1 /*
2 * SHA1 hash implementation and interface functions
3 * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "sha1.h"
19 #include "md5.h"
20 #include "crypto.h"
21
22
23 /**
24 * hmac_sha1_vector - HMAC-SHA1 over data vector (RFC 2104)
25 * @key: Key for HMAC operations
26 * @key_len: Length of the key in bytes
27 * @num_elem: Number of elements in the data vector
28 * @addr: Pointers to the data areas
29 * @len: Lengths of the data blocks
30 * @mac: Buffer for the hash (20 bytes)
31 */
hmac_sha1_vector(const u8 * key,size_t key_len,size_t num_elem,const u8 * addr[],const size_t * len,u8 * mac)32 void hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem,
33 const u8 *addr[], const size_t *len, u8 *mac)
34 {
35 unsigned char k_pad[64]; /* padding - key XORd with ipad/opad */
36 unsigned char tk[20];
37 const u8 *_addr[6];
38 size_t _len[6], i;
39
40 if (num_elem > 5) {
41 /*
42 * Fixed limit on the number of fragments to avoid having to
43 * allocate memory (which could fail).
44 */
45 return;
46 }
47
48 /* if key is longer than 64 bytes reset it to key = SHA1(key) */
49 if (key_len > 64) {
50 sha1_vector(1, &key, &key_len, tk);
51 key = tk;
52 key_len = 20;
53 }
54
55 /* the HMAC_SHA1 transform looks like:
56 *
57 * SHA1(K XOR opad, SHA1(K XOR ipad, text))
58 *
59 * where K is an n byte key
60 * ipad is the byte 0x36 repeated 64 times
61 * opad is the byte 0x5c repeated 64 times
62 * and text is the data being protected */
63
64 /* start out by storing key in ipad */
65 os_memset(k_pad, 0, sizeof(k_pad));
66 os_memcpy(k_pad, key, key_len);
67 /* XOR key with ipad values */
68 for (i = 0; i < 64; i++)
69 k_pad[i] ^= 0x36;
70
71 /* perform inner SHA1 */
72 _addr[0] = k_pad;
73 _len[0] = 64;
74 for (i = 0; i < num_elem; i++) {
75 _addr[i + 1] = addr[i];
76 _len[i + 1] = len[i];
77 }
78 sha1_vector(1 + num_elem, _addr, _len, mac);
79
80 os_memset(k_pad, 0, sizeof(k_pad));
81 os_memcpy(k_pad, key, key_len);
82 /* XOR key with opad values */
83 for (i = 0; i < 64; i++)
84 k_pad[i] ^= 0x5c;
85
86 /* perform outer SHA1 */
87 _addr[0] = k_pad;
88 _len[0] = 64;
89 _addr[1] = mac;
90 _len[1] = SHA1_MAC_LEN;
91 sha1_vector(2, _addr, _len, mac);
92 }
93
94
95 /**
96 * hmac_sha1 - HMAC-SHA1 over data buffer (RFC 2104)
97 * @key: Key for HMAC operations
98 * @key_len: Length of the key in bytes
99 * @data: Pointers to the data area
100 * @data_len: Length of the data area
101 * @mac: Buffer for the hash (20 bytes)
102 */
hmac_sha1(const u8 * key,size_t key_len,const u8 * data,size_t data_len,u8 * mac)103 void hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
104 u8 *mac)
105 {
106 hmac_sha1_vector(key, key_len, 1, &data, &data_len, mac);
107 }
108
109
110 /**
111 * sha1_prf - SHA1-based Pseudo-Random Function (PRF) (IEEE 802.11i, 8.5.1.1)
112 * @key: Key for PRF
113 * @key_len: Length of the key in bytes
114 * @label: A unique label for each purpose of the PRF
115 * @data: Extra data to bind into the key
116 * @data_len: Length of the data
117 * @buf: Buffer for the generated pseudo-random key
118 * @buf_len: Number of bytes of key to generate
119 *
120 * This function is used to derive new, cryptographically separate keys from a
121 * given key (e.g., PMK in IEEE 802.11i).
