1 /* 2 * SHA1 hash implementation and interface functions 3 * Copyright (c) 2003-2005, Jouni Malinen <j (at) w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 17 #include "common.h" 18 #include "sha1.h" 19 #include "md5.h" 20 #include "crypto.h" 21 22 23 /** 24 * hmac_sha1_vector - HMAC-SHA1 over data vector (RFC 2104) 25 * @key: Key for HMAC operations 26 * @key_len: Length of the key in bytes 27 * @num_elem: Number of elements in the data vector 28 * @addr: Pointers to the data areas 29 * @len: Lengths of the data blocks 30 * @mac: Buffer for the hash (20 bytes) 31 */ 32 void hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem, 33 const u8 *addr[], const size_t *len, u8 *mac) 34 { 35 unsigned char k_pad[64]; /* padding - key XORd with ipad/opad */ 36 unsigned char tk[20]; 37 const u8 *_addr[6]; 38 size_t _len[6], i; 39 40 if (num_elem > 5) { 41 /* 42 * Fixed limit on the number of fragments to avoid having to 43 * allocate memory (which could fail). 44 */ 45 return; 46 } 47 48 /* if key is longer than 64 bytes reset it to key = SHA1(key) */ 49 if (key_len > 64) { 50 sha1_vector(1, &key, &key_len, tk); 51 key = tk; 52 key_len = 20; 53 } 54 55 /* the HMAC_SHA1 transform looks like: 56 * 57 * SHA1(K XOR opad, SHA1(K XOR ipad, text)) 58 * 59 * where K is an n byte key 60 * ipad is the byte 0x36 repeated 64 times 61 * opad is the byte 0x5c repeated 64 times 62 * and text is the data being protected */ 63 64 /* start out by storing key in ipad */ 65 os_memset(k_pad, 0, sizeof(k_pad)); 66 os_memcpy(k_pad, key, key_len); 67 /* XOR key with ipad values */ 68 for (i = 0; i < 64; i++) 69 k_pad[i] ^= 0x36; 70 71 /* perform inner SHA1 */ 72 _addr[0] = k_pad; 73 _len[0] = 64; 74 for (i = 0; i < num_elem; i++) { 75 _addr[i + 1] = addr[i]; 76 _len[i + 1] = len[i]; 77 } 78 sha1_vector(1 + num_elem, _addr, _len, mac); 79 80 os_memset(k_pad, 0, sizeof(k_pad)); 81 os_memcpy(k_pad, key, key_len); 82 /* XOR key with opad values */ 83 for (i = 0; i < 64; i++) 84 k_pad[i] ^= 0x5c; 85 86 /* perform outer SHA1 */ 87 _addr[0] = k_pad; 88 _len[0] = 64; 89 _addr[1] = mac; 90 _len[1] = SHA1_MAC_LEN; 91 sha1_vector(2, _addr, _len, mac); 92 } 93 94 95 /** 96 * hmac_sha1 - HMAC-SHA1 over data buffer (RFC 2104) 97 * @key: Key for HMAC operations 98 * @key_len: Length of the key in bytes 99 * @data: Pointers to the data area 100 * @data_len: Length of the data area 101 * @mac: Buffer for the hash (20 bytes) 102 */ 103 void hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len, 104 u8 *mac) 105 { 106 hmac_sha1_vector(key, key_len, 1, &data, &data_len, mac); 107 } 108 109 110 /** 111 * sha1_prf - SHA1-based Pseudo-Random Function (PRF) (IEEE 802.11i, 8.5.1.1) 112 * @key: Key for PRF 113 * @key_len: Length of the key in bytes 114 * @label: A unique label for each purpose of the PRF 115 * @data: Extra data to bind into the key 116 * @data_len: Length of the data 117 * @buf: Buffer for the generated pseudo-random key 118 * @buf_len: Number of bytes of key to generate 119 * 120 * This function is used to derive new, cryptographically separate keys from a 121 * given key (e.g., PMK in IEEE 802.11i). 