Final SHA-256/-512 touches. Extra md_len field in SHA[256|512]_CTX

reserves for truncated hash function output mode and makes SHA224
thread-safe. Next stop is integration with EVP and we're done...

diff --git a/crypto/sha/sha.h b/crypto/sha/sha.h
index f4dd5277c2f78e68dd8f82ad7bdc58965eaaff87..47536d9c4b5fd7b432024e42483c41aa14260738 100644 (file)
--- a/crypto/sha/sha.h
+++ b/crypto/sha/sha.h
@@ -130,18 +130,13 @@ typedef struct SHA256state_st
        SHA_LONG h[8];
        SHA_LONG Nl,Nh;
        SHA_LONG data[SHA_LBLOCK];
-       int num;
+       unsigned int num,md_len;
        } SHA256_CTX;
 
 #ifndef OPENSSL_NO_SHA256
 int SHA224_Init(SHA256_CTX *c);
-#if 0
 int SHA224_Update(SHA256_CTX *c, const void *data, size_t len);
 int SHA224_Final(unsigned char *md, SHA256_CTX *c);
-#else
-#define SHA224_Update(c,data,len)      SHA256_Update((c),(data),(len))
-#define SHA224_Final(md,c)     SHA256_Final((md),(c))
-#endif
 unsigned char *SHA224(const unsigned char *d, size_t n,unsigned char *md);
 int SHA256_Init(SHA256_CTX *c);
 int SHA256_Update(SHA256_CTX *c, const void *data, size_t len);
@@ -177,7 +172,7 @@ typedef struct SHA512state_st
                SHA_LONG64      d[SHA_LBLOCK];
                unsigned char   p[SHA512_CBLOCK];
        } u;
-       int num;
+       unsigned int num,md_len;
        } SHA512_CTX;
 
 #ifndef OPENSSL_NO_SHA512

diff --git a/crypto/sha/sha256.c b/crypto/sha/sha256.c
index f31eb3e7861635b08fd45c097c312135278a07ae..60cb0e68fda6a829bd3f206eaaf909b7f3599402 100644 (file)
--- a/crypto/sha/sha256.c
+++ b/crypto/sha/sha256.c
@@ -20,9 +20,9 @@ int SHA224_Init (SHA256_CTX *c)
        c->h[2]=0x3070dd17UL;   c->h[3]=0xf70e5939UL;
        c->h[4]=0xffc00b31UL;   c->h[5]=0x68581511UL;
        c->h[6]=0x64f98fa7UL;   c->h[7]=0xbefa4fa4UL;
-        c->Nl=0;        c->Nh=0;
-        c->num=0;
-        return 1;
+       c->Nl=0;        c->Nh=0;
+       c->num=0;       c->md_len=SHA224_DIGEST_LENGTH;
+       return 1;
        }
 
 int SHA256_Init (SHA256_CTX *c)
@@ -31,23 +31,20 @@ int SHA256_Init (SHA256_CTX *c)
        c->h[2]=0x3c6ef372UL;   c->h[3]=0xa54ff53aUL;
        c->h[4]=0x510e527fUL;   c->h[5]=0x9b05688cUL;
        c->h[6]=0x1f83d9abUL;   c->h[7]=0x5be0cd19UL;
-        c->Nl=0;        c->Nh=0;
-        c->num=0;
-        return 1;
+       c->Nl=0;        c->Nh=0;
+       c->num=0;       c->md_len=SHA256_DIGEST_LENGTH;
+       return 1;
        }
 
 unsigned char *SHA224(const unsigned char *d, size_t n, unsigned char *md)
        {
        SHA256_CTX c;
-       static unsigned char m[SHA256_DIGEST_LENGTH];
+       static unsigned char m[SHA224_DIGEST_LENGTH];
 
+       if (md == NULL) md=m;
        SHA224_Init(&c);
        SHA256_Update(&c,d,n);
-       SHA256_Final(m,&c);
-       if (md != NULL) memcpy (md,m,SHA224_DIGEST_LENGTH),
-                       memset (m,0,sizeof(m));
-       else            md=m,
-                       memset (m+SHA224_DIGEST_LENGTH,0,sizeof(m)-SHA256_DIGEST_LENGTH);
+       SHA256_Final(md,&c);
        OPENSSL_cleanse(&c,sizeof(c));
        return(md);
        }
@@ -65,6 +62,11 @@ unsigned char *SHA256(const unsigned char *d, size_t n, unsigned char *md)
        return(md);
        }
 
