8cb9d00d75ba560905ec934969afb071833b286e
[exim.git] / src / src / pdkim / sha1.c
1 /*
2 * FIPS-180-1 compliant SHA-1 implementation
3 *
4 * Copyright (C) 2006-2009, Paul Bakker <polarssl_maintainer at polarssl.org>
5 * All rights reserved.
6 *
7 * Joined copyright on original XySSL code with: Christophe Devine
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write to the Free Software Foundation, Inc.,
21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22 */
23 /*
24 * The SHA-1 standard was published by NIST in 1993.
25 *
26 * http://www.itl.nist.gov/fipspubs/fip180-1.htm
27 */
28
29 /* $Cambridge: exim/src/src/pdkim/sha1.c,v 1.3 2009/12/07 13:05:07 tom Exp $ */
30
31 #include "sha1.h"
32
33 #include <string.h>
34 #include <stdio.h>
35
36 /*
37 * 32-bit integer manipulation macros (big endian)
38 */
39 #ifndef GET_ULONG_BE
40 #define GET_ULONG_BE(n,b,i) \
41 { \
42 (n) = ( (unsigned long) (b)[(i) ] << 24 ) \
43 | ( (unsigned long) (b)[(i) + 1] << 16 ) \
44 | ( (unsigned long) (b)[(i) + 2] << 8 ) \
45 | ( (unsigned long) (b)[(i) + 3] ); \
46 }
47 #endif
48
49 #ifndef PUT_ULONG_BE
50 #define PUT_ULONG_BE(n,b,i) \
51 { \
52 (b)[(i) ] = (unsigned char) ( (n) >> 24 ); \
53 (b)[(i) + 1] = (unsigned char) ( (n) >> 16 ); \
54 (b)[(i) + 2] = (unsigned char) ( (n) >> 8 ); \
55 (b)[(i) + 3] = (unsigned char) ( (n) ); \
56 }
57 #endif
58
59 /*
60 * SHA-1 context setup
61 */
62 void sha1_starts( sha1_context *ctx )
63 {
64 ctx->total[0] = 0;
65 ctx->total[1] = 0;
66
67 ctx->state[0] = 0x67452301;
68 ctx->state[1] = 0xEFCDAB89;
69 ctx->state[2] = 0x98BADCFE;
70 ctx->state[3] = 0x10325476;
71 ctx->state[4] = 0xC3D2E1F0;
72 }
73
74 static void sha1_process( sha1_context *ctx, unsigned char data[64] )
75 {
76 unsigned long temp, W[16], A, B, C, D, E;
77
78 GET_ULONG_BE( W[ 0], data, 0 );
79 GET_ULONG_BE( W[ 1], data, 4 );
80 GET_ULONG_BE( W[ 2], data, 8 );
81 GET_ULONG_BE( W[ 3], data, 12 );
82 GET_ULONG_BE( W[ 4], data, 16 );
83 GET_ULONG_BE( W[ 5], data, 20 );
84 GET_ULONG_BE( W[ 6], data, 24 );
85 GET_ULONG_BE( W[ 7], data, 28 );
86 GET_ULONG_BE( W[ 8], data, 32 );
87 GET_ULONG_BE( W[ 9], data, 36 );
88 GET_ULONG_BE( W[10], data, 40 );
89 GET_ULONG_BE( W[11], data, 44 );
90 GET_ULONG_BE( W[12], data, 48 );
91 GET_ULONG_BE( W[13], data, 52 );
92 GET_ULONG_BE( W[14], data, 56 );
93 GET_ULONG_BE( W[15], data, 60 );
94
95 #define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n)))
96
97 #define R(t) \
98 ( \
99 temp = W[(t - 3) & 0x0F] ^ W[(t - 8) & 0x0F] ^ \
100 W[(t - 14) & 0x0F] ^ W[ t & 0x0F], \
101 ( W[t & 0x0F] = S(temp,1) ) \
102 )
103
104 #define P(a,b,c,d,e,x) \
105 { \
106 e += S(a,5) + F(b,c,d) + K + x; b = S(b,30); \
107 }
108
109 A = ctx->state[0];
110 B = ctx->state[1];
111 C = ctx->state[2];
112 D = ctx->state[3];
113 E = ctx->state[4];
114
115 #define F(x,y,z) (z ^ (x & (y ^ z)))
116 #define K 0x5A827999
117
118 P( A, B, C, D, E, W[0] );
119 P( E, A, B, C, D, W[1] );
120 P( D, E, A, B, C, W[2] );
121 P( C, D, E, A, B, W[3] );
122 P( B, C, D, E, A, W[4] );
123 P( A, B, C, D, E, W[5] );
124 P( E, A, B, C, D, W[6] );
125 P( D, E, A, B, C, W[7] );
126 P( C, D, E, A, B, W[8] );
127 P( B, C, D, E, A, W[9] );
128 P( A, B, C, D, E, W[10] );
129 P( E, A, B, C, D, W[11] );
130 P( D, E, A, B, C, W[12] );
131 P( C, D, E, A, B, W[13] );
132 P( B, C, D, E, A, W[14] );
133 P( A, B, C, D, E, W[15] );
134 P( E, A, B, C, D, R(16) );
135 P( D, E, A, B, C, R(17) );