122 */ 123 void sha1_prf(const u8 *key, size_t key_len, const char *label, 124 const u8 *data, size_t data_len, u8 *buf, size_t buf_len) 125 { 126 u8 zero = 0, counter = 0; 127 size_t pos, plen; 128 u8 hash[SHA1_MAC_LEN]; 129 size_t label_len = os_strlen(label); 130 const unsigned char *addr[4]; 131 size_t len[4]; 132 133 addr[0] = (u8 *) label; 134 len[0] = label_len; 135 addr[1] = &zero; 136 len[1] = 1; 137 addr[2] = data; 138 len[2] = data_len; 139 addr[3] = &counter; 140 len[3] = 1; 141 142 pos = 0; 143 while (pos < buf_len) { 144 plen = buf_len - pos; 145 if (plen >= SHA1_MAC_LEN) { 146 hmac_sha1_vector(key, key_len, 4, addr, len, 147 &buf[pos]); 148 pos += SHA1_MAC_LEN; 149 } else { 150 hmac_sha1_vector(key, key_len, 4, addr, len, 151 hash); 152 os_memcpy(&buf[pos], hash, plen); 153 break; 154 } 155 counter++; 156 } 157 } 158 159 160 /** 161 * sha1_t_prf - EAP-FAST Pseudo-Random Function (T-PRF) 162 * @key: Key for PRF 163 * @key_len: Length of the key in bytes 164 * @label: A unique label for each purpose of the PRF 165 * @seed: Seed value to bind into the key 166 * @seed_len: Length of the seed 167 * @buf: Buffer for the generated pseudo-random key 168 * @buf_len: Number of bytes of key to generate 169 * 170 * This function is used to derive new, cryptographically separate keys from a 171 * given key for EAP-FAST. T-PRF is defined in 172 * draft-cam-winget-eap-fast-02.txt, Appendix B. 173 */ 174 void sha1_t_prf(const u8 *key, size_t key_len, const char *label, 175 const u8 *seed, size_t seed_len, u8 *buf, size_t buf_len) 176 { 177 unsigned char counter = 0; 178 size_t pos, plen; 179 u8 hash[SHA1_MAC_LEN]; 180 size_t label_len = os_strlen(label); 181 u8 output_len[2]; 182 const unsigned char *addr[5]; 183 size_t len[5]; 184 185 addr[0] = hash; 186 len[0] = 0; 187 addr[1] = (unsigned char *) label; 188 len[1] = label_len + 1; 189 addr[2] = seed; 190 len[2] = seed_len; 191 addr[3] = output_len; 192 len[3] = 2; 193 addr[4] = &counter; 194 len[4] = 1; 195 196 output_len[0] = (buf_len >> 8) & 0xff; 197 output_len[1] = buf_len & 0xff; 198 pos = 0; 199 while (pos < buf_len) { 200 counter++; 201 plen = buf_len - pos; 202 hmac_sha1_vector(key, key_len, 5, addr, len, hash); 203 if (plen >= SHA1_MAC_LEN) { 204 os_memcpy(&buf[pos], hash, SHA1_MAC_LEN); 205 pos += SHA1_MAC_LEN; 206 } else { 207 os_memcpy(&buf[pos], hash, plen); 208 break; 209 } 210 len[0] = SHA1_MAC_LEN; 211 } 212 } 213 214 215 /** 216 * tls_prf - Pseudo-Random Function for TLS (TLS-PRF, RFC 2246) 217 * @secret: Key for PRF 218 * @secret_len: Length of the key in bytes 219 * @label: A unique label for each purpose of the PRF 220 * @seed: Seed value to bind into the key 221 * @seed_len: Length of the seed 222 * @out: Buffer for the generated pseudo-random key 223 * @outlen: Number of bytes of key to generate 224 * Returns: 0 on success, -1 on failure. 225 * 226 * This function is used to derive new, cryptographically separate keys from a 227 * given key in TLS. This PRF is defined in RFC 2246, Chapter 5. 