sha1.c
Go to the documentation of this file.
1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2  * All rights reserved.
3  *
4  * This package is an SSL implementation written
5  * by Eric Young (eay@cryptsoft.com).
6  * The implementation was written so as to conform with Netscapes SSL.
7  *
8  * This library is free for commercial and non-commercial use as long as
9  * the following conditions are aheared to. The following conditions
10  * apply to all code found in this distribution, be it the RC4, RSA,
11  * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12  * included with this distribution is covered by the same copyright terms
13  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14  *
15  * Copyright remains Eric Young's, and as such any Copyright notices in
16  * the code are not to be removed.
17  * If this package is used in a product, Eric Young should be given attribution
18  * as the author of the parts of the library used.
19  * This can be in the form of a textual message at program startup or
20  * in documentation (online or textual) provided with the package.
21  *
22  * Redistribution and use in source and binary forms, with or without
23  * modification, are permitted provided that the following conditions
24  * are met:
25  * 1. Redistributions of source code must retain the copyright
26  * notice, this list of conditions and the following disclaimer.
27  * 2. Redistributions in binary form must reproduce the above copyright
28  * notice, this list of conditions and the following disclaimer in the
29  * documentation and/or other materials provided with the distribution.
30  * 3. All advertising materials mentioning features or use of this software
31  * must display the following acknowledgement:
32  * "This product includes cryptographic software written by
33  * Eric Young (eay@cryptsoft.com)"
34  * The word 'cryptographic' can be left out if the rouines from the library
35  * being used are not cryptographic related :-).
36  * 4. If you include any Windows specific code (or a derivative thereof) from
37  * the apps directory (application code) you must include an acknowledgement:
38  * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39  *
40  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50  * SUCH DAMAGE.
51  *
52  * The licence and distribution terms for any publically available version or
53  * derivative of this code cannot be changed. i.e. this code cannot simply be
54  * copied and put under another distribution licence
55  * [including the GNU Public Licence.] */
56 
57 #include <openssl/sha.h>
58 
59 #include <string.h>
60 
61 #include <openssl/mem.h>
62 
63 #include "../../internal.h"
64 #include "../digest/md32_common.h"
65 #include "internal.h"
66 
67 
68 int SHA1_Init(SHA_CTX *sha) {
69  OPENSSL_memset(sha, 0, sizeof(SHA_CTX));
70  sha->h[0] = 0x67452301UL;
71  sha->h[1] = 0xefcdab89UL;
72  sha->h[2] = 0x98badcfeUL;
73  sha->h[3] = 0x10325476UL;
74  sha->h[4] = 0xc3d2e1f0UL;
75  return 1;
76 }
77 
78 uint8_t *SHA1(const uint8_t *data, size_t len, uint8_t out[SHA_DIGEST_LENGTH]) {
79  SHA_CTX ctx;
80  SHA1_Init(&ctx);
81  SHA1_Update(&ctx, data, len);
82  SHA1_Final(out, &ctx);
83  OPENSSL_cleanse(&ctx, sizeof(ctx));
84  return out;
85 }
86 
87 #if !defined(SHA1_ASM)
88 static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
89  size_t num);
90 #endif
91 
92 void SHA1_Transform(SHA_CTX *c, const uint8_t data[SHA_CBLOCK]) {
93  sha1_block_data_order(c->h, data, 1);
94 }
95 