122 */
sha1_prf(const u8 * key,size_t key_len,const char * label,const u8 * data,size_t data_len,u8 * buf,size_t buf_len)123 void sha1_prf(const u8 *key, size_t key_len, const char *label,
124 const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
125 {
126 u8 zero = 0, counter = 0;
127 size_t pos, plen;
128 u8 hash[SHA1_MAC_LEN];
129 size_t label_len = os_strlen(label);
130 const unsigned char *addr[4];
131 size_t len[4];
132
133 addr[0] = (u8 *) label;
134 len[0] = label_len;
135 addr[1] = &zero;
136 len[1] = 1;
137 addr[2] = data;
138 len[2] = data_len;
139 addr[3] = &counter;
140 len[3] = 1;
141
142 pos = 0;
143 while (pos < buf_len) {
144 plen = buf_len - pos;
145 if (plen >= SHA1_MAC_LEN) {
146 hmac_sha1_vector(key, key_len, 4, addr, len,
147 &buf[pos]);
148 pos += SHA1_MAC_LEN;
149 } else {
150 hmac_sha1_vector(key, key_len, 4, addr, len,
151 hash);
152 os_memcpy(&buf[pos], hash, plen);
153 break;
154 }
155 counter++;
156 }
157 }
158
159
160 /**
161 * sha1_t_prf - EAP-FAST Pseudo-Random Function (T-PRF)
162 * @key: Key for PRF
163 * @key_len: Length of the key in bytes
164 * @label: A unique label for each purpose of the PRF
165 * @seed: Seed value to bind into the key
166 * @seed_len: Length of the seed
167 * @buf: Buffer for the generated pseudo-random key
168 * @buf_len: Number of bytes of key to generate
169 *
170 * This function is used to derive new, cryptographically separate keys from a
171 * given key for EAP-FAST. T-PRF is defined in
172 * draft-cam-winget-eap-fast-02.txt, Appendix B.
173 */
sha1_t_prf(const u8 * key,size_t key_len,const char * label,const u8 * seed,size_t seed_len,u8 * buf,size_t buf_len)174 void sha1_t_prf(const u8 *key, size_t key_len, const char *label,
175 const u8 *seed, size_t seed_len, u8 *buf, size_t buf_len)
176 {
177 unsigned char counter = 0;
178 size_t pos, plen;
179 u8 hash[SHA1_MAC_LEN];
180 size_t label_len = os_strlen(label);
181 u8 output_len[2];
182 const unsigned char *addr[5];
183 size_t len[5];
184
185 addr[0] = hash;
186 len[0] = 0;
187 addr[1] = (unsigned char *) label;
188 len[1] = label_len + 1;
189 addr[2] = seed;
190 len[2] = seed_len;
191 addr[3] = output_len;
192 len[3] = 2;
193 addr[4] = &counter;
194 len[4] = 1;
195
196 output_len[0] = (buf_len >> 8) & 0xff;
197 output_len[1] = buf_len & 0xff;
198 pos = 0;
199 while (pos < buf_len) {
200 counter++;
201 plen = buf_len - pos;
202 hmac_sha1_vector(key, key_len, 5, addr, len, hash);
203 if (plen >= SHA1_MAC_LEN) {
204 os_memcpy(&buf[pos], hash, SHA1_MAC_LEN);
205 pos += SHA1_MAC_LEN;
206 } else {
207 os_memcpy(&buf[pos], hash, plen);
208 break;
209 }
210 len[0] = SHA1_MAC_LEN;
211 }
212 }
213
214
215 /**
216 * tls_prf - Pseudo-Random Function for TLS (TLS-PRF, RFC 2246)
217 * @secret: Key for PRF
218 * @secret_len: Length of the key in bytes
219 * @label: A unique label for each purpose of the PRF
220 * @seed: Seed value to bind into the key
221 * @seed_len: Length of the seed
222 * @out: Buffer for the generated pseudo-random key
223 * @outlen: Number of bytes of key to generate
224 * Returns: 0 on success, -1 on failure.
