242 lines
6.3 KiB
C
242 lines
6.3 KiB
C
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <assert.h>
|
|
|
|
#define DEBUG 0
|
|
|
|
/*
|
|
* For code size reasons, this doesn't even try to support
|
|
* input sizes >= 2^32 bits = 2^29 bytes
|
|
*/
|
|
struct sha256_state {
|
|
uint32_t iv[8]; /* a, b, c, d, e, f, g, h */
|
|
uint32_t w[64]; /* Fill in first 16 with ntohl(input) */
|
|
uint32_t bytes;
|
|
};
|
|
|
|
/* Rotate right macro. GCC can usually get this right. */
|
|
#define ROTR(x,s) ((x)>>(s) | (x)<<(32-(s)))
|
|
|
|
#if 1
|
|
/*
|
|
* An implementation of SHA-256 for register-starved architectures like
|
|
* x86 or perhaps the MSP430. (Although the latter's lack of a multi-bit
|
|
* shifter will doom its performance no matter what.)
|
|
* This code is also quite small.
|
|
*
|
|
* If you have 12 32-bit registers to work with, loading the 8 state
|
|
* variables into registers is probably faster. If you have 28 registers
|
|
* or so, you can put the input block into registers as well.
|
|
*
|
|
* The key idea is to notice that each round consumes one word from the
|
|
* key schedule w[i], computes a new a, and shifts all the other state
|
|
* variables down one position, discarding the old h.
|
|
*
|
|
* So if we store the state vector in reverse order h..a, immediately
|
|
* before w[i], then a single base pointer can be incremented to advance
|
|
* to the next round.
|
|
*/
|
|
void
|
|
sha256_transform(uint32_t p[76])
|
|
{
|
|
static uint32_t const k[64] = {
|
|
0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b,
|
|
0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01,
|
|
0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7,
|
|
0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
|
|
0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152,
|
|
0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
|
|
0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc,
|
|
0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
|
|
0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819,
|
|
0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08,
|
|
0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f,
|
|
0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
|
|
0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
|
|
};
|
|
/*
|
|
* Look, ma, only 6 local variables including p!
|
|
* Too bad they're so overloaded it's impossible to give them
|
|
* meaningful names.
|
|
*/
|
|
register uint32_t const *kp;
|
|
register uint32_t a, s, t, u;
|
|
|
|
/* Step 1: Expand the 16 words of w[], at p[8..23] into 64 words */
|
|
for (u = 8; u < 8+64-16; u++) {
|
|
/* w[i] = s1(w[i-2]) + w[i-7] + s0(w[i-15]) + w[i-16] */
|
|
/* Form s0(x) = (x >>> 7) ^ (x >>> 18) ^ (x >> 3) */
|
|
s = t = p[u+1];
|
|
s = ROTR(s, 18-7);
|
|
s ^= t;
|
|
s = ROTR(s, 7);
|
|
s ^= t >> 3;
|
|
/* Form s1(x) = (x >>> 17) ^ (x >>> 19) ^ (x >> 10) */
|
|
a = t = p[u+14];
|
|
a = ROTR(a, 19-17);
|
|
a ^= t;
|
|
a = ROTR(a, 17);
|
|
a ^= t >> 10;
|
|
|
|
p[u+16] = s + a + p[u] + p[u+9];
|
|
}
|
|
|
|
/* Step 2: Copy the initial values of d, c, b, a out of the way */
|
|
p[72] = p[4];
|
|
p[73] = p[5];
|
|
p[74] = p[6];
|
|
p[75] = a = p[7];
|
|
|
|
/*
|
|
* Step 3: The big loop.
