• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3  *  Heiko Schocher, DENX Software Engineering, hs@denx.de.
4  *  based on:
5  *  FIPS-180-1 compliant SHA-1 implementation
6  *
7  *  Copyright (C) 2003-2006  Christophe Devine
8  */
9 /*
10  *  The SHA-1 standard was published by NIST in 1993.
11  *
12  *  http://www.itl.nist.gov/fipspubs/fip180-1.htm
13  */
14 
15 #ifndef _CRT_SECURE_NO_DEPRECATE
16 #define _CRT_SECURE_NO_DEPRECATE 1
17 #endif
18 
19 #ifndef USE_HOSTCC
20 #include <common.h>
21 #include <linux/string.h>
22 #else
23 #include <string.h>
24 #endif /* USE_HOSTCC */
25 #include <watchdog.h>
26 #include <u-boot/sha1.h>
27 
28 const uint8_t sha1_der_prefix[SHA1_DER_LEN] = {
29 	0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e,
30 	0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14
31 };
32 
33 /*
34  * 32-bit integer manipulation macros (big endian)
35  */
36 #ifndef GET_UINT32_BE
37 #define GET_UINT32_BE(n,b,i) {				\
38 	(n) = ( (unsigned long) (b)[(i)    ] << 24 )	\
39 	    | ( (unsigned long) (b)[(i) + 1] << 16 )	\
40 	    | ( (unsigned long) (b)[(i) + 2] <<  8 )	\
41 	    | ( (unsigned long) (b)[(i) + 3]       );	\
42 }
43 #endif
44 #ifndef PUT_UINT32_BE
45 #define PUT_UINT32_BE(n,b,i) {				\
46 	(b)[(i)    ] = (unsigned char) ( (n) >> 24 );	\
47 	(b)[(i) + 1] = (unsigned char) ( (n) >> 16 );	\
48 	(b)[(i) + 2] = (unsigned char) ( (n) >>  8 );	\
49 	(b)[(i) + 3] = (unsigned char) ( (n)       );	\
50 }
51 #endif
52 
53 /*
54  * SHA-1 context setup
55  */
sha1_starts(sha1_context * ctx)56 void sha1_starts (sha1_context * ctx)
57 {
58 	ctx->total[0] = 0;
59 	ctx->total[1] = 0;
60 
61 	ctx->state[0] = 0x67452301;
62 	ctx->state[1] = 0xEFCDAB89;
63 	ctx->state[2] = 0x98BADCFE;
64 	ctx->state[3] = 0x10325476;
65 	ctx->state[4] = 0xC3D2E1F0;
66 }
67 
sha1_process(sha1_context * ctx,const unsigned char data[64])68 static void sha1_process(sha1_context *ctx, const unsigned char data[64])
69 {
70 	unsigned long temp, W[16], A, B, C, D, E;
71 
72 	GET_UINT32_BE (W[0], data, 0);
73 	GET_UINT32_BE (W[1], data, 4);
74 	GET_UINT32_BE (W[2], data, 8);
75 	GET_UINT32_BE (W[3], data, 12);
76 	GET_UINT32_BE (W[4], data, 16);
77 	GET_UINT32_BE (W[5], data, 20);
78 	GET_UINT32_BE (W[6], data, 24);
79 	GET_UINT32_BE (W[7], data, 28);
80 	GET_UINT32_BE (W[8], data, 32);
81 	GET_UINT32_BE (W[9], data, 36);
82 	GET_UINT32_BE (W[10], data, 40);
83 	GET_UINT32_BE (W[11], data, 44);
84 	GET_UINT32_BE (W[12], data, 48);
85 	GET_UINT32_BE (W[13], data, 52);
86 	GET_UINT32_BE (W[14], data, 56);
87 	GET_UINT32_BE (W[15], data, 60);
88 
89 #define S(x,n)	((x << n) | ((x & 0xFFFFFFFF) >> (32 - n)))
90 
91 #define R(t) (						\
92 	temp = W[(t -  3) & 0x0F] ^ W[(t - 8) & 0x0F] ^	\
93 	       W[(t - 14) & 0x0F] ^ W[ t      & 0x0F],	\
94 	( W[t & 0x0F] = S(temp,1) )			\
95 )
96 
97 #define P(a,b,c,d,e,x)	{				\
98 	e += S(a,5) + F(b,c,d) + K + x; b = S(b,30);	\
99 }