225 *
226 * This function is used to derive new, cryptographically separate keys from a
227 * given key in TLS. This PRF is defined in RFC 2246, Chapter 5.
228 */
tls_prf(const u8 * secret,size_t secret_len,const char * label,const u8 * seed,size_t seed_len,u8 * out,size_t outlen)229 int tls_prf(const u8 *secret, size_t secret_len, const char *label,
230 const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
231 {
232 size_t L_S1, L_S2, i;
233 const u8 *S1, *S2;
234 u8 A_MD5[MD5_MAC_LEN], A_SHA1[SHA1_MAC_LEN];
235 u8 P_MD5[MD5_MAC_LEN], P_SHA1[SHA1_MAC_LEN];
236 int MD5_pos, SHA1_pos;
237 const u8 *MD5_addr[3];
238 size_t MD5_len[3];
239 const unsigned char *SHA1_addr[3];
240 size_t SHA1_len[3];
241
242 if (secret_len & 1)
243 return -1;
244
245 MD5_addr[0] = A_MD5;
246 MD5_len[0] = MD5_MAC_LEN;
247 MD5_addr[1] = (unsigned char *) label;
248 MD5_len[1] = os_strlen(label);
249 MD5_addr[2] = seed;
250 MD5_len[2] = seed_len;
251
252 SHA1_addr[0] = A_SHA1;
253 SHA1_len[0] = SHA1_MAC_LEN;
254 SHA1_addr[1] = (unsigned char *) label;
255 SHA1_len[1] = os_strlen(label);
256 SHA1_addr[2] = seed;
257 SHA1_len[2] = seed_len;
258
259 /* RFC 2246, Chapter 5
260 * A(0) = seed, A(i) = HMAC(secret, A(i-1))
261 * P_hash = HMAC(secret, A(1) + seed) + HMAC(secret, A(2) + seed) + ..
262 * PRF = P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed)
263 */
264
265 L_S1 = L_S2 = (secret_len + 1) / 2;
266 S1 = secret;
267 S2 = secret + L_S1;
268 if (secret_len & 1) {
269 /* The last byte of S1 will be shared with S2 */
270 S2--;
271 }
272
273 hmac_md5_vector(S1, L_S1, 2, &MD5_addr[1], &MD5_len[1], A_MD5);
274 hmac_sha1_vector(S2, L_S2, 2, &SHA1_addr[1], &SHA1_len[1], A_SHA1);
275
276 MD5_pos = MD5_MAC_LEN;
277 SHA1_pos = SHA1_MAC_LEN;
278 for (i = 0; i < outlen; i++) {
279 if (MD5_pos == MD5_MAC_LEN) {
280 hmac_md5_vector(S1, L_S1, 3, MD5_addr, MD5_len, P_MD5);
281 MD5_pos = 0;
282 hmac_md5(S1, L_S1, A_MD5, MD5_MAC_LEN, A_MD5);
283 }
284 if (SHA1_pos == SHA1_MAC_LEN) {
285 hmac_sha1_vector(S2, L_S2, 3, SHA1_addr, SHA1_len,
286 P_SHA1);
287 SHA1_pos = 0;
288 hmac_sha1(S2, L_S2, A_SHA1, SHA1_MAC_LEN, A_SHA1);
289 }
290
291 out[i] = P_MD5[MD5_pos] ^ P_SHA1[SHA1_pos];
292
293 MD5_pos++;
294 SHA1_pos++;
295 }
296
297 return 0;
298 }
299
300
pbkdf2_sha1_f(const char * passphrase,const char * ssid,size_t ssid_len,int iterations,unsigned int count,u8 * digest)301 static void pbkdf2_sha1_f(const char *passphrase, const char *ssid,
302 size_t ssid_len, int iterations, unsigned int count,
303 u8 *digest)
304 {
305 unsigned char tmp[SHA1_MAC_LEN], tmp2[SHA1_MAC_LEN];
306 int i, j;
307 unsigned char count_buf[4];
308 const u8 *addr[2];
309 size_t len[2];
310 size_t passphrase_len = os_strlen(passphrase);
311
312 addr[0] = (u8 *) ssid;
313 len[0] = ssid_len;
314 addr[1] = count_buf;
315 len[1] = 4;
316
317 /* F(P, S, c, i) = U1 xor U2 xor ... Uc
