1/*
2 * FIPS-180-1 compliant SHA-1 implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19/*
20 * The SHA-1 standard was published by NIST in 1993.
21 *
22 * http://www.itl.nist.gov/fipspubs/fip180-1.htm
23 */
24
25#include "common.h"
26
27#if defined(MBEDTLS_SHA1_C)
28
29#include "mbedtls/sha1.h"
30#include "mbedtls/platform_util.h"
31#include "mbedtls/error.h"
32
33#include <string.h>
34
35#include "mbedtls/platform.h"
36
37#define SHA1_VALIDATE_RET(cond) \
38 MBEDTLS_INTERNAL_VALIDATE_RET(cond, MBEDTLS_ERR_SHA1_BAD_INPUT_DATA)
39
40#define SHA1_VALIDATE(cond) MBEDTLS_INTERNAL_VALIDATE(cond)
41
42#if !defined(MBEDTLS_SHA1_ALT)
43
44void mbedtls_sha1_init(mbedtls_sha1_context *ctx)
45{
46 SHA1_VALIDATE(ctx != NULL);
47
48 memset(ctx, 0, sizeof(mbedtls_sha1_context));
49}
50
51void mbedtls_sha1_free(mbedtls_sha1_context *ctx)
52{
53 if (ctx == NULL) {
54 return;
55 }
56
57 mbedtls_platform_zeroize(ctx, sizeof(mbedtls_sha1_context));
58}
59
60void mbedtls_sha1_clone(mbedtls_sha1_context *dst,
61 const mbedtls_sha1_context *src)
62{
63 SHA1_VALIDATE(dst != NULL);
64 SHA1_VALIDATE(src != NULL);
65
66 *dst = *src;
67}
68
69/*
70 * SHA-1 context setup
71 */
72int mbedtls_sha1_starts_ret(mbedtls_sha1_context *ctx)
73{
74 SHA1_VALIDATE_RET(ctx != NULL);
75
76 ctx->total[0] = 0;
77 ctx->total[1] = 0;
78
79 ctx->state[0] = 0x67452301;
80 ctx->state[1] = 0xEFCDAB89;
81 ctx->state[2] = 0x98BADCFE;
82 ctx->state[3] = 0x10325476;
83 ctx->state[4] = 0xC3D2E1F0;
84
85 return 0;
86}
87
88#if !defined(MBEDTLS_DEPRECATED_REMOVED)
89void mbedtls_sha1_starts(mbedtls_sha1_context *ctx)
90{
91 mbedtls_sha1_starts_ret(ctx);
92}
93#endif
94
95#if !defined(MBEDTLS_SHA1_PROCESS_ALT)
96int mbedtls_internal_sha1_process(mbedtls_sha1_context *ctx,
97 const unsigned char data[64])
98{
99 struct {
100 uint32_t temp, W[16], A, B, C, D, E;
101 } local;
102
103 SHA1_VALIDATE_RET(ctx != NULL);
104 SHA1_VALIDATE_RET((const unsigned char *) data != NULL);
105
106 local.W[0] = MBEDTLS_GET_UINT32_BE(data, 0);
107 local.W[1] = MBEDTLS_GET_UINT32_BE(data, 4);
108 local.W[2] = MBEDTLS_GET_UINT32_BE(data, 8);
109 local.W[3] = MBEDTLS_GET_UINT32_BE(data, 12);
110 local.W[4] = MBEDTLS_GET_UINT32_BE(data, 16);
111 local.W[5] = MBEDTLS_GET_UINT32_BE(data, 20);
112 local.W[6] = MBEDTLS_GET_UINT32_BE(data, 24);
113 local.W[7] = MBEDTLS_GET_UINT32_BE(data, 28);
114 local.W[8] = MBEDTLS_GET_UINT32_BE(data, 32);
115 local.W[9] = MBEDTLS_GET_UINT32_BE(data, 36);
116 local.W[10] = MBEDTLS_GET_UINT32_BE(data, 40);
117 local.W[11] = MBEDTLS_GET_UINT32_BE(data, 44);
118 local.W[12] = MBEDTLS_GET_UINT32_BE(data, 48);
119 local.W[13] = MBEDTLS_GET_UINT32_BE(data, 52);
120 local.W[14] = MBEDTLS_GET_UINT32_BE(data, 56);
121 local.W[15] = MBEDTLS_GET_UINT32_BE(data, 60);
122
123#define S(x, n) (((x) << (n)) | (((x) & 0xFFFFFFFF) >> (32 - (n))))
124
125#define R(t) \
126 ( \
127 local.temp = local.W[((t) - 3) & 0x0F] ^ \
128 local.W[((t) - 8) & 0x0F] ^ \
129 local.W[((t) - 14) & 0x0F] ^ \
130 local.W[(t) & 0x0F], \
131 (local.W[(t) & 0x0F] = S(local.temp, 1)) \
