1 /*
2 * Copyright 2014-2022 The GmSSL Project. All Rights Reserved.
3 *
4 * Licensed under the Apache License, Version 2.0 (the License); you may
5 * not use this file except in compliance with the License.
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 */
9
10
11 #include <string.h>
12 #include <gmssl/sha1.h>
13 #include <gmssl/endian.h>
14
15
16 #define F0(B, C, D) (((B) & (C)) | ((~(B)) & (D)))
17 #define F1(B, C, D) ((B) ^ (C) ^ (D))
18 #define F2(B, C, D) (((B) & (C)) | ((B) & (D)) | ((C) & (D)))
19 #define F3(B, C, D) ((B) ^ (C) ^ (D))
20
21 #define K0 0x5A827999
22 #define K1 0x6ED9EBA1
23 #define K2 0x8F1BBCDC
24 #define K3 0xCA62C1D6
25
sha1_compress_blocks(uint32_t state[5],const unsigned char * data,size_t blocks)26 static void sha1_compress_blocks(uint32_t state[5],
27 const unsigned char *data, size_t blocks)
28 {
29 uint32_t A;
30 uint32_t B;
31 uint32_t C;
32 uint32_t D;
33 uint32_t E;
34 uint32_t T;
35 uint32_t W[80];
36 int i;
37
38 while (blocks--) {
39
40 A = state[0];
41 B = state[1];
42 C = state[2];
43 D = state[3];
44 E = state[4];
45
46 for (i = 0; i < 16; i++) {
47 W[i] = GETU32(data);
48 data += 4;
49 }
50 for (; i < 80; i++) {
51 W[i] = ROL32(W[i-3] ^ W[i-8] ^ W[i-14] ^ W[i-16], 1);
52 }
53
54 /* see https://en.wikipedia.org/wiki/SHA-1#/media/File:SHA-1.svg */
55 for (i = 0; i < 20; i++) {
56 T = E + F0(B, C, D) + ROL32(A, 5) + W[i] + K0;
57 E = D;
58 D = C;
59 C = ROL32(B, 30);
60 B = A;
61 A = T;
62 }
63 for (; i < 40; i++) {
64 T = E + F1(B, C, D) + ROL32(A, 5) + W[i] + K1;
65 E = D;
66 D = C;
67 C = ROL32(B, 30);
68 B = A;
69 A = T;
70 }
71 for (; i < 60; i++) {
72 T = E + F2(B, C, D) + ROL32(A, 5) + W[i] + K2;
73 E = D;
74 D = C;
75 C = ROL32(B, 30);
76 B = A;
77 A = T;
78 }
79 for (; i < 80; i++) {
80 T = E + F3(B, C, D) + ROL32(A, 5) + W[i] + K3;
81 E = D;
82 D = C;
83 C = ROL32(B, 30);
84 B = A;
85 A = T;
86 }
87
88 state[0] += A;
89 state[1] += B;
90 state[2] += C;
91 state[3] += D;
92 state[4] += E;
93 }
94 }
95
sha1_init(SHA1_CTX * ctx)96 void sha1_init(SHA1_CTX *ctx)
97 {
98 memset(ctx, 0, sizeof(*ctx));
99 ctx->state[0] = 0x67452301;
100 ctx->state[1] = 0xEFCDAB89;
101 ctx->state[2] = 0x98BADCFE;
102 ctx->state[3] = 0x10325476;
103 ctx->state[4] = 0xC3D2E1F0;
104 }
105
sha1_update(SHA1_CTX * ctx,const unsigned char * data,size_t datalen)106 void sha1_update(SHA1_CTX *ctx, const unsigned char *data, size_t datalen)
107 {
108 size_t blocks;
109
110 ctx->num &= 0x3f;
111 if (ctx->num) {
112 unsigned int left = SHA1_BLOCK_SIZE - ctx->num;
113 if (datalen < left) {
114 memcpy(ctx->block + ctx->num, data, datalen);
115 ctx->num += datalen;
116 return;
117 } else {
118 memcpy(ctx->block + ctx->num, data, left);
119 sha1_compress_blocks(ctx->state, ctx->block, 1);
120 ctx->nblocks++;
121 data += left;
122 datalen -= left;
123 }
124 }
125
126 blocks = datalen / SHA1_BLOCK_SIZE;
127 sha1_compress_blocks(ctx->state, data, blocks);
128 ctx->nblocks += blocks;
129 data += SHA1_BLOCK_SIZE * blocks;
130 datalen -= SHA1_BLOCK_SIZE * blocks;
131
132 ctx->num = datalen;
133 if (datalen) {
134 memcpy(ctx->block, data, datalen);
135 }
136 }
137
sha1_finish(SHA1_CTX * ctx,unsigned char * dgst)138 void sha1_finish(SHA1_CTX *ctx, unsigned char *dgst)
139 {
140 int i;
141
142 ctx->num &= 0x3f;
143 ctx->block[ctx->num] = 0x80;
144
145 if (ctx->num <= SHA1_BLOCK_SIZE - 9) {
146 memset(ctx->block + ctx->num + 1, 0, SHA1_BLOCK_SIZE - ctx->num - 9);
147 } else {
148 memset(ctx->block + ctx->num + 1, 0, SHA1_BLOCK_SIZE - ctx->num - 1);
149 sha1_compress_blocks(ctx->state, ctx->block, 1);
150 memset(ctx->block, 0, SHA1_BLOCK_SIZE - 8);
151 }
152 PUTU32(ctx->block + 56, ctx->nblocks >> 23);
153 PUTU32(ctx->block + 60, (ctx->nblocks << 9) + (ctx->num << 3));
154
155 sha1_compress_blocks(ctx->state, ctx->block, 1);
156 for (i = 0; i < 5; i++) {
157 PUTU32(dgst + i*4, ctx->state[i]);
158 }
159 memset(ctx, 0, sizeof(*ctx));
160 }
161
sha1_digest(const unsigned char * data,size_t datalen,unsigned char dgst[SHA1_DIGEST_SIZE])162 void sha1_digest(const unsigned char *data, size_t datalen,
163 unsigned char dgst[SHA1_DIGEST_SIZE])
164 {
165 SHA1_CTX ctx;
166 sha1_init(&ctx);
167 sha1_update(&ctx, data, datalen);
168 memset(&ctx, 0, sizeof(ctx));
169 }
170
