1 /*
2 * Copyright (C) 2022 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "location/lbs/contexthub/nanoapps/nearby/crypto/sha2.h"
18
19 #include <string.h>
20
BSWAP32(uint32_t value)21 inline static uint32_t BSWAP32(uint32_t value) {
22 #if defined(__clang__) || \
23 (defined(__GNUC__) && \
24 ((__GNUC__ == 4 && __GNUC_MINOR__ >= 8) || __GNUC__ >= 5))
25 return __builtin_bswap32(value);
26 #else
27 uint32_t Byte0 = value & 0x000000FF;
28 uint32_t Byte1 = value & 0x0000FF00;
29 uint32_t Byte2 = value & 0x00FF0000;
30 uint32_t Byte3 = value & 0xFF000000;
31 return (Byte0 << 24) | (Byte1 << 8) | (Byte2 >> 8) | (Byte3 >> 24);
32 #endif
33 }
34
sha2init(struct Sha2Context * ctx)35 void sha2init(struct Sha2Context *ctx) {
36 ctx->h[0] = 0x6a09e667;
37 ctx->h[1] = 0xbb67ae85;
38 ctx->h[2] = 0x3c6ef372;
39 ctx->h[3] = 0xa54ff53a;
40 ctx->h[4] = 0x510e527f;
41 ctx->h[5] = 0x9b05688c;
42 ctx->h[6] = 0x1f83d9ab;
43 ctx->h[7] = 0x5be0cd19;
44 ctx->msgLen = 0;
45 ctx->bufBytesUsed = 0;
46 }
47
48 #ifdef ARM
49
50 #define STRINFIGY2(b) #b
51 #define STRINGIFY(b) STRINFIGY2(b)
52 #define ror(v, b) \
53 ({ \
54 uint32_t ret; \
55 if (b) \
56 asm("ror %0, #" STRINGIFY(b) : "=r"(ret) : "0"(v)); \
57 else \
58 ret = v; \
59 ret; \
60 })
61
62 #else
63
ror(uint32_t val,uint32_t by)64 inline static uint32_t ror(uint32_t val, uint32_t by) {
65 if (!by) return val;
66
67 val = (val >> by) | (val << (32 - by));
68
69 return val;
70 }
71
72 #endif
73
sha2processBlock(struct Sha2Context * ctx)74 static void sha2processBlock(struct Sha2Context *ctx) {
75 static const uint32_t k[] = {
76 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
77 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
78 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
79 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
80 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
81 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
82 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
83 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
84 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
85 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
86 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
87 };
88 uint32_t i, a, b, c, d, e, f, g, h;
89
90 // input and output streams are little-endian
91 // SHA specification uses big-endian
92 // byteswap the input
93 for (i = 0; i < SHA2_BLOCK_SIZE / sizeof(uint32_t); i++)
94 ctx->w[i] = BSWAP32(ctx->w[i]);
95
96 // expand input
97 for (; i < SHA2_WORDS_CTX_SIZE; i++) {
98 uint32_t s0 = ror(ctx->w[i - 15], 7) ^ ror(ctx->w[i - 15], 18) ^
99 (ctx->w[i - 15] >> 3);
100 uint32_t s1 =
101 ror(ctx->w[i - 2], 17) ^ ror(ctx->w[i - 2], 19) ^ (ctx->w[i - 2] >> 10);
102 ctx->w[i] = ctx->w[i - 16] + s0 + ctx->w[i - 7] + s1;
103 }
104
105 // init working variables
106 a = ctx->h[0];
107 b = ctx->h[1];
108 c = ctx->h[2];
109 d = ctx->h[3];
110 e = ctx->h[4];
111 f = ctx->h[5];
112 g = ctx->h[6];
113 h = ctx->h[7];
114