228 */ 229 int tls_prf(const u8 *secret, size_t secret_len, const char *label, 230 const u8 *seed, size_t seed_len, u8 *out, size_t outlen) 231 { 232 size_t L_S1, L_S2, i; 233 const u8 *S1, *S2; 234 u8 A_MD5[MD5_MAC_LEN], A_SHA1[SHA1_MAC_LEN]; 235 u8 P_MD5[MD5_MAC_LEN], P_SHA1[SHA1_MAC_LEN]; 236 int MD5_pos, SHA1_pos; 237 const u8 *MD5_addr[3]; 238 size_t MD5_len[3]; 239 const unsigned char *SHA1_addr[3]; 240 size_t SHA1_len[3]; 241 242 if (secret_len & 1) 243 return -1; 244 245 MD5_addr[0] = A_MD5; 246 MD5_len[0] = MD5_MAC_LEN; 247 MD5_addr[1] = (unsigned char *) label; 248 MD5_len[1] = os_strlen(label); 249 MD5_addr[2] = seed; 250 MD5_len[2] = seed_len; 251 252 SHA1_addr[0] = A_SHA1; 253 SHA1_len[0] = SHA1_MAC_LEN; 254 SHA1_addr[1] = (unsigned char *) label; 255 SHA1_len[1] = os_strlen(label); 256 SHA1_addr[2] = seed; 257 SHA1_len[2] = seed_len; 258 259 /* RFC 2246, Chapter 5 260 * A(0) = seed, A(i) = HMAC(secret, A(i-1)) 261 * P_hash = HMAC(secret, A(1) + seed) + HMAC(secret, A(2) + seed) + .. 262 * PRF = P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed) 263 */ 264 265 L_S1 = L_S2 = (secret_len + 1) / 2; 266 S1 = secret; 267 S2 = secret + L_S1; 268 if (secret_len & 1) { 269 /* The last byte of S1 will be shared with S2 */ 270 S2--; 271 } 272 273 hmac_md5_vector(S1, L_S1, 2, &MD5_addr[1], &MD5_len[1], A_MD5); 274 hmac_sha1_vector(S2, L_S2, 2, &SHA1_addr[1], &SHA1_len[1], A_SHA1); 275 276 MD5_pos = MD5_MAC_LEN; 277 SHA1_pos = SHA1_MAC_LEN; 278 for (i = 0; i < outlen; i++) { 279 if (MD5_pos == MD5_MAC_LEN) { 280 hmac_md5_vector(S1, L_S1, 3, MD5_addr, MD5_len, P_MD5); 281 MD5_pos = 0; 282 hmac_md5(S1, L_S1, A_MD5, MD5_MAC_LEN, A_MD5); 283 } 284 if (SHA1_pos == SHA1_MAC_LEN) { 285 hmac_sha1_vector(S2, L_S2, 3, SHA1_addr, SHA1_len, 286 P_SHA1); 287 SHA1_pos = 0; 288 hmac_sha1(S2, L_S2, A_SHA1, SHA1_MAC_LEN, A_SHA1); 289 } 290 291 out[i] = P_MD5[MD5_pos] ^ P_SHA1[SHA1_pos]; 292 293 MD5_pos++; 294 SHA1_pos++; 295 } 296 297 return 0; 298 } 299 300 301 static void pbkdf2_sha1_f(const char *passphrase, const char *ssid, 302 size_t ssid_len, int iterations, unsigned int count, 303 u8 *digest) 304 { 305 unsigned char tmp[SHA1_MAC_LEN], tmp2[SHA1_MAC_LEN]; 306 int i, j; 307 unsigned char count_buf[4]; 308 const u8 *addr[2]; 309 size_t len[2]; 310 size_t passphrase_len = os_strlen(passphrase); 311 312 addr[0] = (u8 *) ssid; 313 len[0] = ssid_len; 314 addr[1] = count_buf; 315 len[1] = 4; 316 317 /* F(P, S, c, i) = U1 xor U2 xor ... Uc 318 * U1 = PRF(P, S || i) 319 * U2 = PRF(P, U1) 320 * Uc = PRF(P, Uc-1) 321 */ 322 323 count_buf[0] = (count >> 24) & 0xff; 324 count_buf[1] = (count >> 16) & 0xff; 325 count_buf[2] = (count >> 8) & 0xff; 326 count_buf[3] = count & 0xff; 327 hmac_sha1_vector((u8 *) passphrase, passphrase_len, 2, addr, len, tmp); 328 os_memcpy(digest, tmp, SHA1_MAC_LEN); 329 330 for (i = 1; i < iterations; i++) { 331 hmac_sha1((u8 *) passphrase, passphrase_len, tmp, SHA1_MAC_LEN, 332 tmp2); 333 