SHA2.cpp 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264
  1. /*
  2. * Copyright (c) 2020, Ali Mohammad Pur <ali.mpfard@gmail.com>
  3. * All rights reserved.
  4. *
  5. * Redistribution and use in source and binary forms, with or without
  6. * modification, are permitted provided that the following conditions are met:
  7. *
  8. * 1. Redistributions of source code must retain the above copyright notice, this
  9. * list of conditions and the following disclaimer.
  10. *
  11. * 2. Redistributions in binary form must reproduce the above copyright notice,
  12. * this list of conditions and the following disclaimer in the documentation
  13. * and/or other materials provided with the distribution.
  14. *
  15. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  16. * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  18. * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  19. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  21. * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  22. * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  23. * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  24. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25. */
  26. #include <AK/Types.h>
  27. #include <LibCrypto/Hash/SHA2.h>
  28. namespace Crypto {
  29. namespace Hash {
  30. constexpr inline static auto ROTRIGHT(u32 a, size_t b) { return (a >> b) | (a << (32 - b)); }
  31. constexpr inline static auto CH(u32 x, u32 y, u32 z) { return (x & y) ^ (z & ~x); }
  32. constexpr inline static auto MAJ(u32 x, u32 y, u32 z) { return (x & y) ^ (x & z) ^ (y & z); }
  33. constexpr inline static auto EP0(u32 x) { return ROTRIGHT(x, 2) ^ ROTRIGHT(x, 13) ^ ROTRIGHT(x, 22); }
  34. constexpr inline static auto EP1(u32 x) { return ROTRIGHT(x, 6) ^ ROTRIGHT(x, 11) ^ ROTRIGHT(x, 25); }
  35. constexpr inline static auto SIGN0(u32 x) { return ROTRIGHT(x, 7) ^ ROTRIGHT(x, 18) ^ (x >> 3); }
  36. constexpr inline static auto SIGN1(u32 x) { return ROTRIGHT(x, 17) ^ ROTRIGHT(x, 19) ^ (x >> 10); }
  37. constexpr inline static auto ROTRIGHT(u64 a, size_t b) { return (a >> b) | (a << (64 - b)); }
  38. constexpr inline static auto CH(u64 x, u64 y, u64 z) { return (x & y) ^ (z & ~x); }
  39. constexpr inline static auto MAJ(u64 x, u64 y, u64 z) { return (x & y) ^ (x & z) ^ (y & z); }
  40. constexpr inline static auto EP0(u64 x) { return ROTRIGHT(x, 28) ^ ROTRIGHT(x, 34) ^ ROTRIGHT(x, 39); }
  41. constexpr inline static auto EP1(u64 x) { return ROTRIGHT(x, 14) ^ ROTRIGHT(x, 18) ^ ROTRIGHT(x, 41); }
  42. constexpr inline static auto SIGN0(u64 x) { return ROTRIGHT(x, 1) ^ ROTRIGHT(x, 8) ^ (x >> 7); }
  43. constexpr inline static auto SIGN1(u64 x) { return ROTRIGHT(x, 19) ^ ROTRIGHT(x, 61) ^ (x >> 6); }
  44. inline void SHA256::transform(const u8* data)
  45. {
  46. u32 m[64];
  47. size_t i = 0;
  48. for (size_t j = 0; i < 16; ++i, j += 4) {
  49. m[i] = (data[j] << 24) | (data[j + 1] << 16) | (data[j + 2] << 8) | data[j + 3];
  50. }
  51. for (; i < BlockSize; ++i) {
  52. m[i] = SIGN1(m[i - 2]) + m[i - 7] + SIGN0(m[i - 15]) + m[i - 16];
  53. }
  54. auto a = m_state[0], b = m_state[1],
  55. c = m_state[2], d = m_state[3],