318 * U1 = PRF(P, S || i)
319 * U2 = PRF(P, U1)
320 * Uc = PRF(P, Uc-1)
321 */
322
323 count_buf[0] = (count >> 24) & 0xff;
324 count_buf[1] = (count >> 16) & 0xff;
325 count_buf[2] = (count >> 8) & 0xff;
326 count_buf[3] = count & 0xff;
327 hmac_sha1_vector((u8 *) passphrase, passphrase_len, 2, addr, len, tmp);
328 os_memcpy(digest, tmp, SHA1_MAC_LEN);
329
330 for (i = 1; i < iterations; i++) {
331 hmac_sha1((u8 *) passphrase, passphrase_len, tmp, SHA1_MAC_LEN,
332 tmp2);
333 os_memcpy(tmp, tmp2, SHA1_MAC_LEN);
334 for (j = 0; j < SHA1_MAC_LEN; j++)
335 digest[j] ^= tmp2[j];
336 }
337 }
338
339
340 /**
341 * pbkdf2_sha1 - SHA1-based key derivation function (PBKDF2) for IEEE 802.11i
342 * @passphrase: ASCII passphrase
343 * @ssid: SSID
344 * @ssid_len: SSID length in bytes
345 * @interations: Number of iterations to run
346 * @buf: Buffer for the generated key
347 * @buflen: Length of the buffer in bytes
348 *
349 * This function is used to derive PSK for WPA-PSK. For this protocol,
350 * iterations is set to 4096 and buflen to 32. This function is described in
351 * IEEE Std 802.11-2004, Clause H.4. The main construction is from PKCS#5 v2.0.
352 */
pbkdf2_sha1(const char * passphrase,const char * ssid,size_t ssid_len,int iterations,u8 * buf,size_t buflen)353 void pbkdf2_sha1(const char *passphrase, const char *ssid, size_t ssid_len,
354 int iterations, u8 *buf, size_t buflen)
355 {
356 unsigned int count = 0;
357 unsigned char *pos = buf;
358 size_t left = buflen, plen;
359 unsigned char digest[SHA1_MAC_LEN];
360
361 while (left > 0) {
362 count++;
363 pbkdf2_sha1_f(passphrase, ssid, ssid_len, iterations, count,
364 digest);
365 plen = left > SHA1_MAC_LEN ? SHA1_MAC_LEN : left;
366 os_memcpy(pos, digest, plen);
367 pos += plen;
368 left -= plen;
369 }
370 }
371
372
373 #ifdef INTERNAL_SHA1
374
375 struct SHA1Context {
376 u32 state[5];
377 u32 count[2];
378 unsigned char buffer[64];
379 };
380
381 typedef struct SHA1Context SHA1_CTX;
382
383 #ifndef CONFIG_CRYPTO_INTERNAL
384 static void SHA1Init(struct SHA1Context *context);
385 static void SHA1Update(struct SHA1Context *context, const void *data, u32 len);
386 static void SHA1Final(unsigned char digest[20], struct SHA1Context *context);
387 #endif /* CONFIG_CRYPTO_INTERNAL */
388 static void SHA1Transform(u32 state[5], const unsigned char buffer[64]);
389
390
391 /**
392 * sha1_vector - SHA-1 hash for data vector
393 * @num_elem: Number of elements in the data vector
394 * @addr: Pointers to the data areas
395 * @len: Lengths of the data blocks
396 * @mac: Buffer for the hash
397 */
sha1_vector(size_t num_elem,const u8 * addr[],const size_t * len,u8 * mac)398 void sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len,
399 u8 *mac)
400 {
401 SHA1_CTX ctx;
402 size_t i;
403
404 SHA1Init(&ctx);
405 for (i = 0; i < num_elem; i++)
406 SHA1Update(&ctx, addr[i], len[i]);
