src/pdkim/sha2.c

   1 /*
   2  *  FIPS-180-2 compliant SHA-256 implementation
   3  *
   4  *  Copyright (C) 2006-2010, Brainspark B.V.
   5  *
   6  *  This file is part of PolarSSL (http://www.polarssl.org)
   7  *  Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
   8  *
   9  *  All rights reserved.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License along
  22  *  with this program; if not, write to the Free Software Foundation, Inc.,
  23  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24  */
  25 /*
  26  *  The SHA-256 Secure Hash Standard was published by NIST in 2002.
  27  *
  28  *  http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
  29  */
  30
  31 #include "sha2.h"
  32
  33 #include <string.h>
  34 #include <stdio.h>
  35
  36 /*
  37  * 32-bit integer manipulation macros (big endian)
  38  */
  39 #ifndef GET_ULONG_BE
  40 #define GET_ULONG_BE(n,b,i)                             \
  41 {                                                       \
  42     (n) = ( (unsigned long) (b)[(i)    ] << 24 )        \
  43         | ( (unsigned long) (b)[(i) + 1] << 16 )        \
  44         | ( (unsigned long) (b)[(i) + 2] <<  8 )        \
  45         | ( (unsigned long) (b)[(i) + 3]       );       \
  46 }
  47 #endif
  48
  49 #ifndef PUT_ULONG_BE
  50 #define PUT_ULONG_BE(n,b,i)                             \
  51 {                                                       \
  52     (b)[(i)    ] = (unsigned char) ( (n) >> 24 );       \
  53     (b)[(i) + 1] = (unsigned char) ( (n) >> 16 );       \
  54     (b)[(i) + 2] = (unsigned char) ( (n) >>  8 );       \
  55     (b)[(i) + 3] = (unsigned char) ( (n)       );       \
  56 }
  57 #endif
  58
  59 /*
  60  * SHA-256 context setup
  61  */
  62 void sha2_starts( sha2_context *ctx, int is224 )
  63 {
  64     ctx->total[0] = 0;
  65     ctx->total[1] = 0;
  66
  67     if( is224 == 0 )
  68     {
  69         /* SHA-256 */
  70         ctx->state[0] = 0x6A09E667;
  71         ctx->state[1] = 0xBB67AE85;
  72         ctx->state[2] = 0x3C6EF372;
  73         ctx->state[3] = 0xA54FF53A;
  74         ctx->state[4] = 0x510E527F;
  75         ctx->state[5] = 0x9B05688C;
  76         ctx->state[6] = 0x1F83D9AB;
  77         ctx->state[7] = 0x5BE0CD19;
  78     }
  79     else
  80     {
  81         /* SHA-224 */
  82         ctx->state[0] = 0xC1059ED8;
  83         ctx->state[1] = 0x367CD507;
  84         ctx->state[2] = 0x3070DD17;
  85         ctx->state[3] = 0xF70E5939;
  86         ctx->state[4] = 0xFFC00B31;
  87         ctx->state[5] = 0x68581511;
  88         ctx->state[6] = 0x64F98FA7;
  89         ctx->state[7] = 0xBEFA4FA4;
  90     }
  91
  92     ctx->is224 = is224;
  93 }
  94
  95 static void sha2_process( sha2_context *ctx, const unsigned char data[64] )
  96 {
  97     unsigned long temp1, temp2, W[64];
  98     unsigned long A, B, C, D, E, F, G, H;
  99
