1/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to.  The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 *    notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 *    notice, this list of conditions and the following disclaimer in the
29 *    documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 *    must display the following acknowledgement:
32 *    "This product includes cryptographic software written by
33 *     Eric Young (eay@cryptsoft.com)"
34 *    The word 'cryptographic' can be left out if the rouines from the library
35 *    being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 *    the apps directory (application code) you must include an acknowledgement:
38 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed.  i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.] */
56
57#include <openssl/sha.h>
58
59#include <string.h>
60
61#include <openssl/mem.h>
62
63
64#if !defined(OPENSSL_NO_ASM) && \
65    (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) || defined(OPENSSL_ARM))
66#define SHA1_ASM
67#endif
68
69int SHA1_Init(SHA_CTX *sha) {
70  memset(sha, 0, sizeof(SHA_CTX));
71  sha->h0 = 0x67452301UL;
72  sha->h1 = 0xefcdab89UL;
73  sha->h2 = 0x98badcfeUL;
74  sha->h3 = 0x10325476UL;
75  sha->h4 = 0xc3d2e1f0UL;
76  return 1;
77}
78
79uint8_t *SHA1(const uint8_t *data, size_t len, uint8_t *out) {
80  SHA_CTX ctx;
81  static uint8_t buf[SHA_DIGEST_LENGTH];
82
83  /* TODO(fork): remove this static buffer. */
84  if (out == NULL) {
85    out = buf;
86  }
87  if (!SHA1_Init(&ctx)) {
88    return NULL;
89  }
90  SHA1_Update(&ctx, data, len);
91  SHA1_Final(out, &ctx);
92  OPENSSL_cleanse(&ctx, sizeof(ctx));
93  return out;
94}
95
96#define DATA_ORDER_IS_BIG_ENDIAN
97
98#define HASH_LONG               uint32_t
99#define HASH_CTX                SHA_CTX
100#define HASH_CBLOCK             64
101#define HASH_MAKE_STRING(c, s) \
102  do {                         \
103    unsigned long ll;          \
104    ll = (c)->h0;              \
105    (void) HOST_l2c(ll, (s));  \
106    ll = (c)->h1;              \
107    (void) HOST_l2c(ll, (s));  \
108    ll = (c)->h2;              \
109    (void) HOST_l2c(ll, (s));  \
110    ll = (c)->h3;              \
111    (void) HOST_l2c(ll, (s));  \
112    ll = (c)->h4;              \
113    (void) HOST_l2c(ll, (s));  \
114  } while (0)
115
116#define HASH_UPDATE SHA1_Update
117#define HASH_TRANSFORM SHA1_Transform
118#define HASH_FINAL SHA1_Final
119#define HASH_BLOCK_DATA_ORDER sha1_block_data_order
120#define Xupdate(a, ix, ia, ib, ic, id) \
121  ((a) = (ia ^ ib ^ ic ^ id), ix = (a) = ROTATE((a), 1))
122
123#ifndef SHA1_ASM
124static
125#endif
126void sha1_block_data_order(SHA_CTX *c, const void *p, size_t num);
127
128#include "../digest/md32_common.h"
129
130#define K_00_19 0x5a827999UL
131#define K_20_39 0x6ed9eba1UL
132#define K_40_59 0x8f1bbcdcUL
133#define K_60_79 0xca62c1d6UL
134
135/* As  pointed out by Wei Dai <weidai@eskimo.com>, F() below can be simplified
136 * to the code in F_00_19.  Wei attributes these optimisations to Peter
137 * Gutmann's SHS code, and he attributes it to Rich Schroeppel. #define
138 * F(x,y,z) (((x) & (y))  |  ((~(x)) & (z))) I've just become aware of another
139 * tweak to be made, again from Wei Dai, in F_40_59, (x&a)|(y&a) -> (x|y)&a */
140#define F_00_19(b, c, d) ((((c) ^ (d)) & (b)) ^ (d))
141#define F_20_39(b, c, d) ((b) ^ (c) ^ (d))