100 
101 	A = ctx->state[0];
102 	B = ctx->state[1];
103 	C = ctx->state[2];
104 	D = ctx->state[3];
105 	E = ctx->state[4];
106 
107 #define F(x,y,z) (z ^ (x & (y ^ z)))
108 #define K 0x5A827999
109 
110 	P (A, B, C, D, E, W[0]);
111 	P (E, A, B, C, D, W[1]);
112 	P (D, E, A, B, C, W[2]);
113 	P (C, D, E, A, B, W[3]);
114 	P (B, C, D, E, A, W[4]);
115 	P (A, B, C, D, E, W[5]);
116 	P (E, A, B, C, D, W[6]);
117 	P (D, E, A, B, C, W[7]);
118 	P (C, D, E, A, B, W[8]);
119 	P (B, C, D, E, A, W[9]);
120 	P (A, B, C, D, E, W[10]);
121 	P (E, A, B, C, D, W[11]);
122 	P (D, E, A, B, C, W[12]);
123 	P (C, D, E, A, B, W[13]);
124 	P (B, C, D, E, A, W[14]);
125 	P (A, B, C, D, E, W[15]);
126 	P (E, A, B, C, D, R (16));
127 	P (D, E, A, B, C, R (17));
128 	P (C, D, E, A, B, R (18));
129 	P (B, C, D, E, A, R (19));
130 
131 #undef K
132 #undef F
133 
134 #define F(x,y,z) (x ^ y ^ z)
135 #define K 0x6ED9EBA1
136 
137 	P (A, B, C, D, E, R (20));
138 	P (E, A, B, C, D, R (21));
139 	P (D, E, A, B, C, R (22));
140 	P (C, D, E, A, B, R (23));
141 	P (B, C, D, E, A, R (24));
142 	P (A, B, C, D, E, R (25));
143 	P (E, A, B, C, D, R (26));
144 	P (D, E, A, B, C, R (27));
145 	P (C, D, E, A, B, R (28));
146 	P (B, C, D, E, A, R (29));
147 	P (A, B, C, D, E, R (30));
148 	P (E, A, B, C, D, R (31));
149 	P (D, E, A, B, C, R (32));
150 	P (C, D, E, A, B, R (33));
151 	P (B, C, D, E, A, R (34));
152 	P (A, B, C, D, E, R (35));
153 	P (E, A, B, C, D, R (36));
154 	P (D, E, A, B, C, R (37));
155 	P (C, D, E, A, B, R (38));
156 	P (B, C, D, E, A, R (39));
157 
158 #undef K
159 #undef F
160 
161 #define F(x,y,z) ((x & y) | (z & (x | y)))
162 #define K 0x8F1BBCDC
163 
164 	P (A, B, C, D, E, R (40));
165 	P (E, A, B, C, D, R (41));
166 	P (D, E, A, B, C, R (42));
167 	P (C, D, E, A, B, R (43));
168 	P (B, C, D, E, A, R (44));
169 	P (A, B, C, D, E, R (45));
170 	P (E, A, B, C, D, R (46));
171 	P (D, E, A, B, C, R (47));
172 	P (C, D, E, A, B, R (48));
173 	P (B, C, D, E, A, R (49));
174 	P (A, B, C, D, E, R (50));
175 	P (E, A, B, C, D, R (51));
176 	P (D, E, A, B, C, R (52));
177 	P (C, D, E, A, B, R (53));
178 	P (B, C, D, E, A, R (54));
179 	P (A, B, C, D, E, R (55));
180 	P (E, A, B, C, D, R (56));
181 	P (D, E, A, B, C, R (57));
182 	P (C, D, E, A, B, R (58));
183 	P (B, C, D, E, A, R (59));
184 
185 #undef K
186 #undef F
187 
188 #define F(x,y,z) (x ^ y ^ z)
189 #define K 0xCA62C1D6
190 
191 	P (A, B, C, D, E, R (60));
192 	P (E, A, B, C, D, R (61));
193 	P (D, E, A, B, C, R (62));
194 	P (C, D, E, A, B, R (63));
195 	P (B, C, D, E, A, R (64));
196 	P (A, B, C, D, E, R (65));
197 	P (E, A, B, C, D, R (66));
198 	P (D, E, A, B, C, R (67));
199 	P (C, D, E, A, B, R (68));
200 	P (B, C, D, E, A, R (69));
201 	P (A, B, C, D, E, R (70));
202 	P (E, A, B, C, D, R (71));
203 	P (D, E, A, B, C, R (72));
204 	P (C, D, E, A, B, R (73));
205 	P (B, C, D, E, A, R (74));
206 	P (A, B, C, D, E, R (75));
