9ec363a25d
A lot of internally used crypto headers are publicly includeable in user projects. This leads to bug reports when these headers are incorrectly used or the API's are not used as intended. Move all crypto headers into private crypto src folder, also move crypto_ops into Supplicant to remove dependecy on crypto headers. Closes IDF-476
311 lines
8.2 KiB
C
311 lines
8.2 KiB
C
/*
|
|
* SHA-256 hash implementation and interface functions
|
|
* Copyright (c) 2003-2011, Jouni Malinen <j@w1.fi>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* Alternatively, this software may be distributed under the terms of BSD
|
|
* license.
|
|
*
|
|
* See README and COPYING for more details.
|
|
*/
|
|
/*
|
|
* Hardware crypto support Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#include "utils/includes.h"
|
|
|
|
#include "utils/common.h"
|
|
#ifdef USE_MBEDTLS_CRYPTO
|
|
#include "mbedtls/sha256.h"
|
|
#else /* USE_MBEDTLS_CRYPTO */
|
|
#include "sha256.h"
|
|
#include "crypto.h"
|
|
#endif /* USE_MBEDTLS_CRYPTO */
|
|
|
|
#ifdef USE_MBEDTLS_CRYPTO
|
|
/**
|
|
* sha256_vector - SHA256 hash for data vector
|
|
* @num_elem: Number of elements in the data vector
|
|
* @addr: Pointers to the data areas
|
|
* @len: Lengths of the data blocks
|
|
* @mac: Buffer for the hash
|
|
* Returns: 0 on success, -1 of failure
|
|
*/
|
|
int
|
|
sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len,
|
|
u8 *mac)
|
|
{
|
|
int ret = 0;
|
|
mbedtls_sha256_context ctx;
|
|
|
|
mbedtls_sha256_init(&ctx);
|
|
|
|
if (mbedtls_sha256_starts_ret(&ctx, 0) != 0) {
|
|
ret = -1;
|
|
goto out;
|
|
}
|
|
|
|
for(size_t index = 0; index < num_elem; index++) {
|
|
if (mbedtls_sha256_update_ret(&ctx, addr[index], len[index]) != 0) {
|
|
ret = -1;
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
if (mbedtls_sha256_finish_ret(&ctx, mac) != 0) {
|
|
ret = -1;
|
|
goto out;
|
|
}
|
|
|
|
out:
|
|
mbedtls_sha256_free(&ctx);
|
|
|
|
return ret;
|
|
}
|
|
#else /* USE_MBEDTLS_CRYPTO */
|
|
|
|
#define SHA256_BLOCK_SIZE 64
|
|
|
|
struct sha256_state {
|
|
u64 length;
|
|
u32 state[8], curlen;
|
|
u8 buf[SHA256_BLOCK_SIZE];
|
|
};
|
|
|
|
static void sha256_init(struct sha256_state *md);
|
|
static int sha256_process(struct sha256_state *md, const unsigned char *in,
|
|
unsigned long inlen);
|
|
static int sha256_done(struct sha256_state *md, unsigned char *out);
|
|
|
|
|
|
/**
|
|
* sha256_vector - SHA256 hash for data vector
|
|
* @num_elem: Number of elements in the data vector
|
|
* @addr: Pointers to the data areas
|
|
* @len: Lengths of the data blocks
|
|
* @mac: Buffer for the hash
|
|
* Returns: 0 on success, -1 of failure
|
|
*/
|
|
int
|
|
sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len,
|
|
u8 *mac)
|
|
{
|
|
struct sha256_state ctx;
|
|
size_t i;
|
|
|
|
sha256_init(&ctx);
|
|
for (i = 0; i < num_elem; i++)
|
|
if (sha256_process(&ctx, addr[i], len[i]))
|
|
return -1;
|
|
if (sha256_done(&ctx, mac))
|
|
return -1;
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* ===== start - public domain SHA256 implementation ===== */
|
|
|
|
/* This is based on SHA256 implementation in LibTomCrypt that was released into
|
|
* public domain by Tom St Denis. */
|
|
|
|
/* the K array */
|
|
static const unsigned long K[64] = {
|
|
0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
|
|
0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
|
|
0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
|
|
0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
|
|
0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
|
|
0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
|
|
0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
|
|
0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
|
|
0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
|
|
0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
|
|
0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
|
|
0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
|
|
0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
|
|
};
|
|
|
|
|
|
/* Various logical functions */
|
|
#define RORc(x, y) \
|
|
( ((((unsigned long) (x) & 0xFFFFFFFFUL) >> (unsigned long) ((y) & 31)) | \
|
|
((unsigned long) (x) << (unsigned long) (32 - ((y) & 31)))) & 0xFFFFFFFFUL)
|
|
#define Ch(x,y,z) (z ^ (x & (y ^ z)))
|
|