 100     GET_ULONG_BE( W[ 0], data,  0 );
 101     GET_ULONG_BE( W[ 1], data,  4 );
 102     GET_ULONG_BE( W[ 2], data,  8 );
 103     GET_ULONG_BE( W[ 3], data, 12 );
 104     GET_ULONG_BE( W[ 4], data, 16 );
 105     GET_ULONG_BE( W[ 5], data, 20 );
 106     GET_ULONG_BE( W[ 6], data, 24 );
 107     GET_ULONG_BE( W[ 7], data, 28 );
 108     GET_ULONG_BE( W[ 8], data, 32 );
 109     GET_ULONG_BE( W[ 9], data, 36 );
 110     GET_ULONG_BE( W[10], data, 40 );
 111     GET_ULONG_BE( W[11], data, 44 );
 112     GET_ULONG_BE( W[12], data, 48 );
 113     GET_ULONG_BE( W[13], data, 52 );
 114     GET_ULONG_BE( W[14], data, 56 );
 115     GET_ULONG_BE( W[15], data, 60 );
 116
 117 #define  SHR(x,n) ((x & 0xFFFFFFFF) >> n)
 118 #define ROTR(x,n) (SHR(x,n) | (x << (32 - n)))
 119
 120 #define S0(x) (ROTR(x, 7) ^ ROTR(x,18) ^  SHR(x, 3))
 121 #define S1(x) (ROTR(x,17) ^ ROTR(x,19) ^  SHR(x,10))
 122
 123 #define S2(x) (ROTR(x, 2) ^ ROTR(x,13) ^ ROTR(x,22))
 124 #define S3(x) (ROTR(x, 6) ^ ROTR(x,11) ^ ROTR(x,25))
 125
 126 #define F0(x,y,z) ((x & y) | (z & (x | y)))
 127 #define F1(x,y,z) (z ^ (x & (y ^ z)))
 128
 129 #define R(t)                                    \
 130 (                                               \
 131     W[t] = S1(W[t -  2]) + W[t -  7] +          \
 132            S0(W[t - 15]) + W[t - 16]            \
 133 )
 134
 135 #define P(a,b,c,d,e,f,g,h,x,K)                  \
 136 {                                               \
 137     temp1 = h + S3(e) + F1(e,f,g) + K + x;      \
 138     temp2 = S2(a) + F0(a,b,c);                  \
 139     d += temp1; h = temp1 + temp2;              \
 140 }
 141
 142     A = ctx->state[0];
 143     B = ctx->state[1];
 144     C = ctx->state[2];
 145     D = ctx->state[3];
 146     E = ctx->state[4];
 147     F = ctx->state[5];
 148     G = ctx->state[6];
 149     H = ctx->state[7];
 150
 151     P( A, B, C, D, E, F, G, H, W[ 0], 0x428A2F98 );
 152     P( H, A, B, C, D, E, F, G, W[ 1], 0x71374491 );
 153     P( G, H, A, B, C, D, E, F, W[ 2], 0xB5C0FBCF );
 154     P( F, G, H, A, B, C, D, E, W[ 3], 0xE9B5DBA5 );
 155     P( E, F, G, H, A, B, C, D, W[ 4], 0x3956C25B );
 156     P( D, E, F, G, H, A, B, C, W[ 5], 0x59F111F1 );
 157     P( C, D, E, F, G, H, A, B, W[ 6], 0x923F82A4 );
 158     P( B, C, D, E, F, G, H, A, W[ 7], 0xAB1C5ED5 );
 159     P( A, B, C, D, E, F, G, H, W[ 8], 0xD807AA98 );
 160     P( H, A, B, C, D, E, F, G, W[ 9], 0x12835B01 );
 161     P( G, H, A, B, C, D, E, F, W[10], 0x243185BE );
 162     P( F, G, H, A, B, C, D, E, W[11], 0x550C7DC3 );
 163     P( E, F, G, H, A, B, C, D, W[12], 0x72BE5D74 );
 164     P( D, E, F, G, H, A, B, C, W[13], 0x80DEB1FE );
 165     P( C, D, E, F, G, H, A, B, W[14], 0x9BDC06A7 );
 166     P( B, C, D, E, F, G, H, A, W[15], 0xC19BF174 );
 167     P( A, B, C, D, E, F, G, H, R(16), 0xE49B69C1 );
 168     P( H, A, B, C, D, E, F, G, R(17), 0xEFBE4786 );
 169     P( G, H, A, B, C, D, E, F, R(18), 0x0FC19DC6 );
