1 /* 2 * FIPS-180-1 compliant SHA-1 implementation 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 */ 19 /* 20 * The SHA-1 standard was published by NIST in 1993. 21 * 22 * http://www.itl.nist.gov/fipspubs/fip180-1.htm 23 */ 24 25 #include "common.h" 26 27 #if defined(MBEDTLS_SHA1_C) 28 29 #include "mbedtls/sha1.h" 30 #include "mbedtls/platform_util.h" 31 #include "mbedtls/error.h" 32 33 #include <string.h> 34 35 #if defined(MBEDTLS_SELF_TEST) 36 #if defined(MBEDTLS_PLATFORM_C) 37 #include "mbedtls/platform.h" 38 #else 39 #include <stdio.h> 40 #define mbedtls_printf printf 41 #endif /* MBEDTLS_PLATFORM_C */ 42 #endif /* MBEDTLS_SELF_TEST */ 43 44 #define SHA1_VALIDATE_RET(cond) \ 45 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_SHA1_BAD_INPUT_DATA ) 46 47 #define SHA1_VALIDATE(cond) MBEDTLS_INTERNAL_VALIDATE( cond ) 48 49 #if !defined(MBEDTLS_SHA1_ALT) 50 51 void mbedtls_sha1_init( mbedtls_sha1_context *ctx ) 52 { 53 SHA1_VALIDATE( ctx != NULL ); 54 55 memset( ctx, 0, sizeof( mbedtls_sha1_context ) ); 56 } 57 58 void mbedtls_sha1_free( mbedtls_sha1_context *ctx ) 59 { 60 if( ctx == NULL ) 61 return; 62 63 mbedtls_platform_zeroize( ctx, sizeof( mbedtls_sha1_context ) ); 64 } 65 66 void mbedtls_sha1_clone( mbedtls_sha1_context *dst, 67 const mbedtls_sha1_context *src ) 68 { 69 SHA1_VALIDATE( dst != NULL ); 70 SHA1_VALIDATE( src != NULL ); 71 72 *dst = *src; 73 } 74 75 /* 76 * SHA-1 context setup 77 */ 78 int mbedtls_sha1_starts_ret( mbedtls_sha1_context *ctx ) 79 { 80 SHA1_VALIDATE_RET( ctx != NULL ); 81 82 ctx->total[0] = 0; 83 ctx->total[1] = 0; 84 85 ctx->state[0] = 0x67452301; 86 ctx->state[1] = 0xEFCDAB89; 87 ctx->state[2] = 0x98BADCFE; 88 ctx->state[3] = 0x10325476; 89 ctx->state[4] = 0xC3D2E1F0; 90 91 return( 0 ); 92 } 93 94 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 95 void mbedtls_sha1_starts( mbedtls_sha1_context *ctx ) 96 { 97 mbedtls_sha1_starts_ret( ctx ); 98 } 99 #endif 100 101 #if !defined(MBEDTLS_SHA1_PROCESS_ALT) 102 int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, 103 const unsigned char data[64] ) 104 { 105 struct 106 { 107 uint32_t temp, W[16], A, B, C, D, E; 108 } local; 109 110 SHA1_VALIDATE_RET( ctx != NULL ); 111 SHA1_VALIDATE_RET( (const unsigned char *)data != NULL ); 112 113 local.W[ 0] = MBEDTLS_GET_UINT32_BE( data, 0 ); 114 local.W[ 1] = MBEDTLS_GET_UINT32_BE( data, 4 ); 115 local.W[ 2] = MBEDTLS_GET_UINT32_BE( data, 8 ); 116 local.W[ 3] = MBEDTLS_GET_UINT32_BE( data, 12 ); 117 local.W[ 4] = MBEDTLS_GET_UINT32_BE( data, 16 ); 118 local.W[ 5] = MBEDTLS_GET_UINT32_BE( data, 20 ); 119 local.W[ 6] = MBEDTLS_GET_UINT32_BE( data, 24 ); 120 local.W[ 7] = MBEDTLS_GET_UINT32_BE( data, 28 ); 121 local.W[ 8] = MBEDTLS_GET_UINT32_BE( data, 32 ); 122 local.W[ 9] = MBEDTLS_GET_UINT32_BE( data, 36 ); 123 local.W[10] = MBEDTLS_GET_UINT32_BE( data, 40 ); 124 local.W[11] = MBEDTLS_GET_UINT32_BE( data, 44 ); 125 local.W[12] = MBEDTLS_GET_UINT32_BE( data, 48 ); 126 local.W[13] = MBEDTLS_GET_UINT32_BE( data, 52 ); 127 local.W[14] = MBEDTLS_GET_UINT32_BE( data, 56 ); 128 local.W[15] = MBEDTLS_GET_UINT32_BE( data, 60 ); 129 130 #define S(x,n) (((x) << (n)) | (((x) & 0xFFFFFFFF) >> (32 - (n)))) 