1 //====- SHA1.cpp - Private copy of the SHA1 implementation ---*- C++ -* ======//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This code is taken from public domain
10 // (http://oauth.googlecode.com/svn/code/c/liboauth/src/sha1.c and
11 // http://cvsweb.netbsd.org/bsdweb.cgi/src/common/lib/libc/hash/sha1/sha1.c?rev=1.6)
12 // and modified by wrapping it in a C++ interface for LLVM,
13 // and removing unnecessary code.
14 //
15 //===----------------------------------------------------------------------===//
16
17 #include "llvm/Support/SHA1.h"
18 #include "llvm/ADT/ArrayRef.h"
19 #include "llvm/ADT/StringRef.h"
20 #include "llvm/Support/Endian.h"
21 #include "llvm/Support/Host.h"
22 #include <string.h>
23
24 using namespace llvm;
25
26 #if defined(BYTE_ORDER) && defined(BIG_ENDIAN) && BYTE_ORDER == BIG_ENDIAN
27 #define SHA_BIG_ENDIAN
28 #endif
29
rol(uint32_t Number,int Bits)30 static inline uint32_t rol(uint32_t Number, int Bits) {
31 return (Number << Bits) | (Number >> (32 - Bits));
32 }
33
blk0(uint32_t * Buf,int I)34 static inline uint32_t blk0(uint32_t *Buf, int I) { return Buf[I]; }
35
blk(uint32_t * Buf,int I)36 static inline uint32_t blk(uint32_t *Buf, int I) {
37 Buf[I & 15] = rol(Buf[(I + 13) & 15] ^ Buf[(I + 8) & 15] ^ Buf[(I + 2) & 15] ^
38 Buf[I & 15],
39 1);
40 return Buf[I & 15];
41 }
42
r0(uint32_t & A,uint32_t & B,uint32_t & C,uint32_t & D,uint32_t & E,int I,uint32_t * Buf)43 static inline void r0(uint32_t &A, uint32_t &B, uint32_t &C, uint32_t &D,
44 uint32_t &E, int I, uint32_t *Buf) {
45 E += ((B & (C ^ D)) ^ D) + blk0(Buf, I) + 0x5A827999 + rol(A, 5);
46 B = rol(B, 30);
47 }
48
r1(uint32_t & A,uint32_t & B,uint32_t & C,uint32_t & D,uint32_t & E,int I,uint32_t * Buf)49 static inline void r1(uint32_t &A, uint32_t &B, uint32_t &C, uint32_t &D,
50 uint32_t &E, int I, uint32_t *Buf) {
51 E += ((B & (C ^ D)) ^ D) + blk(Buf, I) + 0x5A827999 + rol(A, 5);
52 B = rol(B, 30);
53 }
54
r2(uint32_t & A,uint32_t & B,uint32_t & C,uint32_t & D,uint32_t & E,int I,uint32_t * Buf)55 static inline void r2(uint32_t &A, uint32_t &B, uint32_t &C, uint32_t &D,
56 uint32_t &E, int I, uint32_t *Buf) {
57 E += (B ^ C ^ D) + blk(Buf, I) + 0x6ED9EBA1 + rol(A, 5);
58 B = rol(B, 30);
59 }
60
r3(uint32_t & A,uint32_t & B,uint32_t & C,uint32_t & D,uint32_t & E,int I,uint32_t * Buf)61 static inline void r3(uint32_t &A, uint32_t &B, uint32_t &C, uint32_t &D,
62 uint32_t &E, int I, uint32_t *Buf) {
63 E += (((B | C) & D) | (B & C)) + blk(Buf, I) + 0x8F1BBCDC + rol(A, 5);
64 B = rol(B, 30);
65 }
66
r4(uint32_t & A,uint32_t & B,uint32_t & C,uint32_t & D,uint32_t & E,int I,uint32_t * Buf)67 static inline void r4(uint32_t &A, uint32_t &B, uint32_t &C, uint32_t &D,
68 uint32_t &E, int I, uint32_t *Buf) {
69 E += (B ^ C ^ D) + blk(Buf, I) + 0xCA62C1D6 + rol(A, 5);
70 B = rol(B, 30);
71 }
72
73 /* code */
74 #define SHA1_K0 0x5a827999
