|
| 1 | +/* -*- Mode: C; c-basic-offset:4 ; indent-tabs-mode:nil -*- */ |
| 2 | +/* |
| 3 | + * Copyright (c) 2022 Triad National Security, LLC. All rights |
| 4 | + * reserved. |
| 5 | + * |
| 6 | + * Additional copyrights may follow |
| 7 | + * |
| 8 | + * $HEADER$ |
| 9 | + */ |
| 10 | + |
| 11 | + |
| 12 | +/********************************************************************* |
| 13 | +* Filename: sha256.c |
| 14 | +* Author: Brad Conte (brad AT bradconte.com) |
| 15 | +* Copyright: |
| 16 | +* Disclaimer: This code is presented "as is" without any guarantees. |
| 17 | +* Details: Implementation of the SHA-256 hashing algorithm. |
| 18 | + SHA-256 is one of the three algorithms in the SHA2 |
| 19 | + specification. The others, SHA-384 and SHA-512, are not |
| 20 | + offered in this implementation. |
| 21 | + Algorithm specification can be found here: |
| 22 | + * http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf |
| 23 | + This implementation uses little endian byte order. |
| 24 | + See https://github.com/B-Con/crypto-algorithms |
| 25 | +*********************************************************************/ |
| 26 | + |
| 27 | +/*************************** HEADER FILES ***************************/ |
| 28 | +#include <stdlib.h> |
| 29 | +#include <memory.h> |
| 30 | +#include "sha256.h" |
| 31 | + |
| 32 | +/****************************** MACROS ******************************/ |
| 33 | +#define ROTLEFT(a,b) (((a) << (b)) | ((a) >> (32-(b)))) |
| 34 | +#define ROTRIGHT(a,b) (((a) >> (b)) | ((a) << (32-(b)))) |
| 35 | + |
| 36 | +#define CH(x,y,z) (((x) & (y)) ^ (~(x) & (z))) |
| 37 | +#define MAJ(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) |
| 38 | +#define EP0(x) (ROTRIGHT(x,2) ^ ROTRIGHT(x,13) ^ ROTRIGHT(x,22)) |
| 39 | +#define EP1(x) (ROTRIGHT(x,6) ^ ROTRIGHT(x,11) ^ ROTRIGHT(x,25)) |
| 40 | +#define SIG0(x) (ROTRIGHT(x,7) ^ ROTRIGHT(x,18) ^ ((x) >> 3)) |
| 41 | +#define SIG1(x) (ROTRIGHT(x,17) ^ ROTRIGHT(x,19) ^ ((x) >> 10)) |
| 42 | + |
| 43 | +/**************************** VARIABLES *****************************/ |
| 44 | +static const WORD k[64] = { |
| 45 | + 0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5, |
| 46 | + 0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174, |
| 47 | + 0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da, |
| 48 | + 0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967, |
| 49 | + 0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85, |
| 50 | + 0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070, |
| 51 | + 0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3, |
| 52 | + 0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2 |
| 53 | +}; |
| 54 | + |
| 55 | +/*********************** FUNCTION DEFINITIONS ***********************/ |
| 56 | +static void sha256_transform(opal_sha256_ctx *ctx, const BYTE data[]) |
| 57 | +{ |
| 58 | + WORD a, b, c, d, e, f, g, h, i, j, t1, t2, m[64]; |
| 59 | + |
| 60 | + for (i = 0, j = 0; i < 16; ++i, j += 4) |
| 61 | + m[i] = (data[j] << 24) | (data[j + 1] << 16) | (data[j + 2] << 8) | (data[j + 3]); |
| 62 | + for ( ; i < 64; ++i) |
| 63 | + m[i] = SIG1(m[i - 2]) + m[i - 7] + SIG0(m[i - 15]) + m[i - 16]; |
| 64 | + |
| 65 | + a = ctx->state[0]; |
| 66 | + b = ctx->state[1]; |
| 67 | + c = ctx->state[2]; |
| 68 | + d = ctx->state[3]; |
| 69 | + e = ctx->state[4]; |
| 70 | + f = ctx->state[5]; |
| 71 | + g = ctx->state[6]; |
| 72 | + h = ctx->state[7]; |
| 73 | + |