131 132 #define R(t) \ 133 ( \ 134 local.temp = local.W[( (t) - 3 ) & 0x0F] ^ \ 135 local.W[( (t) - 8 ) & 0x0F] ^ \ 136 local.W[( (t) - 14 ) & 0x0F] ^ \ 137 local.W[ (t) & 0x0F], \ 138 ( local.W[(t) & 0x0F] = S(local.temp,1) ) \ 139 ) 140 141 #define P(a,b,c,d,e,x) \ 142 do \ 143 { \ 144 (e) += S((a),5) + F((b),(c),(d)) + K + (x); \ 145 (b) = S((b),30); \ 146 } while( 0 ) 147 148 local.A = ctx->state[0]; 149 local.B = ctx->state[1]; 150 local.C = ctx->state[2]; 151 local.D = ctx->state[3]; 152 local.E = ctx->state[4]; 153 154 #define F(x,y,z) ((z) ^ ((x) & ((y) ^ (z)))) 155 #define K 0x5A827999 156 157 P( local.A, local.B, local.C, local.D, local.E, local.W[0] ); 158 P( local.E, local.A, local.B, local.C, local.D, local.W[1] ); 159 P( local.D, local.E, local.A, local.B, local.C, local.W[2] ); 160 P( local.C, local.D, local.E, local.A, local.B, local.W[3] ); 161 P( local.B, local.C, local.D, local.E, local.A, local.W[4] ); 162 P( local.A, local.B, local.C, local.D, local.E, local.W[5] ); 163 P( local.E, local.A, local.B, local.C, local.D, local.W[6] ); 164 P( local.D, local.E, local.A, local.B, local.C, local.W[7] ); 165 P( local.C, local.D, local.E, local.A, local.B, local.W[8] ); 166 P( local.B, local.C, local.D, local.E, local.A, local.W[9] ); 167 P( local.A, local.B, local.C, local.D, local.E, local.W[10] ); 168 P( local.E, local.A, local.B, local.C, local.D, local.W[11] ); 169 P( local.D, local.E, local.A, local.B, local.C, local.W[12] ); 170 P( local.C, local.D, local.E, local.A, local.B, local.W[13] ); 171 P( local.B, local.C, local.D, local.E, local.A, local.W[14] ); 172 P( local.A, local.B, local.C, local.D, local.E, local.W[15] ); 173 P( local.E, local.A, local.B, local.C, local.D, R(16) ); 174 P( local.D, local.E, local.A, local.B, local.C, R(17) ); 175 P( local.C, local.D, local.E, local.A, local.B, R(18) ); 176 P( local.B, local.C, local.D, local.E, local.A, R(19) ); 177 178 #undef K 179 #undef F 180 181 #define F(x,y,z) ((x) ^ (y) ^ (z)) 182 #define K 0x6ED9EBA1 183 184 P( local.A, local.B, local.C, local.D, local.E, R(20) ); 185 P( local.E, local.A, local.B, local.C, local.D, R(21) ); 186 P( local.D, local.E, local.A, local.B, local.C, R(22) ); 187 P( local.C, local.D, local.E, local.A, local.B, R(23) ); 188 P( local.B, local.C, local.D, local.E, local.A, R(24) ); 189 P( local.A, local.B, local.C, local.D, local.E, R(25) ); 190 P( local.E, local.A, local.B, local.C, local.D, R(26) ); 191 P( local.D, local.E, local.A, local.B, local.C, R(27) ); 192 P( local.C, local.D, local.E, local.A, local.B, R(28) ); 193 P( local.B, local.C, local.D, local.E, local.A, R(29) ); 194 P( local.A, local.B, local.C, local.D, local.E, R(30) ); 195 P( local.E, local.A, local.B, local.C, local.D, R(31) ); 196 P( local.D, local.E, local.A, local.B, local.C, R(32) ); 197 P( local.C, local.D, local.E, local.A, local.B, R(33) ); 198 P( local.B, local.C, local.D, local.E, local.A, R(34) ); 199 P( local.A, local.B, local.C, local.D, local.E, R(35) ); 200 P( local.E, local.A, local.B, local.C, local.D, R(36) ); 201 P( local.D, local.E, local.A, local.B, local.C, R(37) ); 202 P( local.C, local.D, local.E, local.A, local.B, R(38) ); 203 