lib/libalpm/sha2.c

   1 /*
   2  *  FIPS-180-2 compliant SHA-256 implementation
   3  *
   4  *  Copyright (C) 2006-2010, Brainspark B.V.
   5  *
   6  *  This file is part of PolarSSL (http://www.polarssl.org)
   7  *  Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
   8  *
   9  *  All rights reserved.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23  */
  24 /*
  25  *  The SHA-256 Secure Hash Standard was published by NIST in 2002.
  26  *
  27  *  http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
  28  */
  29 /*
  30  *  Pacman Notes:
  31  *
  32  *  Taken from the PolarSSL project at http://polarssl.org under terms of the
  33  *  GPL. This is from version 1.0.0 of the library, and has been modified
  34  *  as following, which may be helpful for future updates:
  35  *  * remove "polarssl/config.h" include
  36  *  * change include from "polarssl/md5.h" to "md5.h"
  37  *  * removal of HMAC code
  38  *  * removal of SELF_TEST code
  39  *  * removal of ipad and opad from the sha2_context struct in sha2.h
  40  *  * increase the size of buffer for performance reasons
  41  *  * change 'unsigned long' to uint32_t
  42  */
  43
  44 #include <stdio.h>
  45 #include <stdint.h>
  46
  47 #include "sha2.h"
  48
  49 /*
  50  * 32-bit integer manipulation macros (big endian)
  51  */
  52 #ifndef GET_U32_BE
  53 #define GET_U32_BE(n,b,i)                               \
  54 {                                                       \
  55     (n) = ( (uint32_t) (b)[(i)    ] << 24 )             \
  56         | ( (uint32_t) (b)[(i) + 1] << 16 )             \
  57         | ( (uint32_t) (b)[(i) + 2] <<  8 )             \
  58         | ( (uint32_t) (b)[(i) + 3]       );            \
  59 }
  60 #endif
  61
  62 #ifndef PUT_U32_BE
  63 #define PUT_U32_BE(n,b,i)                               \
  64 {                                                       \
  65     (b)[(i)    ] = (unsigned char) ( (n) >> 24 );       \
  66     (b)[(i) + 1] = (unsigned char) ( (n) >> 16 );       \
  67     (b)[(i) + 2] = (unsigned char) ( (n) >>  8 );       \
  68     (b)[(i) + 3] = (unsigned char) ( (n)       );       \
  69 }
  70 #endif
  71
  72 /*
  73  * SHA-256 context setup
  74  */
  75 static void sha2_starts( sha2_context *ctx, int is224 )
  76 {
  77     ctx->total[0] = 0;
  78     ctx->total[1] = 0;
  79
  80     if( is224 == 0 )
  81     {
  82         /* SHA-256 */
  83         ctx->state[0] = 0x6A09E667;
  84         ctx->state[1] = 0xBB67AE85;
  85         ctx->state[2] = 0x3C6EF372;
  86         ctx->state[3] = 0xA54FF53A;
  87         ctx->state[4] = 0x510E527F;
  88         ctx->state[5] = 0x9B05688C;
  89         ctx->state[6] = 0x1F83D9AB;
  90         ctx->state[7] = 0x5BE0CD19;
  91     }
  92     else
  93     {
  94         /* SHA-224 */
  95         ctx->state[0] = 0xC1059ED8;
  96         ctx->state[1] = 0x367CD507;
  97         ctx->state[2] = 0x3070DD17;
  98         ctx->state[3] = 0xF70E5939;
  99         ctx->state[4] = 0xFFC00B31;
 100         ctx->state[5] = 0x68581511;
 101         ctx->state[6] = 0x64F98FA7;
 102         ctx->state[7] = 0xBEFA4FA4;
 103     }
 104
 105     ctx->is224 = is224;