142#define F_40_59(b, c, d) (((b) & (c)) | (((b) | (c)) & (d)))
143#define F_60_79(b, c, d) F_20_39(b, c, d)
144
145#define BODY_00_15(i, a, b, c, d, e, f, xi)                           \
146  (f) = xi + (e) + K_00_19 + ROTATE((a), 5) + F_00_19((b), (c), (d)); \
147  (b) = ROTATE((b), 30);
148
149#define BODY_16_19(i, a, b, c, d, e, f, xi, xa, xb, xc, xd)       \
150  Xupdate(f, xi, xa, xb, xc, xd);                                 \
151  (f) += (e) + K_00_19 + ROTATE((a), 5) + F_00_19((b), (c), (d)); \
152  (b) = ROTATE((b), 30);
153
154#define BODY_20_31(i, a, b, c, d, e, f, xi, xa, xb, xc, xd)       \
155  Xupdate(f, xi, xa, xb, xc, xd);                                 \
156  (f) += (e) + K_20_39 + ROTATE((a), 5) + F_20_39((b), (c), (d)); \
157  (b) = ROTATE((b), 30);
158
159#define BODY_32_39(i, a, b, c, d, e, f, xa, xb, xc, xd)           \
160  Xupdate(f, xa, xa, xb, xc, xd);                                 \
161  (f) += (e) + K_20_39 + ROTATE((a), 5) + F_20_39((b), (c), (d)); \
162  (b) = ROTATE((b), 30);
163
164#define BODY_40_59(i, a, b, c, d, e, f, xa, xb, xc, xd)           \
165  Xupdate(f, xa, xa, xb, xc, xd);                                 \
166  (f) += (e) + K_40_59 + ROTATE((a), 5) + F_40_59((b), (c), (d)); \
167  (b) = ROTATE((b), 30);
168
169#define BODY_60_79(i, a, b, c, d, e, f, xa, xb, xc, xd)               \
170  Xupdate(f, xa, xa, xb, xc, xd);                                     \
171  (f) = xa + (e) + K_60_79 + ROTATE((a), 5) + F_60_79((b), (c), (d)); \
172  (b) = ROTATE((b), 30);
173
174#ifdef X
175#undef X
176#endif
177
178/* Originally X was an array. As it's automatic it's natural
179* to expect RISC compiler to accomodate at least part of it in
180* the register bank, isn't it? Unfortunately not all compilers
181* "find" this expectation reasonable:-( On order to make such
182* compilers generate better code I replace X[] with a bunch of
183* X0, X1, etc. See the function body below...
184*					<appro@fy.chalmers.se> */
185#define X(i)	XX##i
186
187#if !defined(SHA1_ASM)
188static void HASH_BLOCK_DATA_ORDER(SHA_CTX *c, const void *p, size_t num) {
189  const uint8_t *data = p;
190  register unsigned MD32_REG_T A, B, C, D, E, T, l;
191  unsigned MD32_REG_T XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10,
192      XX11, XX12, XX13, XX14, XX15;
193
194  A = c->h0;
195  B = c->h1;
196  C = c->h2;
197  D = c->h3;
198  E = c->h4;
199
200  for (;;) {
201    const union {
202      long one;
203      char little;
204    } is_endian = {1};
205
206    if (!is_endian.little && ((size_t)p % 4) == 0) {
207      const uint32_t *W = (const uint32_t *)data;
208
209      X(0) = W[0];
210      X(1) = W[1];
211      BODY_00_15(0, A, B, C, D, E, T, X(0));
212      X(2) = W[2];
213      BODY_00_15(1, T, A, B, C, D, E, X(1));
214      X(3) = W[3];
215      BODY_00_15(2, E, T, A, B, C, D, X(2));
216      X(4) = W[4];
217      BODY_00_15(3, D, E, T, A, B, C, X(3));
218      X(5) = W[5];
219      BODY_00_15(4, C, D, E, T, A, B, X(4));
220      X(6) = W[6];
221      BODY_00_15(5, B, C, D, E, T, A, X(5));
222      X(7) = W[7];
223      BODY_00_15(6, A, B, C, D, E, T, X(6));
224      X(8) = W[8];
225      BODY_00_15(7, T, A, B, C, D, E, X(7));
226      X(9) = W[9];
227      BODY_00_15(8, E, T, A, B, C, D, X(8));
228      X(10) = W[10];
229      BODY_00_15(9, D, E, T, A, B, C, X(9));
230      X(11) = W[11];
231      BODY_00_15(10, C, D, E, T, A, B, X(10));