P( local.B, local.C, local.D, local.E, local.A, R(39) ); 204 205 #undef K 206 #undef F 207 208 #define F(x,y,z) (((x) & (y)) | ((z) & ((x) | (y)))) 209 #define K 0x8F1BBCDC 210 211 P( local.A, local.B, local.C, local.D, local.E, R(40) ); 212 P( local.E, local.A, local.B, local.C, local.D, R(41) ); 213 P( local.D, local.E, local.A, local.B, local.C, R(42) ); 214 P( local.C, local.D, local.E, local.A, local.B, R(43) ); 215 P( local.B, local.C, local.D, local.E, local.A, R(44) ); 216 P( local.A, local.B, local.C, local.D, local.E, R(45) ); 217 P( local.E, local.A, local.B, local.C, local.D, R(46) ); 218 P( local.D, local.E, local.A, local.B, local.C, R(47) ); 219 P( local.C, local.D, local.E, local.A, local.B, R(48) ); 220 P( local.B, local.C, local.D, local.E, local.A, R(49) ); 221 P( local.A, local.B, local.C, local.D, local.E, R(50) ); 222 P( local.E, local.A, local.B, local.C, local.D, R(51) ); 223 P( local.D, local.E, local.A, local.B, local.C, R(52) ); 224 P( local.C, local.D, local.E, local.A, local.B, R(53) ); 225 P( local.B, local.C, local.D, local.E, local.A, R(54) ); 226 P( local.A, local.B, local.C, local.D, local.E, R(55) ); 227 P( local.E, local.A, local.B, local.C, local.D, R(56) ); 228 P( local.D, local.E, local.A, local.B, local.C, R(57) ); 229 P( local.C, local.D, local.E, local.A, local.B, R(58) ); 230 P( local.B, local.C, local.D, local.E, local.A, R(59) ); 231 232 #undef K 233 #undef F 234 235 #define F(x,y,z) ((x) ^ (y) ^ (z)) 236 #define K 0xCA62C1D6 237 238 P( local.A, local.B, local.C, local.D, local.E, R(60) ); 239 P( local.E, local.A, local.B, local.C, local.D, R(61) ); 240 P( local.D, local.E, local.A, local.B, local.C, R(62) ); 241 P( local.C, local.D, local.E, local.A, local.B, R(63) ); 242 P( local.B, local.C, local.D, local.E, local.A, R(64) ); 243 P( local.A, local.B, local.C, local.D, local.E, R(65) ); 244 P( local.E, local.A, local.B, local.C, local.D, R(66) ); 245 P( local.D, local.E, local.A, local.B, local.C, R(67) ); 246 P( local.C, local.D, local.E, local.A, local.B, R(68) ); 247 P( local.B, local.C, local.D, local.E, local.A, R(69) ); 248 P( local.A, local.B, local.C, local.D, local.E, R(70) ); 249 P( local.E, local.A, local.B, local.C, local.D, R(71) ); 250 P( local.D, local.E, local.A, local.B, local.C, R(72) ); 251 P( local.C, local.D, local.E, local.A, local.B, R(73) ); 252 P( local.B, local.C, local.D, local.E, local.A, R(74) ); 253 P( local.A, local.B, local.C, local.D, local.E, R(75) ); 254 P( local.E, local.A, local.B, local.C, local.D, R(76) ); 255 P( local.D, local.E, local.A, local.B, local.C, R(77) ); 256 P( local.C, local.D, local.E, local.A, local.B, R(78) ); 257 P( local.B, local.C, local.D, local.E, local.A, R(79) ); 258 259 #undef K 260 #undef F 261 262 ctx->state[0] += local.A; 263 ctx->state[1] += local.B; 264 ctx->state[2] += local.C; 265 ctx->state[3] += local.D; 266 ctx->state[4] += local.E; 267 268 /* Zeroise buffers and variables to clear sensitive data from memory. */ 269 mbedtls_platform_zeroize( &local, sizeof( local ) ); 270 271 return( 0 ); 272 } 273 274 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 275 void mbedtls_sha1_process( mbedtls_sha1_context *ctx, 276 const