132 )
133
134#define P(a, b, c, d, e, x) \
135 do \
136 { \
137 (e) += S((a), 5) + F((b), (c), (d)) + K + (x); \
138 (b) = S((b), 30); \
139 } while (0)
140
141 local.A = ctx->state[0];
142 local.B = ctx->state[1];
143 local.C = ctx->state[2];
144 local.D = ctx->state[3];
145 local.E = ctx->state[4];
146
147#define F(x, y, z) ((z) ^ ((x) & ((y) ^ (z))))
148#define K 0x5A827999
149
150 P(local.A, local.B, local.C, local.D, local.E, local.W[0]);
151 P(local.E, local.A, local.B, local.C, local.D, local.W[1]);
152 P(local.D, local.E, local.A, local.B, local.C, local.W[2]);
153 P(local.C, local.D, local.E, local.A, local.B, local.W[3]);
154 P(local.B, local.C, local.D, local.E, local.A, local.W[4]);
155 P(local.A, local.B, local.C, local.D, local.E, local.W[5]);
156 P(local.E, local.A, local.B, local.C, local.D, local.W[6]);
157 P(local.D, local.E, local.A, local.B, local.C, local.W[7]);
158 P(local.C, local.D, local.E, local.A, local.B, local.W[8]);
159 P(local.B, local.C, local.D, local.E, local.A, local.W[9]);
160 P(local.A, local.B, local.C, local.D, local.E, local.W[10]);
161 P(local.E, local.A, local.B, local.C, local.D, local.W[11]);
162 P(local.D, local.E, local.A, local.B, local.C, local.W[12]);
163 P(local.C, local.D, local.E, local.A, local.B, local.W[13]);
164 P(local.B, local.C, local.D, local.E, local.A, local.W[14]);
165 P(local.A, local.B, local.C, local.D, local.E, local.W[15]);
166 P(local.E, local.A, local.B, local.C, local.D, R(16));
167 P(local.D, local.E, local.A, local.B, local.C, R(17));
168 P(local.C, local.D, local.E, local.A, local.B, R(18));
169 P(local.B, local.C, local.D, local.E, local.A, R(19));
170
171#undef K
172#undef F
173
174#define F(x, y, z) ((x) ^ (y) ^ (z))
175#define K 0x6ED9EBA1
176
177 P(local.A, local.B, local.C, local.D, local.E, R(20));
178 P(local.E, local.A, local.B, local.C, local.D, R(21));
179 P(local.D, local.E, local.A, local.B, local.C, R(22));
180 P(local.C, local.D, local.E, local.A, local.B, R(23));
181 P(local.B, local.C, local.D, local.E, local.A, R(24));
182 P(local.A, local.B, local.C, local.D, local.E, R(25));
183 P(local.E, local.A, local.B, local.C, local.D, R(26));
184 P(local.D, local.E, local.A, local.B, local.C, R(27));
185 P(local.C, local.D, local.E, local.A, local.B, R(28));
186 P(local.B, local.C, local.D, local.E, local.A, R(29));
187 P(local.A, local.B, local.C, local.D, local.E, R(30));
188 P(local.E, local.A, local.B, local.C, local.D, R(31));
189 P(local.D, local.E, local.A, local.B, local.C, R(32));
190 P(local.C, local.D, local.E, local.A, local.B, R(33));
191 P(local.B, local.C, local.D, local.E, local.A, R(34));
192 P(local.A, local.B, local.C, local.D, local.E, R(35));
193 P(local.E, local.A, local.B, local.C, local.D, R(36));
194 P(local.D, local.E, local.A, local.B, local.C, R(37));
195 P(local.C, local.D, local.E, local.A, local.B, R(38));
196 P(local.B, local.C, local.D, local.E, local.A, R(39));
197
198#undef K
199#undef F
200
201#define F(x, y, z) (((x) & (y)) | ((z) & ((x) | (y))))
202#define K 0x8F1BBCDC
203