75 #define SHA1_K20 0x6ed9eba1
76 #define SHA1_K40 0x8f1bbcdc
77 #define SHA1_K60 0xca62c1d6
78
79 #define SEED_0 0x67452301
80 #define SEED_1 0xefcdab89
81 #define SEED_2 0x98badcfe
82 #define SEED_3 0x10325476
83 #define SEED_4 0xc3d2e1f0
84
init()85 void SHA1::init() {
86 InternalState.State[0] = SEED_0;
87 InternalState.State[1] = SEED_1;
88 InternalState.State[2] = SEED_2;
89 InternalState.State[3] = SEED_3;
90 InternalState.State[4] = SEED_4;
91 InternalState.ByteCount = 0;
92 InternalState.BufferOffset = 0;
93 }
94
hashBlock()95 void SHA1::hashBlock() {
96 uint32_t A = InternalState.State[0];
97 uint32_t B = InternalState.State[1];
98 uint32_t C = InternalState.State[2];
99 uint32_t D = InternalState.State[3];
100 uint32_t E = InternalState.State[4];
101
102 // 4 rounds of 20 operations each. Loop unrolled.
103 r0(A, B, C, D, E, 0, InternalState.Buffer.L);
104 r0(E, A, B, C, D, 1, InternalState.Buffer.L);
105 r0(D, E, A, B, C, 2, InternalState.Buffer.L);
106 r0(C, D, E, A, B, 3, InternalState.Buffer.L);
107 r0(B, C, D, E, A, 4, InternalState.Buffer.L);
108 r0(A, B, C, D, E, 5, InternalState.Buffer.L);
109 r0(E, A, B, C, D, 6, InternalState.Buffer.L);
110 r0(D, E, A, B, C, 7, InternalState.Buffer.L);
111 r0(C, D, E, A, B, 8, InternalState.Buffer.L);
112 r0(B, C, D, E, A, 9, InternalState.Buffer.L);
113 r0(A, B, C, D, E, 10, InternalState.Buffer.L);
114 r0(E, A, B, C, D, 11, InternalState.Buffer.L);
115 r0(D, E, A, B, C, 12, InternalState.Buffer.L);
116 r0(C, D, E, A, B, 13, InternalState.Buffer.L);
117 r0(B, C, D, E, A, 14, InternalState.Buffer.L);
118 r0(A, B, C, D, E, 15, InternalState.Buffer.L);
119 r1(E, A, B, C, D, 16, InternalState.Buffer.L);
120 r1(D, E, A, B, C, 17, InternalState.Buffer.L);
121 r1(C, D, E, A, B, 18, InternalState.Buffer.L);
122 r1(B, C, D, E, A, 19, InternalState.Buffer.L);
123
124 r2(A, B, C, D, E, 20, InternalState.Buffer.L);
125 r2(E, A, B, C, D, 21, InternalState.Buffer.L);
126 r2(D, E, A, B, C, 22, InternalState.Buffer.L);
127 r2(C, D, E, A, B, 23, InternalState.Buffer.L);
128 r2(B, C, D, E, A, 24, InternalState.Buffer.L);
129 r2(A, B, C, D, E, 25, InternalState.Buffer.L);
130 r2(E, A, B, C, D, 26, InternalState.Buffer.L);
131 r2(D, E, A, B, C, 27, InternalState.Buffer.L);
132 r2(C, D, E, A, B, 28, InternalState.Buffer.L);
133 r2(B, C, D, E, A, 29, InternalState.Buffer.L);
134 r2(A, B, C, D, E, 30, InternalState.Buffer.L);
135 r2(E, A, B, C, D, 31, InternalState.Buffer.L);
136 r2(D, E, A, B, C, 32, InternalState.Buffer.L);
137 r2(C, D, E, A, B, 33, InternalState.Buffer.L);
138 r2(B, C, D, E, A, 34, InternalState.Buffer.L);
139 r2(A, B, C, D, E, 35, InternalState.Buffer.L);
140 r2(E, A, B, C, D, 36, InternalState.Buffer.L);
141 r2(D, E, A, B, C, 37, InternalState.Buffer.L);
142 r2(C, D, E, A, B, 38, InternalState.Buffer.L);
143 r2(B, C, D, E, A, 39, InternalState.Buffer.L);
144
145 r3(A, B, C, D, E, 40, InternalState.Buffer.L);