207 	P (E, A, B, C, D, R (76));
208 	P (D, E, A, B, C, R (77));
209 	P (C, D, E, A, B, R (78));
210 	P (B, C, D, E, A, R (79));
211 
212 #undef K
213 #undef F
214 
215 	ctx->state[0] += A;
216 	ctx->state[1] += B;
217 	ctx->state[2] += C;
218 	ctx->state[3] += D;
219 	ctx->state[4] += E;
220 }
221 
222 /*
223  * SHA-1 process buffer
224  */
sha1_update(sha1_context * ctx,const unsigned char * input,unsigned int ilen)225 void sha1_update(sha1_context *ctx, const unsigned char *input,
226 		 unsigned int ilen)
227 {
228 	int fill;
229 	unsigned long left;
230 
231 	if (ilen <= 0)
232 		return;
233 
234 	left = ctx->total[0] & 0x3F;
235 	fill = 64 - left;
236 
237 	ctx->total[0] += ilen;
238 	ctx->total[0] &= 0xFFFFFFFF;
239 
240 	if (ctx->total[0] < (unsigned long) ilen)
241 		ctx->total[1]++;
242 
243 	if (left && ilen >= fill) {
244 		memcpy ((void *) (ctx->buffer + left), (void *) input, fill);
245 		sha1_process (ctx, ctx->buffer);
246 		input += fill;
247 		ilen -= fill;
248 		left = 0;
249 	}
250 
251 	while (ilen >= 64) {
252 		sha1_process (ctx, input);
253 		input += 64;
254 		ilen -= 64;
255 	}
256 
257 	if (ilen > 0) {
258 		memcpy ((void *) (ctx->buffer + left), (void *) input, ilen);
259 	}
260 }
261 
262 static const unsigned char sha1_padding[64] = {
263 	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
264 	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
265 	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
266 	   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
267 };
268 
269 /*
270  * SHA-1 final digest
271  */
sha1_finish(sha1_context * ctx,unsigned char output[20])272 void sha1_finish (sha1_context * ctx, unsigned char output[20])
273 {
274 	unsigned long last, padn;
275 	unsigned long high, low;
276 	unsigned char msglen[8];
277 
278 	high = (ctx->total[0] >> 29)
279 		| (ctx->total[1] << 3);
280 	low = (ctx->total[0] << 3);
281 
282 	PUT_UINT32_BE (high, msglen, 0);
283 	PUT_UINT32_BE (low, msglen, 4);
284 
285 	last = ctx->total[0] & 0x3F;
286 	padn = (last < 56) ? (56 - last) : (120 - last);
287 
288 	sha1_update (ctx, (unsigned char *) sha1_padding, padn);
289 	sha1_update (ctx, msglen, 8);
290 
291 	PUT_UINT32_BE (ctx->state[0], output, 0);
292 	PUT_UINT32_BE (ctx->state[1], output, 4);
293 	PUT_UINT32_BE (ctx->state[2], output, 8);
294 	PUT_UINT32_BE (ctx->state[3], output, 12);
295 	PUT_UINT32_BE (ctx->state[4], output, 16);
296 }
297 
298 /*
299  * Output = SHA-1( input buffer )
300  */
sha1_csum(const unsigned char * input,unsigned int ilen,unsigned char * output)301 void sha1_csum(const unsigned char *input, unsigned int ilen,
302 	       unsigned char *output)
303 {
304 	sha1_context ctx;
305 
306 	sha1_starts (&ctx);
307 	sha1_update (&ctx, input, ilen);
308 	sha1_finish (&ctx, output);
309 }
310 
311 /*
312  * Output = SHA-1( input buffer ). Trigger the watchdog every 'chunk_sz'
313  * bytes of input processed.
