ripemd160.c 7.05 KB
Newer Older
Niels Möller's avatar
Niels Möller committed
1
2
3
4
/* ripemd160.c  -  RIPE-MD160 */

/* nettle, low-level cryptographics library
 *
Andres Mejia's avatar
Andres Mejia committed
5
 * Copyright (C) 1998, 2001, 2002, 2003 Free Software Foundation, Inc.
Niels Möller's avatar
Niels Möller committed
6
 * Copyright (C) 2011 Niels Möller
Andres Mejia's avatar
Andres Mejia committed
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
 *
 * The nettle library is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation; either version 2.1 of the License, or (at your
 * option) any later version.
 *
 * The nettle library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
 * License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with the nettle library; see the file COPYING.LIB.  If not, write to
 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

#if HAVE_CONFIG_H
# include "config.h"
#endif
Niels Möller's avatar
Niels Möller committed
27

Andres Mejia's avatar
Andres Mejia committed
28
29
30
31
32
#include <string.h>
#include <assert.h>

#include "ripemd160.h"

33
34
35
#include "macros.h"
#include "nettle-write.h"

Andres Mejia's avatar
Andres Mejia committed
36
/*********************************
37
 * RIPEMD-160 is not patented, see (as of 2011-08-28)
Andres Mejia's avatar
Andres Mejia committed
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 *   http://www.esat.kuleuven.ac.be/~bosselae/ripemd160.html
 * Note that the code uses Little Endian byteorder, which is good for
 * 386 etc, but we must add some conversion when used on a big endian box.
 *
 *
 * Pseudo-code for RIPEMD-160
 *
 * RIPEMD-160 is an iterative hash function that operates on 32-bit words.
 * The round function takes as input a 5-word chaining variable and a 16-word
 * message block and maps this to a new chaining variable. All operations are
 * defined on 32-bit words. Padding is identical to that of MD4.
 *
 *
 * RIPEMD-160: definitions
 *
 *
 *   nonlinear functions at bit level: exor, mux, -, mux, -
 *
 *   f(j, x, y, z) = x XOR y XOR z      (0 <= j <= 15)
 *   f(j, x, y, z) = (x AND y) OR (NOT(x) AND z)  (16 <= j <= 31)
 *   f(j, x, y, z) = (x OR NOT(y)) XOR z    (32 <= j <= 47)
 *   f(j, x, y, z) = (x AND z) OR (y AND NOT(z))  (48 <= j <= 63)
 *   f(j, x, y, z) = x XOR (y OR NOT(z))    (64 <= j <= 79)
 *
 *
 *   added constants (hexadecimal)
 *
 *   K(j) = 0x00000000      (0 <= j <= 15)
 *   K(j) = 0x5A827999     (16 <= j <= 31)  int(2**30 x sqrt(2))
 *   K(j) = 0x6ED9EBA1     (32 <= j <= 47)  int(2**30 x sqrt(3))
 *   K(j) = 0x8F1BBCDC     (48 <= j <= 63)  int(2**30 x sqrt(5))
 *   K(j) = 0xA953FD4E     (64 <= j <= 79)  int(2**30 x sqrt(7))
 *   K'(j) = 0x50A28BE6     (0 <= j <= 15)      int(2**30 x cbrt(2))
 *   K'(j) = 0x5C4DD124    (16 <= j <= 31)      int(2**30 x cbrt(3))
 *   K'(j) = 0x6D703EF3    (32 <= j <= 47)      int(2**30 x cbrt(5))
 *   K'(j) = 0x7A6D76E9    (48 <= j <= 63)      int(2**30 x cbrt(7))
 *   K'(j) = 0x00000000    (64 <= j <= 79)
 *
 *
 *   selection of message word
 *
 *   r(j)      = j          (0 <= j <= 15)
 *   r(16..31) = 7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8
 *   r(32..47) = 3, 10, 14, 4, 9, 15, 8, 1, 2, 7, 0, 6, 13, 11, 5, 12
 *   r(48..63) = 1, 9, 11, 10, 0, 8, 12, 4, 13, 3, 7, 15, 14, 5, 6, 2
 *   r(64..79) = 4, 0, 5, 9, 7, 12, 2, 10, 14, 1, 3, 8, 11, 6, 15, 13
 *   r0(0..15) = 5, 14, 7, 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12
 *   r0(16..31)= 6, 11, 3, 7, 0, 13, 5, 10, 14, 15, 8, 12, 4, 9, 1, 2
 *   r0(32..47)= 15, 5, 1, 3, 7, 14, 6, 9, 11, 8, 12, 2, 10, 0, 4, 13
 *   r0(48..63)= 8, 6, 4, 1, 3, 11, 15, 0, 5, 12, 2, 13, 9, 7, 10, 14
 *   r0(64..79)= 12, 15, 10, 4, 1, 5, 8, 7, 6, 2, 13, 14, 0, 3, 9, 11
 *
 *
 *   amount for rotate left (rol)
 *
 *   s(0..15)  = 11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8
 *   s(16..31) = 7, 6, 8, 13, 11, 9, 7, 15, 7, 12, 15, 9, 11, 7, 13, 12
 *   s(32..47) = 11, 13, 6, 7, 14, 9, 13, 15, 14, 8, 13, 6, 5, 12, 7, 5
 *   s(48..63) = 11, 12, 14, 15, 14, 15, 9, 8, 9, 14, 5, 6, 8, 6, 5, 12
 *   s(64..79) = 9, 15, 5, 11, 6, 8, 13, 12, 5, 12, 13, 14, 11, 8, 5, 6
 *   s'(0..15) = 8, 9, 9, 11, 13, 15, 15, 5, 7, 7, 8, 11, 14, 14, 12, 6
 *   s'(16..31)= 9, 13, 15, 7, 12, 8, 9, 11, 7, 7, 12, 7, 6, 15, 13, 11
 *   s'(32..47)= 9, 7, 15, 11, 8, 6, 6, 14, 12, 13, 5, 14, 13, 13, 7, 5
 *   s'(48..63)= 15, 5, 8, 11, 14, 14, 6, 14, 6, 9, 12, 9, 12, 5, 15, 8
 *   s'(64..79)= 8, 5, 12, 9, 12, 5, 14, 6, 8, 13, 6, 5, 15, 13, 11, 11
 *
 *
 *   initial value (hexadecimal)
 *
 *   h0 = 0x67452301; h1 = 0xEFCDAB89; h2 = 0x98BADCFE; h3 = 0x10325476;
 *              h4 = 0xC3D2E1F0;
 *
 *
 * RIPEMD-160: pseudo-code
 *
 *   It is assumed that the message after padding consists of t 16-word blocks
 *   that will be denoted with X[i][j], with 0 <= i <= t-1 and 0 <= j <= 15.
 *   The symbol [+] denotes addition modulo 2**32 and rol_s denotes cyclic left
 *   shift (rotate) over s positions.
 *
 *
 *   for i := 0 to t-1 {
 *   A := h0; B := h1; C := h2; D = h3; E = h4;
 *   A' := h0; B' := h1; C' := h2; D' = h3; E' = h4;
 *   for j := 0 to 79 {
 *       T := rol_s(j)(A [+] f(j, B, C, D) [+] X[i][r(j)] [+] K(j)) [+] E;
 *       A := E; E := D; D := rol_10(C); C := B; B := T;
 *       T := rol_s'(j)(A' [+] f(79-j, B', C', D') [+] X[i][r'(j)]
                   [+] K'(j)) [+] E';
 *       A' := E'; E' := D'; D' := rol_10(C'); C' := B'; B' := T;
 *   }
 *   T := h1 [+] C [+] D'; h1 := h2 [+] D [+] E'; h2 := h3 [+] E [+] A';
 *   h3 := h4 [+] A [+] B'; h4 := h0 [+] B [+] C'; h0 := T;
 *   }
 */