136 P( C, D, E, A, B, R(18) );
137 P( B, C, D, E, A, R(19) );
138
139 #undef K
140 #undef F
141
142 #define F(x,y,z) (x ^ y ^ z)
143 #define K 0x6ED9EBA1
144
145 P( A, B, C, D, E, R(20) );
146 P( E, A, B, C, D, R(21) );
147 P( D, E, A, B, C, R(22) );
148 P( C, D, E, A, B, R(23) );
149 P( B, C, D, E, A, R(24) );
150 P( A, B, C, D, E, R(25) );
151 P( E, A, B, C, D, R(26) );
152 P( D, E, A, B, C, R(27) );
153 P( C, D, E, A, B, R(28) );
154 P( B, C, D, E, A, R(29) );
155 P( A, B, C, D, E, R(30) );
156 P( E, A, B, C, D, R(31) );
157 P( D, E, A, B, C, R(32) );
158 P( C, D, E, A, B, R(33) );
159 P( B, C, D, E, A, R(34) );
160 P( A, B, C, D, E, R(35) );
161 P( E, A, B, C, D, R(36) );
162 P( D, E, A, B, C, R(37) );
163 P( C, D, E, A, B, R(38) );
164 P( B, C, D, E, A, R(39) );
165
166 #undef K
167 #undef F
168
169 #define F(x,y,z) ((x & y) | (z & (x | y)))
170 #define K 0x8F1BBCDC
171
172 P( A, B, C, D, E, R(40) );
173 P( E, A, B, C, D, R(41) );
174 P( D, E, A, B, C, R(42) );
175 P( C, D, E, A, B, R(43) );
176 P( B, C, D, E, A, R(44) );
177 P( A, B, C, D, E, R(45) );
178 P( E, A, B, C, D, R(46) );
179 P( D, E, A, B, C, R(47) );
180 P( C, D, E, A, B, R(48) );
181 P( B, C, D, E, A, R(49) );
182 P( A, B, C, D, E, R(50) );
183 P( E, A, B, C, D, R(51) );
184 P( D, E, A, B, C, R(52) );
185 P( C, D, E, A, B, R(53) );
186 P( B, C, D, E, A, R(54) );
187 P( A, B, C, D, E, R(55) );
188 P( E, A, B, C, D, R(56) );
189 P( D, E, A, B, C, R(57) );
190 P( C, D, E, A, B, R(58) );
191 P( B, C, D, E, A, R(59) );
192
193 #undef K
194 #undef F
195
196 #define F(x,y,z) (x ^ y ^ z)
197 #define K 0xCA62C1D6
198
199 P( A, B, C, D, E, R(60) );
200 P( E, A, B, C, D, R(61) );
201 P( D, E, A, B, C, R(62) );
202 P( C, D, E, A, B, R(63) );
203 P( B, C, D, E, A, R(64) );
204 P( A, B, C, D, E, R(65) );
205 P( E, A, B, C, D, R(66) );
206 P( D, E, A, B, C, R(67) );
207 P( C, D, E, A, B, R(68) );
208 P( B, C, D, E, A, R(69) );
209 P( A, B, C, D, E, R(70) );
210 P( E, A, B, C, D, R(71) );
211 P( D, E, A, B, C, R(72) );
212 P( C, D, E, A, B, R(73) );
213 P( B, C, D, E, A, R(74) );
214 P( A, B, C, D, E, R(75) );
215 P( E, A, B, C, D, R(76) );
216 P( D, E, A, B, C, R(77) );
217 P( C, D, E, A, B, R(78) );
218 P( B, C, D, E, A, R(79) );
219
220 #undef K
221 #undef F
222
223 ctx->state[0] += A;
224 ctx->state[1] += B;
225 ctx->state[2] += C;
226 ctx->state[3] += D;
227 ctx->state[4] += E;
228 }
229
230 /*
231 * SHA-1 process buffer
232 */
233 void sha1_update( sha1_context *ctx, unsigned char *input, int ilen )
234 {
235 int fill;
236 unsigned long left;
237
238 if( ilen <= 0 )
239 return;
240
241 left = ctx->total[0] & 0x3F;
242 fill = 64 - left;
243
244 ctx->total[0] += ilen;
245 ctx->total[0] &= 0xFFFFFFFF;
246
247 if( ctx->total[0] < (unsigned long) ilen )
248 ctx->total[1]++;
249
250 if( left && ilen >= fill )
251 {
252 memcpy( (void *) (ctx->buffer + left),
253 (void *) input, fill );
254 sha1_process( ctx, ctx->buffer );
255 input += fill;
256 ilen -= fill;
257 left = 0;
258 }
259
260 while( ilen >= 64 )
261 {
262 sha1_process( ctx, input );
263 input += 64;
264 ilen -= 64;
265 }
266
267 if( ilen > 0 )
268 {
269 memcpy( (void *) (ctx->buffer + left),
270 (void *) input, ilen );
271 }
272 }
273
274 static const unsigned char sha1_padding[64] =
275 {
276 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
277 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
278 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