407 SHA1Final(mac, &ctx);
408 }
409
410
fips186_2_prf(const u8 * seed,size_t seed_len,u8 * x,size_t xlen)411 int fips186_2_prf(const u8 *seed, size_t seed_len, u8 *x, size_t xlen)
412 {
413 u8 xkey[64];
414 u32 t[5], _t[5];
415 int i, j, m, k;
416 u8 *xpos = x;
417 u32 carry;
418
419 if (seed_len > sizeof(xkey))
420 seed_len = sizeof(xkey);
421
422 /* FIPS 186-2 + change notice 1 */
423
424 os_memcpy(xkey, seed, seed_len);
425 os_memset(xkey + seed_len, 0, 64 - seed_len);
426 t[0] = 0x67452301;
427 t[1] = 0xEFCDAB89;
428 t[2] = 0x98BADCFE;
429 t[3] = 0x10325476;
430 t[4] = 0xC3D2E1F0;
431
432 m = xlen / 40;
433 for (j = 0; j < m; j++) {
434 /* XSEED_j = 0 */
435 for (i = 0; i < 2; i++) {
436 /* XVAL = (XKEY + XSEED_j) mod 2^b */
437
438 /* w_i = G(t, XVAL) */
439 os_memcpy(_t, t, 20);
440 SHA1Transform(_t, xkey);
441 _t[0] = host_to_be32(_t[0]);
442 _t[1] = host_to_be32(_t[1]);
443 _t[2] = host_to_be32(_t[2]);
444 _t[3] = host_to_be32(_t[3]);
445 _t[4] = host_to_be32(_t[4]);
446 os_memcpy(xpos, _t, 20);
447
448 /* XKEY = (1 + XKEY + w_i) mod 2^b */
449 carry = 1;
450 for (k = 19; k >= 0; k--) {
451 carry += xkey[k] + xpos[k];
452 xkey[k] = carry & 0xff;
453 carry >>= 8;
454 }
455
456 xpos += SHA1_MAC_LEN;
457 }
458 /* x_j = w_0|w_1 */
459 }
460
461 return 0;
462 }
463
464
465 /* ===== start - public domain SHA1 implementation ===== */
466
467 /*
468 SHA-1 in C
469 By Steve Reid <sreid@sea-to-sky.net>
470 100% Public Domain
471
472 -----------------
473 Modified 7/98
474 By James H. Brown <jbrown@burgoyne.com>
475 Still 100% Public Domain
476
477 Corrected a problem which generated improper hash values on 16 bit machines
478 Routine SHA1Update changed from
479 void SHA1Update(SHA1_CTX* context, unsigned char* data, unsigned int
480 len)
481 to
482 void SHA1Update(SHA1_CTX* context, unsigned char* data, unsigned
483 long len)
484
485 The 'len' parameter was declared an int which works fine on 32 bit machines.
486 However, on 16 bit machines an int is too small for the shifts being done
487 against
488 it. This caused the hash function to generate incorrect values if len was
489 greater than 8191 (8K - 1) due to the 'len << 3' on line 3 of SHA1Update().
490
491 Since the file IO in main() reads 16K at a time, any file 8K or larger would
492 be guaranteed to generate the wrong hash (e.g. Test Vector #3, a million
493 "a"s).
494
495 I also changed the declaration of variables i & j in SHA1Update to
496 unsigned long from unsigned int for the same reason.
497
498 These changes should make no difference to any 32 bit implementations since
499 an
500 int and a long are the same size in those environments.
501
502 --
503 I also corrected a few compiler warnings generated by Borland C.
504 1. Added #include <process.h> for exit() prototype
505 2. Removed unused variable 'j' in SHA1Final
506 3. Changed exit(0) to return(0) at end of main.
