|
| 1 | +// Written for Graviola by Joe Birr-Pixton, 2025. |
| 2 | +// Based on 2014 version written for cifra. |
| 3 | +// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0 |
| 4 | + |
| 5 | +//! The SHA1 hash function. |
| 6 | +//! |
| 7 | +//! Do not use SHA1 for new applications or for applications involving signatures. |
| 8 | +//! |
| 9 | +//! This is described in [FIPS180-1](https://nvlpubs.nist.gov/nistpubs/Legacy/FIPS/fipspub180-1.pdf). |
| 10 | +
|
| 11 | +use crate::low::Blockwise; |
| 12 | + |
| 13 | +/// A context for incremental computation of SHA1. |
| 14 | +#[derive(Clone)] |
| 15 | +pub struct Sha1Context { |
| 16 | + h: [u32; 5], |
| 17 | + blockwise: Blockwise<{ Self::BLOCK_SZ }>, |
| 18 | + nblocks: usize, |
| 19 | +} |
| 20 | + |
| 21 | +impl Sha1Context { |
| 22 | + /// Start a new SHA1 hash computation. |
| 23 | + pub const fn new() -> Self { |
| 24 | + Self { |
| 25 | + h: [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0], |
| 26 | + blockwise: Blockwise::new(), |
| 27 | + nblocks: 0, |
| 28 | + } |
| 29 | + } |
| 30 | + |
| 31 | + /// Add `bytes` to the ongoing hash computation. |
| 32 | + pub fn update(&mut self, bytes: &[u8]) { |
| 33 | + if self.blockwise.used() == 0 && bytes.len().is_multiple_of(Self::BLOCK_SZ) { |
| 34 | + self.update_blocks(bytes); |
| 35 | + return; |
| 36 | + } |
| 37 | + |
| 38 | + let bytes = self.blockwise.add_leading(bytes); |
| 39 | + |
| 40 | + if let Some(block) = self.blockwise.take() { |
| 41 | + self.update_blocks(&block); |
| 42 | + } |
| 43 | + |
| 44 | + let (whole_blocks, remainder) = { |
| 45 | + let whole_len = bytes.len() - (bytes.len() & (Self::BLOCK_SZ - 1)); |
| 46 | + (&bytes[..whole_len], &bytes[whole_len..]) |
| 47 | + }; |
| 48 | + |
| 49 | + self.update_blocks(whole_blocks); |
| 50 | + |
| 51 | + self.blockwise.add_trailing(remainder); |
| 52 | + } |
| 53 | + |
| 54 | + /// Complete the SHA1 computation, returning the hash output. |
| 55 | + pub fn finish(mut self) -> [u8; Self::OUTPUT_SZ] { |
| 56 | + let bytes = self |
| 57 | + .nblocks |
| 58 | + .checked_mul(Self::BLOCK_SZ) |
| 59 | + .and_then(|bytes| bytes.checked_add(self.blockwise.used())) |
| 60 | + .unwrap(); |
| 61 | + |
| 62 | + let bits = bytes |
| 63 | + .checked_mul(8) |
| 64 | + .expect("excess data processed by hash function"); |
| 65 | + |
| 66 | + let last_blocks = self |
| 67 | + .blockwise |
| 68 | + .md_pad_with_length(&(bits as u64).to_be_bytes()); |
| 69 | + self.update_blocks(last_blocks.as_ref()); |
| 70 | + |
| 71 | + let mut r = [0u8; Self::OUTPUT_SZ]; |
| 72 | + for (out, state) in r.chunks_exact_mut(4).zip(self.h.iter()) { |
| 73 | + out.copy_from_slice(&state.to_be_bytes()); |
| 74 | + } |
| 75 | + r |
| 76 | + } |
| 77 | + |
| 78 | + fn update_blocks(&mut self, blocks: &[u8]) { |
| 79 | + debug_assert!(blocks.len().is_multiple_of(Self::BLOCK_SZ)); |
| 80 | + if !blocks.is_empty() { |
| 81 | + sha1_compress_blocks(&mut self.h, blocks); |
| 82 | + self.nblocks = self.nblocks.saturating_add(blocks.len() / Self::BLOCK_SZ); |
| 83 | + } |
| 84 | + } |
| 85 | + |
| 86 | + /// The internal block size of SHA1. |
| 87 | + pub const BLOCK_SZ: usize = 64; |
| 88 | + |
| 89 | + /// The output size of SHA1. |
| 90 | + pub const OUTPUT_SZ: usize = 20; |
| 91 | +} |
| 92 | + |
| 93 | +fn sha1_compress_block(state: &mut [u32; 5], block: &[u8]) { |
| 94 | + let mut a = state[0]; |
| 95 | + let mut b = state[1]; |
| 96 | + let mut c = state[2]; |
| 97 | + let mut d = state[3]; |
| 98 | + let mut e = state[4]; |
| 99 | + |
| 100 | + // This is a 16-word window into the whole W array. |
| 101 | + let mut w: [u32; 16] = [0; 16]; |
| 102 | + |
