Mercurial > dropbear

comparison libtomcrypt/src/hashes/sha2/sha256.c @ 285:1b9e69c058d2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
propagate from branch 'au.asn.ucc.matt.ltc.dropbear' (head 20dccfc09627970a312d77fb41dc2970b62689c3) to branch 'au.asn.ucc.matt.dropbear' (head fdf4a7a3b97ae5046139915de7e40399cceb2c01)
author Matt Johnston <matt@ucc.asn.au>
date Wed, 08 Mar 2006 13:23:58 +0000
parents
children 0cbe8f6dbf9e
comparison
equal deleted inserted replaced
281:997e6f7dc01e 285:1b9e69c058d2
1 /* LibTomCrypt, modular cryptographic library -- Tom St Denis
2 *
3 * LibTomCrypt is a library that provides various cryptographic
4 * algorithms in a highly modular and flexible manner.
5 *
6 * The library is free for all purposes without any express
7 * guarantee it works.
8 *
9 * Tom St Denis, [email protected], http://libtomcrypt.org
10 */
11 #include "tomcrypt.h"
12
13 /**
14 @file sha256.c
15 SHA256 by Tom St Denis
16 */
17
18 #ifdef SHA256
19
20 const struct ltc_hash_descriptor sha256_desc =
21 {
22 "sha256",
23 0,
24 32,
25 64,
26
27 /* OID */
28 { 2, 16, 840, 1, 101, 3, 4, 2, 1, },
29 9,
30
31 &sha256_init,
32 &sha256_process,
33 &sha256_done,
34 &sha256_test
35 };
36
37 #ifdef LTC_SMALL_CODE
38 /* the K array */
39 static const unsigned long K[64] = {
40 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
41 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
42 0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
43 0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
44 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
45 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
46 0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
47 0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
48 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
49 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
50 0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
51 0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
52 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
53 };
54 #endif
55
56 /* Various logical functions */
57 #define Ch(x,y,z) (z ^ (x & (y ^ z)))
58 #define Maj(x,y,z) (((x | y) & z) | (x & y))
59 #define S(x, n) RORc((x),(n))
60 #define R(x, n) (((x)&0xFFFFFFFFUL)>>(n))
61 #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22))
62 #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25))
63 #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3))
64 #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10))
65
66 /* compress 512-bits */
67 #ifdef LTC_CLEAN_STACK
68 static int _sha256_compress(hash_state * md, unsigned char *buf)
69 #else
70 static int sha256_compress(hash_state * md, unsigned char *buf)
71 #endif
72 {
73 ulong32 S[8], W[64], t0, t1;
74 #ifdef LTC_SMALL_CODE
75 ulong32 t;
76 #endif
77 int i;
78
79 /* copy state into S */
80 for (i = 0; i < 8; i++) {
81 S[i] = md->sha256.state[i];
82 }
83
84 /* copy the state into 512-bits into W[0..15] */
85 for (i = 0; i < 16; i++) {
86 LOAD32H(W[i], buf + (4*i));
87 }
88
89 /* fill W[16..63] */
90 for (i = 16; i < 64; i++) {
91 W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16];
92 }
93
94 /* Compress */
95 #ifdef LTC_SMALL_CODE
96 #define RND(a,b,c,d,e,f,g,h,i) \
97 t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
98 t1 = Sigma0(a) + Maj(a, b, c); \
99 d += t0; \
100 h = t0 + t1;
101
102 for (i = 0; i < 64; ++i) {
103 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],i);
104 t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4];
105 S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
106 }
107 #else
108 #define RND(a,b,c,d,e,f,g,h,i,ki) \
109 t0 = h + Sigma1(e) + Ch(e, f, g) + ki + W[i]; \
110 t1 = Sigma0(a) + Maj(a, b, c); \
111 d += t0; \
112 h = t0 + t1;
113
114 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],0,0x428a2f98);
115 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],1,0x71374491);
116 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],2,0xb5c0fbcf);
117 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],3,0xe9b5dba5);
118 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],4,0x3956c25b);
119 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],5,0x59f111f1);
120 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],6,0x923f82a4);
121 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],7,0xab1c5ed5);
122 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],8,0xd807aa98);
123 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],9,0x12835b01);
124 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],10,0x243185be);
125 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],11,0x550c7dc3);
126 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],12,0x72be5d74);
127 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],13,0x80deb1fe);
128 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],14,0x9bdc06a7);
129 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],15,0xc19bf174);
130 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],16,0xe49b69c1);
131 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],17,0xefbe4786);
132 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],18,0x0fc19dc6);
133 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],19,0x240ca1cc);
134 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],20,0x2de92c6f);