314  */
sha1_csum_wd(const unsigned char * input,unsigned int ilen,unsigned char * output,unsigned int chunk_sz)315 void sha1_csum_wd(const unsigned char *input, unsigned int ilen,
316 		  unsigned char *output, unsigned int chunk_sz)
317 {
318 	sha1_context ctx;
319 #if defined(CONFIG_HW_WATCHDOG) || defined(CONFIG_WATCHDOG)
320 	const unsigned char *end, *curr;
321 	int chunk;
322 #endif
323 
324 	sha1_starts (&ctx);
325 
326 #if defined(CONFIG_HW_WATCHDOG) || defined(CONFIG_WATCHDOG)
327 	curr = input;
328 	end = input + ilen;
329 	while (curr < end) {
330 		chunk = end - curr;
331 		if (chunk > chunk_sz)
332 			chunk = chunk_sz;
333 		sha1_update (&ctx, curr, chunk);
334 		curr += chunk;
335 		WATCHDOG_RESET ();
336 	}
337 #else
338 	sha1_update (&ctx, input, ilen);
339 #endif
340 
341 	sha1_finish (&ctx, output);
342 }
343 
344 /*
345  * Output = HMAC-SHA-1( input buffer, hmac key )
346  */
sha1_hmac(const unsigned char * key,int keylen,const unsigned char * input,unsigned int ilen,unsigned char * output)347 void sha1_hmac(const unsigned char *key, int keylen,
348 	       const unsigned char *input, unsigned int ilen,
349 	       unsigned char *output)
350 {
351 	int i;
352 	sha1_context ctx;
353 	unsigned char k_ipad[64];
354 	unsigned char k_opad[64];
355 	unsigned char tmpbuf[20];
356 
357 	memset (k_ipad, 0x36, 64);
358 	memset (k_opad, 0x5C, 64);
359 
360 	for (i = 0; i < keylen; i++) {
361 		if (i >= 64)
362 			break;
363 
364 		k_ipad[i] ^= key[i];
365 		k_opad[i] ^= key[i];
366 	}
367 
368 	sha1_starts (&ctx);
369 	sha1_update (&ctx, k_ipad, 64);
370 	sha1_update (&ctx, input, ilen);
371 	sha1_finish (&ctx, tmpbuf);
372 
373 	sha1_starts (&ctx);
374 	sha1_update (&ctx, k_opad, 64);
375 	sha1_update (&ctx, tmpbuf, 20);
376 	sha1_finish (&ctx, output);
377 
378 	memset (k_ipad, 0, 64);
379 	memset (k_opad, 0, 64);
380 	memset (tmpbuf, 0, 20);
381 	memset (&ctx, 0, sizeof (sha1_context));
382 }
383 
384 #ifdef SELF_TEST
385 /*
386  * FIPS-180-1 test vectors
387  */
388 static const char sha1_test_str[3][57] = {
389 	{"abc"},
390 	{"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"},
391 	{""}
392 };
393 
394 static const unsigned char sha1_test_sum[3][20] = {
395 	{0xA9, 0x99, 0x3E, 0x36, 0x47, 0x06, 0x81, 0x6A, 0xBA, 0x3E,
396 	 0x25, 0x71, 0x78, 0x50, 0xC2, 0x6C, 0x9C, 0xD0, 0xD8, 0x9D},
397 	{0x84, 0x98, 0x3E, 0x44, 0x1C, 0x3B, 0xD2, 0x6E, 0xBA, 0xAE,
398 	 0x4A, 0xA1, 0xF9, 0x51, 0x29, 0xE5, 0xE5, 0x46, 0x70, 0xF1},
399 	{0x34, 0xAA, 0x97, 0x3C, 0xD4, 0xC4, 0xDA, 0xA4, 0xF6, 0x1E,
400 	 0xEB, 0x2B, 0xDB, 0xAD, 0x27, 0x31, 0x65, 0x34, 0x01, 0x6F}
401 };
402 
403 /*
404  * Checkup routine
405  */
sha1_self_test(void)406 int sha1_self_test (void)
407 {
408 	int i, j;
409 	unsigned char buf[1000];
410 	unsigned char sha1sum[20];
411 	sha1_context ctx;
412 
413 	for (i = 0; i < 3; i++) {
414 		printf ("  SHA-1 test #%d: ", i + 1);
415 
416 		sha1_starts (&ctx);
417 
418 		if (i < 2)
419 			sha1_update (&ctx, (unsigned char *) sha1_test_str[i],
420 				     strlen (sha1_test_str[i]));
421 		else {
422 			memset (buf, 'a', 1000);
423 			for (j = 0; j < 1000; j++)
424 				sha1_update (&ctx, buf, 1000);
425 		}
426 
427 		sha1_finish (&ctx, sha1sum);
428 
429 		if (memcmp (sha1sum, sha1_test_sum[i], 20) != 0) {
430 			printf ("failed\n");
431 			return (1);
432 		}
433 
434 		printf ("passed\n");
435 	}
436 
437 	printf ("\n");
438 	return (0);
439 }
440 #else
sha1_self_test(void)441 int sha1_self_test (void)
442 {
443 	return (0);
444 }
445 #endif
446