| 103 | + for t in 0..80 { |
| 104 | + // For W[0..16] we process the input into W. |
| 105 | + // For W[16..80] we compute the next W value: |
| 106 | + // |
| 107 | + // W[t] = (W[t - 3] ^ W[t - 8] ^ W[t - 14] ^ W[t - 16]) <<< 1 |
| 108 | + // |
| 109 | + // But all W indices are reduced mod 16 into our window. |
| 110 | + let w_t = if t < 16 { |
| 111 | + let w_t = u32::from_be_bytes(block[t * 4..(t + 1) * 4].try_into().unwrap()); |
| 112 | + w[t] = w_t; |
| 113 | + w_t |
| 114 | + } else { |
| 115 | + let w_t = (w[(t - 3) % 16] ^ w[(t - 8) % 16] ^ w[(t - 14) % 16] ^ w[(t - 16) % 16]) |
| 116 | + .rotate_left(1); |
| 117 | + w[t % 16] = w_t; |
| 118 | + w_t |
| 119 | + }; |
| 120 | + |
| 121 | + let (f, k) = match t { |
| 122 | + 0..20 => ((b & c) | (!b & d), 0x5a827999), |
| 123 | + 20..40 => (b ^ c ^ d, 0x6ed9eba1), |
| 124 | + 40..60 => ((b & c) | (b & d) | (c & d), 0x8f1bbcdc), |
| 125 | + _ => (b ^ c ^ d, 0xca62c1d6), |
| 126 | + }; |
| 127 | + |
| 128 | + let temp = a |
| 129 | + .rotate_left(5) |
| 130 | + .wrapping_add(f) |
| 131 | + .wrapping_add(e) |
| 132 | + .wrapping_add(k) |
| 133 | + .wrapping_add(w_t); |
| 134 | + e = d; |
| 135 | + d = c; |
| 136 | + c = b.rotate_left(30); |
| 137 | + b = a; |
| 138 | + a = temp; |
| 139 | + } |
| 140 | + |
| 141 | + state[0] = state[0].wrapping_add(a); |
| 142 | + state[1] = state[1].wrapping_add(b); |
| 143 | + state[2] = state[2].wrapping_add(c); |
| 144 | + state[3] = state[3].wrapping_add(d); |
| 145 | + state[4] = state[4].wrapping_add(e); |
| 146 | +} |
| 147 | + |
| 148 | +pub(crate) fn sha1_compress_blocks(state: &mut [u32; 5], blocks: &[u8]) { |
| 149 | + debug_assert!(blocks.len().is_multiple_of(64)); |
| 150 | + |
| 151 | + for block in blocks.chunks_exact(64) { |
| 152 | + sha1_compress_block(state, block); |
| 153 | + } |
| 154 | +} |
| 155 | + |
| 156 | +#[cfg(test)] |
| 157 | +#[cfg_attr(coverage_nightly, coverage(off))] |
| 158 | +mod tests { |
| 159 | + use super::*; |
| 160 | + |
| 161 | + #[test] |
| 162 | + fn test_vectors() { |
| 163 | + vector( |
| 164 | + b"", |
| 165 | + b"\xda\x39\xa3\xee\x5e\x6b\x4b\x0d\x32\x55\xbf\xef\x95\x60\x18\x90\xaf\xd8\x07\x09", |
| 166 | + ); |
| 167 | + vector( |
| 168 | + b"abc", |
| 169 | + b"\xa9\x99\x3e\x36\x47\x06\x81\x6a\xba\x3e\x25\x71\x78\x50\xc2\x6c\x9c\xd0\xd8\x9d", |
| 170 | + ); |
| 171 | + vector( |
| 172 | + b"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", |
| 173 | + b"\x84\x98\x3e\x44\x1c\x3b\xd2\x6e\xba\xae\x4a\xa1\xf9\x51\x29\xe5\xe5\x46\x70\xf1", |
| 174 | + ); |
| 175 | + vector( |
| 176 | + b"abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu", |
| 177 | + b"\xa4\x9b\x24\x46\xa0\x2c\x64\x5b\xf4\x19\xf9\x95\xb6\x70\x91\x25\x3a\x04\xa2\x59", |
| 178 | + ); |
| 179 | + |
| 180 | + fn vector(message: &[u8], expected: &[u8; Sha1Context::OUTPUT_SZ]) { |
| 181 | + let mut ctx = Sha1Context::new(); |
| 182 | + ctx.update(message); |
| 183 | + assert_eq!(&ctx.finish(), expected); |
| 184 | + } |
| 185 | + } |
| 186 | + |
| 187 | + #[test] |
| 188 | + fn sha1_all_lengths() { |
| 189 | + // see cifra `vector_length` and associated |
| 190 | + let mut outer = Sha1Context::new(); |
| 191 | + |
| 192 | + for len in 0..1024 { |
| 193 | + let mut inner = Sha1Context::new(); |
| 194 | + |
| 195 | + for _ in 0..len { |
| 196 | + inner.update(&[len as u8]); |
| 197 | + } |
| 198 | + |
| 199 | + outer.update(&inner.finish()); |
| 200 | + } |
| 201 | + |
| 202 | + assert_eq!( |
| 203 | + &outer.finish(), |
| 204 | + b"\x15\x53\x65\xcf\x77\xee\xd4\x8f\x46\xe2\x55\xc7\xdd\xdf\xfd\x0a\xf6\x99\x88\xbe" |
| 205 | + ); |
| 206 | + } |
| 207 | +} |
0 commit comments