 106 }
 107
 108 static void sha2_process( sha2_context *ctx, const unsigned char data[64] )
 109 {
 110     uint32_t temp1, temp2, W[64];
 111     uint32_t A, B, C, D, E, F, G, H;
 112
 113     GET_U32_BE( W[ 0], data,  0 );
 114     GET_U32_BE( W[ 1], data,  4 );
 115     GET_U32_BE( W[ 2], data,  8 );
 116     GET_U32_BE( W[ 3], data, 12 );
 117     GET_U32_BE( W[ 4], data, 16 );
 118     GET_U32_BE( W[ 5], data, 20 );
 119     GET_U32_BE( W[ 6], data, 24 );
 120     GET_U32_BE( W[ 7], data, 28 );
 121     GET_U32_BE( W[ 8], data, 32 );
 122     GET_U32_BE( W[ 9], data, 36 );
 123     GET_U32_BE( W[10], data, 40 );
 124     GET_U32_BE( W[11], data, 44 );
 125     GET_U32_BE( W[12], data, 48 );
 126     GET_U32_BE( W[13], data, 52 );
 127     GET_U32_BE( W[14], data, 56 );
 128     GET_U32_BE( W[15], data, 60 );
 129
 130 #define  SHR(x,n) ((x & 0xFFFFFFFF) >> n)
 131 #define ROTR(x,n) (SHR(x,n) | (x << (32 - n)))
 132
 133 #define S0(x) (ROTR(x, 7) ^ ROTR(x,18) ^  SHR(x, 3))
 134 #define S1(x) (ROTR(x,17) ^ ROTR(x,19) ^  SHR(x,10))
 135
 136 #define S2(x) (ROTR(x, 2) ^ ROTR(x,13) ^ ROTR(x,22))
 137 #define S3(x) (ROTR(x, 6) ^ ROTR(x,11) ^ ROTR(x,25))
 138
 139 #define F0(x,y,z) ((x & y) | (z & (x | y)))
 140 #define F1(x,y,z) (z ^ (x & (y ^ z)))
 141
 142 #define R(t)                                    \
 143 (                                               \
 144     W[t] = S1(W[t -  2]) + W[t -  7] +          \
 145            S0(W[t - 15]) + W[t - 16]            \
 146 )
 147
 148 #define P(a,b,c,d,e,f,g,h,x,K)                  \
 149 {                                               \
 150     temp1 = h + S3(e) + F1(e,f,g) + K + x;      \
 151     temp2 = S2(a) + F0(a,b,c);                  \
 152     d += temp1; h = temp1 + temp2;              \
 153 }
 154
 155     A = ctx->state[0];
 156     B = ctx->state[1];
 157     C = ctx->state[2];
 158     D = ctx->state[3];
 159     E = ctx->state[4];
 160     F = ctx->state[5];
 161     G = ctx->state[6];
 162     H = ctx->state[7];
 163
 164     P( A, B, C, D, E, F, G, H, W[ 0], 0x428A2F98 );
 165     P( H, A, B, C, D, E, F, G, W[ 1], 0x71374491 );
 166     P( G, H, A, B, C, D, E, F, W[ 2], 0xB5C0FBCF );
 167     P( F, G, H, A, B, C, D, E, W[ 3], 0xE9B5DBA5 );
 168     P( E, F, G, H, A, B, C, D, W[ 4], 0x3956C25B );
 169     P( D, E, F, G, H, A, B, C, W[ 5], 0x59F111F1 );
 170     P( C, D, E, F, G, H, A, B, W[ 6], 0x923F82A4 );
 171     P( B, C, D, E, F, G, H, A, W[ 7], 0xAB1C5ED5 );
 172     P( A, B, C, D, E, F, G, H, W[ 8], 0xD807AA98 );
 173     P( H, A, B, C, D, E, F, G, W[ 9], 0x12835B01 );
 174     P( G, H, A, B, C, D, E, F, W[10], 0x243185BE );
 175     P( F, G, H, A, B, C, D, E, W[11], 0x550C7DC3 );
 176     P( E, F, G, H, A, B, C, D, W[12], 0x72BE5D74 );
 177     P( D, E, F, G, H, A, B, C, W[13], 0x80DEB1FE );
 178     P( C, D, E, F, G, H, A, B, W[14], 0x9BDC06A7 );
 179     P( B, C, D, E, F, G, H, A, W[15], 0xC19BF174 );
 180     P( A, B, C, D, E, F, G, H, R(16), 0xE49B69C1 );
 181     P( H, A, B, C, D, E, F, G, R(17), 0xEFBE4786 );
 182     P( G, H, A, B, C, D, E, F, R(18), 0x0FC19DC6 );
 183     P( F, G, H, A, B, C, D, E, R(19), 0x240CA1CC );