135 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],21,0x4a7484aa);
136 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],22,0x5cb0a9dc);
137 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],23,0x76f988da);
138 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],24,0x983e5152);
139 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],25,0xa831c66d);
140 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],26,0xb00327c8);
141 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],27,0xbf597fc7);
142 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],28,0xc6e00bf3);
143 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],29,0xd5a79147);
144 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],30,0x06ca6351);
145 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],31,0x14292967);
146 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],32,0x27b70a85);
147 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],33,0x2e1b2138);
148 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],34,0x4d2c6dfc);
149 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],35,0x53380d13);
150 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],36,0x650a7354);
151 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],37,0x766a0abb);
152 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],38,0x81c2c92e);
153 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],39,0x92722c85);
154 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],40,0xa2bfe8a1);
155 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],41,0xa81a664b);
156 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],42,0xc24b8b70);
157 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],43,0xc76c51a3);
158 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],44,0xd192e819);
159 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],45,0xd6990624);
160 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],46,0xf40e3585);
161 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],47,0x106aa070);
162 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],48,0x19a4c116);
163 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],49,0x1e376c08);
164 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],50,0x2748774c);
165 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],51,0x34b0bcb5);
166 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],52,0x391c0cb3);
167 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],53,0x4ed8aa4a);
168 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],54,0x5b9cca4f);
169 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],55,0x682e6ff3);
170 RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],56,0x748f82ee);
171 RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],57,0x78a5636f);
172 RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],58,0x84c87814);
173 RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],59,0x8cc70208);
174 RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],60,0x90befffa);
175 RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],61,0xa4506ceb);
176 RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],62,0xbef9a3f7);
177 RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],63,0xc67178f2);
178
179 #undef RND
180
181 #endif
182
183 /* feedback */
184 for (i = 0; i < 8; i++) {
185 md->sha256.state[i] = md->sha256.state[i] + S[i];
186 }
187 return CRYPT_OK;
188 }
189
190 #ifdef LTC_CLEAN_STACK
191 static int sha256_compress(hash_state * md, unsigned char *buf)
192 {
193 int err;
194 err = _sha256_compress(md, buf);
195 burn_stack(sizeof(ulong32) * 74);
196 return err;
197 }
198 #endif
199
200 /**
201 Initialize the hash state
202 @param md The hash state you wish to initialize
203 @return CRYPT_OK if successful
204 */
205 int sha256_init(hash_state * md)
206 {
207 LTC_ARGCHK(md != NULL);
208
209 md->sha256.curlen = 0;
210 md->sha256.length = 0;
211 md->sha256.state[0] = 0x6A09E667UL;
212 md->sha256.state[1] = 0xBB67AE85UL;
213 md->sha256.state[2] = 0x3C6EF372UL;
214 md->sha256.state[3] = 0xA54FF53AUL;
215 md->sha256.state[4] = 0x510E527FUL;
216 md->sha256.state[5] = 0x9B05688CUL;
217 md->sha256.state[6] = 0x1F83D9ABUL;
218 md->sha256.state[7] = 0x5BE0CD19UL;
219 return CRYPT_OK;
220 }
221
222 /**
223 Process a block of memory though the hash
224 @param md The hash state
225 @param in The data to hash
226 @param inlen The length of the data (octets)
227 @return CRYPT_OK if successful
228 */
229 HASH_PROCESS(sha256_process, sha256_compress, sha256, 64)
230
231 /**
232 Terminate the hash to get the digest
233 @param md The hash state
234 @param out [out] The destination of the hash (32 bytes)
235 @return CRYPT_OK if successful
236 */
237 int sha256_done(hash_state * md, unsigned char *out)
238 {
239 int i;
240
241 LTC_ARGCHK(md != NULL);
242 LTC_ARGCHK(out != NULL);
243
244 if (md->sha256.curlen >= sizeof(md->sha256.buf)) {
245 return CRYPT_INVALID_ARG;
246 }
247
248
249 /* increase the length of the message */
250 md->sha256.length += md->sha256.curlen * 8;
251
252 /* append the '1' bit */
253 md->sha256.buf[md->sha256.curlen++] = (unsigned char)0x80;
254
255 /* if the length is currently above 56 bytes we append zeros
256 * then compress. Then we can fall back to padding zeros and length
257 * encoding like normal.
