1/*
2 * SHA-256 hash implementation and interface functions
3 * Copyright (c) 2003-2006, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15#include "includes.h"
16
17#include "common.h"
18#include "sha256.h"
19#include "crypto.h"
20
21
22/**
23 * hmac_sha256_vector - HMAC-SHA256 over data vector (RFC 2104)
24 * @key: Key for HMAC operations
25 * @key_len: Length of the key in bytes
26 * @num_elem: Number of elements in the data vector
27 * @addr: Pointers to the data areas
28 * @len: Lengths of the data blocks
29 * @mac: Buffer for the hash (32 bytes)
30 */
31void hmac_sha256_vector(const u8 *key, size_t key_len, size_t num_elem,
32			const u8 *addr[], const size_t *len, u8 *mac)
33{
34	unsigned char k_pad[64]; /* padding - key XORd with ipad/opad */
35	unsigned char tk[32];
36	const u8 *_addr[6];
37	size_t _len[6], i;
38
39	if (num_elem > 5) {
40		/*
41		 * Fixed limit on the number of fragments to avoid having to
42		 * allocate memory (which could fail).
43		 */
44		return;
45	}
46
47        /* if key is longer than 64 bytes reset it to key = SHA256(key) */
48        if (key_len > 64) {
49		sha256_vector(1, &key, &key_len, tk);
50		key = tk;
51		key_len = 32;
52        }
53
54	/* the HMAC_SHA256 transform looks like:
55	 *
56	 * SHA256(K XOR opad, SHA256(K XOR ipad, text))
57	 *
58	 * where K is an n byte key
59	 * ipad is the byte 0x36 repeated 64 times
60	 * opad is the byte 0x5c repeated 64 times
61	 * and text is the data being protected */
62
63	/* start out by storing key in ipad */
64	memset(k_pad, 0, sizeof(k_pad));
65	memcpy(k_pad, key, key_len);
66	/* XOR key with ipad values */
67	for (i = 0; i < 64; i++)
68		k_pad[i] ^= 0x36;
69
70	/* perform inner SHA256 */
71	_addr[0] = k_pad;
72	_len[0] = 64;
73	for (i = 0; i < num_elem; i++) {
74		_addr[i + 1] = addr[i];
75		_len[i + 1] = len[i];
76	}
77	sha256_vector(1 + num_elem, _addr, _len, mac);
78
79	memset(k_pad, 0, sizeof(k_pad));
80	memcpy(k_pad, key, key_len);
81	/* XOR key with opad values */
82	for (i = 0; i < 64; i++)
83		k_pad[i] ^= 0x5c;
84
85	/* perform outer SHA256 */
86	_addr[0] = k_pad;
87	_len[0] = 64;
88	_addr[1] = mac;
89	_len[1] = SHA256_MAC_LEN;
90	sha256_vector(2, _addr, _len, mac);
91}
92
93
94/**
95 * hmac_sha256 - HMAC-SHA256 over data buffer (RFC 2104)
96 * @key: Key for HMAC operations
97 * @key_len: Length of the key in bytes
98 * @data: Pointers to the data area
99 * @data_len: Length of the data area
100 * @mac: Buffer for the hash (20 bytes)
101 */
102void hmac_sha256(const u8 *key, size_t key_len, const u8 *data,
103		 size_t data_len, u8 *mac)
104{
105	hmac_sha256_vector(key, key_len, 1, &data, &data_len, mac);
106}
107
108
109/**
110 * sha256_prf - SHA256-based Pseudo-Random Function (IEEE 802.11r, 8.5A.3)
111 * @key: Key for PRF
112 * @key_len: Length of the key in bytes
113 * @label: A unique label for each purpose of the PRF
114 * @data: Extra data to bind into the key
115 * @data_len: Length of the data
116 * @buf: Buffer for the generated pseudo-random key
117 * @buf_len: Number of bytes of key to generate
118 *
119 * This function is used to derive new, cryptographically separate keys from a
120 * given key.