204 P(local.A, local.B, local.C, local.D, local.E, R(40));
205 P(local.E, local.A, local.B, local.C, local.D, R(41));
206 P(local.D, local.E, local.A, local.B, local.C, R(42));
207 P(local.C, local.D, local.E, local.A, local.B, R(43));
208 P(local.B, local.C, local.D, local.E, local.A, R(44));
209 P(local.A, local.B, local.C, local.D, local.E, R(45));
210 P(local.E, local.A, local.B, local.C, local.D, R(46));
211 P(local.D, local.E, local.A, local.B, local.C, R(47));
212 P(local.C, local.D, local.E, local.A, local.B, R(48));
213 P(local.B, local.C, local.D, local.E, local.A, R(49));
214 P(local.A, local.B, local.C, local.D, local.E, R(50));
215 P(local.E, local.A, local.B, local.C, local.D, R(51));
216 P(local.D, local.E, local.A, local.B, local.C, R(52));
217 P(local.C, local.D, local.E, local.A, local.B, R(53));
218 P(local.B, local.C, local.D, local.E, local.A, R(54));
219 P(local.A, local.B, local.C, local.D, local.E, R(55));
220 P(local.E, local.A, local.B, local.C, local.D, R(56));
221 P(local.D, local.E, local.A, local.B, local.C, R(57));
222 P(local.C, local.D, local.E, local.A, local.B, R(58));
223 P(local.B, local.C, local.D, local.E, local.A, R(59));
224
225#undef K
226#undef F
227
228#define F(x, y, z) ((x) ^ (y) ^ (z))
229#define K 0xCA62C1D6
230
231 P(local.A, local.B, local.C, local.D, local.E, R(60));
232 P(local.E, local.A, local.B, local.C, local.D, R(61));
233 P(local.D, local.E, local.A, local.B, local.C, R(62));
234 P(local.C, local.D, local.E, local.A, local.B, R(63));
235 P(local.B, local.C, local.D, local.E, local.A, R(64));
236 P(local.A, local.B, local.C, local.D, local.E, R(65));
237 P(local.E, local.A, local.B, local.C, local.D, R(66));
238 P(local.D, local.E, local.A, local.B, local.C, R(67));
239 P(local.C, local.D, local.E, local.A, local.B, R(68));
240 P(local.B, local.C, local.D, local.E, local.A, R(69));
241 P(local.A, local.B, local.C, local.D, local.E, R(70));
242 P(local.E, local.A, local.B, local.C, local.D, R(71));
243 P(local.D, local.E, local.A, local.B, local.C, R(72));
244 P(local.C, local.D, local.E, local.A, local.B, R(73));
245 P(local.B, local.C, local.D, local.E, local.A, R(74));
246 P(local.A, local.B, local.C, local.D, local.E, R(75));
247 P(local.E, local.A, local.B, local.C, local.D, R(76));
248 P(local.D, local.E, local.A, local.B, local.C, R(77));
249 P(local.C, local.D, local.E, local.A, local.B, R(78));
250 P(local.B, local.C, local.D, local.E, local.A, R(79));
251
252#undef K
253#undef F
254
255 ctx->state[0] += local.A;
256 ctx->state[1] += local.B;
257 ctx->state[2] += local.C;
258 ctx->state[3] += local.D;
259 ctx->state[4] += local.E;
260
261 /* Zeroise buffers and variables to clear sensitive data from memory. */
262 mbedtls_platform_zeroize(&local, sizeof(local));
263
264 return 0;
265}
266
267#if !defined(MBEDTLS_DEPRECATED_REMOVED)
268void mbedtls_sha1_process(mbedtls_sha1_context *ctx,
269 const unsigned char data[64])
270{
271 mbedtls_internal_sha1_process(ctx, data);
272}
273#endif
274#endif /* !MBEDTLS_SHA1_PROCESS_ALT */
275
276/*