 170     P( F, G, H, A, B, C, D, E, R(19), 0x240CA1CC );
 171     P( E, F, G, H, A, B, C, D, R(20), 0x2DE92C6F );
 172     P( D, E, F, G, H, A, B, C, R(21), 0x4A7484AA );
 173     P( C, D, E, F, G, H, A, B, R(22), 0x5CB0A9DC );
 174     P( B, C, D, E, F, G, H, A, R(23), 0x76F988DA );
 175     P( A, B, C, D, E, F, G, H, R(24), 0x983E5152 );
 176     P( H, A, B, C, D, E, F, G, R(25), 0xA831C66D );
 177     P( G, H, A, B, C, D, E, F, R(26), 0xB00327C8 );
 178     P( F, G, H, A, B, C, D, E, R(27), 0xBF597FC7 );
 179     P( E, F, G, H, A, B, C, D, R(28), 0xC6E00BF3 );
 180     P( D, E, F, G, H, A, B, C, R(29), 0xD5A79147 );
 181     P( C, D, E, F, G, H, A, B, R(30), 0x06CA6351 );
 182     P( B, C, D, E, F, G, H, A, R(31), 0x14292967 );
 183     P( A, B, C, D, E, F, G, H, R(32), 0x27B70A85 );
 184     P( H, A, B, C, D, E, F, G, R(33), 0x2E1B2138 );
 185     P( G, H, A, B, C, D, E, F, R(34), 0x4D2C6DFC );
 186     P( F, G, H, A, B, C, D, E, R(35), 0x53380D13 );
 187     P( E, F, G, H, A, B, C, D, R(36), 0x650A7354 );
 188     P( D, E, F, G, H, A, B, C, R(37), 0x766A0ABB );
 189     P( C, D, E, F, G, H, A, B, R(38), 0x81C2C92E );
 190     P( B, C, D, E, F, G, H, A, R(39), 0x92722C85 );
 191     P( A, B, C, D, E, F, G, H, R(40), 0xA2BFE8A1 );
 192     P( H, A, B, C, D, E, F, G, R(41), 0xA81A664B );
 193     P( G, H, A, B, C, D, E, F, R(42), 0xC24B8B70 );
 194     P( F, G, H, A, B, C, D, E, R(43), 0xC76C51A3 );
 195     P( E, F, G, H, A, B, C, D, R(44), 0xD192E819 );
 196     P( D, E, F, G, H, A, B, C, R(45), 0xD6990624 );
 197     P( C, D, E, F, G, H, A, B, R(46), 0xF40E3585 );
 198     P( B, C, D, E, F, G, H, A, R(47), 0x106AA070 );
 199     P( A, B, C, D, E, F, G, H, R(48), 0x19A4C116 );
 200     P( H, A, B, C, D, E, F, G, R(49), 0x1E376C08 );
 201     P( G, H, A, B, C, D, E, F, R(50), 0x2748774C );
 202     P( F, G, H, A, B, C, D, E, R(51), 0x34B0BCB5 );
 203     P( E, F, G, H, A, B, C, D, R(52), 0x391C0CB3 );
 204     P( D, E, F, G, H, A, B, C, R(53), 0x4ED8AA4A );
 205     P( C, D, E, F, G, H, A, B, R(54), 0x5B9CCA4F );
 206     P( B, C, D, E, F, G, H, A, R(55), 0x682E6FF3 );
 207     P( A, B, C, D, E, F, G, H, R(56), 0x748F82EE );
 208     P( H, A, B, C, D, E, F, G, R(57), 0x78A5636F );
 209     P( G, H, A, B, C, D, E, F, R(58), 0x84C87814 );
 210     P( F, G, H, A, B, C, D, E, R(59), 0x8CC70208 );
 211     P( E, F, G, H, A, B, C, D, R(60), 0x90BEFFFA );
 212     P( D, E, F, G, H, A, B, C, R(61), 0xA4506CEB );
 213     P( C, D, E, F, G, H, A, B, R(62), 0xBEF9A3F7 );
 214     P( B, C, D, E, F, G, H, A, R(63), 0xC67178F2 );
 215
 216     ctx->state[0] += A;
 217     ctx->state[1] += B;
 218     ctx->state[2] += C;
 219     ctx->state[3] += D;
 220     ctx->state[4] += E;
 221     ctx->state[5] += F;
 222     ctx->state[6] += G;
 223     ctx->state[7] += H;
 224 }
 225
 226 /*
 227  * SHA-256 process buffer
 228  */
 229 void sha2_update( sha2_context *ctx, const unsigned char *input, int ilen )