unsigned char data[64] ) 277 { 278 mbedtls_internal_sha1_process( ctx, data ); 279 } 280 #endif 281 #endif /* !MBEDTLS_SHA1_PROCESS_ALT */ 282 283 /* 284 * SHA-1 process buffer 285 */ 286 int mbedtls_sha1_update_ret( mbedtls_sha1_context *ctx, 287 const unsigned char *input, 288 size_t ilen ) 289 { 290 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 291 size_t fill; 292 uint32_t left; 293 294 SHA1_VALIDATE_RET( ctx != NULL ); 295 SHA1_VALIDATE_RET( ilen == 0 || input != NULL ); 296 297 if( ilen == 0 ) 298 return( 0 ); 299 300 left = ctx->total[0] & 0x3F; 301 fill = 64 - left; 302 303 ctx->total[0] += (uint32_t) ilen; 304 ctx->total[0] &= 0xFFFFFFFF; 305 306 if( ctx->total[0] < (uint32_t) ilen ) 307 ctx->total[1]++; 308 309 if( left && ilen >= fill ) 310 { 311 memcpy( (void *) (ctx->buffer + left), input, fill ); 312 313 if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 ) 314 return( ret ); 315 316 input += fill; 317 ilen -= fill; 318 left = 0; 319 } 320 321 while( ilen >= 64 ) 322 { 323 if( ( ret = mbedtls_internal_sha1_process( ctx, input ) ) != 0 ) 324 return( ret ); 325 326 input += 64; 327 ilen -= 64; 328 } 329 330 if( ilen > 0 ) 331 memcpy( (void *) (ctx->buffer + left), input, ilen ); 332 333 return( 0 ); 334 } 335 336 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 337 void mbedtls_sha1_update( mbedtls_sha1_context *ctx, 338 const unsigned char *input, 339 size_t ilen ) 340 { 341 mbedtls_sha1_update_ret( ctx, input, ilen ); 342 } 343 #endif 344 345 /* 346 * SHA-1 final digest 347 */ 348 int mbedtls_sha1_finish_ret( mbedtls_sha1_context *ctx, 349 unsigned char output[20] ) 350 { 351 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 352 uint32_t used; 353 uint32_t high, low; 354 355 SHA1_VALIDATE_RET( ctx != NULL ); 356 SHA1_VALIDATE_RET( (unsigned char *)output != NULL ); 357 358 /* 359 * Add padding: 0x80 then 0x00 until 8 bytes remain for the length 360 */ 361 used = ctx->total[0] & 0x3F; 362 363 ctx->buffer[used++] = 0x80; 364 365 if( used <= 56 ) 366 { 367 /* Enough room for padding + length in current block */ 368 memset( ctx->buffer + used, 0, 56 - used ); 369 } 370 else 371 { 372 /* We'll need an extra block */ 373 memset( ctx->buffer + used, 0, 64 - used ); 374 375 if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 ) 376 return( ret ); 377 378 memset( ctx->buffer, 0, 56 ); 379 } 380 381 /* 382 * Add message length 383 */ 384 high = ( ctx->total[0] >> 29 ) 385 | ( ctx->total[1] << 3 ); 386 low = ( ctx->total[0] << 3 ); 387 388 MBEDTLS_PUT_UINT32_BE( high, ctx->buffer, 56 ); 389 MBEDTLS_PUT_UINT32_BE( low, ctx->buffer, 60 ); 390 391 if( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 ) 392 return( ret ); 393 394 /* 395 * Output final state 396 */ 397 MBEDTLS_PUT_UINT32_BE( ctx->state[0], output, 0 ); 398 MBEDTLS_PUT_UINT32_BE( ctx->state[1], output, 4 ); 399 MBEDTLS_PUT_UINT32_BE( ctx->state[2], output, 8 ); 400 MBEDTLS_PUT_UINT32_BE( ctx->state[3], output, 12 ); 401 MBEDTLS_PUT_UINT32_BE( ctx->state[4], output, 16 ); 402 403 return( 0 ); 404 } 405 406 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 407 void mbedtls_sha1_finish( mbedtls_sha1_context *ctx, 408 unsigned char output[20] ) 