279 lines
8.0 KiB
C
279 lines
8.0 KiB
C
/* Copyright Rusty Russell (Blockstream) 2015.
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
of this software and associated documentation files (the "Software"), to deal
|
|
in the Software without restriction, including without limitation the rights
|
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
copies of the Software, and to permit persons to whom the Software is
|
|
furnished to do so, subject to the following conditions:
|
|
|
|
The above copyright notice and this permission notice shall be included in
|
|
all copies or substantial portions of the Software.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
THE SOFTWARE.
|
|
*/
|
|
|
|
#include <string.h>
|
|
#include "hmac.h"
|
|
|
|
#define IPAD 0x3636363636363636ULL
|
|
#define OPAD 0x5C5C5C5C5C5C5C5CULL
|
|
|
|
#define BLOCK_256_U64S (HMAC_SHA256_BLOCKSIZE / sizeof(uint64_t))
|
|
#define BLOCK_512_U64S (HMAC_SHA512_BLOCKSIZE / sizeof(uint64_t))
|
|
|
|
static inline void xor_block_256(uint64_t block[BLOCK_256_U64S], uint64_t pad)
|
|
{
|
|
size_t i;
|
|
|
|
for (i = 0; i < BLOCK_256_U64S; i++)
|
|
block[i] ^= pad;
|
|
}
|
|
|
|
|
|
static inline void xor_block_512(uint64_t block[BLOCK_512_U64S], uint64_t pad)
|
|
{
|
|
size_t i;
|
|
|
|
for (i = 0; i < BLOCK_512_U64S; i++)
|
|
block[i] ^= pad;
|
|
}
|
|
|
|
void hmac_sha256_init(struct hmac_sha256_ctx *ctx,
|
|
const void *k, size_t ksize)
|
|
{
|
|
struct sha256 hashed_key;
|
|
/* We use k_opad as k_ipad temporarily. */
|
|
uint64_t *k_ipad = ctx->k_opad;
|
|
|
|
/* (keys longer than B bytes are first hashed using H) */
|
|
if (ksize > HMAC_SHA256_BLOCKSIZE) {
|
|
sha256(&hashed_key, k, ksize);
|
|
k = &hashed_key;
|
|
ksize = sizeof(hashed_key);
|
|
}
|
|
|
|
/* From RFC2104:
|
|
*
|
|
* (1) append zeros to the end of K to create a B byte string
|
|
* (e.g., if K is of length 20 bytes and B=64, then K will be
|
|
* appended with 44 zero bytes 0x00)
|
|
*/
|
|
memcpy(k_ipad, k, ksize);
|
|
memset((char *)k_ipad + ksize, 0, HMAC_SHA256_BLOCKSIZE - ksize);
|
|
|
|
/*
|
|
* (2) XOR (bitwise exclusive-OR) the B byte string computed
|
|
* in step (1) with ipad
|
|
*/
|
|
xor_block_256(k_ipad, IPAD);
|
|
|
|
/*
|
|
* We start (4) here, appending text later:
|
|
*
|
|
* (3) append the stream of data 'text' to the B byte string resulting
|
|
* from step (2)
|
|
* (4) apply H to the stream generated in step (3)
|
|
*/
|
|
sha256_init(&ctx->sha);
|
|
sha256_update(&ctx->sha, k_ipad, HMAC_SHA256_BLOCKSIZE);
|
|
|
|
/*
|
|
* (5) XOR (bitwise exclusive-OR) the B byte string computed in
|
|
* step (1) with opad
|
|
*/
|
|
xor_block_256(ctx->k_opad, IPAD^OPAD);
|
|
}
|
|
|
|
|
|
void hmac_sha512_init(struct hmac_sha512_ctx *ctx,
|
|
const void *k, size_t ksize)
|
|
{
|
|
struct sha512 hashed_key;
|
|
/* We use k_opad as k_ipad temporarily. */
|
|
uint64_t *k_ipad = ctx->k_opad;
|
|
|
|
/* (keys longer than B bytes are first hashed using H) */
|
|
if (ksize > HMAC_SHA512_BLOCKSIZE) {
|
|
sha512(&hashed_key, k, ksize);
|
|
k = &hashed_key;
|
|
ksize = sizeof(hashed_key);
|
|
}
|
|
|
|
/* From RFC2104:
|
|
*
|
|
* (1) append zeros to the end of K to create a B byte string
|
|
* (e.g., if K is of length 20 bytes and B=64, then K will be
|
|
* appended with 44 zero bytes 0x00)
|
|
*/
|
|
memcpy(k_ipad, k, ksize);
|
|
memset((char *)k_ipad + ksize, 0, HMAC_SHA512_BLOCKSIZE - ksize);
|
|
|
|
/*
|
|
* (2) XOR (bitwise exclusive-OR) the B byte string computed
|
|
* in step (1) with ipad
|
|
*/
|
|
xor_block_512(k_ipad, IPAD);
|
|
|
|
/*
|
|
* We start (4) here, appending text later:
|
|
*
|
|
* (3) append the stream of data 'text' to the B byte string resulting
|
|
* from step (2)
|
|
* (4) apply H to the stream generated in step (3)
|
|
*/
|
|
sha512_init(&ctx->sha);
|
|
sha512_update(&ctx->sha, k_ipad, HMAC_SHA512_BLOCKSIZE);
|
|
|
|
/*
|
|
* (5) XOR (bitwise exclusive-OR) the B byte string computed in
|
|
* step (1) with opad
