1 /*
2 * FIPS-180-2 compliant SHA-256 implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7 /*
8 * The SHA-256 Secure Hash Standard was published by NIST in 2002.
9 *
10 * http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
11 */
12
13 #include "common.h"
14
15 #if defined(MBEDTLS_SHA256_C)
16
17 #include "mbedtls/sha256.h"
18 #include "mbedtls/platform_util.h"
19 #include "mbedtls/error.h"
20
21 #include <string.h>
22
23 #include "mbedtls/platform.h"
24
25 #define SHA256_VALIDATE_RET(cond) \
26 MBEDTLS_INTERNAL_VALIDATE_RET(cond, MBEDTLS_ERR_SHA256_BAD_INPUT_DATA)
27 #define SHA256_VALIDATE(cond) MBEDTLS_INTERNAL_VALIDATE(cond)
28
29 #if !defined(MBEDTLS_SHA256_ALT)
30
mbedtls_sha256_init(mbedtls_sha256_context * ctx)31 void mbedtls_sha256_init(mbedtls_sha256_context *ctx)
32 {
33 SHA256_VALIDATE(ctx != NULL);
34
35 memset(ctx, 0, sizeof(mbedtls_sha256_context));
36 }
37
mbedtls_sha256_free(mbedtls_sha256_context * ctx)38 void mbedtls_sha256_free(mbedtls_sha256_context *ctx)
39 {
40 if (ctx == NULL) {
41 return;
42 }
43
44 mbedtls_platform_zeroize(ctx, sizeof(mbedtls_sha256_context));
45 }
46
mbedtls_sha256_clone(mbedtls_sha256_context * dst,const mbedtls_sha256_context * src)47 void mbedtls_sha256_clone(mbedtls_sha256_context *dst,
48 const mbedtls_sha256_context *src)
49 {
50 SHA256_VALIDATE(dst != NULL);
51 SHA256_VALIDATE(src != NULL);
52
53 *dst = *src;
54 }
55
56 /*
57 * SHA-256 context setup
58 */
mbedtls_sha256_starts_ret(mbedtls_sha256_context * ctx,int is224)59 int mbedtls_sha256_starts_ret(mbedtls_sha256_context *ctx, int is224)
60 {
61 SHA256_VALIDATE_RET(ctx != NULL);
62 SHA256_VALIDATE_RET(is224 == 0 || is224 == 1);
63
64 ctx->total[0] = 0;
65 ctx->total[1] = 0;
66
67 if (is224 == 0) {
68 /* SHA-256 */
69 ctx->state[0] = 0x6A09E667;
70 ctx->state[1] = 0xBB67AE85;
71 ctx->state[2] = 0x3C6EF372;
72 ctx->state[3] = 0xA54FF53A;
73 ctx->state[4] = 0x510E527F;
74 ctx->state[5] = 0x9B05688C;
75 ctx->state[6] = 0x1F83D9AB;
76 ctx->state[7] = 0x5BE0CD19;
77 } else {
78 /* SHA-224 */
79 ctx->state[0] = 0xC1059ED8;
80 ctx->state[1] = 0x367CD507;
81 ctx->state[2] = 0x3070DD17;
82 ctx->state[3] = 0xF70E5939;
83 ctx->state[4] = 0xFFC00B31;
84 ctx->state[5] = 0x68581511;
85 ctx->state[6] = 0x64F98FA7;
86 ctx->state[7] = 0xBEFA4FA4;
87 }
88
89 ctx->is224 = is224;
90
91 return 0;
92 }
93
94 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_sha256_starts(mbedtls_sha256_context * ctx,int is224)95 void mbedtls_sha256_starts(mbedtls_sha256_context *ctx,
96 int is224)
97 {
98 mbedtls_sha256_starts_ret(ctx, is224);
99 }
100 #endif
101
102 #if !defined(MBEDTLS_SHA256_PROCESS_ALT)
103 static const uint32_t K[] =
104 {
105 0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5,
106 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
107 0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3,
108 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
109 0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC,
110 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
111 0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7,
112 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
113 0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13,
114 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
115 0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3,
