1 /* sha1.cc - Functions to compute SHA1 message digest of data streams
2 according to the NIST specification FIPS-180-1.
4 Copyright (C) 2000, 2001, 2003, 2004, 2005 Free Software Foundation, Inc.
5 Copyright (C) 2006 Michael Vrable
7 This program is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by the
9 Free Software Foundation; either version 2, or (at your option) any
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software Foundation,
19 Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
21 /* Written by Scott G. Miller
23 Robert Klep <robert@ilse.nl> -- Expansion function fix
25 Modified by Michael Vrable <mvrable@cs.ucsd.edu> to simplify the interface
26 and add an object-oriented wrapper. Original code (in C) taken from GNU
27 coreutils (Debian package 5.97-5).
34 #include <arpa/inet.h>
36 /* SWAP does an endian swap on architectures that are little-endian,
37 as SHA1 needs some data in a big-endian form. */
38 #define SWAP(n) htonl(n)
40 #define BLOCKSIZE 4096
41 #if BLOCKSIZE % 64 != 0
42 # error "invalid BLOCKSIZE"
45 /* This array contains the bytes used to pad the buffer to the next
46 64-byte boundary. (RFC 1321, 3.1: Step 1) */
47 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ... */ };
51 Takes a pointer to a 160 bit block of data (five 32 bit ints) and
52 intializes it to the start constants of the SHA1 algorithm. This
53 must be called before using hash in the call to sha1_hash.
56 sha1_init_ctx (struct sha1_ctx *ctx)
64 ctx->total[0] = ctx->total[1] = 0;
68 /* Put result from CTX in first 20 bytes following RESBUF. The result
69 must be in little endian byte order.
71 IMPORTANT: On some systems it is required that RESBUF is correctly
72 aligned for a 32 bits value. */
74 sha1_read_ctx (const struct sha1_ctx *ctx, void *resbuf)
76 ((md5_uint32 *) resbuf)[0] = SWAP (ctx->A);
77 ((md5_uint32 *) resbuf)[1] = SWAP (ctx->B);
78 ((md5_uint32 *) resbuf)[2] = SWAP (ctx->C);
79 ((md5_uint32 *) resbuf)[3] = SWAP (ctx->D);
80 ((md5_uint32 *) resbuf)[4] = SWAP (ctx->E);
85 /* Process the remaining bytes in the internal buffer and the usual
86 prolog according to the standard and write the result to RESBUF.
88 IMPORTANT: On some systems it is required that RESBUF is correctly
89 aligned for a 32 bits value. */
91 sha1_finish_ctx (struct sha1_ctx *ctx, void *resbuf)
93 /* Take yet unprocessed bytes into account. */
94 md5_uint32 bytes = ctx->buflen;
97 /* Now count remaining bytes. */
98 ctx->total[0] += bytes;
99 if (ctx->total[0] < bytes)
102 pad = bytes >= 56 ? 64 + 56 - bytes : 56 - bytes;
103 memcpy (&ctx->buffer[bytes], fillbuf, pad);
105 /* Put the 64-bit file length in *bits* at the end of the buffer. */
106 *(md5_uint32 *) &ctx->buffer[bytes + pad + 4] = SWAP (ctx->total[0] << 3);
107 *(md5_uint32 *) &ctx->buffer[bytes + pad] = SWAP ((ctx->total[1] << 3) |
108 (ctx->total[0] >> 29));
110 /* Process last bytes. */
111 sha1_process_block (ctx->buffer, bytes + pad + 8, ctx);
113 return sha1_read_ctx (ctx, resbuf);
117 sha1_process_bytes (const void *buffer, size_t len, struct sha1_ctx *ctx)