96 int SHA1_Update(SHA_CTX *c, const void *data, size_t len) {
97  crypto_md32_update(&sha1_block_data_order, c->h, c->data, SHA_CBLOCK, &c->num,
98  &c->Nh, &c->Nl, data, len);
99  return 1;
100 }
101 
102 int SHA1_Final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c) {
103  crypto_md32_final(&sha1_block_data_order, c->h, c->data, SHA_CBLOCK, &c->num,
104  c->Nh, c->Nl, /*is_big_endian=*/1);
105 
106  CRYPTO_store_u32_be(out, c->h[0]);
107  CRYPTO_store_u32_be(out + 4, c->h[1]);
108  CRYPTO_store_u32_be(out + 8, c->h[2]);
109  CRYPTO_store_u32_be(out + 12, c->h[3]);
110  CRYPTO_store_u32_be(out + 16, c->h[4]);
111  return 1;
112 }
113 
114 #define Xupdate(a, ix, ia, ib, ic, id) \
115  do { \
116  (a) = ((ia) ^ (ib) ^ (ic) ^ (id)); \
117  (ix) = (a) = CRYPTO_rotl_u32((a), 1); \
118  } while (0)
119 
120 #define K_00_19 0x5a827999UL
121 #define K_20_39 0x6ed9eba1UL
122 #define K_40_59 0x8f1bbcdcUL
123 #define K_60_79 0xca62c1d6UL
124 
125 // As pointed out by Wei Dai <weidai@eskimo.com>, F() below can be simplified
126 // to the code in F_00_19. Wei attributes these optimisations to Peter
127 // Gutmann's SHS code, and he attributes it to Rich Schroeppel. #define
128 // F(x,y,z) (((x) & (y)) | ((~(x)) & (z))) I've just become aware of another
129 // tweak to be made, again from Wei Dai, in F_40_59, (x&a)|(y&a) -> (x|y)&a
130 #define F_00_19(b, c, d) ((((c) ^ (d)) & (b)) ^ (d))
131 #define F_20_39(b, c, d) ((b) ^ (c) ^ (d))
132 #define F_40_59(b, c, d) (((b) & (c)) | (((b) | (c)) & (d)))
133 #define F_60_79(b, c, d) F_20_39(b, c, d)
134 
135 #define BODY_00_15(i, a, b, c, d, e, f, xi) \
136  do { \
137  (f) = (xi) + (e) + K_00_19 + CRYPTO_rotl_u32((a), 5) + \
138  F_00_19((b), (c), (d)); \
139  (b) = CRYPTO_rotl_u32((b), 30); \
140  } while (0)
141 
142 #define BODY_16_19(i, a, b, c, d, e, f, xi, xa, xb, xc, xd) \
143  do { \
144  Xupdate(f, xi, xa, xb, xc, xd); \
145  (f) += (e) + K_00_19 + CRYPTO_rotl_u32((a), 5) + F_00_19((b), (c), (d)); \
146  (b) = CRYPTO_rotl_u32((b), 30); \
147  } while (0)
148 
149 #define BODY_20_31(i, a, b, c, d, e, f, xi, xa, xb, xc, xd) \
150  do { \
151  Xupdate(f, xi, xa, xb, xc, xd); \
152  (f) += (e) + K_20_39 + CRYPTO_rotl_u32((a), 5) + F_20_39((b), (c), (d)); \
153  (b) = CRYPTO_rotl_u32((b), 30); \
154  } while (0)
155 
156 #define BODY_32_39(i, a, b, c, d, e, f, xa, xb, xc, xd) \
157  do { \
158  Xupdate(f, xa, xa, xb, xc, xd); \
159  (f) += (e) + K_20_39 + CRYPTO_rotl_u32((a), 5) + F_20_39((b), (c), (d)); \
160  (b) = CRYPTO_rotl_u32((b), 30); \
161  } while (0)
162 
163 #define BODY_40_59(i, a, b, c, d, e, f, xa, xb, xc, xd) \
164  do { \
165  Xupdate(f, xa, xa, xb, xc, xd); \
166  (f) += (e) + K_40_59 + CRYPTO_rotl_u32((a), 5) + F_40_59((b), (c), (d)); \
167  (b) = CRYPTO_rotl_u32((b), 30); \
168  } while (0)
169 
170 #define BODY_60_79(i, a, b, c, d, e, f, xa, xb, xc, xd) \
171  do { \
172  Xupdate(f, xa, xa, xb, xc, xd); \
173  (f) = (xa) + (e) + K_60_79 + CRYPTO_rotl_u32((a), 5) + \
174  F_60_79((b), (c), (d)); \
175  (b) = CRYPTO_rotl_u32((b), 30); \
176  } while (0)
177 
178 #ifdef X
179 #undef X
180 #endif
181 
182 /* Originally X was an array. As it's automatic it's natural
183 * to expect RISC compiler to accomodate at least part of it in
184 * the register bank, isn't it? Unfortunately not all compilers
185 * "find" this expectation reasonable:-( On order to make such
186 * compilers generate better code I replace X[] with a bunch of
187 * X0, X1, etc. See the function body below...