  56. e = m_state[4], f = m_state[5],
  57. g = m_state[6], h = m_state[7];
  58. for (size_t i = 0; i < Rounds; ++i) {
  59. auto temp0 = h + EP1(e) + CH(e, f, g) + SHA256Constants::RoundConstants[i] + m[i];
  60. auto temp1 = EP0(a) + MAJ(a, b, c);
  61. h = g;
  62. g = f;
  63. f = e;
  64. e = d + temp0;
  65. d = c;
  66. c = b;
  67. b = a;
  68. a = temp0 + temp1;
  69. }
  70. m_state[0] += a;
  71. m_state[1] += b;
  72. m_state[2] += c;
  73. m_state[3] += d;
  74. m_state[4] += e;
  75. m_state[5] += f;
  76. m_state[6] += g;
  77. m_state[7] += h;
  78. }
  79. void SHA256::update(const u8* message, size_t length)
  80. {
  81. for (size_t i = 0; i < length; ++i) {
  82. if (m_data_length == BlockSize) {
  83. transform(m_data_buffer);
  84. m_bit_length += 512;
  85. m_data_length = 0;
  86. }
  87. m_data_buffer[m_data_length++] = message[i];
  88. }
  89. }
  90. SHA256::DigestType SHA256::digest()
  91. {
  92. auto digest = peek();
  93. reset();
  94. return digest;
  95. }
  96. SHA256::DigestType SHA256::peek()
  97. {
  98. DigestType digest;
  99. size_t i = m_data_length;
  100. if (m_data_length < FinalBlockDataSize) {
  101. m_data_buffer[i++] = 0x80;
  102. while (i < FinalBlockDataSize)
  103. m_data_buffer[i++] = 0x00;
  104. } else {
  105. m_data_buffer[i++] = 0x80;
  106. while (i < BlockSize)
  107. m_data_buffer[i++] = 0x00;
  108. transform(m_data_buffer);
  109. __builtin_memset(m_data_buffer, 0, FinalBlockDataSize);
  110. }
  111. // append total message length
  112. m_bit_length += m_data_length * 8;
  113. m_data_buffer[BlockSize - 1] = m_bit_length;
  114. m_data_buffer[BlockSize - 2] = m_bit_length >> 8;
  115. m_data_buffer[BlockSize - 3] = m_bit_length >> 16;
  116. m_data_buffer[BlockSize - 4] = m_bit_length >> 24;
  117. m_data_buffer[BlockSize - 5] = m_bit_length >> 32;
  118. m_data_buffer[BlockSize - 6] = m_bit_length >> 40;
  119. m_data_buffer[BlockSize - 7] = m_bit_length >> 48;
  120. m_data_buffer[BlockSize - 8] = m_bit_length >> 56;
  121. transform(m_data_buffer);
  122. // SHA uses big-endian and we assume little-endian
  123. // FIXME: looks like a thing for AK::NetworkOrdered,
  124. // but he doesn't support shifting operations
  125. for (size_t i = 0; i < 4; ++i) {
  126. digest.data[i + 0] = (m_state[0] >> (24 - i * 8)) & 0x000000ff;
  127. digest.data[i + 4] = (m_state[1] >> (24 - i * 8)) & 0x000000ff;
  128. digest.data[i + 8] = (m_state[2] >> (24 - i * 8)) & 0x000000ff;
  129. digest.data[i + 12] = (m_state[3] >> (24 - i * 8)) & 0x000000ff;
  130. digest.data[i + 16] = (m_state[4] >> (24 - i * 8)) & 0x000000ff;
  131. digest.data[i + 20] = (m_state[5] >> (24 - i * 8)) & 0x000000ff;
  132. digest.data[i + 24] = (m_state[6] >> (24 - i * 8)) & 0x000000ff;
  133. digest.data[i + 28] = (m_state[7] >> (24 - i * 8)) & 0x000000ff;
  134. }
  135. return digest;
  136. }
  137. inline void SHA512::transform(const u8* data)
  138. {
  139. u64 m[80];
  140. size_t i = 0;
  141. for (size_t j = 0; i < 16; ++i, j += 8) {
  142. m[i] = ((u64)data[j] << 56) | ((u64)data[j + 1] << 48) | ((u64)data[j + 2] << 40) | ((u64)data[j + 3] << 32) | ((u64)data[j + 4] << 24) | ((u64)data[j + 5] << 16) | ((u64)data[j + 6] << 8) | (u64)data[j + 7];