115 // 64 rounds
116 for (i = 0; i < 64; i++) {
117 uint32_t s1 = ror(e, 6) ^ ror(e, 11) ^ ror(e, 25);
118 uint32_t ch = (e & f) ^ ((~e) & g);
119 uint32_t temp1 = h + s1 + ch + k[i] + ctx->w[i];
120 uint32_t s0 = ror(a, 2) ^ ror(a, 13) ^ ror(a, 22);
121 uint32_t maj = (a & b) ^ (a & c) ^ (b & c);
122 uint32_t temp2 = s0 + maj;
123
124 h = g;
125 g = f;
126 f = e;
127 e = d + temp1;
128 d = c;
129 c = b;
130 b = a;
131 a = temp1 + temp2;
132 }
133
134 // put result back into context
135 ctx->h[0] += a;
136 ctx->h[1] += b;
137 ctx->h[2] += c;
138 ctx->h[3] += d;
139 ctx->h[4] += e;
140 ctx->h[5] += f;
141 ctx->h[6] += g;
142 ctx->h[7] += h;
143 }
144
sha2processBytes(struct Sha2Context * ctx,const void * inData,size_t dataLen)145 void sha2processBytes(struct Sha2Context *ctx, const void *inData,
146 size_t dataLen) {
147 const uint8_t *inBytes = (const uint8_t *)inData;
148
149 ctx->msgLen += dataLen;
150 while (dataLen) {
151 size_t bytesToCopy;
152
153 // step 1: copy data into context if there is space & there is data
154 bytesToCopy = dataLen;
155 if (bytesToCopy > SHA2_BLOCK_SIZE - ctx->bufBytesUsed)
156 bytesToCopy = SHA2_BLOCK_SIZE - ctx->bufBytesUsed;
157 memcpy(ctx->b + ctx->bufBytesUsed, inBytes, bytesToCopy);
158 inBytes += bytesToCopy;
159 dataLen -= bytesToCopy;
160 ctx->bufBytesUsed += bytesToCopy;
161
162 // step 2: if there is a full block, process it
163 if (ctx->bufBytesUsed == SHA2_BLOCK_SIZE) {
164 sha2processBlock(ctx);
165 ctx->bufBytesUsed = 0;
166 }
167 }
168 }
169
sha2finish(struct Sha2Context * ctx,void * outHash,uint32_t hashLen)170 void sha2finish(struct Sha2Context *ctx, void *outHash, uint32_t hashLen) {
171 uint8_t appendend = 0x80;
172 uint64_t dataLenInBits = ctx->msgLen * 8;
173 uint32_t minHashLen;
174
175 // append the one
176 sha2processBytes(ctx, &appendend, 1);
177
178 // append the zeroes
179 appendend = 0;
180 while (ctx->bufBytesUsed != 56) sha2processBytes(ctx, &appendend, 1);
181
182 // append the length in bits (we can safely write into context since we're
183 // sure where to write to (we're definitely 56-bytes into a block)
184 for (uint32_t i = 0; i < 8; i++, dataLenInBits >>= 8)
185 ctx->b[63 - i] = (uint8_t)(dataLenInBits);
186
187 // process last block
188 sha2processBlock(ctx);
189
190 // input and output streams are little-endian
191 // SHA specification uses big-endian
192 // copy the final hash to the output after byteswap
193 for (uint32_t i = 0; i < sizeof(ctx->h) / sizeof(uint32_t); i++)
194 ctx->h[i] = BSWAP32(ctx->h[i]);
195
196 minHashLen = (hashLen > SHA2_HASH_SIZE) ? SHA2_HASH_SIZE : hashLen;
197 memcpy(outHash, ctx->h, minHashLen);
198 }
199
sha256(const void * inData,const uint32_t dataLen,void * outHash,const uint32_t hashLen)200 void sha256(const void *inData, const uint32_t dataLen, void *outHash,
201 const uint32_t hashLen) {
202 struct Sha2Context ctx;
203 sha2init(&ctx);
204 sha2processBytes(&ctx, inData, dataLen);
205 sha2finish(&ctx, outHash, hashLen);
206 }
207