sha256.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386
  1. /*
  2. * Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <openssl/opensslconf.h>
  10. #include <stdlib.h>
  11. #include <string.h>
  12. #include <openssl/crypto.h>
  13. #include <openssl/sha.h>
  14. #include <openssl/opensslv.h>
  15. int SHA224_Init(SHA256_CTX *c)
  16. {
  17. memset(c, 0, sizeof(*c));
  18. c->h[0] = 0xc1059ed8UL;
  19. c->h[1] = 0x367cd507UL;
  20. c->h[2] = 0x3070dd17UL;
  21. c->h[3] = 0xf70e5939UL;
  22. c->h[4] = 0xffc00b31UL;
  23. c->h[5] = 0x68581511UL;
  24. c->h[6] = 0x64f98fa7UL;
  25. c->h[7] = 0xbefa4fa4UL;
  26. c->md_len = SHA224_DIGEST_LENGTH;
  27. return 1;
  28. }
  29. int SHA256_Init(SHA256_CTX *c)
  30. {
  31. memset(c, 0, sizeof(*c));
  32. c->h[0] = 0x6a09e667UL;
  33. c->h[1] = 0xbb67ae85UL;
  34. c->h[2] = 0x3c6ef372UL;
  35. c->h[3] = 0xa54ff53aUL;
  36. c->h[4] = 0x510e527fUL;
  37. c->h[5] = 0x9b05688cUL;
  38. c->h[6] = 0x1f83d9abUL;
  39. c->h[7] = 0x5be0cd19UL;
  40. c->md_len = SHA256_DIGEST_LENGTH;
  41. return 1;
  42. }
  43. unsigned char *SHA224(const unsigned char *d, size_t n, unsigned char *md)
  44. {
  45. SHA256_CTX c;
  46. static unsigned char m[SHA224_DIGEST_LENGTH];
  47. if (md == NULL)
  48. md = m;
  49. SHA224_Init(&c);
  50. SHA256_Update(&c, d, n);
  51. SHA256_Final(md, &c);
  52. OPENSSL_cleanse(&c, sizeof(c));
  53. return md;
  54. }
  55. unsigned char *SHA256(const unsigned char *d, size_t n, unsigned char *md)
  56. {
  57. SHA256_CTX c;
  58. static unsigned char m[SHA256_DIGEST_LENGTH];
  59. if (md == NULL)
  60. md = m;
  61. SHA256_Init(&c);
  62. SHA256_Update(&c, d, n);
  63. SHA256_Final(md, &c);
  64. OPENSSL_cleanse(&c, sizeof(c));
  65. return md;
  66. }
  67. int SHA224_Update(SHA256_CTX *c, const void *data, size_t len)
  68. {
  69. return SHA256_Update(c, data, len);
  70. }
  71. int SHA224_Final(unsigned char *md, SHA256_CTX *c)
  72. {
  73. return SHA256_Final(md, c);
  74. }
  75. #define DATA_ORDER_IS_BIG_ENDIAN
  76. #define HASH_LONG SHA_LONG
  77. #define HASH_CTX SHA256_CTX
  78. #define HASH_CBLOCK SHA_CBLOCK
  79. /*
  80. * Note that FIPS180-2 discusses "Truncation of the Hash Function Output."
  81. * default: case below covers for it. It's not clear however if it's
  82. * permitted to truncate to amount of bytes not divisible by 4. I bet not,
  83. * but if it is, then default: case shall be extended. For reference.
  84. * Idea behind separate cases for pre-defined lengths is to let the
  85. * compiler decide if it's appropriate to unroll small loops.