116 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
117 0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5,
118 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
119 0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208,
120 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2,
121 };
122
123 #define SHR(x, n) (((x) & 0xFFFFFFFF) >> (n))
124 #define ROTR(x, n) (SHR(x, n) | ((x) << (32 - (n))))
125
126 #define S0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
127 #define S1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
128
129 #define S2(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
130 #define S3(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
131
132 #define F0(x, y, z) (((x) & (y)) | ((z) & ((x) | (y))))
133 #define F1(x, y, z) ((z) ^ ((x) & ((y) ^ (z))))
134
135 #define R(t) \
136 ( \
137 local.W[t] = S1(local.W[(t) - 2]) + local.W[(t) - 7] + \
138 S0(local.W[(t) - 15]) + local.W[(t) - 16] \
139 )
140
141 #define P(a, b, c, d, e, f, g, h, x, K) \
142 do \
143 { \
144 local.temp1 = (h) + S3(e) + F1((e), (f), (g)) + (K) + (x); \
145 local.temp2 = S2(a) + F0((a), (b), (c)); \
146 (d) += local.temp1; (h) = local.temp1 + local.temp2; \
147 } while (0)
148
mbedtls_internal_sha256_process(mbedtls_sha256_context * ctx,const unsigned char data[64])149 int mbedtls_internal_sha256_process(mbedtls_sha256_context *ctx,
150 const unsigned char data[64])
151 {
152 struct {
153 uint32_t temp1, temp2, W[64];
154 uint32_t A[8];
155 } local;
156
157 unsigned int i;
158
159 SHA256_VALIDATE_RET(ctx != NULL);
160 SHA256_VALIDATE_RET((const unsigned char *) data != NULL);
161
162 for (i = 0; i < 8; i++) {
163 local.A[i] = ctx->state[i];
164 }
165
166 #if defined(MBEDTLS_SHA256_SMALLER)
167 for (i = 0; i < 64; i++) {
168 if (i < 16) {
169 local.W[i] = MBEDTLS_GET_UINT32_BE(data, 4 * i);
170 } else {
171 R(i);
172 }
173
174 P(local.A[0], local.A[1], local.A[2], local.A[3], local.A[4],
175 local.A[5], local.A[6], local.A[7], local.W[i], K[i]);
176
177 local.temp1 = local.A[7]; local.A[7] = local.A[6];
178 local.A[6] = local.A[5]; local.A[5] = local.A[4];
179 local.A[4] = local.A[3]; local.A[3] = local.A[2];
180 local.A[2] = local.A[1]; local.A[1] = local.A[0];
181 local.A[0] = local.temp1;
182 }
183 #else /* MBEDTLS_SHA256_SMALLER */
184 for (i = 0; i < 16; i++) {
185 local.W[i] = MBEDTLS_GET_UINT32_BE(data, 4 * i);
186 }
187
188 for (i = 0; i < 16; i += 8) {
189 P(local.A[0], local.A[1], local.A[2], local.A[3], local.A[4],
190 local.A[5], local.A[6], local.A[7], local.W[i+0], K[i+0]);
191 P(local.A[7], local.A[0], local.A[1], local.A[2], local.A[3],
192 local.A[4], local.A[5], local.A[6], local.W[i+1], K[i+1]);
193 P(local.A[6], local.A[7], local.A[0], local.A[1], local.A[2],
194 local.A[3], local.A[4], local.A[5], local.W[i+2], K[i+2]);
195 P(local.A[5], local.A[6], local.A[7], local.A[0], local.A[1],
196 local.A[2], local.A[3], local.A[4], local.W[i+3], K[i+3]);
197 P(local.A[4], local.A[5], local.A[6], local.A[7], local.A[0],
198 local.A[1], local.A[2], local.A[3], local.W[i+4], K[i+4]);
199 P(local.A[3], local.A[4], local.A[5], local.A[6], local.A[7],
200 local.A[0], local.A[1], local.A[2], local.W[i+5], K[i+5]);
201 P(local.A[2], local.A[3], local.A[4], local.A[5], local.A[6],
202 local.A[7], local.A[0], local.A[1], local.W[i+6], K[i+6]);
203 P(local.A[1], local.A[2], local.A[3], local.A[4], local.A[5],