119 /* When we already have some bits in our internal buffer concatenate
120 both inputs first. */
121 if (ctx->buflen != 0)
123 size_t left_over = ctx->buflen;
124 size_t add = 128 - left_over > len ? len : 128 - left_over;
126 memcpy (&ctx->buffer[left_over], buffer, add);
129 if (ctx->buflen > 64)
131 sha1_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
134 /* The regions in the following copy operation cannot overlap. */
135 memcpy (ctx->buffer, &ctx->buffer[(left_over + add) & ~63],
139 buffer = (const char *) buffer + add;
143 /* Process available complete blocks. */
146 #if !_STRING_ARCH_unaligned
147 # define alignof(type) offsetof (struct { char c; type x; }, x)
148 # define UNALIGNED_P(p) (((size_t) p) % alignof (md5_uint32) != 0)
149 if (UNALIGNED_P (buffer))
152 sha1_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
153 buffer = (const char *) buffer + 64;
159 sha1_process_block (buffer, len & ~63, ctx);
160 buffer = (const char *) buffer + (len & ~63);
165 /* Move remaining bytes in internal buffer. */
168 size_t left_over = ctx->buflen;
170 memcpy (&ctx->buffer[left_over], buffer, len);
174 sha1_process_block (ctx->buffer, 64, ctx);
176 memcpy (ctx->buffer, &ctx->buffer[64], left_over);
178 ctx->buflen = left_over;
182 /* --- Code below is the primary difference between md5.c and sha1.c --- */
184 /* SHA1 round constants */
185 #define K1 0x5a827999L
186 #define K2 0x6ed9eba1L
187 #define K3 0x8f1bbcdcL
188 #define K4 0xca62c1d6L
190 /* Round functions. Note that F2 is the same as F4. */
191 #define F1(B,C,D) ( D ^ ( B & ( C ^ D ) ) )
192 #define F2(B,C,D) (B ^ C ^ D)
193 #define F3(B,C,D) ( ( B & C ) | ( D & ( B | C ) ) )
194 #define F4(B,C,D) (B ^ C ^ D)
196 /* Process LEN bytes of BUFFER, accumulating context into CTX.
197 It is assumed that LEN % 64 == 0.
198 Most of this code comes from GnuPG's cipher/sha1.c. */
201 sha1_process_block (const void *buffer, size_t len, struct sha1_ctx *ctx)
203 const md5_uint32 *words = (const md5_uint32 *)buffer;
204 size_t nwords = len / sizeof (md5_uint32);
205 const md5_uint32 *endp = words + nwords;
207 md5_uint32 a = ctx->A;
208 md5_uint32 b = ctx->B;
209 md5_uint32 c = ctx->C;
210 md5_uint32 d = ctx->D;
211 md5_uint32 e = ctx->E;
213 /* First increment the byte count. RFC 1321 specifies the possible
214 length of the file up to 2^64 bits. Here we only compute the
215 number of bytes. Do a double word increment. */
216 ctx->total[0] += len;
217 if (ctx->total[0] < len)
220 #define rol(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
222 #define M(I) ( tm = x[I&0x0f] ^ x[(I-14)&0x0f] \
223 ^ x[(I-8)&0x0f] ^ x[(I-3)&0x0f] \
224 , (x[I&0x0f] = rol(tm, 1)) )
226 #define R(A,B,C,D,E,F,K,M) do { E += rol( A, 5 ) \
237 for (t = 0; t < 16; t++)
239 x[t] = SWAP (*words);
243 R( a, b, c, d, e, F1, K1, x[ 0] );
244 R( e, a, b, c, d, F1, K1, x[ 1] );
245 R( d, e, a, b, c, F1, K1, x[ 2] );
246 R( c, d, e, a, b, F1, K1, x[ 3] );
247 R( b, c, d, e, a, F1, K1, x[ 4] );
248 R( a, b, c, d, e, F1, K1, x[ 5] );
249 R( e, a, b, c, d, F1, K1, x[ 6] );
250 R( d, e, a, b, c, F1, K1, x[ 7] );
251 R( c, d, e, a, b, F1, K1, x[ 8] );