  86. */
  87. #define HASH_MAKE_STRING(c,s) do { \
  88. unsigned long ll; \
  89. unsigned int nn; \
  90. switch ((c)->md_len) \
  91. { case SHA224_DIGEST_LENGTH: \
  92. for (nn=0;nn<SHA224_DIGEST_LENGTH/4;nn++) \
  93. { ll=(c)->h[nn]; (void)HOST_l2c(ll,(s)); } \
  94. break; \
  95. case SHA256_DIGEST_LENGTH: \
  96. for (nn=0;nn<SHA256_DIGEST_LENGTH/4;nn++) \
  97. { ll=(c)->h[nn]; (void)HOST_l2c(ll,(s)); } \
  98. break; \
  99. default: \
  100. if ((c)->md_len > SHA256_DIGEST_LENGTH) \
  101. return 0; \
  102. for (nn=0;nn<(c)->md_len/4;nn++) \
  103. { ll=(c)->h[nn]; (void)HOST_l2c(ll,(s)); } \
  104. break; \
  105. } \
  106. } while (0)
  107. #define HASH_UPDATE SHA256_Update
  108. #define HASH_TRANSFORM SHA256_Transform
  109. #define HASH_FINAL SHA256_Final
  110. #define HASH_BLOCK_DATA_ORDER sha256_block_data_order
  111. #ifndef SHA256_ASM
  112. static
  113. #endif
  114. void sha256_block_data_order(SHA256_CTX *ctx, const void *in, size_t num);
  115. #include "crypto/md32_common.h"
  116. #ifndef SHA256_ASM
  117. static const SHA_LONG K256[64] = {
  118. 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
  119. 0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
  120. 0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
  121. 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
  122. 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
  123. 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
  124. 0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
  125. 0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
  126. 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
  127. 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
  128. 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
  129. 0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
  130. 0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
  131. 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
  132. 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
  133. 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
  134. };
  135. /*
  136. * FIPS specification refers to right rotations, while our ROTATE macro
  137. * is left one. This is why you might notice that rotation coefficients
  138. * differ from those observed in FIPS document by 32-N...
  139. */
  140. # define Sigma0(x) (ROTATE((x),30) ^ ROTATE((x),19) ^ ROTATE((x),10))
  141. # define Sigma1(x) (ROTATE((x),26) ^ ROTATE((x),21) ^ ROTATE((x),7))
  142. # define sigma0(x) (ROTATE((x),25) ^ ROTATE((x),14) ^ ((x)>>3))
  143. # define sigma1(x) (ROTATE((x),15) ^ ROTATE((x),13) ^ ((x)>>10))
  144. # define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z)))
  145. # define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
  146. # ifdef OPENSSL_SMALL_FOOTPRINT
  147. static void sha256_block_data_order(SHA256_CTX *ctx, const void *in,
  148. size_t num)
  149. {
  150. unsigned MD32_REG_T a, b, c, d, e, f, g, h, s0, s1, T1, T2;