188 * <appro@fy.chalmers.se> */
189 #define X(i) XX##i
190 
191 #if !defined(SHA1_ASM)
192 static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
193  size_t num) {
194  register uint32_t A, B, C, D, E, T;
195  uint32_t XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10,
196  XX11, XX12, XX13, XX14, XX15;
197 
198  A = state[0];
199  B = state[1];
200  C = state[2];
201  D = state[3];
202  E = state[4];
203 
204  for (;;) {
205  X(0) = CRYPTO_load_u32_be(data);
206  data += 4;
207  X(1) = CRYPTO_load_u32_be(data);
208  data += 4;
209  BODY_00_15(0, A, B, C, D, E, T, X(0));
210  X(2) = CRYPTO_load_u32_be(data);
211  data += 4;
212  BODY_00_15(1, T, A, B, C, D, E, X(1));
213  X(3) = CRYPTO_load_u32_be(data);
214  data += 4;
215  BODY_00_15(2, E, T, A, B, C, D, X(2));
216  X(4) = CRYPTO_load_u32_be(data);
217  data += 4;
218  BODY_00_15(3, D, E, T, A, B, C, X(3));
219  X(5) = CRYPTO_load_u32_be(data);
220  data += 4;
221  BODY_00_15(4, C, D, E, T, A, B, X(4));
222  X(6) = CRYPTO_load_u32_be(data);
223  data += 4;
224  BODY_00_15(5, B, C, D, E, T, A, X(5));
225  X(7) = CRYPTO_load_u32_be(data);
226  data += 4;
227  BODY_00_15(6, A, B, C, D, E, T, X(6));
228  X(8) = CRYPTO_load_u32_be(data);
229  data += 4;
230  BODY_00_15(7, T, A, B, C, D, E, X(7));
231  X(9) = CRYPTO_load_u32_be(data);
232  data += 4;
233  BODY_00_15(8, E, T, A, B, C, D, X(8));
234  X(10) = CRYPTO_load_u32_be(data);
235  data += 4;
236  BODY_00_15(9, D, E, T, A, B, C, X(9));
237  X(11) = CRYPTO_load_u32_be(data);
238  data += 4;
239  BODY_00_15(10, C, D, E, T, A, B, X(10));
240  X(12) = CRYPTO_load_u32_be(data);
241  data += 4;
242  BODY_00_15(11, B, C, D, E, T, A, X(11));
243  X(13) = CRYPTO_load_u32_be(data);
244  data += 4;
245  BODY_00_15(12, A, B, C, D, E, T, X(12));
246  X(14) = CRYPTO_load_u32_be(data);
247  data += 4;
248  BODY_00_15(13, T, A, B, C, D, E, X(13));
249  X(15) = CRYPTO_load_u32_be(data);
250  data += 4;
251  BODY_00_15(14, E, T, A, B, C, D, X(14));
252  BODY_00_15(15, D, E, T, A, B, C, X(15));
253 
254  BODY_16_19(16, C, D, E, T, A, B, X(0), X(0), X(2), X(8), X(13));
255  BODY_16_19(17, B, C, D, E, T, A, X(1), X(1), X(3), X(9), X(14));
256  BODY_16_19(18, A, B, C, D, E, T, X(2), X(2), X(4), X(10), X(15));
257  BODY_16_19(19, T, A, B, C, D, E, X(3), X(3), X(5), X(11), X(0));
258 
259  BODY_20_31(20, E, T, A, B, C, D, X(4), X(4), X(6), X(12), X(1));
260  BODY_20_31(21, D, E, T, A, B, C, X(5), X(5), X(7), X(13), X(2));
261  BODY_20_31(22, C, D, E, T, A, B, X(6), X(6), X(8), X(14), X(3));
262  BODY_20_31(23, B, C, D, E, T, A, X(7), X(7), X(9), X(15), X(4));