  143. }
  144. for (; i < Rounds; ++i) {
  145. m[i] = SIGN1(m[i - 2]) + m[i - 7] + SIGN0(m[i - 15]) + m[i - 16];
  146. }
  147. auto a = m_state[0], b = m_state[1],
  148. c = m_state[2], d = m_state[3],
  149. e = m_state[4], f = m_state[5],
  150. g = m_state[6], h = m_state[7];
  151. for (size_t i = 0; i < Rounds; ++i) {
  152. auto temp0 = h + EP1(e) + CH(e, f, g) + SHA512Constants::RoundConstants[i] + m[i];
  153. auto temp1 = EP0(a) + MAJ(a, b, c);
  154. h = g;
  155. g = f;
  156. f = e;
  157. e = d + temp0;
  158. d = c;
  159. c = b;
  160. b = a;
  161. a = temp0 + temp1;
  162. }
  163. m_state[0] += a;
  164. m_state[1] += b;
  165. m_state[2] += c;
  166. m_state[3] += d;
  167. m_state[4] += e;
  168. m_state[5] += f;
  169. m_state[6] += g;
  170. m_state[7] += h;
  171. }
  172. void SHA512::update(const u8* message, size_t length)
  173. {
  174. for (size_t i = 0; i < length; ++i) {
  175. if (m_data_length == BlockSize) {
  176. transform(m_data_buffer);
  177. m_bit_length += 1024;
  178. m_data_length = 0;
  179. }
  180. m_data_buffer[m_data_length++] = message[i];
  181. }
  182. }
  183. SHA512::DigestType SHA512::digest()
  184. {
  185. auto digest = peek();
  186. reset();
  187. return digest;
  188. }
  189. SHA512::DigestType SHA512::peek()
  190. {
  191. DigestType digest;
  192. size_t i = m_data_length;
  193. if (m_data_length < FinalBlockDataSize) {
  194. m_data_buffer[i++] = 0x80;
  195. while (i < FinalBlockDataSize)
  196. m_data_buffer[i++] = 0x00;
  197. } else {
  198. m_data_buffer[i++] = 0x80;
  199. while (i < BlockSize)
  200. m_data_buffer[i++] = 0x00;
  201. transform(m_data_buffer);
  202. __builtin_memset(m_data_buffer, 0, FinalBlockDataSize);
  203. }
  204. // append total message length
  205. m_bit_length += m_data_length * 8;
  206. m_data_buffer[BlockSize - 1] = m_bit_length;
  207. m_data_buffer[BlockSize - 2] = m_bit_length >> 8;
  208. m_data_buffer[BlockSize - 3] = m_bit_length >> 16;
  209. m_data_buffer[BlockSize - 4] = m_bit_length >> 24;
  210. m_data_buffer[BlockSize - 5] = m_bit_length >> 32;
  211. m_data_buffer[BlockSize - 6] = m_bit_length >> 40;
  212. m_data_buffer[BlockSize - 7] = m_bit_length >> 48;
  213. m_data_buffer[BlockSize - 8] = m_bit_length >> 56;
  214. transform(m_data_buffer);
  215. // SHA uses big-endian and we assume little-endian
  216. // FIXME: looks like a thing for AK::NetworkOrdered,
  217. // but he doesn't support shifting operations
  218. for (size_t i = 0; i < 8; ++i) {
  219. digest.data[i + 0] = (m_state[0] >> (56 - i * 8)) & 0x000000ff;
  220. digest.data[i + 8] = (m_state[1] >> (56 - i * 8)) & 0x000000ff;
  221. digest.data[i + 16] = (m_state[2] >> (56 - i * 8)) & 0x000000ff;
  222. digest.data[i + 24] = (m_state[3] >> (56 - i * 8)) & 0x000000ff;
  223. digest.data[i + 32] = (m_state[4] >> (56 - i * 8)) & 0x000000ff;
  224. digest.data[i + 40] = (m_state[5] >> (56 - i * 8)) & 0x000000ff;
  225. digest.data[i + 48] = (m_state[6] >> (56 - i * 8)) & 0x000000ff;
  226. digest.data[i + 56] = (m_state[7] >> (56 - i * 8)) & 0x000000ff;
  227. }
  228. return digest;
  229. }
  230. }
  231. }