  151. SHA_LONG X[16], l;
  152. int i;
  153. const unsigned char *data = in;
  154. while (num--) {
  155. a = ctx->h[0];
  156. b = ctx->h[1];
  157. c = ctx->h[2];
  158. d = ctx->h[3];
  159. e = ctx->h[4];
  160. f = ctx->h[5];
  161. g = ctx->h[6];
  162. h = ctx->h[7];
  163. for (i = 0; i < 16; i++) {
  164. (void)HOST_c2l(data, l);
  165. T1 = X[i] = l;
  166. T1 += h + Sigma1(e) + Ch(e, f, g) + K256[i];
  167. T2 = Sigma0(a) + Maj(a, b, c);
  168. h = g;
  169. g = f;
  170. f = e;
  171. e = d + T1;
  172. d = c;
  173. c = b;
  174. b = a;
  175. a = T1 + T2;
  176. }
  177. for (; i < 64; i++) {
  178. s0 = X[(i + 1) & 0x0f];
  179. s0 = sigma0(s0);
  180. s1 = X[(i + 14) & 0x0f];
  181. s1 = sigma1(s1);
  182. T1 = X[i & 0xf] += s0 + s1 + X[(i + 9) & 0xf];
  183. T1 += h + Sigma1(e) + Ch(e, f, g) + K256[i];
  184. T2 = Sigma0(a) + Maj(a, b, c);
  185. h = g;
  186. g = f;
  187. f = e;
  188. e = d + T1;
  189. d = c;
  190. c = b;
  191. b = a;
  192. a = T1 + T2;
  193. }
  194. ctx->h[0] += a;
  195. ctx->h[1] += b;
  196. ctx->h[2] += c;
  197. ctx->h[3] += d;
  198. ctx->h[4] += e;
  199. ctx->h[5] += f;
  200. ctx->h[6] += g;
  201. ctx->h[7] += h;
  202. }
  203. }
  204. # else
  205. # define ROUND_00_15(i,a,b,c,d,e,f,g,h) do { \
  206. T1 += h + Sigma1(e) + Ch(e,f,g) + K256[i]; \
  207. h = Sigma0(a) + Maj(a,b,c); \
  208. d += T1; h += T1; } while (0)
  209. # define ROUND_16_63(i,a,b,c,d,e,f,g,h,X) do { \
  210. s0 = X[(i+1)&0x0f]; s0 = sigma0(s0); \
  211. s1 = X[(i+14)&0x0f]; s1 = sigma1(s1); \
  212. T1 = X[(i)&0x0f] += s0 + s1 + X[(i+9)&0x0f]; \
  213. ROUND_00_15(i,a,b,c,d,e,f,g,h); } while (0)
  214. static void sha256_block_data_order(SHA256_CTX *ctx, const void *in,
  215. size_t num)
  216. {
  217. unsigned MD32_REG_T a, b, c, d, e, f, g, h, s0, s1, T1;
  218. SHA_LONG X[16];
  219. int i;
  220. const unsigned char *data = in;
  221. const union {
  222. long one;
  223. char little;
  224. } is_endian = {
  225. 1
  226. };
  227. while (num--) {
  228. a = ctx->h[0];
  229. b = ctx->h[1];
  230. c = ctx->h[2];
  231. d = ctx->h[3];
  232. e = ctx->h[4];
  233. f = ctx->h[5];
  234. g = ctx->h[6];
  235. h = ctx->h[7];
  236. if (!is_endian.little && sizeof(SHA_LONG) == 4
  237. && ((size_t)in % 4) == 0) {
  238. const SHA_LONG *W = (const SHA_LONG *)data;
  239. T1 = X[0] = W[0];
  240. ROUND_00_15(0, a, b, c, d, e, f, g, h);
  241. T1 = X[1] = W[1];
  242. ROUND_00_15(1, h, a, b, c, d, e, f, g);
  243. T1 = X[2] = W[2];
  244. ROUND_00_15(2, g, h, a, b, c, d, e, f);
  245. T1 = X[3] = W[3];
  246. ROUND_00_15(3, f, g, h, a, b, c, d, e);
  247. T1 = X[4] = W[4];
  248. ROUND_00_15(4, e, f, g, h, a, b, c, d);
  249. T1 = X[5] = W[5];
  250. ROUND_00_15(5, d, e, f, g, h, a, b, c);
  251. T1 = X[6] = W[6];
  252. ROUND_00_15(6, c, d, e, f, g, h, a, b);
  253. T1 = X[7] = W[7];
  254. ROUND_00_15(7, b, c, d, e, f, g, h, a);
  255. T1 = X[8] = W[8];
  256. ROUND_00_15(8, a, b, c, d, e, f, g, h);