409 { 410 mbedtls_sha1_finish_ret( ctx, output ); 411 } 412 #endif 413 414 #endif /* !MBEDTLS_SHA1_ALT */ 415 416 /* 417 * output = SHA-1( input buffer ) 418 */ 419 int mbedtls_sha1_ret( const unsigned char *input, 420 size_t ilen, 421 unsigned char output[20] ) 422 { 423 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 424 mbedtls_sha1_context ctx; 425 426 SHA1_VALIDATE_RET( ilen == 0 || input != NULL ); 427 SHA1_VALIDATE_RET( (unsigned char *)output != NULL ); 428 429 mbedtls_sha1_init( &ctx ); 430 431 if( ( ret = mbedtls_sha1_starts_ret( &ctx ) ) != 0 ) 432 goto exit; 433 434 if( ( ret = mbedtls_sha1_update_ret( &ctx, input, ilen ) ) != 0 ) 435 goto exit; 436 437 if( ( ret = mbedtls_sha1_finish_ret( &ctx, output ) ) != 0 ) 438 goto exit; 439 440 exit: 441 mbedtls_sha1_free( &ctx ); 442 443 return( ret ); 444 } 445 446 #if !defined(MBEDTLS_DEPRECATED_REMOVED) 447 void mbedtls_sha1( const unsigned char *input, 448 size_t ilen, 449 unsigned char output[20] ) 450 { 451 mbedtls_sha1_ret( input, ilen, output ); 452 } 453 #endif 454 455 #if defined(MBEDTLS_SELF_TEST) 456 /* 457 * FIPS-180-1 test vectors 458 */ 459 static const unsigned char sha1_test_buf[3][57] = 460 { 461 { "abc" }, 462 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" }, 463 { "" } 464 }; 465 466 static const size_t sha1_test_buflen[3] = 467 { 468 3, 56, 1000 469 }; 470 471 static const unsigned char sha1_test_sum[3][20] = 472 { 473 { 0xA9, 0x99, 0x3E, 0x36, 0x47, 0x06, 0x81, 0x6A, 0xBA, 0x3E, 474 0x25, 0x71, 0x78, 0x50, 0xC2, 0x6C, 0x9C, 0xD0, 0xD8, 0x9D }, 475 { 0x84, 0x98, 0x3E, 0x44, 0x1C, 0x3B, 0xD2, 0x6E, 0xBA, 0xAE, 476 0x4A, 0xA1, 0xF9, 0x51, 0x29, 0xE5, 0xE5, 0x46, 0x70, 0xF1 }, 477 { 0x34, 0xAA, 0x97, 0x3C, 0xD4, 0xC4, 0xDA, 0xA4, 0xF6, 0x1E, 478 0xEB, 0x2B, 0xDB, 0xAD, 0x27, 0x31, 0x65, 0x34, 0x01, 0x6F } 479 }; 480 481 /* 482 * Checkup routine 483 */ 484 int mbedtls_sha1_self_test( int verbose ) 485 { 486 int i, j, buflen, ret = 0; 487 unsigned char buf[1024]; 488 unsigned char sha1sum[20]; 489 mbedtls_sha1_context ctx; 490 491 mbedtls_sha1_init( &ctx ); 492 493 /* 494 * SHA-1 495 */ 496 for( i = 0; i < 3; i++ ) 497 { 498 if( verbose != 0 ) 499 mbedtls_printf( " SHA-1 test #%d: ", i + 1 ); 500 501 if( ( ret = mbedtls_sha1_starts_ret( &ctx ) ) != 0 ) 502 goto fail; 503 504 if( i == 2 ) 505 { 506 memset( buf, 'a', buflen = 1000 ); 507 508 for( j = 0; j < 1000; j++ ) 509 { 510 ret = mbedtls_sha1_update_ret( &ctx, buf, buflen ); 511 if( ret != 0 ) 512 goto fail; 513 } 514 } 515 else 516 { 517 ret = mbedtls_sha1_update_ret( &ctx, sha1_test_buf[i], 518 sha1_test_buflen[i] ); 519 if( ret != 0 ) 520 goto fail; 521 } 522 523 if( ( ret = mbedtls_sha1_finish_ret( &ctx, sha1sum ) ) != 0 ) 524 goto fail; 525 526 if( memcmp( sha1sum, sha1_test_sum[i], 20 ) != 0 ) 527 { 528 ret = 1; 529 goto fail; 530 } 531 532 if( verbose != 0 ) 533 mbedtls_printf( "passed\n" ); 534 } 535 536 if( verbose != 0 ) 537 mbedtls_printf( "\n" ); 538 539 goto exit; 540 541 fail: 542 if( verbose != 0 ) 543 mbedtls_printf( "failed\n" ); 544 545 exit: 546 mbedtls_sha1_free( &ctx ); 547 548 return( ret ); 549 } 550 551 #endif /* MBEDTLS_SELF_TEST */ 552 553 #endif /* MBEDTLS_SHA1_C */ 554