121 */
122void sha256_prf(const u8 *key, size_t key_len, const char *label,
123		const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
124{
125	u16 counter = 0;
126	size_t pos, plen;
127	u8 hash[SHA256_MAC_LEN];
128	const u8 *addr[3];
129	size_t len[3];
130	u8 counter_le[2];
131
132	addr[0] = counter_le;
133	len[0] = 2;
134	addr[1] = (u8 *) label;
135	len[1] = strlen(label) + 1;
136	addr[2] = data;
137	len[2] = data_len;
138
139	pos = 0;
140	while (pos < buf_len) {
141		plen = buf_len - pos;
142		WPA_PUT_LE16(counter_le, counter);
143		if (plen >= SHA256_MAC_LEN) {
144			hmac_sha256_vector(key, key_len, 3, addr, len,
145					   &buf[pos]);
146			pos += SHA256_MAC_LEN;
147		} else {
148			hmac_sha256_vector(key, key_len, 3, addr, len, hash);
149			memcpy(&buf[pos], hash, plen);
150			break;
151		}
152		counter++;
153	}
154}
155
156
157#ifdef INTERNAL_SHA256
158
159struct sha256_state {
160	u64 length;
161	u32 state[8], curlen;
162	u8 buf[64];
163};
164
165static void sha256_init(struct sha256_state *md);
166static int sha256_process(struct sha256_state *md, const unsigned char *in,
167			  unsigned long inlen);
168static int sha256_done(struct sha256_state *md, unsigned char *out);
169
170
171/**
172 * sha256_vector - SHA256 hash for data vector
173 * @num_elem: Number of elements in the data vector
174 * @addr: Pointers to the data areas
175 * @len: Lengths of the data blocks
176 * @mac: Buffer for the hash
177 */
178void sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len,
179		 u8 *mac)
180{
181	struct sha256_state ctx;
182	size_t i;
183
184	sha256_init(&ctx);
185	for (i = 0; i < num_elem; i++)
186		sha256_process(&ctx, addr[i], len[i]);
187	sha256_done(&ctx, mac);
188}
189
190
191/* ===== start - public domain SHA256 implementation ===== */
192
193/* This is based on SHA256 implementation in LibTomCrypt that was released into
194 * public domain by Tom St Denis. */
195
196/* the K array */
197static const unsigned long K[64] = {
198	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
199	0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
200	0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
201	0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
202	0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
203	0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
204	0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
205	0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
206	0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
207	0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
208	0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
209	0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
210	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
211};
212
213
214/* Various logical functions */
215#define RORc(x, y) \
216( ((((unsigned long) (x) & 0xFFFFFFFFUL) >> (unsigned long) ((y) & 31)) | \
217   ((unsigned long) (x) << (unsigned long) (32 - ((y) & 31)))) & 0xFFFFFFFFUL)
218#define Ch(x,y,z)       (z ^ (x & (y ^ z)))
219#define Maj(x,y,z)      (((x | y) & z) | (x & y))
220#define S(x, n)         RORc((x), (n))
221#define R(x, n)         (((x)&0xFFFFFFFFUL)>>(n))
222#define Sigma0(x)       (S(x, 2) ^ S(x, 13) ^ S(x, 22))
223#define Sigma1(x)       (S(x, 6) ^ S(x, 11) ^ S(x, 25))
224#define Gamma0(x)       (S(x, 7) ^ S(x, 18) ^ R(x, 3))
225#define Gamma1(x)       (S(x, 17) ^ S(x, 19) ^ R(x, 10))
226#ifndef MIN
227#define MIN(x, y) (((x) < (y)) ? (x) : (y))
228#endif
229
230/* compress 512-bits */
231static int sha256_compress(struct sha256_state *md, unsigned char *buf)
232{
233	u32 S[8], W[64], t0, t1;
234	u32 t;
235	int i;
236
237	/* copy state into S */