os_memcpy(tmp, tmp2, SHA1_MAC_LEN); 334 for (j = 0; j < SHA1_MAC_LEN; j++) 335 digest[j] ^= tmp2[j]; 336 } 337 } 338 339 340 /** 341 * pbkdf2_sha1 - SHA1-based key derivation function (PBKDF2) for IEEE 802.11i 342 * @passphrase: ASCII passphrase 343 * @ssid: SSID 344 * @ssid_len: SSID length in bytes 345 * @interations: Number of iterations to run 346 * @buf: Buffer for the generated key 347 * @buflen: Length of the buffer in bytes 348 * 349 * This function is used to derive PSK for WPA-PSK. For this protocol, 350 * iterations is set to 4096 and buflen to 32. This function is described in 351 * IEEE Std 802.11-2004, Clause H.4. The main construction is from PKCS#5 v2.0. 352 */ 353 void pbkdf2_sha1(const char *passphrase, const char *ssid, size_t ssid_len, 354 int iterations, u8 *buf, size_t buflen) 355 { 356 unsigned int count = 0; 357 unsigned char *pos = buf; 358 size_t left = buflen, plen; 359 unsigned char digest[SHA1_MAC_LEN]; 360 361 while (left > 0) { 362 count++; 363 pbkdf2_sha1_f(passphrase, ssid, ssid_len, iterations, count, 364 digest); 365 plen = left > SHA1_MAC_LEN ? SHA1_MAC_LEN : left; 366 os_memcpy(pos, digest, plen); 367 pos += plen; 368 left -= plen; 369 } 370 } 371 372 373 #ifdef INTERNAL_SHA1 374 375 struct SHA1Context { 376 u32 state[5]; 377 u32 count[2]; 378 unsigned char buffer[64]; 379 }; 380 381 typedef struct SHA1Context SHA1_CTX; 382 383 #ifndef CONFIG_CRYPTO_INTERNAL 384 static void SHA1Init(struct SHA1Context *context); 385 static void SHA1Update(struct SHA1Context *context, const void *data, u32 len); 386 static void SHA1Final(unsigned char digest[20], struct SHA1Context *context); 387 #endif /* CONFIG_CRYPTO_INTERNAL */ 388 static void SHA1Transform(u32 state[5], const unsigned char buffer[64]); 389 390 391 /** 392 * sha1_vector - SHA-1 hash for data vector 393 * @num_elem: Number of elements in the data vector 394 * @addr: Pointers to the data areas 395 * @len: Lengths of the data blocks 396 * @mac: Buffer for the hash 397 */ 398 void sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, 399 u8 *mac) 400 { 401 SHA1_CTX ctx; 402 size_t i; 403 404 SHA1Init(&ctx); 405 for (i = 0; i < num_elem; i++) 406 SHA1Update(&ctx, addr[i], len[i]); 407 SHA1Final(mac, &ctx); 408 } 409 410 411 int fips186_2_prf(const u8 *seed, size_t seed_len, u8 *x, size_t xlen) 412 { 413 u8 xkey[64]; 414 u32 t[5], _t[5]; 415 int i, j, m, k; 416 u8 *xpos = x; 417 u32 carry; 418 419 if (seed_len > sizeof(xkey)) 420 seed_len = sizeof(xkey); 421 422 /* FIPS 186-2 + change notice 1 */ 423 424 os_memcpy(xkey, seed, seed_len); 425 os_memset(xkey + seed_len, 0, 64 - seed_len); 426 t[0] = 0x67452301; 427 t[1] = 0xEFCDAB89; 428 t[2] = 0x98BADCFE; 429 t[3] = 0x10325476; 430 t[4] = 0xC3D2E1F0; 431 432 m = xlen / 40; 433 for (j = 0; j < m; j++) { 434 /* XSEED_j = 0 */ 435 for (i = 0; i < 2; i++) { 436 /* XVAL = (XKEY + XSEED_j) mod 2^b */ 437 438 /* w_i = G(t, XVAL) */ 439 os_memcpy(_t, t, 20); 440 SHA1Transform(_t, xkey); 441 _t[0] = host_to_be32(_t[0]); 442 _t[1] = host_to_be32(_t[1]); 443 _t[2] = host_to_be32(_t[2]); 