507
508 ALL changes I made can be located by searching for comments containing 'JHB'
509 -----------------
510 Modified 8/98
511 By Steve Reid <sreid@sea-to-sky.net>
512 Still 100% public domain
513
514 1- Removed #include <process.h> and used return() instead of exit()
515 2- Fixed overwriting of finalcount in SHA1Final() (discovered by Chris Hall)
516 3- Changed email address from steve@edmweb.com to sreid@sea-to-sky.net
517
518 -----------------
519 Modified 4/01
520 By Saul Kravitz <Saul.Kravitz@celera.com>
521 Still 100% PD
522 Modified to run on Compaq Alpha hardware.
523
524 -----------------
525 Modified 4/01
526 By Jouni Malinen <j@w1.fi>
527 Minor changes to match the coding style used in Dynamics.
528
529 Modified September 24, 2004
530 By Jouni Malinen <j@w1.fi>
531 Fixed alignment issue in SHA1Transform when SHA1HANDSOFF is defined.
532
533 */
534
535 /*
536 Test Vectors (from FIPS PUB 180-1)
537 "abc"
538 A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D
539 "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
540 84983E44 1C3BD26E BAAE4AA1 F95129E5 E54670F1
541 A million repetitions of "a"
542 34AA973C D4C4DAA4 F61EEB2B DBAD2731 6534016F
543 */
544
545 #define SHA1HANDSOFF
546
547 #define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
548
549 /* blk0() and blk() perform the initial expand. */
550 /* I got the idea of expanding during the round function from SSLeay */
551 #ifndef WORDS_BIGENDIAN
552 #define blk0(i) (block->l[i] = (rol(block->l[i], 24) & 0xFF00FF00) | \
553 (rol(block->l[i], 8) & 0x00FF00FF))
554 #else
555 #define blk0(i) block->l[i]
556 #endif
557 #define blk(i) (block->l[i & 15] = rol(block->l[(i + 13) & 15] ^ \
558 block->l[(i + 8) & 15] ^ block->l[(i + 2) & 15] ^ block->l[i & 15], 1))
559
560 /* (R0+R1), R2, R3, R4 are the different operations used in SHA1 */
561 #define R0(v,w,x,y,z,i) \
562 z += ((w & (x ^ y)) ^ y) + blk0(i) + 0x5A827999 + rol(v, 5); \
563 w = rol(w, 30);
564 #define R1(v,w,x,y,z,i) \
565 z += ((w & (x ^ y)) ^ y) + blk(i) + 0x5A827999 + rol(v, 5); \
566 w = rol(w, 30);
567 #define R2(v,w,x,y,z,i) \
568 z += (w ^ x ^ y) + blk(i) + 0x6ED9EBA1 + rol(v, 5); w = rol(w, 30);
569 #define R3(v,w,x,y,z,i) \
570 z += (((w | x) & y) | (w & x)) + blk(i) + 0x8F1BBCDC + rol(v, 5); \
571 w = rol(w, 30);
572 #define R4(v,w,x,y,z,i) \
573 z += (w ^ x ^ y) + blk(i) + 0xCA62C1D6 + rol(v, 5); \
574 w=rol(w, 30);
575
576
577 #ifdef VERBOSE /* SAK */
SHAPrintContext(SHA1_CTX * context,char * msg)578 void SHAPrintContext(SHA1_CTX *context, char *msg)
579 {
580 printf("%s (%d,%d) %x %x %x %x %x\n",
581 msg,
582 context->count[0], context->count[1],
583 context->state[0],
584 context->state[1],
585 context->state[2],
586 context->state[3],
587 context->state[4]);
588 }
589 #endif
590
591 /* Hash a single 512-bit block. This is the core of the algorithm. */
592
SHA1Transform(u32 state[5],const unsigned char buffer[64])593 static void SHA1Transform(u32 state[5], const unsigned char buffer[64])
594 {
595 u32 a, b, c, d, e;
596 typedef union {
597 unsigned char c[64];
598 u32 l[16];
599 } CHAR64LONG16;
600 CHAR64LONG16* block;
601 #ifdef SHA1HANDSOFF
602 u32 workspace[16];
603 block = (CHAR64LONG16 *) workspace;
604 os_memcpy(block, buffer, 64);
605 #else
606 block = (CHAR64LONG16 *) buffer;
607 #endif
608 /* Copy context->state[] to working vars */
609 a = state[0];
610 b = state[1];
611 c = state[2];
612 d = state[3];
613 e = state[4];
614 /* 4 rounds of 20 operations each. Loop unrolled. */
615 R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
616 R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
