONG_BE( ctx->state[7], output, 28 );
 322 }
 323
 324 /*
 325  * output = SHA-256( input buffer )
 326  */
 327 void sha2( const unsigned char *input, size_t ilen,
 328            unsigned char output[32], int is224 )
 329 {
 330     sha2_context ctx;
 331
 332     sha2_starts( &ctx, is224 );
 333     sha2_update( &ctx, input, ilen );
 334     sha2_finish( &ctx, output );
 335
 336     memset( &ctx, 0, sizeof( sha2_context ) );
 337 }
 338
 339 /*
 340  * output = SHA-256( file contents )
 341  */
 342 int sha2_file( const char *path, unsigned char output[32], int is224 )
 343 {
 344     FILE *f;
 345     size_t n;
 346     sha2_context ctx;
 347     unsigned char buf[4096];
 348
 349     if( ( f = fopen( path, "rb" ) ) == NULL )
 350         return( 1 );
 351
 352     sha2_starts( &ctx, is224 );
 353
 354     while( ( n = fread( buf, 1, sizeof( buf ), f ) ) > 0 )
 355         sha2_update( &ctx, buf, n );
 356
 357     sha2_finish( &ctx, output );
 358
 359     memset( &ctx, 0, sizeof( sha2_context ) );
 360
 361     if( ferror( f ) != 0 )
 362     {
 363         fclose( f );
 364         return( 2 );
 365     }
 366
 367     fclose( f );
 368     return( 0 );
 369 }