277 * SHA-1 process buffer
278 */
279int mbedtls_sha1_update_ret(mbedtls_sha1_context *ctx,
280 const unsigned char *input,
281 size_t ilen)
282{
283 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
284 size_t fill;
285 uint32_t left;
286
287 SHA1_VALIDATE_RET(ctx != NULL);
288 SHA1_VALIDATE_RET(ilen == 0 || input != NULL);
289
290 if (ilen == 0) {
291 return 0;
292 }
293
294 left = ctx->total[0] & 0x3F;
295 fill = 64 - left;
296
297 ctx->total[0] += (uint32_t) ilen;
298 ctx->total[0] &= 0xFFFFFFFF;
299
300 if (ctx->total[0] < (uint32_t) ilen) {
301 ctx->total[1]++;
302 }
303
304 if (left && ilen >= fill) {
305 memcpy((void *) (ctx->buffer + left), input, fill);
306
307 if ((ret = mbedtls_internal_sha1_process(ctx, ctx->buffer)) != 0) {
308 return ret;
309 }
310
311 input += fill;
312 ilen -= fill;
313 left = 0;
314 }
315
316 while (ilen >= 64) {
317 if ((ret = mbedtls_internal_sha1_process(ctx, input)) != 0) {
318 return ret;
319 }
320
321 input += 64;
322 ilen -= 64;
323 }
324
325 if (ilen > 0) {
326 memcpy((void *) (ctx->buffer + left), input, ilen);
327 }
328
329 return 0;
330}
331
332#if !defined(MBEDTLS_DEPRECATED_REMOVED)
333void mbedtls_sha1_update(mbedtls_sha1_context *ctx,
334 const unsigned char *input,
335 size_t ilen)
336{
337 mbedtls_sha1_update_ret(ctx, input, ilen);
338}
339#endif
340
341/*
342 * SHA-1 final digest
343 */
344int mbedtls_sha1_finish_ret(mbedtls_sha1_context *ctx,
345 unsigned char output[20])
346{
347 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
348 uint32_t used;
349 uint32_t high, low;
350
351 SHA1_VALIDATE_RET(ctx != NULL);
352 SHA1_VALIDATE_RET((unsigned char *) output != NULL);
353
354 /*
355 * Add padding: 0x80 then 0x00 until 8 bytes remain for the length
356 */
357 used = ctx->total[0] & 0x3F;
358
359 ctx->buffer[used++] = 0x80;
360
361 if (used <= 56) {
362 /* Enough room for padding + length in current block */
363 memset(ctx->buffer + used, 0, 56 - used);
364 } else {
365 /* We'll need an extra block */
366 memset(ctx->buffer + used, 0, 64 - used);
367
368 if ((ret = mbedtls_internal_sha1_process(ctx, ctx->buffer)) != 0) {
369 return ret;
370 }
371
372 memset(ctx->buffer, 0, 56);
373 }
374
375 /*
376 * Add message length
377 */
378 high = (ctx->total[0] >> 29)
379 | (ctx->total[1] << 3);
380 low = (ctx->total[0] << 3);
381
382 MBEDTLS_PUT_UINT32_BE(high, ctx->buffer, 56);
383 MBEDTLS_PUT_UINT32_BE(low, ctx->buffer, 60);
384
385 if ((ret = mbedtls_internal_sha1_process(ctx, ctx->buffer)) != 0) {
386 return ret;
387 }
388
389 /*
390 * Output final state
391 */
392 MBEDTLS_PUT_UINT32_BE(ctx->state[0], output, 0);
393 MBEDTLS_PUT_UINT32_BE(ctx->state[1], output, 4);
394 MBEDTLS_PUT_UINT32_BE(ctx->state[2], output, 8);
395 MBEDTLS_PUT_UINT32_BE(ctx->state[3], output, 12);
396 MBEDTLS_PUT_UINT32_BE(ctx->state[4], output, 16);
397
398 return 0;
399}
400
401#if !defined(MBEDTLS_DEPRECATED_REMOVED)
402void mbedtls_sha1_finish(mbedtls_sha1_context *ctx,
403 unsigned char output[20])
404{
405 mbedtls_sha1_finish_ret(ctx, output);
406}
407#endif
408
409#endif /* !MBEDTLS_SHA1_ALT */