 184     P( E, F, G, H, A, B, C, D, R(20), 0x2DE92C6F );
 185     P( D, E, F, G, H, A, B, C, R(21), 0x4A7484AA );
 186     P( C, D, E, F, G, H, A, B, R(22), 0x5CB0A9DC );
 187     P( B, C, D, E, F, G, H, A, R(23), 0x76F988DA );
 188     P( A, B, C, D, E, F, G, H, R(24), 0x983E5152 );
 189     P( H, A, B, C, D, E, F, G, R(25), 0xA831C66D );
 190     P( G, H, A, B, C, D, E, F, R(26), 0xB00327C8 );
 191     P( F, G, H, A, B, C, D, E, R(27), 0xBF597FC7 );
 192     P( E, F, G, H, A, B, C, D, R(28), 0xC6E00BF3 );
 193     P( D, E, F, G, H, A, B, C, R(29), 0xD5A79147 );
 194     P( C, D, E, F, G, H, A, B, R(30), 0x06CA6351 );
 195     P( B, C, D, E, F, G, H, A, R(31), 0x14292967 );
 196     P( A, B, C, D, E, F, G, H, R(32), 0x27B70A85 );
 197     P( H, A, B, C, D, E, F, G, R(33), 0x2E1B2138 );
 198     P( G, H, A, B, C, D, E, F, R(34), 0x4D2C6DFC );
 199     P( F, G, H, A, B, C, D, E, R(35), 0x53380D13 );
 200     P( E, F, G, H, A, B, C, D, R(36), 0x650A7354 );
 201     P( D, E, F, G, H, A, B, C, R(37), 0x766A0ABB );
 202     P( C, D, E, F, G, H, A, B, R(38), 0x81C2C92E );
 203     P( B, C, D, E, F, G, H, A, R(39), 0x92722C85 );
 204     P( A, B, C, D, E, F, G, H, R(40), 0xA2BFE8A1 );
 205     P( H, A, B, C, D, E, F, G, R(41), 0xA81A664B );
 206     P( G, H, A, B, C, D, E, F, R(42), 0xC24B8B70 );
 207     P( F, G, H, A, B, C, D, E, R(43), 0xC76C51A3 );
 208     P( E, F, G, H, A, B, C, D, R(44), 0xD192E819 );
 209     P( D, E, F, G, H, A, B, C, R(45), 0xD6990624 );
 210     P( C, D, E, F, G, H, A, B, R(46), 0xF40E3585 );
 211     P( B, C, D, E, F, G, H, A, R(47), 0x106AA070 );
 212     P( A, B, C, D, E, F, G, H, R(48), 0x19A4C116 );
 213     P( H, A, B, C, D, E, F, G, R(49), 0x1E376C08 );
 214     P( G, H, A, B, C, D, E, F, R(50), 0x2748774C );
 215     P( F, G, H, A, B, C, D, E, R(51), 0x34B0BCB5 );
 216     P( E, F, G, H, A, B, C, D, R(52), 0x391C0CB3 );
 217     P( D, E, F, G, H, A, B, C, R(53), 0x4ED8AA4A );
 218     P( C, D, E, F, G, H, A, B, R(54), 0x5B9CCA4F );
 219     P( B, C, D, E, F, G, H, A, R(55), 0x682E6FF3 );
 220     P( A, B, C, D, E, F, G, H, R(56), 0x748F82EE );
 221     P( H, A, B, C, D, E, F, G, R(57), 0x78A5636F );
 222     P( G, H, A, B, C, D, E, F, R(58), 0x84C87814 );
 223     P( F, G, H, A, B, C, D, E, R(59), 0x8CC70208 );
 224     P( E, F, G, H, A, B, C, D, R(60), 0x90BEFFFA );
 225     P( D, E, F, G, H, A, B, C, R(61), 0xA4506CEB );
 226     P( C, D, E, F, G, H, A, B, R(62), 0xBEF9A3F7 );
 227     P( B, C, D, E, F, G, H, A, R(63), 0xC67178F2 );
 228
 229     ctx->state[0] += A;
 230     ctx->state[1] += B;
 231     ctx->state[2] += C;
 232     ctx->state[3] += D;
 233     ctx->state[4] += E;
 234     ctx->state[5] += F;
 235     ctx->state[6] += G;
 236     ctx->state[7] += H;
 237 }
 238
 239 /*
 240  * SHA-256 process buffer
 241  */
 242 static void sha2_update( sha2_context *ctx, const unsigned char *input, size_t ilen )
 243 {
 244     size_t fill;
 245     uint32_t left;
 246
 247     if( ilen <= 0 )
 248         return;
 249
 250     left = ctx->total[0] & 0x3F;
 251     fill = 64 - left;
 252
 253     ctx->total[0] += (uint32_t) ilen;
 254     ctx->total[0] &= 0xFFFFFFFF;
 255
 256     if( ctx->total[0] < (uint32_t) ilen )