258 */
259 if (md->sha256.curlen > 56) {
260 while (md->sha256.curlen < 64) {
261 md->sha256.buf[md->sha256.curlen++] = (unsigned char)0;
262 }
263 sha256_compress(md, md->sha256.buf);
264 md->sha256.curlen = 0;
265 }
266
267 /* pad upto 56 bytes of zeroes */
268 while (md->sha256.curlen < 56) {
269 md->sha256.buf[md->sha256.curlen++] = (unsigned char)0;
270 }
271
272 /* store length */
273 STORE64H(md->sha256.length, md->sha256.buf+56);
274 sha256_compress(md, md->sha256.buf);
275
276 /* copy output */
277 for (i = 0; i < 8; i++) {
278 STORE32H(md->sha256.state[i], out+(4*i));
279 }
280 #ifdef LTC_CLEAN_STACK
281 zeromem(md, sizeof(hash_state));
282 #endif
283 return CRYPT_OK;
284 }
285
286 /**
287 Self-test the hash
288 @return CRYPT_OK if successful, CRYPT_NOP if self-tests have been disabled
289 */
290 int sha256_test(void)
291 {
292 #ifndef LTC_TEST
293 return CRYPT_NOP;
294 #else
295 static const struct {
296 char *msg;
297 unsigned char hash[32];
298 } tests[] = {
299 { "abc",
300 { 0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea,
301 0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23,
302 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
303 0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad }
304 },
305 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
306 { 0x24, 0x8d, 0x6a, 0x61, 0xd2, 0x06, 0x38, 0xb8,
307 0xe5, 0xc0, 0x26, 0x93, 0x0c, 0x3e, 0x60, 0x39,
308 0xa3, 0x3c, 0xe4, 0x59, 0x64, 0xff, 0x21, 0x67,
309 0xf6, 0xec, 0xed, 0xd4, 0x19, 0xdb, 0x06, 0xc1 }
310 },
311 };
312
313 int i;
314 unsigned char tmp[32];
315 hash_state md;
316
317 for (i = 0; i < (int)(sizeof(tests) / sizeof(tests[0])); i++) {
318 sha256_init(&md);
319 sha256_process(&md, (unsigned char*)tests[i].msg, (unsigned long)strlen(tests[i].msg));
320 sha256_done(&md, tmp);
321 if (memcmp(tmp, tests[i].hash, 32) != 0) {
322 return CRYPT_FAIL_TESTVECTOR;
323 }
324 }
325 return CRYPT_OK;
326 #endif
327 }
328
329 #ifdef SHA224
330 #include "sha224.c"
331 #endif
332
333 #endif
334
335
336
337 /* $Source: /cvs/libtom/libtomcrypt/src/hashes/sha2/sha256.c,v $ */
338 /* $Revision: 1.5 $ */
339 /* $Date: 2005/05/23 02:42:07 $ */