|
|
*/
|
|
xor_block_512(ctx->k_opad, IPAD^OPAD);
|
|
}
|
|
|
|
|
|
void hmac_sha256_update(struct hmac_sha256_ctx *ctx, const void *p, size_t size)
|
|
{
|
|
/* This is the appending-text part of this:
|
|
*
|
|
* (3) append the stream of data 'text' to the B byte string resulting
|
|
* from step (2)
|
|
* (4) apply H to the stream generated in step (3)
|
|
*/
|
|
sha256_update(&ctx->sha, p, size);
|
|
}
|
|
|
|
|
|
void hmac_sha512_update(struct hmac_sha512_ctx *ctx, const void *p, size_t size)
|
|
{
|
|
sha512_update(&ctx->sha, p, size);
|
|
}
|
|
|
|
|
|
void hmac_sha256_done(struct hmac_sha256_ctx *ctx,
|
|
struct hmac_sha256 *hmac)
|
|
{
|
|
/* (4) apply H to the stream generated in step (3) */
|
|
sha256_done(&ctx->sha, &hmac->sha);
|
|
|
|
/*
|
|
* (6) append the H result from step (4) to the B byte string
|
|
* resulting from step (5)
|
|
* (7) apply H to the stream generated in step (6) and output
|
|
* the result
|
|
*/
|
|
sha256_init(&ctx->sha);
|
|
sha256_update(&ctx->sha, ctx->k_opad, sizeof(ctx->k_opad));
|
|
sha256_update(&ctx->sha, &hmac->sha, sizeof(hmac->sha));
|
|
sha256_done(&ctx->sha, &hmac->sha);
|
|
}
|
|
|
|
|
|
void hmac_sha512_done(struct hmac_sha512_ctx *ctx,
|
|
struct hmac_sha512 *hmac)
|
|
{
|
|
/* (4) apply H to the stream generated in step (3) */
|
|
sha512_done(&ctx->sha, &hmac->sha);
|
|
|
|
/*
|
|
* (6) append the H result from step (4) to the B byte string
|
|
* resulting from step (5)
|
|
* (7) apply H to the stream generated in step (6) and output
|
|
* the result
|
|
*/
|
|
sha512_init(&ctx->sha);
|
|
sha512_update(&ctx->sha, ctx->k_opad, sizeof(ctx->k_opad));
|
|
sha512_update(&ctx->sha, &hmac->sha, sizeof(hmac->sha));
|
|
sha512_done(&ctx->sha, &hmac->sha);
|
|
}
|
|
|
|
#if 1
|
|
void hmac_sha256(struct hmac_sha256 *hmac,
|
|
const void *k, size_t ksize,
|
|
const void *d, size_t dsize)
|
|
{
|
|
struct hmac_sha256_ctx ctx;
|
|
|
|
hmac_sha256_init(&ctx, k, ksize);
|
|
hmac_sha256_update(&ctx, d, dsize);
|
|
hmac_sha256_done(&ctx, hmac);
|
|
}
|
|
|
|
|
|
void hmac_sha512(struct hmac_sha512 *hmac,
|
|
const void *k, size_t ksize,
|
|
const void *d, size_t dsize)
|
|
{
|
|
struct hmac_sha512_ctx ctx;
|
|
|
|
hmac_sha512_init(&ctx, k, ksize);
|
|
hmac_sha512_update(&ctx, d, dsize);
|
|
hmac_sha512_done(&ctx, hmac);
|
|
}
|
|
|
|
|
|
#else
|
|
/* Direct mapping from MD5 example in RFC2104 */
|
|
void hmac_sha256(struct hmac_sha256 *hmac,
|
|
const void *key, size_t key_len,
|
|
const void *text, size_t text_len)
|
|
{
|
|
struct sha256_ctx context;
|
|
unsigned char k_ipad[65]; /* inner padding -
|
|
* key XORd with ipad
|
|
*/
|
|
unsigned char k_opad[65]; /* outer padding -
|
|
* key XORd with opad
|
|
*//* start out by storing key in pads */
|
|
unsigned char tk[32];
|
|
int i;
|
|
|
|
/* if key is longer than 64 bytes reset it to key=MD5(key) */
|
|
if (key_len > 64) {
|
|
|
|
struct sha256_ctx tctx;
|
|
|
|
sha256_init(&tctx);
|
|
sha256_update(&tctx, key, key_len);
|
|
sha256_done(&tctx, tk);
|
|
|
|
key = tk;
|
|
key_len = 32;
|
|
}
|
|
bzero( k_ipad, sizeof k_ipad);
|
|
bzero( k_opad, sizeof k_opad);
|
|
bcopy( key, k_ipad, key_len);
|
|
bcopy( key, k_opad, key_len);
|
|
|
|
/* XOR key with ipad and opad values */
|
|
for (i=0; i<64; i++) {
|
|
k_ipad[i] ^= 0x36;
|
|
k_opad[i] ^= 0x5c;
|
|
}
|
|
/*
|
|
* perform inner MD5
|
|
*/
|
|
sha256_init(&context); /* init context for 1st
|
|
* pass */
|
|
sha256_update(&context, k_ipad, 64); /* start with inner pad */
|
|
sha256_update(&context, text, text_len); /* then text of datagram */
|
|
sha256_done(&context, &hmac->sha); /* finish up 1st pass */
|
|
/*
|
|
* perform outer MD5
|
|
*/
|
|
sha256_init(&context); /* init context for 2nd
|
|
* pass */
|
|
sha256_update(&context, k_opad, 64); /* start with outer pad */
|
|
sha256_update(&context, &hmac->sha, 32); /* then results of 1st
|
|
* hash */
|
|
sha256_done(&context, &hmac->sha); /* finish up 2nd pass */
|
|
}
|
|
#endif
|