232      X(12) = W[12];
233      BODY_00_15(11, B, C, D, E, T, A, X(11));
234      X(13) = W[13];
235      BODY_00_15(12, A, B, C, D, E, T, X(12));
236      X(14) = W[14];
237      BODY_00_15(13, T, A, B, C, D, E, X(13));
238      X(15) = W[15];
239      BODY_00_15(14, E, T, A, B, C, D, X(14));
240      BODY_00_15(15, D, E, T, A, B, C, X(15));
241
242      data += HASH_CBLOCK;
243    } else {
244      (void)HOST_c2l(data, l);
245      X(0) = l;
246      (void)HOST_c2l(data, l);
247      X(1) = l;
248      BODY_00_15(0, A, B, C, D, E, T, X(0));
249      (void)HOST_c2l(data, l);
250      X(2) = l;
251      BODY_00_15(1, T, A, B, C, D, E, X(1));
252      (void)HOST_c2l(data, l);
253      X(3) = l;
254      BODY_00_15(2, E, T, A, B, C, D, X(2));
255      (void)HOST_c2l(data, l);
256      X(4) = l;
257      BODY_00_15(3, D, E, T, A, B, C, X(3));
258      (void)HOST_c2l(data, l);
259      X(5) = l;
260      BODY_00_15(4, C, D, E, T, A, B, X(4));
261      (void)HOST_c2l(data, l);
262      X(6) = l;
263      BODY_00_15(5, B, C, D, E, T, A, X(5));
264      (void)HOST_c2l(data, l);
265      X(7) = l;
266      BODY_00_15(6, A, B, C, D, E, T, X(6));
267      (void)HOST_c2l(data, l);
268      X(8) = l;
269      BODY_00_15(7, T, A, B, C, D, E, X(7));
270      (void)HOST_c2l(data, l);
271      X(9) = l;
272      BODY_00_15(8, E, T, A, B, C, D, X(8));
273      (void)HOST_c2l(data, l);
274      X(10) = l;
275      BODY_00_15(9, D, E, T, A, B, C, X(9));
276      (void)HOST_c2l(data, l);
277      X(11) = l;
278      BODY_00_15(10, C, D, E, T, A, B, X(10));
279      (void)HOST_c2l(data, l);
280      X(12) = l;
281      BODY_00_15(11, B, C, D, E, T, A, X(11));
282      (void)HOST_c2l(data, l);
283      X(13) = l;
284      BODY_00_15(12, A, B, C, D, E, T, X(12));
285      (void)HOST_c2l(data, l);
286      X(14) = l;
287      BODY_00_15(13, T, A, B, C, D, E, X(13));
288      (void)HOST_c2l(data, l);
289      X(15) = l;
290      BODY_00_15(14, E, T, A, B, C, D, X(14));
291      BODY_00_15(15, D, E, T, A, B, C, X(15));
292    }
293
294    BODY_16_19(16, C, D, E, T, A, B, X(0), X(0), X(2), X(8), X(13));
295    BODY_16_19(17, B, C, D, E, T, A, X(1), X(1), X(3), X(9), X(14));
296    BODY_16_19(18, A, B, C, D, E, T, X(2), X(2), X(4), X(10), X(15));
297    BODY_16_19(19, T, A, B, C, D, E, X(3), X(3), X(5), X(11), X(0));
298
299    BODY_20_31(20, E, T, A, B, C, D, X(4), X(4), X(6), X(12), X(1));
300    BODY_20_31(21, D, E, T, A, B, C, X(5), X(5), X(7), X(13), X(2));
301    BODY_20_31(22, C, D, E, T, A, B, X(6), X(6), X(8), X(14), X(3));
302    BODY_20_31(23, B, C, D, E, T, A, X(7), X(7), X(9), X(15), X(4));
303    BODY_20_31(24, A, B, C, D, E, T, X(8), X(8), X(10), X(0), X(5));
304    BODY_20_31(25, T, A, B, C, D, E, X(9), X(9), X(11), X(1), X(6));
305    BODY_20_31(26, E, T, A, B, C, D, X(10), X(10), X(12), X(2), X(7));
306    BODY_20_31(27, D, E, T, A, B, C, X(11), X(11), X(13), X(3), X(8));
307    BODY_20_31(28, C, D, E, T, A, B, X(12), X(12), X(14), X(4), X(9));
308    BODY_20_31(29, B, C, D, E, T, A, X(13), X(13), X(15), X(5), X(10));
309    BODY_20_31(30, A, B, C, D, E, T, X(14), X(14), X(0), X(6), X(11));
310    BODY_20_31(31, T, A, B, C, D, E, X(15), X(15), X(1), X(7), X(12));
311
312    BODY_32_39(32, E, T, A, B, C, D, X(0), X(2), X(8), X(13));
313    BODY_32_39(33, D, E, T, A, B, C, X(1), X(3), X(9), X(14));
314    BODY_32_39(34, C, D, E, T, A, B, X(2), X(4), X(10), X(15));