444 _t[3] = host_to_be32(_t[3]); 445 _t[4] = host_to_be32(_t[4]); 446 os_memcpy(xpos, _t, 20); 447 448 /* XKEY = (1 + XKEY + w_i) mod 2^b */ 449 carry = 1; 450 for (k = 19; k >= 0; k--) { 451 carry += xkey[k] + xpos[k]; 452 xkey[k] = carry & 0xff; 453 carry >>= 8; 454 } 455 456 xpos += SHA1_MAC_LEN; 457 } 458 /* x_j = w_0|w_1 */ 459 } 460 461 return 0; 462 } 463 464 465 /* ===== start - public domain SHA1 implementation ===== */ 466 467 /* 468 SHA-1 in C 469 By Steve Reid <sreid (at) sea-to-sky.net> 470 100% Public Domain 471 472 ----------------- 473 Modified 7/98 474 By James H. Brown <jbrown (at) burgoyne.com> 475 Still 100% Public Domain 476 477 Corrected a problem which generated improper hash values on 16 bit machines 478 Routine SHA1Update changed from 479 void SHA1Update(SHA1_CTX* context, unsigned char* data, unsigned int 480 len) 481 to 482 void SHA1Update(SHA1_CTX* context, unsigned char* data, unsigned 483 long len) 484 485 The 'len' parameter was declared an int which works fine on 32 bit machines. 486 However, on 16 bit machines an int is too small for the shifts being done 487 against 488 it. This caused the hash function to generate incorrect values if len was 489 greater than 8191 (8K - 1) due to the 'len << 3' on line 3 of SHA1Update(). 490 491 Since the file IO in main() reads 16K at a time, any file 8K or larger would 492 be guaranteed to generate the wrong hash (e.g. Test Vector #3, a million 493 "a"s). 494 495 I also changed the declaration of variables i & j in SHA1Update to 496 unsigned long from unsigned int for the same reason. 497 498 These changes should make no difference to any 32 bit implementations since 499 an 500 int and a long are the same size in those environments. 501 502 -- 503 I also corrected a few compiler warnings generated by Borland C. 504 1. Added #include <process.h> for exit() prototype 505 2. Removed unused variable 'j' in SHA1Final 506 3. Changed exit(0) to return(0) at end of main. 507 508 ALL changes I made can be located by searching for comments containing 'JHB' 509 ----------------- 510 Modified 8/98 511 By Steve Reid <sreid (at) sea-to-sky.net> 512 Still 100% public domain 513 514 1- Removed #include <process.h> and used return() instead of exit() 515 2- Fixed overwriting of finalcount in SHA1Final() (discovered by Chris Hall) 516 3- Changed email address from steve (at) edmweb.com to sreid (at) sea-to-sky.net 517 518 ----------------- 519 Modified 4/01 520 By Saul Kravitz <Saul.Kravitz (at) celera.com> 521 Still 100% PD 522 Modified to run on Compaq Alpha hardware. 523 524 ----------------- 525 Modified 4/01 526 By Jouni Malinen <j (at) w1.fi> 527 Minor changes to match the coding style used in Dynamics. 528 529 Modified September 24, 2004 530 By Jouni Malinen <j (at) w1.fi> 531 Fixed alignment issue in SHA1Transform when SHA1HANDSOFF is defined. 