204 local.A[6], local.A[7], local.A[0], local.W[i+7], K[i+7]);
205 }
206
207 for (i = 16; i < 64; i += 8) {
208 P(local.A[0], local.A[1], local.A[2], local.A[3], local.A[4],
209 local.A[5], local.A[6], local.A[7], R(i+0), K[i+0]);
210 P(local.A[7], local.A[0], local.A[1], local.A[2], local.A[3],
211 local.A[4], local.A[5], local.A[6], R(i+1), K[i+1]);
212 P(local.A[6], local.A[7], local.A[0], local.A[1], local.A[2],
213 local.A[3], local.A[4], local.A[5], R(i+2), K[i+2]);
214 P(local.A[5], local.A[6], local.A[7], local.A[0], local.A[1],
215 local.A[2], local.A[3], local.A[4], R(i+3), K[i+3]);
216 P(local.A[4], local.A[5], local.A[6], local.A[7], local.A[0],
217 local.A[1], local.A[2], local.A[3], R(i+4), K[i+4]);
218 P(local.A[3], local.A[4], local.A[5], local.A[6], local.A[7],
219 local.A[0], local.A[1], local.A[2], R(i+5), K[i+5]);
220 P(local.A[2], local.A[3], local.A[4], local.A[5], local.A[6],
221 local.A[7], local.A[0], local.A[1], R(i+6), K[i+6]);
222 P(local.A[1], local.A[2], local.A[3], local.A[4], local.A[5],
223 local.A[6], local.A[7], local.A[0], R(i+7), K[i+7]);
224 }
225 #endif /* MBEDTLS_SHA256_SMALLER */
226
227 for (i = 0; i < 8; i++) {
228 ctx->state[i] += local.A[i];
229 }
230
231 /* Zeroise buffers and variables to clear sensitive data from memory. */
232 mbedtls_platform_zeroize(&local, sizeof(local));
233
234 return 0;
235 }
236
237 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_sha256_process(mbedtls_sha256_context * ctx,const unsigned char data[64])238 void mbedtls_sha256_process(mbedtls_sha256_context *ctx,
239 const unsigned char data[64])
240 {
241 mbedtls_internal_sha256_process(ctx, data);
242 }
243 #endif
244 #endif /* !MBEDTLS_SHA256_PROCESS_ALT */
245
246 /*
247 * SHA-256 process buffer
248 */
mbedtls_sha256_update_ret(mbedtls_sha256_context * ctx,const unsigned char * input,size_t ilen)249 int mbedtls_sha256_update_ret(mbedtls_sha256_context *ctx,
250 const unsigned char *input,
251 size_t ilen)
252 {
253 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
254 size_t fill;
255 uint32_t left;
256
257 SHA256_VALIDATE_RET(ctx != NULL);
258 SHA256_VALIDATE_RET(ilen == 0 || input != NULL);
259
260 if (ilen == 0) {
261 return 0;
262 }
263
264 left = ctx->total[0] & 0x3F;
265 fill = 64 - left;
266
267 ctx->total[0] += (uint32_t) ilen;
268 ctx->total[0] &= 0xFFFFFFFF;
269
270 if (ctx->total[0] < (uint32_t) ilen) {
271 ctx->total[1]++;
272 }
273
274 if (left && ilen >= fill) {
275 memcpy((void *) (ctx->buffer + left), input, fill);
276
277 if ((ret = mbedtls_internal_sha256_process(ctx, ctx->buffer)) != 0) {
278 return ret;
279 }
280
281 input += fill;
282 ilen -= fill;
283 left = 0;
284 }
285
286 while (ilen >= 64) {
287 if ((ret = mbedtls_internal_sha256_process(ctx, input)) != 0) {
288 return ret;
289 }
290
291 input += 64;
292 ilen -= 64;
293 }
294
295 if (ilen > 0) {
296 memcpy((void *) (ctx->buffer + left), input, ilen);
297 }
298
299 return 0;
300 }
301
302 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_sha256_update(mbedtls_sha256_context * ctx,const unsigned char * input,size_t ilen)303 void mbedtls_sha256_update(mbedtls_sha256_context *ctx,
304 const unsigned char *input,
305 size_t ilen)
306 {
307 mbedtls_sha256_update_ret(ctx, input, ilen);
308 }
309 #endif
310
311 /*
312 * SHA-256 final digest
313 */