410
411/*
412 * output = SHA-1( input buffer )
413 */
414int mbedtls_sha1_ret(const unsigned char *input,
415 size_t ilen,
416 unsigned char output[20])
417{
418 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
419 mbedtls_sha1_context ctx;
420
421 SHA1_VALIDATE_RET(ilen == 0 || input != NULL);
422 SHA1_VALIDATE_RET((unsigned char *) output != NULL);
423
424 mbedtls_sha1_init(&ctx);
425
426 if ((ret = mbedtls_sha1_starts_ret(&ctx)) != 0) {
427 goto exit;
428 }
429
430 if ((ret = mbedtls_sha1_update_ret(&ctx, input, ilen)) != 0) {
431 goto exit;
432 }
433
434 if ((ret = mbedtls_sha1_finish_ret(&ctx, output)) != 0) {
435 goto exit;
436 }
437
438exit:
439 mbedtls_sha1_free(&ctx);
440
441 return ret;
442}
443
444#if !defined(MBEDTLS_DEPRECATED_REMOVED)
445void mbedtls_sha1(const unsigned char *input,
446 size_t ilen,
447 unsigned char output[20])
448{
449 mbedtls_sha1_ret(input, ilen, output);
450}
451#endif
452
453#if defined(MBEDTLS_SELF_TEST)
454/*
455 * FIPS-180-1 test vectors
456 */
457static const unsigned char sha1_test_buf[3][57] =
458{
459 { "abc" },
460 { "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" },
461 { "" }
462};
463
464static const size_t sha1_test_buflen[3] =
465{
466 3, 56, 1000
467};
468
469static const unsigned char sha1_test_sum[3][20] =
470{
471 { 0xA9, 0x99, 0x3E, 0x36, 0x47, 0x06, 0x81, 0x6A, 0xBA, 0x3E,
472 0x25, 0x71, 0x78, 0x50, 0xC2, 0x6C, 0x9C, 0xD0, 0xD8, 0x9D },
473 { 0x84, 0x98, 0x3E, 0x44, 0x1C, 0x3B, 0xD2, 0x6E, 0xBA, 0xAE,
474 0x4A, 0xA1, 0xF9, 0x51, 0x29, 0xE5, 0xE5, 0x46, 0x70, 0xF1 },
475 { 0x34, 0xAA, 0x97, 0x3C, 0xD4, 0xC4, 0xDA, 0xA4, 0xF6, 0x1E,
476 0xEB, 0x2B, 0xDB, 0xAD, 0x27, 0x31, 0x65, 0x34, 0x01, 0x6F }
477};
478
479/*
480 * Checkup routine
481 */
482int mbedtls_sha1_self_test(int verbose)
483{
484 int i, j, buflen, ret = 0;
485 unsigned char buf[1024];
486 unsigned char sha1sum[20];
487 mbedtls_sha1_context ctx;
488
489 mbedtls_sha1_init(&ctx);
490
491 /*
492 * SHA-1
493 */
494 for (i = 0; i < 3; i++) {
495 if (verbose != 0) {
496 mbedtls_printf(" SHA-1 test #%d: ", i + 1);
497 }
498
499 if ((ret = mbedtls_sha1_starts_ret(&ctx)) != 0) {
500 goto fail;
501 }
502
503 if (i == 2) {
504 memset(buf, 'a', buflen = 1000);
505
506 for (j = 0; j < 1000; j++) {
507 ret = mbedtls_sha1_update_ret(&ctx, buf, buflen);
508 if (ret != 0) {
509 goto fail;
510 }
511 }
512 } else {
513 ret = mbedtls_sha1_update_ret(&ctx, sha1_test_buf[i],
514 sha1_test_buflen[i]);
515 if (ret != 0) {
516 goto fail;
517 }
518 }
519
520 if ((ret = mbedtls_sha1_finish_ret(&ctx, sha1sum)) != 0) {
521 goto fail;
522 }
523
524 if (memcmp(sha1sum, sha1_test_sum[i], 20) != 0) {
525 ret = 1;
526 goto fail;
527 }
528
529 if (verbose != 0) {
530 mbedtls_printf("passed\n");
531 }
532 }
533
534 if (verbose != 0) {
535 mbedtls_printf("\n");
536 }
537
538 goto exit;
539
540fail:
541 if (verbose != 0) {
542 mbedtls_printf("failed\n");
543 }
544
545exit:
546 mbedtls_sha1_free(&ctx);
547
548 return ret;
549}
550
551#endif /* MBEDTLS_SELF_TEST */
552
553#endif /* MBEDTLS_SHA1_C */
554