+int SHA224_Update(SHA256_CTX *c, const void *data, size_t len)
+{   return SHA256_Update (c,data,len);   }
+int SHA224_Final (unsigned char *md, SHA256_CTX *c)
+{   return SHA256_Final (md,c);   }
+
 #ifndef        SHA_LONG_LOG2
 #define        SHA_LONG_LOG2   2       /* default to 32 bits */
 #endif
@@ -76,12 +78,33 @@ unsigned char *SHA256(const unsigned char *d, size_t n, unsigned char *md)
 #define        HASH_CTX                SHA256_CTX
 #define        HASH_CBLOCK             SHA_CBLOCK
 #define        HASH_LBLOCK             SHA_LBLOCK
+/*
+ * Note that FIPS180-2 discusses "Truncation of the Hash Function Output."
+ * default: case below covers for it. It's not clear however if it's
+ * permitted to truncate at amount of bits not divisable by 4. I bet not,
+ * but if it is, then default: case shall be extended. For reference.
+ * Idea behind separate cases for pre-defined lenghts is to let the
+ * compiler decide if it's appropriate to unroll small loops.
+ */
 #define        HASH_MAKE_STRING(c,s)   do {    \
        unsigned long ll;               \
-       ll=(c)->h[0]; HOST_l2c(ll,(s)); ll=(c)->h[1]; HOST_l2c(ll,(s)); \
-       ll=(c)->h[2]; HOST_l2c(ll,(s)); ll=(c)->h[3]; HOST_l2c(ll,(s)); \
-       ll=(c)->h[4]; HOST_l2c(ll,(s)); ll=(c)->h[5]; HOST_l2c(ll,(s)); \
-       ll=(c)->h[6]; HOST_l2c(ll,(s)); ll=(c)->h[7]; HOST_l2c(ll,(s)); \
+       unsigned int  n;                \
+       switch ((c)->md_len)            \
+       {   case SHA224_DIGEST_LENGTH:  \
+               for (n=0;n<SHA224_DIGEST_LENGTH/4;n++)  \
+               {   ll=(c)->h[n]; HOST_l2c(ll,(s));   } \
+               break;                  \
+           case SHA256_DIGEST_LENGTH:  \
+               for (n=0;n<SHA256_DIGEST_LENGTH/4;n++)  \
+               {   ll=(c)->h[n]; HOST_l2c(ll,(s));   } \
+               break;                  \
+           default:                    \
+               if ((c)->md_len > SHA256_DIGEST_LENGTH) \
+                   return 0;                           \
+               for (n=0;n<(c)->md_len/4;n++)           \
+               {   ll=(c)->h[n]; HOST_l2c(ll,(s));   } \
+               break;                  \
+       }                               \
        } while (0)
 
 #define        HASH_UPDATE             SHA256_Update

diff --git a/crypto/sha/sha512.c b/crypto/sha/sha512.c
index 0549e6fd6686dc52f4e255d67cba6c6d710d283d..dc1047d59e28784b1b72ed98f2a05ad33abf06a5 100644 (file)
--- a/crypto/sha/sha512.c
+++ b/crypto/sha/sha512.c
@@ -64,7 +64,7 @@ int SHA384_Init (SHA512_CTX *c)
        c->h[6]=U64(0xdb0c2e0d64f98fa7);
        c->h[7]=U64(0x47b5481dbefa4fa4);
         c->Nl=0;        c->Nh=0;
-        c->num=0;
+        c->num=0;       c->md_len=SHA384_DIGEST_LENGTH;
         return 1;
        }
 
@@ -79,18 +79,18 @@ int SHA512_Init (SHA512_CTX *c)
        c->h[6]=U64(0x1f83d9abfb41bd6b);
        c->h[7]=U64(0x5be0cd19137e2179);
         c->Nl=0;        c->Nh=0;
-        c->num=0;
+        c->num=0;       c->md_len=SHA512_DIGEST_LENGTH;
         return 1;
        }
 
 static void sha512_block (SHA512_CTX *ctx, const void *in, size_t num);
 