146 r3(E, A, B, C, D, 41, InternalState.Buffer.L);
147 r3(D, E, A, B, C, 42, InternalState.Buffer.L);
148 r3(C, D, E, A, B, 43, InternalState.Buffer.L);
149 r3(B, C, D, E, A, 44, InternalState.Buffer.L);
150 r3(A, B, C, D, E, 45, InternalState.Buffer.L);
151 r3(E, A, B, C, D, 46, InternalState.Buffer.L);
152 r3(D, E, A, B, C, 47, InternalState.Buffer.L);
153 r3(C, D, E, A, B, 48, InternalState.Buffer.L);
154 r3(B, C, D, E, A, 49, InternalState.Buffer.L);
155 r3(A, B, C, D, E, 50, InternalState.Buffer.L);
156 r3(E, A, B, C, D, 51, InternalState.Buffer.L);
157 r3(D, E, A, B, C, 52, InternalState.Buffer.L);
158 r3(C, D, E, A, B, 53, InternalState.Buffer.L);
159 r3(B, C, D, E, A, 54, InternalState.Buffer.L);
160 r3(A, B, C, D, E, 55, InternalState.Buffer.L);
161 r3(E, A, B, C, D, 56, InternalState.Buffer.L);
162 r3(D, E, A, B, C, 57, InternalState.Buffer.L);
163 r3(C, D, E, A, B, 58, InternalState.Buffer.L);
164 r3(B, C, D, E, A, 59, InternalState.Buffer.L);
165
166 r4(A, B, C, D, E, 60, InternalState.Buffer.L);
167 r4(E, A, B, C, D, 61, InternalState.Buffer.L);
168 r4(D, E, A, B, C, 62, InternalState.Buffer.L);
169 r4(C, D, E, A, B, 63, InternalState.Buffer.L);
170 r4(B, C, D, E, A, 64, InternalState.Buffer.L);
171 r4(A, B, C, D, E, 65, InternalState.Buffer.L);
172 r4(E, A, B, C, D, 66, InternalState.Buffer.L);
173 r4(D, E, A, B, C, 67, InternalState.Buffer.L);
174 r4(C, D, E, A, B, 68, InternalState.Buffer.L);
175 r4(B, C, D, E, A, 69, InternalState.Buffer.L);
176 r4(A, B, C, D, E, 70, InternalState.Buffer.L);
177 r4(E, A, B, C, D, 71, InternalState.Buffer.L);
178 r4(D, E, A, B, C, 72, InternalState.Buffer.L);
179 r4(C, D, E, A, B, 73, InternalState.Buffer.L);
180 r4(B, C, D, E, A, 74, InternalState.Buffer.L);
181 r4(A, B, C, D, E, 75, InternalState.Buffer.L);
182 r4(E, A, B, C, D, 76, InternalState.Buffer.L);
183 r4(D, E, A, B, C, 77, InternalState.Buffer.L);
184 r4(C, D, E, A, B, 78, InternalState.Buffer.L);
185 r4(B, C, D, E, A, 79, InternalState.Buffer.L);
186
187 InternalState.State[0] += A;
188 InternalState.State[1] += B;
189 InternalState.State[2] += C;
190 InternalState.State[3] += D;
191 InternalState.State[4] += E;
192 }
193
addUncounted(uint8_t Data)194 void SHA1::addUncounted(uint8_t Data) {
195 #ifdef SHA_BIG_ENDIAN
196 InternalState.Buffer.C[InternalState.BufferOffset] = Data;
197 #else
198 InternalState.Buffer.C[InternalState.BufferOffset ^ 3] = Data;
199 #endif
200
201 InternalState.BufferOffset++;
202 if (InternalState.BufferOffset == BLOCK_LENGTH) {
203 hashBlock();
204 InternalState.BufferOffset = 0;
205 }
206 }
207
writebyte(uint8_t Data)208 void SHA1::writebyte(uint8_t Data) {
209 ++InternalState.ByteCount;
210 addUncounted(Data);
211 }
212
update(ArrayRef<uint8_t> Data)213 void SHA1::update(ArrayRef<uint8_t> Data) {
214 InternalState.ByteCount += Data.size();
215
216 // Finish the current block.
