src/core/md4.c

   1 /* vim:set ts=2 sw=2 et cindent: */
   2 /* This Source Code Form is subject to the terms of the Mozilla Public
   3  * License, v. 2.0. If a copy of the MPL was not distributed with this
   4  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   5
   6 /*
   7  * "clean room" MD4 implementation (see RFC 1320)
   8  */
   9
  10 #include <string.h>
  11 #include "md4.h"
  12
  13 /* the "conditional" function */
  14 #define F(x,y,z) (((x) & (y)) | (~(x) & (z)))
  15
  16 /* the "majority" function */
  17 #define G(x,y,z) (((x) & (y)) | ((x) & (z)) | ((y) & (z)))
  18
  19 /* the "parity" function */
  20 #define H(x,y,z) ((x) ^ (y) ^ (z))
  21
  22 /* rotate n-bits to the left */
  23 #define ROTL(x,n) (((x) << (n)) | ((x) >> (0x20 - n)))
  24
  25 /* round 1: [abcd k s]: a = (a + F(b,c,d) + X[k]) <<< s */
  26 #define RD1(a,b,c,d,k,s) a += F(b,c,d) + X[k]; a = ROTL(a,s)
  27
  28 /* round 2: [abcd k s]: a = (a + G(b,c,d) + X[k] + MAGIC) <<< s */
  29 #define RD2(a,b,c,d,k,s) a += G(b,c,d) + X[k] + 0x5A827999; a = ROTL(a,s)
  30
  31 /* round 3: [abcd k s]: a = (a + H(b,c,d) + X[k] + MAGIC) <<< s */
  32 #define RD3(a,b,c,d,k,s) a += H(b,c,d) + X[k] + 0x6ED9EBA1; a = ROTL(a,s)
  33
  34 /* converts from word array to byte array, len is number of bytes */
  35 static void w2b(uint8_t *out, const uint32_t *in, uint32_t len)
  36 {
  37   uint8_t *bp; const uint32_t *wp, *wpend;
  38
  39   bp = out;
  40   wp = in;
  41   wpend = wp + (len >> 2);
  42
  43   for (; wp != wpend; ++wp, bp += 4)
  44   {
  45     bp[0] = (uint8_t) ((*wp      ) & 0xFF);
  46     bp[1] = (uint8_t) ((*wp >>  8) & 0xFF);
  47     bp[2] = (uint8_t) ((*wp >> 16) & 0xFF);
  48     bp[3] = (uint8_t) ((*wp >> 24) & 0xFF);
  49   }
  50 }
  51
  52 /* converts from byte array to word array, len is number of bytes */
  53 static void b2w(uint32_t *out, const uint8_t *in, uint32_t len)
  54 {
  55   uint32_t *wp; const uint8_t *bp, *bpend;
  56
  57   wp = out;
  58   bp = in;
  59   bpend = in + len;
  60
  61   for (; bp != bpend; bp += 4, ++wp)
  62   {
  63     *wp = (uint32_t) (bp[0]      ) |
  64           (uint32_t) (bp[1] <<  8) |
  65           (uint32_t) (bp[2] << 16) |
  66           (uint32_t) (bp[3] << 24);
  67   }
  68 }
  69
  70 /* update state: data is 64 bytes in length */
  71 static void md4step(uint32_t state[4], const uint8_t *data)
  72 {
  73   uint32_t A, B, C, D, X[16];
  74
  75   b2w(X, data, 64);
  76
  77   A = state[0];
  78   B = state[1];
  79   C = state[2];
  80   D = state[3];
  81
  82   RD1(A,B,C,D, 0,3); RD1(D,A,B,C, 1,7); RD1(C,D,A,B, 2,11); RD1(B,C,D,A, 3,19);
  83   RD1(A,B,C,D, 4,3); RD1(D,A,B,C, 5,7); RD1(C,D,A,B, 6,11); RD1(B,C,D,A, 7,19);
  84   RD1(A,B,C,D, 8,3); RD1(D,A,B,C, 9,7); RD1(C,D,A,B,10,11); RD1(B,C,D,A,11,19);
  85   RD1(A,B,C,D,12,3); RD1(D,A,B,C,13,7); RD1(C,D,A,B,14,11); RD1(B,C,D,A,15,19);
  86
  87   RD2(A,B,C,D, 0,3); RD2(D,A,B,C, 4,5); RD2(C,D,A,B, 8, 9); RD2(B,C,D,A,12,13);
  88   RD2(A,B,C,D, 1,3); RD2(D,A,B,C, 5,5); RD2(C,D,A,B, 9, 9); RD2(B,C,D,A,13,13);
  89   RD2(A,B,C,D, 2,3); RD2(D,A,B,C, 6,5); RD2(C,D,A,B,10, 9); RD2(B,C,D,A,14,13);
  90   RD2(A,B,C,D, 3,3); RD2(D,A,B,C, 7,5); RD2(C,D,A,B,11, 9); RD2(B,C,D,A,15,13);
  91
  92   RD3(A,B,C,D, 0,3); RD3(D,A,B,C, 8,9); RD3(C,D,A,B, 4,11); RD3(B,C,D,A,12,15);
  93   RD3(A,B,C,D, 2,3); RD3(D,A,B,C,10,9); RD3(C,D,A,B, 6,11); RD3(B,C,D,A,14,15);
  94   RD3(A,B,C,D, 1,3); RD3(D,A,B,C, 9,9); RD3(C,D,A,B, 5,11); RD3(B,C,D,A,13,15);
  95   RD3(A,B,C,D, 3,3); RD3(D,A,B,C,11,9); RD3(C,D,A,B, 7,11); RD3(B,C,D,A,15,15);
  96
  97   state[0] += A;
  98   state[1] += B;
  99   state[2] += C;
 100   state[3] += D;
 101 }
 102
 103 void md4sum(const uint8_t *input, uint32_t inputLen, uint8_t *result)
 104 {
 105   uint8_t final[128];
 106   uint32_t i, n, m, state[4];
 107   uint64_t inputLenBits;
 108   uint32_t inputLenBitsLow;
 109   uint32_t inputLenBitsHigh;
 110
 111   /* magic initial states */
 112   state[0] = 0x67452301;
 113   state[1] = 0xEFCDAB89;
 114   state[2] = 0x98BADCFE;
 115   state[3] = 0x10325476;
 116
 117   /* compute number of complete 64-byte segments contained in input */
 118   m = inputLen >> 6;
 119
 120   /* digest first m segments */
 121   for (i=0; i<m; ++i)
 122     md4step(state, (input + (i << 6)));
 123
 124   /* build final buffer */
 125   n = inputLen % 64;
 126   memcpy(final, input + (m << 6), n);
 127   final[n] = 0x80;
 128   memset(final + n + 1, 0, 120 - (n + 1));
 129
 130   /* Append the original input length in bits as a 64-bit number. This is done
 131    * in two 32-bit chunks, with the least-significant 32 bits first.
 132    * w2b will handle endianness. */
 133   inputLenBits = inputLen << 3;
 134   inputLenBitsLow = (uint32_t)(inputLenBits & 0xFFFFFFFF);
 135   w2b(final + (n >= 56 ? 120 : 56), &inputLenBitsLow, 4);
 136   inputLenBitsHigh = (uint32_t)((inputLenBits >> 32) & 0xFFFFFFFF);
 137   w2b(final + (n >= 56 ? 124 : 60), &inputLenBitsHigh, 4);
 138
 139   md4step(state, final);
 140   if (n >= 56)
 141     md4step(state, final + 64);
 142
 143   /* copy state to result */
 144   w2b(result, state, 16);
 145 }