mbedtls_sha256_finish_ret(mbedtls_sha256_context * ctx,unsigned char output[32])314 int mbedtls_sha256_finish_ret(mbedtls_sha256_context *ctx,
315 unsigned char output[32])
316 {
317 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
318 uint32_t used;
319 uint32_t high, low;
320
321 SHA256_VALIDATE_RET(ctx != NULL);
322 SHA256_VALIDATE_RET((unsigned char *) output != NULL);
323
324 /*
325 * Add padding: 0x80 then 0x00 until 8 bytes remain for the length
326 */
327 used = ctx->total[0] & 0x3F;
328
329 ctx->buffer[used++] = 0x80;
330
331 if (used <= 56) {
332 /* Enough room for padding + length in current block */
333 memset(ctx->buffer + used, 0, 56 - used);
334 } else {
335 /* We'll need an extra block */
336 memset(ctx->buffer + used, 0, 64 - used);
337
338 if ((ret = mbedtls_internal_sha256_process(ctx, ctx->buffer)) != 0) {
339 return ret;
340 }
341
342 memset(ctx->buffer, 0, 56);
343 }
344
345 /*
346 * Add message length
347 */
348 high = (ctx->total[0] >> 29)
349 | (ctx->total[1] << 3);
350 low = (ctx->total[0] << 3);
351
352 MBEDTLS_PUT_UINT32_BE(high, ctx->buffer, 56);
353 MBEDTLS_PUT_UINT32_BE(low, ctx->buffer, 60);
354
355 if ((ret = mbedtls_internal_sha256_process(ctx, ctx->buffer)) != 0) {
356 return ret;
357 }
358
359 /*
360 * Output final state
361 */
362 MBEDTLS_PUT_UINT32_BE(ctx->state[0], output, 0);
363 MBEDTLS_PUT_UINT32_BE(ctx->state[1], output, 4);
364 MBEDTLS_PUT_UINT32_BE(ctx->state[2], output, 8);
365 MBEDTLS_PUT_UINT32_BE(ctx->state[3], output, 12);
366 MBEDTLS_PUT_UINT32_BE(ctx->state[4], output, 16);
367 MBEDTLS_PUT_UINT32_BE(ctx->state[5], output, 20);
368 MBEDTLS_PUT_UINT32_BE(ctx->state[6], output, 24);
369
370 if (ctx->is224 == 0) {
371 MBEDTLS_PUT_UINT32_BE(ctx->state[7], output, 28);
372 }
373
374 return 0;
375 }
376
377 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_sha256_finish(mbedtls_sha256_context * ctx,unsigned char output[32])378 void mbedtls_sha256_finish(mbedtls_sha256_context *ctx,
379 unsigned char output[32])
380 {
381 mbedtls_sha256_finish_ret(ctx, output);
382 }
383 #endif
384
385 #endif /* !MBEDTLS_SHA256_ALT */
386
387 /*
388 * output = SHA-256( input buffer )
389 */
mbedtls_sha256_ret(const unsigned char * input,size_t ilen,unsigned char output[32],int is224)390 int mbedtls_sha256_ret(const unsigned char *input,
391 size_t ilen,
392 unsigned char output[32],
393 int is224)
394 {
395 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
396 mbedtls_sha256_context ctx;
397
398 SHA256_VALIDATE_RET(is224 == 0 || is224 == 1);
399 SHA256_VALIDATE_RET(ilen == 0 || input != NULL);
400 SHA256_VALIDATE_RET((unsigned char *) output != NULL);
401
402 mbedtls_sha256_init(&ctx);
403
404 if ((ret = mbedtls_sha256_starts_ret(&ctx, is224)) != 0) {
405 goto exit;
406 }
407
408 if ((ret = mbedtls_sha256_update_ret(&ctx, input, ilen)) != 0) {
409 goto exit;
410 }
411
412 if ((ret = mbedtls_sha256_finish_ret(&ctx, output)) != 0) {
413 goto exit;
414 }
415
416 exit:
417 mbedtls_sha256_free(&ctx);
418
419 return ret;
420 }
421
422 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
mbedtls_sha256(const unsigned char * input,size_t ilen,unsigned char output[32],int is224)423 void mbedtls_sha256(const unsigned char *input,
424 size_t ilen,
425 unsigned char output[32],
426 int is224)
427 {
428 mbedtls_sha256_ret(input, ilen, output, is224);
429 }
430 #endif
431