  257. T1 = X[9] = W[9];
  258. ROUND_00_15(9, h, a, b, c, d, e, f, g);
  259. T1 = X[10] = W[10];
  260. ROUND_00_15(10, g, h, a, b, c, d, e, f);
  261. T1 = X[11] = W[11];
  262. ROUND_00_15(11, f, g, h, a, b, c, d, e);
  263. T1 = X[12] = W[12];
  264. ROUND_00_15(12, e, f, g, h, a, b, c, d);
  265. T1 = X[13] = W[13];
  266. ROUND_00_15(13, d, e, f, g, h, a, b, c);
  267. T1 = X[14] = W[14];
  268. ROUND_00_15(14, c, d, e, f, g, h, a, b);
  269. T1 = X[15] = W[15];
  270. ROUND_00_15(15, b, c, d, e, f, g, h, a);
  271. data += SHA256_CBLOCK;
  272. } else {
  273. SHA_LONG l;
  274. (void)HOST_c2l(data, l);
  275. T1 = X[0] = l;
  276. ROUND_00_15(0, a, b, c, d, e, f, g, h);
  277. (void)HOST_c2l(data, l);
  278. T1 = X[1] = l;
  279. ROUND_00_15(1, h, a, b, c, d, e, f, g);
  280. (void)HOST_c2l(data, l);
  281. T1 = X[2] = l;
  282. ROUND_00_15(2, g, h, a, b, c, d, e, f);
  283. (void)HOST_c2l(data, l);
  284. T1 = X[3] = l;
  285. ROUND_00_15(3, f, g, h, a, b, c, d, e);
  286. (void)HOST_c2l(data, l);
  287. T1 = X[4] = l;
  288. ROUND_00_15(4, e, f, g, h, a, b, c, d);
  289. (void)HOST_c2l(data, l);
  290. T1 = X[5] = l;
  291. ROUND_00_15(5, d, e, f, g, h, a, b, c);
  292. (void)HOST_c2l(data, l);
  293. T1 = X[6] = l;
  294. ROUND_00_15(6, c, d, e, f, g, h, a, b);
  295. (void)HOST_c2l(data, l);
  296. T1 = X[7] = l;
  297. ROUND_00_15(7, b, c, d, e, f, g, h, a);
  298. (void)HOST_c2l(data, l);
  299. T1 = X[8] = l;
  300. ROUND_00_15(8, a, b, c, d, e, f, g, h);
  301. (void)HOST_c2l(data, l);
  302. T1 = X[9] = l;
  303. ROUND_00_15(9, h, a, b, c, d, e, f, g);
  304. (void)HOST_c2l(data, l);
  305. T1 = X[10] = l;
  306. ROUND_00_15(10, g, h, a, b, c, d, e, f);
  307. (void)HOST_c2l(data, l);
  308. T1 = X[11] = l;
  309. ROUND_00_15(11, f, g, h, a, b, c, d, e);
  310. (void)HOST_c2l(data, l);
  311. T1 = X[12] = l;
  312. ROUND_00_15(12, e, f, g, h, a, b, c, d);
  313. (void)HOST_c2l(data, l);
  314. T1 = X[13] = l;
  315. ROUND_00_15(13, d, e, f, g, h, a, b, c);
  316. (void)HOST_c2l(data, l);
  317. T1 = X[14] = l;
  318. ROUND_00_15(14, c, d, e, f, g, h, a, b);
  319. (void)HOST_c2l(data, l);
  320. T1 = X[15] = l;
  321. ROUND_00_15(15, b, c, d, e, f, g, h, a);
  322. }
  323. for (i = 16; i < 64; i += 8) {
  324. ROUND_16_63(i + 0, a, b, c, d, e, f, g, h, X);
  325. ROUND_16_63(i + 1, h, a, b, c, d, e, f, g, X);
  326. ROUND_16_63(i + 2, g, h, a, b, c, d, e, f, X);
  327. ROUND_16_63(i + 3, f, g, h, a, b, c, d, e, X);
  328. ROUND_16_63(i + 4, e, f, g, h, a, b, c, d, X);
  329. ROUND_16_63(i + 5, d, e, f, g, h, a, b, c, X);
  330. ROUND_16_63(i + 6, c, d, e, f, g, h, a, b, X);
  331. ROUND_16_63(i + 7, b, c, d, e, f, g, h, a, X);
  332. }
  333. ctx->h[0] += a;
  334. ctx->h[1] += b;
  335. ctx->h[2] += c;
  336. ctx->h[3] += d;
  337. ctx->h[4] += e;
  338. ctx->h[5] += f;
  339. ctx->h[6] += g;
  340. ctx->h[7] += h;
  341. }
  342. }
  343. # endif
  344. #endif /* SHA256_ASM */