| 74 | + for (i = 0; i < 64; ++i) { |
| 75 | + t1 = h + EP1(e) + CH(e,f,g) + k[i] + m[i]; |
| 76 | + t2 = EP0(a) + MAJ(a,b,c); |
| 77 | + h = g; |
| 78 | + g = f; |
| 79 | + f = e; |
| 80 | + e = d + t1; |
| 81 | + d = c; |
| 82 | + c = b; |
| 83 | + b = a; |
| 84 | + a = t1 + t2; |
| 85 | + } |
| 86 | + |
| 87 | + ctx->state[0] += a; |
| 88 | + ctx->state[1] += b; |
| 89 | + ctx->state[2] += c; |
| 90 | + ctx->state[3] += d; |
| 91 | + ctx->state[4] += e; |
| 92 | + ctx->state[5] += f; |
| 93 | + ctx->state[6] += g; |
| 94 | + ctx->state[7] += h; |
| 95 | +} |
| 96 | + |
| 97 | +void opal_sha256_init(opal_sha256_ctx *ctx) |
| 98 | +{ |
| 99 | + ctx->datalen = 0; |
| 100 | + ctx->bitlen = 0; |
| 101 | + ctx->state[0] = 0x6a09e667; |
| 102 | + ctx->state[1] = 0xbb67ae85; |
| 103 | + ctx->state[2] = 0x3c6ef372; |
| 104 | + ctx->state[3] = 0xa54ff53a; |
| 105 | + ctx->state[4] = 0x510e527f; |
| 106 | + ctx->state[5] = 0x9b05688c; |
| 107 | + ctx->state[6] = 0x1f83d9ab; |
| 108 | + ctx->state[7] = 0x5be0cd19; |
| 109 | +} |
| 110 | + |
| 111 | +void opal_sha256_update(opal_sha256_ctx *ctx, const BYTE data[], size_t len) |
| 112 | +{ |
| 113 | + WORD i; |
| 114 | + |
| 115 | + for (i = 0; i < len; ++i) { |
| 116 | + ctx->data[ctx->datalen] = data[i]; |
| 117 | + ctx->datalen++; |
| 118 | + if (ctx->datalen == 64) { |
| 119 | + sha256_transform(ctx, ctx->data); |
| 120 | + ctx->bitlen += 512; |
| 121 | + ctx->datalen = 0; |
| 122 | + } |
| 123 | + } |
| 124 | +} |
| 125 | + |
| 126 | +void opal_sha256_final(opal_sha256_ctx *ctx, BYTE hash[]) |
| 127 | +{ |
| 128 | + WORD i; |
| 129 | + |
| 130 | + i = ctx->datalen; |
| 131 | + |
| 132 | + // Pad whatever data is left in the buffer. |
| 133 | + if (ctx->datalen < 56) { |
| 134 | + ctx->data[i++] = 0x80; |
| 135 | + while (i < 56) |
| 136 | + ctx->data[i++] = 0x00; |
| 137 | + } |
| 138 | + else { |
| 139 | + ctx->data[i++] = 0x80; |
| 140 | + while (i < 64) |
| 141 | + ctx->data[i++] = 0x00; |
| 142 | + sha256_transform(ctx, ctx->data); |
| 143 | + memset(ctx->data, 0, 56); |
| 144 | + } |
| 145 | + |
| 146 | + // Append to the padding the total message's length in bits and transform. |
| 147 | + ctx->bitlen += ctx->datalen * 8; |
| 148 | + ctx->data[63] = ctx->bitlen; |
| 149 | + ctx->data[62] = ctx->bitlen >> 8; |
| 150 | + ctx->data[61] = ctx->bitlen >> 16; |
| 151 | + ctx->data[60] = ctx->bitlen >> 24; |
| 152 | + ctx->data[59] = ctx->bitlen >> 32; |
| 153 | + ctx->data[58] = ctx->bitlen >> 40; |
| 154 | + ctx->data[57] = ctx->bitlen >> 48; |
| 155 | + ctx->data[56] = ctx->bitlen >> 56; |
| 156 | + sha256_transform(ctx, ctx->data); |
| 157 | + |
| 158 | + // Since this implementation uses little endian byte ordering and SHA uses big endian, |
| 159 | + // reverse all the bytes when copying the final state to the output hash. |
| 160 | + for (i = 0; i < 4; ++i) { |
| 161 | + hash[i] = (ctx->state[0] >> (24 - i * 8)) & 0x000000ff; |
| 162 | + hash[i + 4] = (ctx->state[1] >> (24 - i * 8)) & 0x000000ff; |
| 163 | + hash[i + 8] = (ctx->state[2] >> (24 - i * 8)) & 0x000000ff; |
| 164 | + hash[i + 12] = (ctx->state[3] >> (24 - i * 8)) & 0x000000ff; |
| 165 | + hash[i + 16] = (ctx->state[4] >> (24 - i * 8)) & 0x000000ff; |
| 166 | + hash[i + 20] = (ctx->state[5] >> (24 - i * 8)) & 0x000000ff; |
| 167 | + hash[i + 24] = (ctx->state[6] >> (24 - i * 8)) & 0x000000ff; |
| 168 | + hash[i + 28] = (ctx->state[7] >> (24 - i * 8)) & 0x000000ff; |
| 169 | + } |
| 170 | +} |
0 commit comments