 230 {
 231     int fill;
 232     unsigned long left;
 233
 234     if( ilen <= 0 )
 235         return;
 236
 237     left = ctx->total[0] & 0x3F;
 238     fill = 64 - left;
 239
 240     ctx->total[0] += ilen;
 241     ctx->total[0] &= 0xFFFFFFFF;
 242
 243     if( ctx->total[0] < (unsigned long) ilen )
 244         ctx->total[1]++;
 245
 246     if( left && ilen >= fill )
 247     {
 248         memcpy( (void *) (ctx->buffer + left),
 249                 (void *) input, fill );
 250         sha2_process( ctx, ctx->buffer );
 251         input += fill;
 252         ilen  -= fill;
 253         left = 0;
 254     }
 255
 256     while( ilen >= 64 )
 257     {
 258         sha2_process( ctx, input );
 259         input += 64;
 260         ilen  -= 64;
 261     }
 262
 263     if( ilen > 0 )
 264     {
 265         memcpy( (void *) (ctx->buffer + left),
 266                 (void *) input, ilen );
 267     }
 268 }
 269
 270 static const unsigned char sha2_padding[64] =
 271 {
 272  0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 273     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 274     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 275     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 276 };
 277
 278 /*
 279  * SHA-256 final digest
 280  */
 281 void sha2_finish( sha2_context *ctx, unsigned char output[32] )
 282 {
 283     unsigned long last, padn;
 284     unsigned long high, low;
 285     unsigned char msglen[8];
 286
 287     high = ( ctx->total[0] >> 29 )
 288          | ( ctx->total[1] <<  3 );
 289     low  = ( ctx->total[0] <<  3 );
 290
 291     PUT_ULONG_BE( high, msglen, 0 );
 292     PUT_ULONG_BE( low,  msglen, 4 );
 293
 294     last = ctx->total[0] & 0x3F;
 295     padn = ( last < 56 ) ? ( 56 - last ) : ( 120 - last );
 296
 297     sha2_update( ctx, (unsigned char *) sha2_padding, padn );
 298     sha2_update( ctx, msglen, 8 );
 299
 300     PUT_ULONG_BE( ctx->state[0], output,  0 );
 301     PUT_ULONG_BE( ctx->state[1], output,  4 );
 302     PUT_ULONG_BE( ctx->state[2], output,  8 );
 303     PUT_ULONG_BE( ctx->state[3], output, 12 );
 304     PUT_ULONG_BE( ctx->state[4], output, 16 );
 305     PUT_ULONG_BE( ctx->state[5], output, 20 );
 306     PUT_ULONG_BE( ctx->state[6], output, 24 );
 307
 308     if( ctx->is224 == 0 )
 309         PUT_ULONG_BE( ctx->state[7], output, 28 );
 310 }
 311
 312 /*
 313  * output = SHA-256( input buffer )
 314  */
 315 void sha2( const unsigned char *input, int ilen,
 316            unsigned char output[32], int is224 )
 317 {
 318     sha2_context ctx;
 319
 320     sha2_starts( &ctx, is224 );
 321     sha2_update( &ctx, input, ilen );
 322     sha2_finish( &ctx, output );
 323
 324     memset( &ctx, 0, sizeof( sha2_context ) );
 325 }
 326
 327 /*
 328  * output = SHA-256( file contents )
 329  */
 330 int sha2_file( const char *path, unsigned char output[32], int is224 )