263  BODY_20_31(24, A, B, C, D, E, T, X(8), X(8), X(10), X(0), X(5));
264  BODY_20_31(25, T, A, B, C, D, E, X(9), X(9), X(11), X(1), X(6));
265  BODY_20_31(26, E, T, A, B, C, D, X(10), X(10), X(12), X(2), X(7));
266  BODY_20_31(27, D, E, T, A, B, C, X(11), X(11), X(13), X(3), X(8));
267  BODY_20_31(28, C, D, E, T, A, B, X(12), X(12), X(14), X(4), X(9));
268  BODY_20_31(29, B, C, D, E, T, A, X(13), X(13), X(15), X(5), X(10));
269  BODY_20_31(30, A, B, C, D, E, T, X(14), X(14), X(0), X(6), X(11));
270  BODY_20_31(31, T, A, B, C, D, E, X(15), X(15), X(1), X(7), X(12));
271 
272  BODY_32_39(32, E, T, A, B, C, D, X(0), X(2), X(8), X(13));
273  BODY_32_39(33, D, E, T, A, B, C, X(1), X(3), X(9), X(14));
274  BODY_32_39(34, C, D, E, T, A, B, X(2), X(4), X(10), X(15));
275  BODY_32_39(35, B, C, D, E, T, A, X(3), X(5), X(11), X(0));
276  BODY_32_39(36, A, B, C, D, E, T, X(4), X(6), X(12), X(1));
277  BODY_32_39(37, T, A, B, C, D, E, X(5), X(7), X(13), X(2));
278  BODY_32_39(38, E, T, A, B, C, D, X(6), X(8), X(14), X(3));
279  BODY_32_39(39, D, E, T, A, B, C, X(7), X(9), X(15), X(4));
280 
281  BODY_40_59(40, C, D, E, T, A, B, X(8), X(10), X(0), X(5));
282  BODY_40_59(41, B, C, D, E, T, A, X(9), X(11), X(1), X(6));
283  BODY_40_59(42, A, B, C, D, E, T, X(10), X(12), X(2), X(7));
284  BODY_40_59(43, T, A, B, C, D, E, X(11), X(13), X(3), X(8));
285  BODY_40_59(44, E, T, A, B, C, D, X(12), X(14), X(4), X(9));
286  BODY_40_59(45, D, E, T, A, B, C, X(13), X(15), X(5), X(10));
287  BODY_40_59(46, C, D, E, T, A, B, X(14), X(0), X(6), X(11));
288  BODY_40_59(47, B, C, D, E, T, A, X(15), X(1), X(7), X(12));
289  BODY_40_59(48, A, B, C, D, E, T, X(0), X(2), X(8), X(13));
290  BODY_40_59(49, T, A, B, C, D, E, X(1), X(3), X(9), X(14));
291  BODY_40_59(50, E, T, A, B, C, D, X(2), X(4), X(10), X(15));
292  BODY_40_59(51, D, E, T, A, B, C, X(3), X(5), X(11), X(0));
293  BODY_40_59(52, C, D, E, T, A, B, X(4), X(6), X(12), X(1));
294  BODY_40_59(53, B, C, D, E, T, A, X(5), X(7), X(13), X(2));
295  BODY_40_59(54, A, B, C, D, E, T, X(6), X(8), X(14), X(3));
296  BODY_40_59(55, T, A, B, C, D, E, X(7), X(9), X(15), X(4));
297  BODY_40_59(56, E, T, A, B, C, D, X(8), X(10), X(0), X(5));
298  BODY_40_59(57, D, E, T, A, B, C, X(9), X(11), X(1), X(6));
299  BODY_40_59(58, C, D, E, T, A, B, X(10), X(12), X(2), X(7));
300  BODY_40_59(59, B, C, D, E, T, A, X(11), X(13), X(3), X(8));
301 
302  BODY_60_79(60, A, B, C, D, E, T, X(12), X(14), X(4), X(9));
303  BODY_60_79(61, T, A, B, C, D, E, X(13), X(15), X(5), X(10));
304  BODY_60_79(62, E, T, A, B, C, D, X(14), X(0), X(6), X(11));