#define Maj(x,y,z) (((x | y) & z) | (x & y))
|
|
#define S(x, n) RORc((x), (n))
|
|
#define R(x, n) (((x)&0xFFFFFFFFUL)>>(n))
|
|
#define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22))
|
|
#define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25))
|
|
#define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3))
|
|
#define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10))
|
|
#ifndef MIN
|
|
#define MIN(x, y) (((x) < (y)) ? (x) : (y))
|
|
#endif
|
|
|
|
/* compress 512-bits */
|
|
static int
|
|
sha256_compress(struct sha256_state *md, unsigned char *buf)
|
|
{
|
|
u32 S[8], W[64], t0, t1;
|
|
u32 t;
|
|
int i;
|
|
|
|
/* copy state into S */
|
|
for (i = 0; i < 8; i++) {
|
|
S[i] = md->state[i];
|
|
}
|
|
|
|
/* copy the state into 512-bits into W[0..15] */
|
|
for (i = 0; i < 16; i++)
|
|
W[i] = WPA_GET_BE32(buf + (4 * i));
|
|
|
|
/* fill W[16..63] */
|
|
for (i = 16; i < 64; i++) {
|
|
W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) +
|
|
W[i - 16];
|
|
}
|
|
|
|
/* Compress */
|
|
#define RND(a,b,c,d,e,f,g,h,i) \
|
|
t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i]; \
|
|
t1 = Sigma0(a) + Maj(a, b, c); \
|
|
d += t0; \
|
|
h = t0 + t1;
|
|
|
|
for (i = 0; i < 64; ++i) {
|
|
RND(S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i);
|
|
t = S[7]; S[7] = S[6]; S[6] = S[5]; S[5] = S[4];
|
|
S[4] = S[3]; S[3] = S[2]; S[2] = S[1]; S[1] = S[0]; S[0] = t;
|
|
}
|
|
|
|
/* feedback */
|
|
for (i = 0; i < 8; i++) {
|
|
md->state[i] = md->state[i] + S[i];
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* Initialize the hash state */
|
|
static void
|
|
sha256_init(struct sha256_state *md)
|
|
{
|
|
md->curlen = 0;
|
|
md->length = 0;
|
|
md->state[0] = 0x6A09E667UL;
|
|
md->state[1] = 0xBB67AE85UL;
|
|
md->state[2] = 0x3C6EF372UL;
|
|
md->state[3] = 0xA54FF53AUL;
|
|
md->state[4] = 0x510E527FUL;
|
|
md->state[5] = 0x9B05688CUL;
|
|
md->state[6] = 0x1F83D9ABUL;
|
|
md->state[7] = 0x5BE0CD19UL;
|
|
}
|
|
|
|
/**
|
|
Process a block of memory though the hash
|
|
@param md The hash state
|
|
@param in The data to hash
|
|
@param inlen The length of the data (octets)
|
|
@return CRYPT_OK if successful
|
|
*/
|
|
static int
|
|
sha256_process(struct sha256_state *md, const unsigned char *in,
|
|
unsigned long inlen)
|
|
{
|
|
unsigned long n;
|
|
|
|
if (md->curlen >= sizeof(md->buf))
|
|
return -1;
|
|
|
|
while (inlen > 0) {
|
|
if (md->curlen == 0 && inlen >= SHA256_BLOCK_SIZE) {
|
|
if (sha256_compress(md, (unsigned char *) in) < 0)
|
|
return -1;
|
|
md->length += SHA256_BLOCK_SIZE * 8;
|
|
in += SHA256_BLOCK_SIZE;
|
|
inlen -= SHA256_BLOCK_SIZE;
|
|
} else {
|
|
n = MIN(inlen, (SHA256_BLOCK_SIZE - md->curlen));
|
|
os_memcpy(md->buf + md->curlen, in, n);
|
|
md->curlen += n;
|
|
in += n;
|
|
inlen -= n;
|
|
if (md->curlen == SHA256_BLOCK_SIZE) {
|
|
if (sha256_compress(md, md->buf) < 0)
|
|
return -1;
|
|
md->length += 8 * SHA256_BLOCK_SIZE;
|
|
md->curlen = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/**
|
|
Terminate the hash to get the digest
|
|
@param md The hash state
|
|
@param out [out] The destination of the hash (32 bytes)
|
|
@return CRYPT_OK if successful
|
|
*/
|
|
static int
|
|
sha256_done(struct sha256_state *md, unsigned char *out)
|
|
{
|
|
int i;
|
|
|
|
if (md->curlen >= sizeof(md->buf))
|
|
return -1;
|
|
|
|
/* increase the length of the message */
|
|
md->length += md->curlen * 8;
|
|
|
|
/* append the '1' bit */
|
|
md->buf[md->curlen++] = (unsigned char) 0x80;
|
|
|
|
/* if the length is currently above 56 bytes we append zeros
|
|
* then compress. Then we can fall back to padding zeros and length
|
|
* encoding like normal.
|
|
*/
|
|
if (md->curlen > 56) {
|
|
while (md->curlen < SHA256_BLOCK_SIZE) {
|
|
md->buf[md->curlen++] = (unsigned char) 0;
|
|
}
|
|
sha256_compress(md, md->buf);
|
|
md->curlen = 0;
|
|
}
|
|
|
|
/* pad up to 56 bytes of zeroes */
|
|
while (md->curlen < 56) {
|
|
md->buf[md->curlen++] = (unsigned char) 0;
|
|
}
|
|
|
|
/* store length */
|
|
WPA_PUT_BE64(md->buf + 56, md->length);
|
|
sha256_compress(md, md->buf);
|
|
|
|
/* copy output */
|
|
for (i = 0; i < 8; i++)
|
|
WPA_PUT_BE32(out + (4 * i), md->state[i]);
|
|
|
|
return 0;
|
|
}
|
|
#endif /* USE_MBEDTLS_CRYPTO */
|
|
|
|
/* ===== end - public domain SHA256 implementation ===== */
|