252 R( b, c, d, e, a, F1, K1, x[ 9] );
253 R( a, b, c, d, e, F1, K1, x[10] );
254 R( e, a, b, c, d, F1, K1, x[11] );
255 R( d, e, a, b, c, F1, K1, x[12] );
256 R( c, d, e, a, b, F1, K1, x[13] );
257 R( b, c, d, e, a, F1, K1, x[14] );
258 R( a, b, c, d, e, F1, K1, x[15] );
259 R( e, a, b, c, d, F1, K1, M(16) );
260 R( d, e, a, b, c, F1, K1, M(17) );
261 R( c, d, e, a, b, F1, K1, M(18) );
262 R( b, c, d, e, a, F1, K1, M(19) );
263 R( a, b, c, d, e, F2, K2, M(20) );
264 R( e, a, b, c, d, F2, K2, M(21) );
265 R( d, e, a, b, c, F2, K2, M(22) );
266 R( c, d, e, a, b, F2, K2, M(23) );
267 R( b, c, d, e, a, F2, K2, M(24) );
268 R( a, b, c, d, e, F2, K2, M(25) );
269 R( e, a, b, c, d, F2, K2, M(26) );
270 R( d, e, a, b, c, F2, K2, M(27) );
271 R( c, d, e, a, b, F2, K2, M(28) );
272 R( b, c, d, e, a, F2, K2, M(29) );
273 R( a, b, c, d, e, F2, K2, M(30) );
274 R( e, a, b, c, d, F2, K2, M(31) );
275 R( d, e, a, b, c, F2, K2, M(32) );
276 R( c, d, e, a, b, F2, K2, M(33) );
277 R( b, c, d, e, a, F2, K2, M(34) );
278 R( a, b, c, d, e, F2, K2, M(35) );
279 R( e, a, b, c, d, F2, K2, M(36) );
280 R( d, e, a, b, c, F2, K2, M(37) );
281 R( c, d, e, a, b, F2, K2, M(38) );
282 R( b, c, d, e, a, F2, K2, M(39) );
283 R( a, b, c, d, e, F3, K3, M(40) );
284 R( e, a, b, c, d, F3, K3, M(41) );
285 R( d, e, a, b, c, F3, K3, M(42) );
286 R( c, d, e, a, b, F3, K3, M(43) );
287 R( b, c, d, e, a, F3, K3, M(44) );
288 R( a, b, c, d, e, F3, K3, M(45) );
289 R( e, a, b, c, d, F3, K3, M(46) );
290 R( d, e, a, b, c, F3, K3, M(47) );
291 R( c, d, e, a, b, F3, K3, M(48) );
292 R( b, c, d, e, a, F3, K3, M(49) );
293 R( a, b, c, d, e, F3, K3, M(50) );
294 R( e, a, b, c, d, F3, K3, M(51) );
295 R( d, e, a, b, c, F3, K3, M(52) );
296 R( c, d, e, a, b, F3, K3, M(53) );
297 R( b, c, d, e, a, F3, K3, M(54) );
298 R( a, b, c, d, e, F3, K3, M(55) );
299 R( e, a, b, c, d, F3, K3, M(56) );
300 R( d, e, a, b, c, F3, K3, M(57) );
301 R( c, d, e, a, b, F3, K3, M(58) );
302 R( b, c, d, e, a, F3, K3, M(59) );
303 R( a, b, c, d, e, F4, K4, M(60) );
304 R( e, a, b, c, d, F4, K4, M(61) );
305 R( d, e, a, b, c, F4, K4, M(62) );
306 R( c, d, e, a, b, F4, K4, M(63) );
307 R( b, c, d, e, a, F4, K4, M(64) );
308 R( a, b, c, d, e, F4, K4, M(65) );
309 R( e, a, b, c, d, F4, K4, M(66) );
310 R( d, e, a, b, c, F4, K4, M(67) );
311 R( c, d, e, a, b, F4, K4, M(68) );
312 R( b, c, d, e, a, F4, K4, M(69) );
313 R( a, b, c, d, e, F4, K4, M(70) );
314 R( e, a, b, c, d, F4, K4, M(71) );
315 R( d, e, a, b, c, F4, K4, M(72) );
316 R( c, d, e, a, b, F4, K4, M(73) );
317 R( b, c, d, e, a, F4, K4, M(74) );
318 R( a, b, c, d, e, F4, K4, M(75) );
319 R( e, a, b, c, d, F4, K4, M(76) );
320 R( d, e, a, b, c, F4, K4, M(77) );
321 R( c, d, e, a, b, F4, K4, M(78) );
322 R( b, c, d, e, a, F4, K4, M(79) );
332 /* ---- Object-Oriented Wrapper */
333 SHA1Checksum::SHA1Checksum()
338 SHA1Checksum::~SHA1Checksum()
342 void SHA1Checksum::process(const void *data, size_t len)
344 sha1_process_bytes(data, len, &ctx);
347 const uint8_t *SHA1Checksum::checksum()
349 sha1_finish_ctx(&ctx, resbuf);
350 return (const uint8_t *)resbuf;