305  BODY_60_79(63, D, E, T, A, B, C, X(15), X(1), X(7), X(12));
306  BODY_60_79(64, C, D, E, T, A, B, X(0), X(2), X(8), X(13));
307  BODY_60_79(65, B, C, D, E, T, A, X(1), X(3), X(9), X(14));
308  BODY_60_79(66, A, B, C, D, E, T, X(2), X(4), X(10), X(15));
309  BODY_60_79(67, T, A, B, C, D, E, X(3), X(5), X(11), X(0));
310  BODY_60_79(68, E, T, A, B, C, D, X(4), X(6), X(12), X(1));
311  BODY_60_79(69, D, E, T, A, B, C, X(5), X(7), X(13), X(2));
312  BODY_60_79(70, C, D, E, T, A, B, X(6), X(8), X(14), X(3));
313  BODY_60_79(71, B, C, D, E, T, A, X(7), X(9), X(15), X(4));
314  BODY_60_79(72, A, B, C, D, E, T, X(8), X(10), X(0), X(5));
315  BODY_60_79(73, T, A, B, C, D, E, X(9), X(11), X(1), X(6));
316  BODY_60_79(74, E, T, A, B, C, D, X(10), X(12), X(2), X(7));
317  BODY_60_79(75, D, E, T, A, B, C, X(11), X(13), X(3), X(8));
318  BODY_60_79(76, C, D, E, T, A, B, X(12), X(14), X(4), X(9));
319  BODY_60_79(77, B, C, D, E, T, A, X(13), X(15), X(5), X(10));
320  BODY_60_79(78, A, B, C, D, E, T, X(14), X(0), X(6), X(11));
321  BODY_60_79(79, T, A, B, C, D, E, X(15), X(1), X(7), X(12));
322 
323  state[0] = (state[0] + E) & 0xffffffffL;
324  state[1] = (state[1] + T) & 0xffffffffL;
325  state[2] = (state[2] + A) & 0xffffffffL;
326  state[3] = (state[3] + B) & 0xffffffffL;
327  state[4] = (state[4] + C) & 0xffffffffL;
328 
329  if (--num == 0) {
330  break;
331  }
332 
333  A = state[0];
334  B = state[1];
335  C = state[2];
336  D = state[3];
337  E = state[4];
338  }
339 }
340 #endif
341 
342 #undef Xupdate
343 #undef K_00_19
344 #undef K_20_39
345 #undef K_40_59
346 #undef K_60_79
347 #undef F_00_19
348 #undef F_20_39
349 #undef F_40_59
350 #undef F_60_79
351 #undef BODY_00_15
352 #undef BODY_16_19
353 #undef BODY_20_31
354 #undef BODY_32_39
355 #undef BODY_40_59
356 #undef BODY_60_79
357 #undef X
BODY_00_15
#define BODY_00_15(i, a, b, c, d, e, f, xi)
Definition: sha1.c:135
gen_build_yaml.out
dictionary out
Definition: src/benchmark/gen_build_yaml.py:24
SHA_CBLOCK
#define SHA_CBLOCK
Definition: sha.h:71
ctx
Definition: benchmark-async.c:30
OPENSSL_cleanse
#define OPENSSL_cleanse
Definition: boringssl_prefix_symbols.h:1864
sha_state_st::h
uint32_t h[5]
Definition: sha.h:106
SHA1_Transform
void SHA1_Transform(SHA_CTX *c, const uint8_t data[SHA_CBLOCK])
Definition: sha1.c:92
C
#define C(x)
Definition: abseil-cpp/absl/hash/internal/city_test.cc:49
internal.h
SHA1_Init
int SHA1_Init(SHA_CTX *sha)
Definition: sha1.c:68
string.h
ctx
static struct test_ctx ctx
Definition: test-ipc-send-recv.c:65
uint8_t
unsigned char uint8_t