|
|
* We maintain p[0..7] = h..a, and p[8] is w[i]
|
|
*/
|
|
kp = k;
|
|
|
|
do {
|
|
/* T1 = h + S1(e) + Ch(e,f,g) + k[i] + w[i] */
|
|
/* Form Ch(e,f,g) = g ^ (e & (f ^ g)) */
|
|
s = t = p[1]; /* g */
|
|
s ^= p[2]; /* f ^ g */
|
|
s &= u = p[3]; /* e & (f ^ g) */
|
|
s ^= t;
|
|
/* Form S1(e) = (e >>> 6) ^ (e >>> 11) ^ (e >>> 25) */
|
|
t = u;
|
|
u = ROTR(u, 25-11);
|
|
u ^= t;
|
|
u = ROTR(u, 11-6);
|
|
u ^= t;
|
|
u = ROTR(u, 6);
|
|
s += u;
|
|
/* Now add other things to t1 */
|
|
s += p[0] + p[8] + *kp; /* h + w[i] + kp[i] */
|
|
/* Round function: e = d + T1 */
|
|
p[4] += s;
|
|
/* a = t1 + (t2 = S0(a) + Maj(a,b,c) */
|
|
/* Form S0(a) = (a >>> 2) ^ (a >>> 13) ^ (a >>> 22) */
|
|
t = a;
|
|
t = ROTR(t, 22-13);
|
|
t ^= a;
|
|
t = ROTR(t, 13-2);
|
|
t ^= a;
|
|
t = ROTR(t, 2);
|
|
s += t;
|
|
/* Form Maj(a,b,c) = (a & b) + (c & (a ^ b)) */
|
|
t = a;
|
|
u = p[6]; /* b */
|
|
a ^= u; /* a ^ b */
|
|
u &= t; /* a & b */
|
|
a &= p[5]; /* c & (a + b) */
|
|
s += u;
|
|
a += s; /* Sum final result into a */
|
|
|
|
/* Now store new a on top of w[i] and shift... */
|
|
p[8] = a;
|
|
p++;
|
|
#if DEBUG
|
|
/* If debugging, print out the state variables each round */
|
|
printf("%2u:", kp-k);
|
|
for (t = 8; t--; )
|
|
printf(" %08x", p[t]);
|
|
putchar('\n');
|
|
#endif
|
|
} while (++kp != k+64);
|
|
|
|
/* Now, do the final summation. */
|
|
p -= 64;
|
|
/*
|
|
* Now, the final h..a are in p[64..71], and the initial values
|
|
* are in p[0..7]. Except that p[4..7] got trashed in the loop
|
|
* above, so use the copies we made.
|
|
*/
|
|
p[0] += p[64];
|
|
p[1] += p[65];
|
|
p[2] += p[66];
|
|
p[3] += p[67];
|
|
p[4] = p[68] + p[72];
|
|
p[5] = p[69] + p[73];
|
|
p[6] = p[70] + p[74];
|
|
p[7] = a + p[75];
|
|
}
|
|
|
|
#else
|
|
|
|
/* A space-optimized ARM assembly implementation */
|
|
void sha256_transform(uint32_t p[8+64]);
|
|
|
|
#endif
|
|
|
|
/* Initial values H0..H7 for SHA-256, and SHA-224. */
|
|
static uint32_t const sha256_iv[8] = {
|
|
0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
|
|
0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
|
|
};
|
|
#if 0
|
|
static uint32_t const sha224_iv[8] = {
|
|
0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939,
|
|
0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4
|
|
};
|
|
#endif
|
|
|
|
void
|
|
sha256_begin(struct sha256_state *s)
|
|
{
|
|
memcpy(s->iv, sha256_iv, sizeof sha256_iv);
|
|
s->bytes = 0;
|
|
}
|
|
|
|
#include <netinet/in.h> /* For ntohl, htonl */
|
|
|
|
void
|
|
sha256_hash(unsigned char const *data, size_t len, struct sha256_state *s)
|
|
{
|
|
unsigned space = 64 - (unsigned)s->bytes % 64;
|
|
unsigned i;
|
|
|
|
s->bytes += len;
|
|
|
|
while (len >= space) {
|
|
memcpy((unsigned char *)s->w + 64 - space, data, space);
|
|
len -= space;
|
|
space = 64;
|
|
for (i = 0; i < 16; i++)
|
|
s->w[i] = ntohl(s->w[i]);
|
|
sha256_transform(s->iv);
|
|
}
|
|
memcpy((unsigned char *)s->w + 64 - space, data, len);
|
|
}
|
|
|
|
void
|
|
sha256_end(unsigned char hash[32], struct sha256_state *s)
|
|
{
|
|
static unsigned char const padding[64] = { 0x80, 0, 0 /* ,... */ };
|
|
uint32_t bytes = s->bytes;
|
|
unsigned i;
|
|
|
|
/* Add trailing bit padding. */
|
|
sha256_hash(padding, 64 - ((bytes+8) & 63), s);
|
|
assert(s->bytes % 64 == 56);
|
|
|
|
/* Byte-swap and hash final block */
|
|
for (i = 0; i < 14; i++)
|
|
s->w[i] = ntohl(s->w[i]);
|
|
s->w[14] = 0; /* We don't even try */
|
|
s->w[15] = s->bytes << 3;
|
|
sha256_transform(s->iv);
|
|
|
|
for (i = 0; i < 8; i++)
|
|
s->iv[i] = htonl(s->iv[i]);
|
|
memcpy(hash, s->iv, sizeof s->iv);
|
|
memset(s, 0, sizeof *s); /* Good cryptographic hygiene */
|
|
}
|
|
|
|
void
|
|
sha256(unsigned char hash[32], const unsigned char *data, size_t len)
|
|
{
|
|
struct sha256_state s;
|
|
sha256_begin(&s);
|
|
sha256_hash(data, len, &s);
|
|
sha256_end(hash, &s);
|
|
}
|