 331 {
 332     FILE *f;
 333     size_t n;
 334     sha2_context ctx;
 335     unsigned char buf[1024];
 336
 337     if( ( f = fopen( path, "rb" ) ) == NULL )
 338         return( 1 );
 339
 340     sha2_starts( &ctx, is224 );
 341
 342     while( ( n = fread( buf, 1, sizeof( buf ), f ) ) > 0 )
 343         sha2_update( &ctx, buf, (int) n );
 344
 345     sha2_finish( &ctx, output );
 346
 347     memset( &ctx, 0, sizeof( sha2_context ) );
 348
 349     if( ferror( f ) != 0 )
 350     {
 351         fclose( f );
 352         return( 2 );
 353     }
 354
 355     fclose( f );
 356     return( 0 );
 357 }
 358
 359 /*
 360  * SHA-256 HMAC context setup
 361  */
 362 void sha2_hmac_starts( sha2_context *ctx, const unsigned char *key, int keylen,
 363                        int is224 )
 364 {
 365     int i;
 366     unsigned char sum[32];
 367
 368     if( keylen > 64 )
 369     {
 370         sha2( key, keylen, sum, is224 );
 371         keylen = ( is224 ) ? 28 : 32;
 372         key = sum;
 373     }
 374
 375     memset( ctx->ipad, 0x36, 64 );
 376     memset( ctx->opad, 0x5C, 64 );
 377
 378     for( i = 0; i < keylen; i++ )
 379     {
 380         ctx->ipad[i] = (unsigned char)( ctx->ipad[i] ^ key[i] );
 381         ctx->opad[i] = (unsigned char)( ctx->opad[i] ^ key[i] );
 382     }
 383
 384     sha2_starts( ctx, is224 );
 385     sha2_update( ctx, ctx->ipad, 64 );
 386
 387     memset( sum, 0, sizeof( sum ) );
 388 }
 389
 390 /*
 391  * SHA-256 HMAC process buffer
 392  */
 393 void sha2_hmac_update( sha2_context *ctx, const unsigned char *input, int ilen )
 394 {
 395     sha2_update( ctx, input, ilen );
 396 }
 397
 398 /*
 399  * SHA-256 HMAC final digest
 400  */
 401 void sha2_hmac_finish( sha2_context *ctx, unsigned char output[32] )
 402 {
 403     int is224, hlen;
 404     unsigned char tmpbuf[32];
 405
 406     is224 = ctx->is224;
 407     hlen = ( is224 == 0 ) ? 32 : 28;
 408
 409     sha2_finish( ctx, tmpbuf );
 410     sha2_starts( ctx, is224 );
 411     sha2_update( ctx, ctx->opad, 64 );
 412     sha2_update( ctx, tmpbuf, hlen );
 413     sha2_finish( ctx, output );
 414
 415     memset( tmpbuf, 0, sizeof( tmpbuf ) );
 416 }
 417
 418 /*
 419  * SHA-256 HMAC context reset
 420  */
 421 void sha2_hmac_reset( sha2_context *ctx )
 422 {
 423     sha2_starts( ctx, ctx->is224 );
 424     sha2_update( ctx, ctx->ipad, 64 );
 425 }
 426
 427 /*
 428  * output = HMAC-SHA-256( hmac key, input buffer )
 429  */
 430 void sha2_hmac( const unsigned char *key, int keylen,
 431                 const unsigned char *input, int ilen,
 432                 unsigned char output[32], int is224 )
 433 {
 434     sha2_context ctx;
 435
 436     sha2_hmac_starts( &ctx, key, keylen, is224 );
 437     sha2_hmac_update( &ctx, input, ilen );
 438     sha2_hmac_finish( &ctx, output );
 439
 440     memset( &ctx, 0, sizeof( sha2_context ) );
 441 }