 257         ctx->total[1]++;
 258
 259     if( left && ilen >= fill )
 260     {
 261         memcpy( (void *) (ctx->buffer + left),
 262                 (void *) input, fill );
 263         sha2_process( ctx, ctx->buffer );
 264         input += fill;
 265         ilen  -= fill;
 266         left = 0;
 267     }
 268
 269     while( ilen >= 64 )
 270     {
 271         sha2_process( ctx, input );
 272         input += 64;
 273         ilen  -= 64;
 274     }
 275
 276     if( ilen > 0 )
 277     {
 278         memcpy( (void *) (ctx->buffer + left),
 279                 (void *) input, ilen );
 280     }
 281 }
 282
 283 static const unsigned char sha2_padding[64] =
 284 {
 285  0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 286     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 287     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 288     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 289 };
 290
 291 /*
 292  * SHA-256 final digest
 293  */
 294 static void sha2_finish( sha2_context *ctx, unsigned char output[32] )
 295 {
 296     uint32_t last, padn;
 297     uint32_t high, low;
 298     unsigned char msglen[8];
 299
 300     high = ( ctx->total[0] >> 29 )
 301          | ( ctx->total[1] <<  3 );
 302     low  = ( ctx->total[0] <<  3 );
 303
 304     PUT_U32_BE( high, msglen, 0 );
 305     PUT_U32_BE( low,  msglen, 4 );
 306
 307     last = ctx->total[0] & 0x3F;
 308     padn = ( last < 56 ) ? ( 56 - last ) : ( 120 - last );
 309
 310     sha2_update( ctx, (unsigned char *) sha2_padding, padn );
 311     sha2_update( ctx, msglen, 8 );
 312
 313     PUT_U32_BE( ctx->state[0], output,  0 );
 314     PUT_U32_BE( ctx->state[1], output,  4 );
 315     PUT_U32_BE( ctx->state[2], output,  8 );
 316     PUT_U32_BE( ctx->state[3], output, 12 );
 317     PUT_U32_BE( ctx->state[4], output, 16 );
 318     PUT_U32_BE( ctx->state[5], output, 20 );
 319     PUT_U32_BE( ctx->state[6], output, 24 );
 320
 321     if( ctx->is224 == 0 )
 322         PUT_U32_BE( ctx->state[7], output, 28 );
 323 }
 324
 325 /*
 326  * output = SHA-256( input buffer )
 327  */
 328 void sha2( const unsigned char *input, size_t ilen,
 329            unsigned char output[32], int is224 )
 330 {
 331     sha2_context ctx;
 332
 333     sha2_starts( &ctx, is224 );
 334     sha2_update( &ctx, input, ilen );
 335     sha2_finish( &ctx, output );
 336
 337     memset( &ctx, 0, sizeof( sha2_context ) );
 338 }
 339
 340 /*
 341  * output = SHA-256( file contents )
 342  */
 343 int sha2_file( const char *path, unsigned char output[32], int is224 )
 344 {
 345     FILE *f;
 346     size_t n;
 347     sha2_context ctx;
 348     unsigned char buf[4096];
 349
 350     if( ( f = fopen( path, "rb" ) ) == NULL )
 351         return( 1 );
 352
 353     sha2_starts( &ctx, is224 );
 354
 355     while( ( n = fread( buf, 1, sizeof( buf ), f ) ) > 0 )
 356         sha2_update( &ctx, buf, n );
 357
 358     sha2_finish( &ctx, output );
 359
 360     memset( &ctx, 0, sizeof( sha2_context ) );
 361
 362     if( ferror( f ) != 0 )
 363     {
 364         fclose( f );
 365         return( 2 );
 366     }
 367
 368     fclose( f );
 369     return( 0 );
 370 }