217 if (InternalState.BufferOffset > 0) {
218 const size_t Remainder = std::min<size_t>(
219 Data.size(), BLOCK_LENGTH - InternalState.BufferOffset);
220 for (size_t I = 0; I < Remainder; ++I)
221 addUncounted(Data[I]);
222 Data = Data.drop_front(Remainder);
223 }
224
225 // Fast buffer filling for large inputs.
226 while (Data.size() >= BLOCK_LENGTH) {
227 assert(InternalState.BufferOffset == 0);
228 assert(BLOCK_LENGTH % 4 == 0);
229 constexpr size_t BLOCK_LENGTH_32 = BLOCK_LENGTH / 4;
230 for (size_t I = 0; I < BLOCK_LENGTH_32; ++I)
231 InternalState.Buffer.L[I] = support::endian::read32be(&Data[I * 4]);
232 hashBlock();
233 Data = Data.drop_front(BLOCK_LENGTH);
234 }
235
236 // Finish the remainder.
237 for (uint8_t C : Data)
238 addUncounted(C);
239 }
240
update(StringRef Str)241 void SHA1::update(StringRef Str) {
242 update(
243 ArrayRef<uint8_t>((uint8_t *)const_cast<char *>(Str.data()), Str.size()));
244 }
245
pad()246 void SHA1::pad() {
247 // Implement SHA-1 padding (fips180-2 5.1.1)
248
249 // Pad with 0x80 followed by 0x00 until the end of the block
250 addUncounted(0x80);
251 while (InternalState.BufferOffset != 56)
252 addUncounted(0x00);
253
254 // Append length in the last 8 bytes
255 addUncounted(0); // We're only using 32 bit lengths
256 addUncounted(0); // But SHA-1 supports 64 bit lengths
257 addUncounted(0); // So zero pad the top bits
258 addUncounted(InternalState.ByteCount >> 29); // Shifting to multiply by 8
259 addUncounted(InternalState.ByteCount >>
260 21); // as SHA-1 supports bitstreams as well as
261 addUncounted(InternalState.ByteCount >> 13); // byte.
262 addUncounted(InternalState.ByteCount >> 5);
263 addUncounted(InternalState.ByteCount << 3);
264 }
265
final()266 StringRef SHA1::final() {
267 // Pad to complete the last block
268 pad();
269
270 #ifdef SHA_BIG_ENDIAN
271 // Just copy the current state
272 for (int i = 0; i < 5; i++) {
273 HashResult[i] = InternalState.State[i];
274 }
275 #else
276 // Swap byte order back
277 for (int i = 0; i < 5; i++) {
278 HashResult[i] = (((InternalState.State[i]) << 24) & 0xff000000) |
279 (((InternalState.State[i]) << 8) & 0x00ff0000) |
280 (((InternalState.State[i]) >> 8) & 0x0000ff00) |
281 (((InternalState.State[i]) >> 24) & 0x000000ff);
282 }
283 #endif
284
285 // Return pointer to hash (20 characters)
286 return StringRef((char *)HashResult, HASH_LENGTH);
287 }
288
result()289 StringRef SHA1::result() {
290 auto StateToRestore = InternalState;
291
292 auto Hash = final();
293
294 // Restore the state
295 InternalState = StateToRestore;
296
297 // Return pointer to hash (20 characters)
298 return Hash;
299 }
300
hash(ArrayRef<uint8_t> Data)301 std::array<uint8_t, 20> SHA1::hash(ArrayRef<uint8_t> Data) {
302 SHA1 Hash;
303 Hash.update(Data);
304 StringRef S = Hash.final();
305
306 std::array<uint8_t, 20> Arr;
307 memcpy(Arr.data(), S.data(), S.size());
308 return Arr;
309 }
310