432 #if defined(MBEDTLS_SELF_TEST)
433 /*
434 * FIPS-180-2 test vectors
435 */
436 static const unsigned char sha256_test_buf[3][57] =
437 {
438 { "abc" },
439 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" },
440 { "" }
441 };
442
443 static const size_t sha256_test_buflen[3] =
444 {
445 3, 56, 1000
446 };
447
448 static const unsigned char sha256_test_sum[6][32] =
449 {
450 /*
451 * SHA-224 test vectors
452 */
453 { 0x23, 0x09, 0x7D, 0x22, 0x34, 0x05, 0xD8, 0x22,
454 0x86, 0x42, 0xA4, 0x77, 0xBD, 0xA2, 0x55, 0xB3,
455 0x2A, 0xAD, 0xBC, 0xE4, 0xBD, 0xA0, 0xB3, 0xF7,
456 0xE3, 0x6C, 0x9D, 0xA7 },
457 { 0x75, 0x38, 0x8B, 0x16, 0x51, 0x27, 0x76, 0xCC,
458 0x5D, 0xBA, 0x5D, 0xA1, 0xFD, 0x89, 0x01, 0x50,
459 0xB0, 0xC6, 0x45, 0x5C, 0xB4, 0xF5, 0x8B, 0x19,
460 0x52, 0x52, 0x25, 0x25 },
461 { 0x20, 0x79, 0x46, 0x55, 0x98, 0x0C, 0x91, 0xD8,
462 0xBB, 0xB4, 0xC1, 0xEA, 0x97, 0x61, 0x8A, 0x4B,
463 0xF0, 0x3F, 0x42, 0x58, 0x19, 0x48, 0xB2, 0xEE,
464 0x4E, 0xE7, 0xAD, 0x67 },
465
466 /*
467 * SHA-256 test vectors
468 */
469 { 0xBA, 0x78, 0x16, 0xBF, 0x8F, 0x01, 0xCF, 0xEA,
470 0x41, 0x41, 0x40, 0xDE, 0x5D, 0xAE, 0x22, 0x23,
471 0xB0, 0x03, 0x61, 0xA3, 0x96, 0x17, 0x7A, 0x9C,
472 0xB4, 0x10, 0xFF, 0x61, 0xF2, 0x00, 0x15, 0xAD },
473 { 0x24, 0x8D, 0x6A, 0x61, 0xD2, 0x06, 0x38, 0xB8,
474 0xE5, 0xC0, 0x26, 0x93, 0x0C, 0x3E, 0x60, 0x39,
475 0xA3, 0x3C, 0xE4, 0x59, 0x64, 0xFF, 0x21, 0x67,
476 0xF6, 0xEC, 0xED, 0xD4, 0x19, 0xDB, 0x06, 0xC1 },
477 { 0xCD, 0xC7, 0x6E, 0x5C, 0x99, 0x14, 0xFB, 0x92,
478 0x81, 0xA1, 0xC7, 0xE2, 0x84, 0xD7, 0x3E, 0x67,
479 0xF1, 0x80, 0x9A, 0x48, 0xA4, 0x97, 0x20, 0x0E,
480 0x04, 0x6D, 0x39, 0xCC, 0xC7, 0x11, 0x2C, 0xD0 }
481 };
482
483 /*
484 * Checkup routine
485 */
mbedtls_sha256_self_test(int verbose)486 int mbedtls_sha256_self_test(int verbose)
487 {
488 int i, j, k, buflen, ret = 0;
489 unsigned char *buf;
490 unsigned char sha256sum[32];
491 mbedtls_sha256_context ctx;
492
493 buf = mbedtls_calloc(1024, sizeof(unsigned char));
494 if (NULL == buf) {
495 if (verbose != 0) {
496 mbedtls_printf("Buffer allocation failed\n");
497 }
498
499 return 1;
500 }
501
502 mbedtls_sha256_init(&ctx);
503
504 for (i = 0; i < 6; i++) {
505 j = i % 3;
506 k = i < 3;
507
508 if (verbose != 0) {
509 mbedtls_printf(" SHA-%d test #%d: ", 256 - k * 32, j + 1);
510 }
511
512 if ((ret = mbedtls_sha256_starts_ret(&ctx, k)) != 0) {
513 goto fail;
514 }
515
516 if (j == 2) {
517 memset(buf, 'a', buflen = 1000);
518
519 for (j = 0; j < 1000; j++) {
520 ret = mbedtls_sha256_update_ret(&ctx, buf, buflen);
521 if (ret != 0) {
522 goto fail;
523 }
524 }
525
526 } else {
527 ret = mbedtls_sha256_update_ret(&ctx, sha256_test_buf[j],
528 sha256_test_buflen[j]);
529 if (ret != 0) {
530 goto fail;
531 }
532 }
533
534 if ((ret = mbedtls_sha256_finish_ret(&ctx, sha256sum)) != 0) {
535 goto fail;
536 }
537
538
539 if (memcmp(sha256sum, sha256_test_sum[i], 32 - k * 4) != 0) {
540 ret = 1;
541 goto fail;
542 }
543
544 if (verbose != 0) {
545 mbedtls_printf("passed\n");
546 }
547 }
548
549 if (verbose != 0) {
550 mbedtls_printf("\n");
551 }
552
553 goto exit;
554
555 fail:
556 if (verbose != 0) {
557 mbedtls_printf("failed\n");
558 }
559
560 exit:
561 mbedtls_sha256_free(&ctx);
562 mbedtls_free(buf);
563
564 return ret;
565 }
566
567 #endif /* MBEDTLS_SELF_TEST */
568
569 #endif /* MBEDTLS_SHA256_C */
570