Definition: stdint-msvc2008.h:78
OPENSSL_memset
static void * OPENSSL_memset(void *dst, int c, size_t n)
Definition: third_party/boringssl-with-bazel/src/crypto/internal.h:835
T
#define T(upbtypeconst, upbtype, ctype, default_value)
SHA1_Final
int SHA1_Final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c)
Definition: sha1.c:102
SHA1
uint8_t * SHA1(const uint8_t *data, size_t len, uint8_t out[SHA_DIGEST_LENGTH])
Definition: sha1.c:78
uint32_t
unsigned int uint32_t
Definition: stdint-msvc2008.h:80
crypto_md32_update
static void crypto_md32_update(crypto_md32_block_func block_func, uint32_t *h, uint8_t *data, size_t block_size, unsigned *num, uint32_t *Nh, uint32_t *Nl, const uint8_t *in, size_t len)
Definition: md32_common.h:98
c
void c(T a)
Definition: miscompile_with_no_unique_address_test.cc:40
CRYPTO_store_u32_be
static void CRYPTO_store_u32_be(void *out, uint32_t v)
Definition: third_party/boringssl-with-bazel/src/crypto/internal.h:866
sha_state_st
Definition: sha.h:99
sha.h
X
#define X(i)
Definition: sha1.c:189
A
#define A(T)
BODY_16_19
#define BODY_16_19(i, a, b, c, d, e, f, xi, xa, xb, xc, xd)
Definition: sha1.c:142
BODY_32_39
#define BODY_32_39(i, a, b, c, d, e, f, xa, xb, xc, xd)
Definition: sha1.c:156
data
char data[kBufferLength]
Definition: abseil-cpp/absl/strings/internal/str_format/float_conversion.cc:1006
CRYPTO_load_u32_be
static uint32_t CRYPTO_load_u32_be(const void *in)
Definition: third_party/boringssl-with-bazel/src/crypto/internal.h:860
BODY_20_31
#define BODY_20_31(i, a, b, c, d, e, f, xi, xa, xb, xc, xd)
Definition: sha1.c:149
SHA1_Update
int SHA1_Update(SHA_CTX *c, const void *data, size_t len)
Definition: sha1.c:96
sha1_block_data_order
static void sha1_block_data_order(uint32_t *state, const uint8_t *data, size_t num)
Definition: sha1.c:192
A
Definition: miscompile_with_no_unique_address_test.cc:23
xds_manager.num
num
Definition: xds_manager.py:56
state
Definition: bloaty/third_party/zlib/contrib/blast/blast.c:41
SHA_DIGEST_LENGTH
#define SHA_DIGEST_LENGTH
Definition: sha.h:74
mem.h
len
int len
Definition: abseil-cpp/absl/base/internal/low_level_alloc_test.cc:46
crypto_md32_final
static void crypto_md32_final(crypto_md32_block_func block_func, uint32_t *h, uint8_t *data, size_t block_size, unsigned *num, uint32_t Nh, uint32_t Nl, int is_big_endian)
Definition: md32_common.h:157
BODY_60_79
#define BODY_60_79(i, a, b, c, d, e, f, xa, xb, xc, xd)
Definition: sha1.c:170
BODY_40_59
#define BODY_40_59(i, a, b, c, d, e, f, xa, xb, xc, xd)
Definition: sha1.c:163

grpc
Author(s):
autogenerated on Fri May 16 2025 03:00:12