532 533 */ 534 535 /* 536 Test Vectors (from FIPS PUB 180-1) 537 "abc" 538 A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D 539 "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" 540 84983E44 1C3BD26E BAAE4AA1 F95129E5 E54670F1 541 A million repetitions of "a" 542 34AA973C D4C4DAA4 F61EEB2B DBAD2731 6534016F 543 */ 544 545 #define SHA1HANDSOFF 546 547 #define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits)))) 548 549 /* blk0() and blk() perform the initial expand. */ 550 /* I got the idea of expanding during the round function from SSLeay */ 551 #ifndef WORDS_BIGENDIAN 552 #define blk0(i) (block->l[i] = (rol(block->l[i], 24) & 0xFF00FF00) | \ 553 (rol(block->l[i], 8) & 0x00FF00FF)) 554 #else 555 #define blk0(i) block->l[i] 556 #endif 557 #define blk(i) (block->l[i & 15] = rol(block->l[(i + 13) & 15] ^ \ 558 block->l[(i + 8) & 15] ^ block->l[(i + 2) & 15] ^ block->l[i & 15], 1)) 559 560 /* (R0+R1), R2, R3, R4 are the different operations used in SHA1 */ 561 #define R0(v,w,x,y,z,i) \ 562 z += ((w & (x ^ y)) ^ y) + blk0(i) + 0x5A827999 + rol(v, 5); \ 563 w = rol(w, 30); 564 #define R1(v,w,x,y,z,i) \ 565 z += ((w & (x ^ y)) ^ y) + blk(i) + 0x5A827999 + rol(v, 5); \ 566 w = rol(w, 30); 567 #define R2(v,w,x,y,z,i) \ 568 z += (w ^ x ^ y) + blk(i) + 0x6ED9EBA1 + rol(v, 5); w = rol(w, 30); 569 #define R3(v,w,x,y,z,i) \ 570 z += (((w | x) & y) | (w & x)) + blk(i) + 0x8F1BBCDC + rol(v, 5); \ 571 w = rol(w, 30); 572 #define R4(v,w,x,y,z,i) \ 573 z += (w ^ x ^ y) + blk(i) + 0xCA62C1D6 + rol(v, 5); \ 574 w=rol(w, 30); 575 576 577 #ifdef VERBOSE /* SAK */ 578 void SHAPrintContext(SHA1_CTX *context, char *msg) 579 { 580 printf("%s (%d,%d) %x %x %x %x %x\n", 581 msg, 582 context->count[0], context->count[1], 583 context->state[0], 584 context->state[1], 585 context->state[2], 586 context->state[3], 587 context->state[4]); 588 } 589 #endif 590 591 /* Hash a single 512-bit block. This is the core of the algorithm. */ 592 593 static void SHA1Transform(u32 state[5], const unsigned char buffer[64]) 594 { 595 u32 a, b, c, d, e; 596 typedef union { 597 unsigned char c[64]; 598 u32 l[16]; 599 } CHAR64LONG16; 600 CHAR64LONG16* block; 601 #ifdef SHA1HANDSOFF 602 u32 workspace[16]; 603 block = (CHAR64LONG16 *) workspace; 604 os_memcpy(block, buffer, 64); 605 #else 606 block = (CHAR64LONG16 *) buffer; 607 #endif 608 /* Copy context->state[] to working vars */ 609 a = state[0]; 610 b = state[1]; 611 c = state[2]; 612 d = state[3]; 613 e = state[4]; 614 /* 4 rounds of 20 operations each. Loop unrolled. */ 615 R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3); 616 R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7); 617 R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11); 618 R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15); 619 R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19); 620 R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23); 621 R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27); 622 R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31); 623 R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35); 624 R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39); 625 R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43); 