315    BODY_32_39(35, B, C, D, E, T, A, X(3), X(5), X(11), X(0));
316    BODY_32_39(36, A, B, C, D, E, T, X(4), X(6), X(12), X(1));
317    BODY_32_39(37, T, A, B, C, D, E, X(5), X(7), X(13), X(2));
318    BODY_32_39(38, E, T, A, B, C, D, X(6), X(8), X(14), X(3));
319    BODY_32_39(39, D, E, T, A, B, C, X(7), X(9), X(15), X(4));
320
321    BODY_40_59(40, C, D, E, T, A, B, X(8), X(10), X(0), X(5));
322    BODY_40_59(41, B, C, D, E, T, A, X(9), X(11), X(1), X(6));
323    BODY_40_59(42, A, B, C, D, E, T, X(10), X(12), X(2), X(7));
324    BODY_40_59(43, T, A, B, C, D, E, X(11), X(13), X(3), X(8));
325    BODY_40_59(44, E, T, A, B, C, D, X(12), X(14), X(4), X(9));
326    BODY_40_59(45, D, E, T, A, B, C, X(13), X(15), X(5), X(10));
327    BODY_40_59(46, C, D, E, T, A, B, X(14), X(0), X(6), X(11));
328    BODY_40_59(47, B, C, D, E, T, A, X(15), X(1), X(7), X(12));
329    BODY_40_59(48, A, B, C, D, E, T, X(0), X(2), X(8), X(13));
330    BODY_40_59(49, T, A, B, C, D, E, X(1), X(3), X(9), X(14));
331    BODY_40_59(50, E, T, A, B, C, D, X(2), X(4), X(10), X(15));
332    BODY_40_59(51, D, E, T, A, B, C, X(3), X(5), X(11), X(0));
333    BODY_40_59(52, C, D, E, T, A, B, X(4), X(6), X(12), X(1));
334    BODY_40_59(53, B, C, D, E, T, A, X(5), X(7), X(13), X(2));
335    BODY_40_59(54, A, B, C, D, E, T, X(6), X(8), X(14), X(3));
336    BODY_40_59(55, T, A, B, C, D, E, X(7), X(9), X(15), X(4));
337    BODY_40_59(56, E, T, A, B, C, D, X(8), X(10), X(0), X(5));
338    BODY_40_59(57, D, E, T, A, B, C, X(9), X(11), X(1), X(6));
339    BODY_40_59(58, C, D, E, T, A, B, X(10), X(12), X(2), X(7));
340    BODY_40_59(59, B, C, D, E, T, A, X(11), X(13), X(3), X(8));
341
342    BODY_60_79(60, A, B, C, D, E, T, X(12), X(14), X(4), X(9));
343    BODY_60_79(61, T, A, B, C, D, E, X(13), X(15), X(5), X(10));
344    BODY_60_79(62, E, T, A, B, C, D, X(14), X(0), X(6), X(11));
345    BODY_60_79(63, D, E, T, A, B, C, X(15), X(1), X(7), X(12));
346    BODY_60_79(64, C, D, E, T, A, B, X(0), X(2), X(8), X(13));
347    BODY_60_79(65, B, C, D, E, T, A, X(1), X(3), X(9), X(14));
348    BODY_60_79(66, A, B, C, D, E, T, X(2), X(4), X(10), X(15));
349    BODY_60_79(67, T, A, B, C, D, E, X(3), X(5), X(11), X(0));
350    BODY_60_79(68, E, T, A, B, C, D, X(4), X(6), X(12), X(1));
351    BODY_60_79(69, D, E, T, A, B, C, X(5), X(7), X(13), X(2));
352    BODY_60_79(70, C, D, E, T, A, B, X(6), X(8), X(14), X(3));
353    BODY_60_79(71, B, C, D, E, T, A, X(7), X(9), X(15), X(4));
354    BODY_60_79(72, A, B, C, D, E, T, X(8), X(10), X(0), X(5));
355    BODY_60_79(73, T, A, B, C, D, E, X(9), X(11), X(1), X(6));
356    BODY_60_79(74, E, T, A, B, C, D, X(10), X(12), X(2), X(7));
357    BODY_60_79(75, D, E, T, A, B, C, X(11), X(13), X(3), X(8));
358    BODY_60_79(76, C, D, E, T, A, B, X(12), X(14), X(4), X(9));
359    BODY_60_79(77, B, C, D, E, T, A, X(13), X(15), X(5), X(10));
360    BODY_60_79(78, A, B, C, D, E, T, X(14), X(0), X(6), X(11));
361    BODY_60_79(79, T, A, B, C, D, E, X(15), X(1), X(7), X(12));
362
363    c->h0 = (c->h0 + E) & 0xffffffffL;
364    c->h1 = (c->h1 + T) & 0xffffffffL;
365    c->h2 = (c->h2 + A) & 0xffffffffL;
366    c->h3 = (c->h3 + B) & 0xffffffffL;
367    c->h4 = (c->h4 + C) & 0xffffffffL;
368
369    if (--num == 0)
370      break;
371
372    A = c->h0;
373    B = c->h1;
374    C = c->h2;
375    D = c->h3;
376    E = c->h4;
377  }
378}
379#endif
380