279 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
280 };
281
282 /*
283 * SHA-1 final digest
284 */
285 void sha1_finish( sha1_context *ctx, unsigned char output[20] )
286 {
287 unsigned long last, padn;
288 unsigned long high, low;
289 unsigned char msglen[8];
290
291 high = ( ctx->total[0] >> 29 )
292 | ( ctx->total[1] << 3 );
293 low = ( ctx->total[0] << 3 );
294
295 PUT_ULONG_BE( high, msglen, 0 );
296 PUT_ULONG_BE( low, msglen, 4 );
297
298 last = ctx->total[0] & 0x3F;
299 padn = ( last < 56 ) ? ( 56 - last ) : ( 120 - last );
300
301 sha1_update( ctx, (unsigned char *) sha1_padding, padn );
302 sha1_update( ctx, msglen, 8 );
303
304 PUT_ULONG_BE( ctx->state[0], output, 0 );
305 PUT_ULONG_BE( ctx->state[1], output, 4 );
306 PUT_ULONG_BE( ctx->state[2], output, 8 );
307 PUT_ULONG_BE( ctx->state[3], output, 12 );
308 PUT_ULONG_BE( ctx->state[4], output, 16 );
309 }
310
311 /*
312 * output = SHA-1( input buffer )
313 */
314 void sha1( unsigned char *input, int ilen, unsigned char output[20] )
315 {
316 sha1_context ctx;
317
318 sha1_starts( &ctx );
319 sha1_update( &ctx, input, ilen );
320 sha1_finish( &ctx, output );
321
322 memset( &ctx, 0, sizeof( sha1_context ) );
323 }
324
325 /*
326 * output = SHA-1( file contents )
327 */
328 int sha1_file( char *path, unsigned char output[20] )
329 {
330 FILE *f;
331 size_t n;
332 sha1_context ctx;
333 unsigned char buf[1024];
334
335 if( ( f = fopen( path, "rb" ) ) == NULL )
336 return( 1 );
337
338 sha1_starts( &ctx );
339
340 while( ( n = fread( buf, 1, sizeof( buf ), f ) ) > 0 )
341 sha1_update( &ctx, buf, (int) n );
342
343 sha1_finish( &ctx, output );
344
345 memset( &ctx, 0, sizeof( sha1_context ) );
346
347 if( ferror( f ) != 0 )
348 {
349 fclose( f );
350 return( 2 );
351 }
352
353 fclose( f );
354 return( 0 );
355 }
356
357 /*
358 * SHA-1 HMAC context setup
359 */
360 void sha1_hmac_starts( sha1_context *ctx, unsigned char *key, int keylen )
361 {
362 int i;
363 unsigned char sum[20];
364
365 if( keylen > 64 )
366 {
367 sha1( key, keylen, sum );
368 keylen = 20;
369 key = sum;
370 }
371
372 memset( ctx->ipad, 0x36, 64 );
373 memset( ctx->opad, 0x5C, 64 );
374
375 for( i = 0; i < keylen; i++ )
376 {
377 ctx->ipad[i] = (unsigned char)( ctx->ipad[i] ^ key[i] );
378 ctx->opad[i] = (unsigned char)( ctx->opad[i] ^ key[i] );
379 }
380
381 sha1_starts( ctx );
382 sha1_update( ctx, ctx->ipad, 64 );
383
384 memset( sum, 0, sizeof( sum ) );
385 }
386
387 /*
388 * SHA-1 HMAC process buffer
389 */
390 void sha1_hmac_update( sha1_context *ctx, unsigned char *input, int ilen )
391 {
392 sha1_update( ctx, input, ilen );
393 }
394
395 /*
396 * SHA-1 HMAC final digest
397 */
398 void sha1_hmac_finish( sha1_context *ctx, unsigned char output[20] )
399 {
400 unsigned char tmpbuf[20];
401
402 sha1_finish( ctx, tmpbuf );
403 sha1_starts( ctx );
404 sha1_update( ctx, ctx->opad, 64 );
405 sha1_update( ctx, tmpbuf, 20 );
406 sha1_finish( ctx, output );
407
408 memset( tmpbuf, 0, sizeof( tmpbuf ) );
409 }
410
411 /*
412 * output = HMAC-SHA-1( hmac key, input buffer )
413 */
414 void sha1_hmac( unsigned char *key, int keylen,
415 unsigned char *input, int ilen,
416 unsigned char output[20] )
417 {
418 sha1_context ctx;
419
420 sha1_hmac_starts( &ctx, key, keylen );
421 sha1_hmac_update( &ctx, input, ilen );
422 sha1_hmac_finish( &ctx, output );
423
424 memset( &ctx, 0, sizeof( sha1_context ) );
425 }