626 R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47); 627 R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51); 628 R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55); 629 R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59); 630 R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63); 631 R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67); 632 R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71); 633 R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75); 634 R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79); 635 /* Add the working vars back into context.state[] */ 636 state[0] += a; 637 state[1] += b; 638 state[2] += c; 639 state[3] += d; 640 state[4] += e; 641 /* Wipe variables */ 642 a = b = c = d = e = 0; 643 #ifdef SHA1HANDSOFF 644 os_memset(block, 0, 64); 645 #endif 646 } 647 648 649 /* SHA1Init - Initialize new context */ 650 651 void SHA1Init(SHA1_CTX* context) 652 { 653 /* SHA1 initialization constants */ 654 context->state[0] = 0x67452301; 655 context->state[1] = 0xEFCDAB89; 656 context->state[2] = 0x98BADCFE; 657 context->state[3] = 0x10325476; 658 context->state[4] = 0xC3D2E1F0; 659 context->count[0] = context->count[1] = 0; 660 } 661 662 663 /* Run your data through this. */ 664 665 void SHA1Update(SHA1_CTX* context, const void *_data, u32 len) 666 { 667 u32 i, j; 668 const unsigned char *data = _data; 669 670 #ifdef VERBOSE 671 SHAPrintContext(context, "before"); 672 #endif 673 j = (context->count[0] >> 3) & 63; 674 if ((context->count[0] += len << 3) < (len << 3)) 675 context->count[1]++; 676 context->count[1] += (len >> 29); 677 if ((j + len) > 63) { 678 os_memcpy(&context->buffer[j], data, (i = 64-j)); 679 SHA1Transform(context->state, context->buffer); 680 for ( ; i + 63 < len; i += 64) { 681 SHA1Transform(context->state, &data[i]); 682 } 683 j = 0; 684 } 685 else i = 0; 686 os_memcpy(&context->buffer[j], &data[i], len - i); 687 #ifdef VERBOSE 688 SHAPrintContext(context, "after "); 689 #endif 690 } 691 692 693 /* Add padding and return the message digest. */ 694 695 void SHA1Final(unsigned char digest[20], SHA1_CTX* context) 696 { 697 u32 i; 698 unsigned char finalcount[8]; 699 700 for (i = 0; i < 8; i++) { 701 finalcount[i] = (unsigned char) 702 ((context->count[(i >= 4 ? 0 : 1)] >> 703 ((3-(i & 3)) * 8) ) & 255); /* Endian independent */ 704 } 705 SHA1Update(context, (unsigned char *) "\200", 1); 706 while ((context->count[0] & 504) != 448) { 707 SHA1Update(context, (unsigned char *) "\0", 1); 708 } 709 SHA1Update(context, finalcount, 8); /* Should cause a SHA1Transform() 710 */ 711 for (i = 0; i < 20; i++) { 712 digest[i] = (unsigned char) 713 ((context->state[i >> 2] >> ((3 - (i & 3)) * 8)) & 714 255); 715 } 716 /* Wipe variables */ 717 i = 0; 718 os_memset(context->buffer, 0, 64); 719 os_memset(context->state, 0, 20); 720 os_memset(context->count, 0, 8); 721 os_memset(finalcount, 0, 8); 722 } 723 724 /* ===== end - public domain SHA1 implementation ===== */ 725 726 #endif /* INTERNAL_SHA1 */ 727