-static int sha512_final (unsigned char *md, SHA512_CTX *c, size_t msz)
+int SHA512_Final (unsigned char *md, SHA512_CTX *c)
        {
        unsigned char *p=(unsigned char *)c->u.p;
        size_t n=c->num;
 
-       p[n]=0x80;
+       p[n]=0x80;      /* There always is a room for one */
        n++;
        if (n > (sizeof(c->u)-16))
                memset (p+n,0,sizeof(c->u)-n), n=0,
@@ -123,23 +123,40 @@ static int sha512_final (unsigned char *md, SHA512_CTX *c, size_t msz)
 
        if (md==0) return 0;
 
-       for (n=0;msz>0;n++,msz-=8)
+       switch (c->md_len)
                {
-               SHA_LONG64 t = c->h[n];
-
-               *(md++) = (t>>56)&0xFF; *(md++) = (t>>48)&0xFF;
-               *(md++) = (t>>40)&0xFF; *(md++) = (t>>32)&0xFF;
-               *(md++) = (t>>24)&0xFF; *(md++) = (t>>16)&0xFF;
-               *(md++) = (t>>8)&0xFF;  *(md++) = (t)&0xFF;
+               /* Let compiler decide if it's appropriate to unroll... */
+               case SHA384_DIGEST_LENGTH:
+                       for (n=0;n<SHA384_DIGEST_LENGTH/8;n++)
+                               {
+                               SHA_LONG64 t = c->h[n];
+
+                               *(md++) = (t>>56)&0xFF; *(md++) = (t>>48)&0xFF;
+                               *(md++) = (t>>40)&0xFF; *(md++) = (t>>32)&0xFF;
+                               *(md++) = (t>>24)&0xFF; *(md++) = (t>>16)&0xFF;
+                               *(md++) = (t>>8)&0xFF;  *(md++) = (t)&0xFF;
+                               }
+                       break;
+               case SHA512_DIGEST_LENGTH:
+                       for (n=0;n<SHA512_DIGEST_LENGTH/8;n++)
+                               {
+                               SHA_LONG64 t = c->h[n];
+
+                               *(md++) = (t>>56)&0xFF; *(md++) = (t>>48)&0xFF;
+                               *(md++) = (t>>40)&0xFF; *(md++) = (t>>32)&0xFF;
+                               *(md++) = (t>>24)&0xFF; *(md++) = (t>>16)&0xFF;
+                               *(md++) = (t>>8)&0xFF;  *(md++) = (t)&0xFF;
+                               }
+                       break;
+               /* ... as well as make sure md_len is not abused. */
+               default:        return 0;
                }
 
        return 1;
        }
 
 int SHA384_Final (unsigned char *md,SHA512_CTX *c)
-{   return sha512_final (md,c,SHA384_DIGEST_LENGTH);   }
-int SHA512_Final (unsigned char *md,SHA512_CTX *c)
-{   return sha512_final (md,c,SHA512_DIGEST_LENGTH);   }
+{   return SHA512_Final (md,c);   }
 
 int SHA512_Update (SHA512_CTX *c, const void *_data, size_t len)
        {
@@ -206,7 +223,7 @@ unsigned char *SHA384(const unsigned char *d, size_t n, unsigned char *md)
        if (md == NULL) md=m;
        SHA384_Init(&c);
        SHA512_Update(&c,d,n);
-       sha512_final(md,&c,sizeof(m));
+       SHA512_Final(md,&c);
        OPENSSL_cleanse(&c,sizeof(c));
        return(md);
        }
@@ -219,7 +236,7 @@ unsigned char *SHA512(const unsigned char *d, size_t n, unsigned char *md)
        if (md == NULL) md=m;
        SHA512_Init(&c);
        SHA512_Update(&c,d,n);
-       sha512_final(md,&c,sizeof(m));
+       SHA512_Final(md,&c);
        OPENSSL_cleanse(&c,sizeof(c));
        return(md);
        }