617 R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
618 R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
619 R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
620 R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
621 R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
622 R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
623 R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
624 R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
625 R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
626 R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
627 R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
628 R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
629 R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
630 R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
631 R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
632 R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
633 R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
634 R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
635 /* Add the working vars back into context.state[] */
636 state[0] += a;
637 state[1] += b;
638 state[2] += c;
639 state[3] += d;
640 state[4] += e;
641 /* Wipe variables */
642 a = b = c = d = e = 0;
643 #ifdef SHA1HANDSOFF
644 os_memset(block, 0, 64);
645 #endif
646 }
647
648
649 /* SHA1Init - Initialize new context */
650
SHA1Init(SHA1_CTX * context)651 void SHA1Init(SHA1_CTX* context)
652 {
653 /* SHA1 initialization constants */
654 context->state[0] = 0x67452301;
655 context->state[1] = 0xEFCDAB89;
656 context->state[2] = 0x98BADCFE;
657 context->state[3] = 0x10325476;
658 context->state[4] = 0xC3D2E1F0;
659 context->count[0] = context->count[1] = 0;
660 }
661
662
663 /* Run your data through this. */
664
SHA1Update(SHA1_CTX * context,const void * _data,u32 len)665 void SHA1Update(SHA1_CTX* context, const void *_data, u32 len)
666 {
667 u32 i, j;
668 const unsigned char *data = _data;
669
670 #ifdef VERBOSE
671 SHAPrintContext(context, "before");
672 #endif
673 j = (context->count[0] >> 3) & 63;
674 if ((context->count[0] += len << 3) < (len << 3))
675 context->count[1]++;
676 context->count[1] += (len >> 29);
677 if ((j + len) > 63) {
678 os_memcpy(&context->buffer[j], data, (i = 64-j));
679 SHA1Transform(context->state, context->buffer);
680 for ( ; i + 63 < len; i += 64) {
681 SHA1Transform(context->state, &data[i]);
682 }
683 j = 0;
684 }
685 else i = 0;
686 os_memcpy(&context->buffer[j], &data[i], len - i);
687 #ifdef VERBOSE
688 SHAPrintContext(context, "after ");
689 #endif
690 }
691
692
693 /* Add padding and return the message digest. */
694
SHA1Final(unsigned char digest[20],SHA1_CTX * context)695 void SHA1Final(unsigned char digest[20], SHA1_CTX* context)
696 {
697 u32 i;
698 unsigned char finalcount[8];
699
700 for (i = 0; i < 8; i++) {
701 finalcount[i] = (unsigned char)
702 ((context->count[(i >= 4 ? 0 : 1)] >>
703 ((3-(i & 3)) * 8) ) & 255); /* Endian independent */
704 }
705 SHA1Update(context, (unsigned char *) "\200", 1);
706 while ((context->count[0] & 504) != 448) {
707 SHA1Update(context, (unsigned char *) "\0", 1);
708 }
709 SHA1Update(context, finalcount, 8); /* Should cause a SHA1Transform()
710 */
711 for (i = 0; i < 20; i++) {
712 digest[i] = (unsigned char)
713 ((context->state[i >> 2] >> ((3 - (i & 3)) * 8)) &
714 255);
715 }
716 /* Wipe variables */
717 i = 0;
718 os_memset(context->buffer, 0, 64);
719 os_memset(context->state, 0, 20);
720 os_memset(context->count, 0, 8);
721 os_memset(finalcount, 0, 8);
722 }
723
724 /* ===== end - public domain SHA1 implementation ===== */
725
726 #endif /* INTERNAL_SHA1 */
727