238	for (i = 0; i < 8; i++) {
239		S[i] = md->state[i];
240	}
241
242	/* copy the state into 512-bits into W[0..15] */
243	for (i = 0; i < 16; i++)
244		W[i] = WPA_GET_BE32(buf + (4 * i));
245
246	/* fill W[16..63] */
247	for (i = 16; i < 64; i++) {
248		W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) +
249			W[i - 16];
250	}
251
252	/* Compress */
253#define RND(a,b,c,d,e,f,g,h,i)                          \
254	t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];	\
255	t1 = Sigma0(a) + Maj(a, b, c);			\
256	d += t0;					\
257	h  = t0 + t1;
258
259	for (i = 0; i < 64; ++i) {
260		RND(S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i);
261		t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4];
262		S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
263	}
264
265	/* feedback */
266	for (i = 0; i < 8; i++) {
267		md->state[i] = md->state[i] + S[i];
268	}
269	return 0;
270}
271
272
273/* Initialize the hash state */
274static void sha256_init(struct sha256_state *md)
275{
276	md->curlen = 0;
277	md->length = 0;
278	md->state[0] = 0x6A09E667UL;
279	md->state[1] = 0xBB67AE85UL;
280	md->state[2] = 0x3C6EF372UL;
281	md->state[3] = 0xA54FF53AUL;
282	md->state[4] = 0x510E527FUL;
283	md->state[5] = 0x9B05688CUL;
284	md->state[6] = 0x1F83D9ABUL;
285	md->state[7] = 0x5BE0CD19UL;
286}
287
288/**
289   Process a block of memory though the hash
290   @param md     The hash state
291   @param in     The data to hash
292   @param inlen  The length of the data (octets)
293   @return CRYPT_OK if successful
294*/
295static int sha256_process(struct sha256_state *md, const unsigned char *in,
296			  unsigned long inlen)
297{
298	unsigned long n;
299#define block_size 64
300
301	if (md->curlen > sizeof(md->buf))
302		return -1;
303
304	while (inlen > 0) {
305		if (md->curlen == 0 && inlen >= block_size) {
306			if (sha256_compress(md, (unsigned char *) in) < 0)
307				return -1;
308			md->length += block_size * 8;
309			in += block_size;
310			inlen -= block_size;
311		} else {
312			n = MIN(inlen, (block_size - md->curlen));
313			memcpy(md->buf + md->curlen, in, n);
314			md->curlen += n;
315			in += n;
316			inlen -= n;
317			if (md->curlen == block_size) {
318				if (sha256_compress(md, md->buf) < 0)
319					return -1;
320				md->length += 8 * block_size;
321				md->curlen = 0;
322			}
323		}
324	}
325
326	return 0;
327}
328
329
330/**
331   Terminate the hash to get the digest
332   @param md  The hash state
333   @param out [out] The destination of the hash (32 bytes)
334   @return CRYPT_OK if successful
335*/
336static int sha256_done(struct sha256_state *md, unsigned char *out)
337{
338	int i;
339
340	if (md->curlen >= sizeof(md->buf))
341		return -1;
342
343	/* increase the length of the message */
344	md->length += md->curlen * 8;
345
346	/* append the '1' bit */
347	md->buf[md->curlen++] = (unsigned char) 0x80;
348
349	/* if the length is currently above 56 bytes we append zeros
350	 * then compress.  Then we can fall back to padding zeros and length
351	 * encoding like normal.
352	 */
353	if (md->curlen > 56) {
354		while (md->curlen < 64) {
355			md->buf[md->curlen++] = (unsigned char) 0;
356		}
357		sha256_compress(md, md->buf);
358		md->curlen = 0;
359	}
360
361	/* pad upto 56 bytes of zeroes */
362	while (md->curlen < 56) {
363		md->buf[md->curlen++] = (unsigned char) 0;
364	}
365
366	/* store length */
367	WPA_PUT_BE64(md->buf + 56, md->length);
368	sha256_compress(md, md->buf);
369
370	/* copy output */
371	for (i = 0; i < 8; i++)
372		WPA_PUT_BE32(out + (4 * i), md->state[i]);
373
374	return 0;
375}
376
377/* ===== end - public domain SHA256 implementation ===== */
378
379#endif /* INTERNAL_SHA256 */
380