/* Some examples:
 * ""                    9c1185a5c5e9fc54612808977ee8f548b2258d31
 * "a"                   0bdc9d2d256b3ee9daae347be6f4dc835a467ffe
 * "abc"                 8eb208f7e05d987a9b044a8e98c6b087f15a0bfc
 * "message digest"      5d0689ef49d2fae572b881b123a85ffa21595f36
 * "a...z"               f71c27109c692c1b56bbdceb5b9d2865b3708dbc
 * "abcdbcde...nopq"     12a053384a9c0c88e405a06c27dcf49ada62eb2b
 * "A...Za...z0...9"     b0e20b6e3116640286ed3a87a5713079b21f5189
 * 8 times "1234567890"  9b752e45573d4b39f4dbd3323cab82bf63326bfb
 * 1 million times "a"   52783243c1697bdbe16d37f97f68f08325dc1528
 */

void
ripemd160_init(struct ripemd160_ctx *ctx)
{
149
150
151
152
153
154
155
156
157
158
  static const uint32_t iv[_RIPEMD160_DIGEST_LENGTH] =
    {
      0x67452301,
      0xEFCDAB89,
      0x98BADCFE,
      0x10325476,
      0xC3D2E1F0,
    };
  memcpy(ctx->state, iv, sizeof(ctx->state));
  ctx->count_low = ctx->count_high = 0;
Andres Mejia's avatar
Andres Mejia committed
159
160
161
  ctx->index = 0;
}

162
163
#define COMPRESS(ctx, data) (_nettle_ripemd160_compress((ctx)->state, (data)))

Andres Mejia's avatar
Andres Mejia committed
164
165
166
167
168
169
/* Update the message digest with the contents
 * of DATA with length LENGTH.
 */
void
ripemd160_update(struct ripemd160_ctx *ctx, unsigned length, const uint8_t *data)
{
170
  MD_UPDATE(ctx, length, data, COMPRESS, MD_INCR(ctx));
Andres Mejia's avatar
Andres Mejia committed
171
172
}

173
174
void
ripemd160_digest(struct ripemd160_ctx *ctx, unsigned length, uint8_t *digest)
Andres Mejia's avatar
Andres Mejia committed
175
{
176
  uint32_t high, low;
Andres Mejia's avatar
Andres Mejia committed
177

178
  assert(length <= RIPEMD160_DIGEST_SIZE);
Andres Mejia's avatar
Andres Mejia committed
179

180
  MD_PAD(ctx, 8, COMPRESS);
Andres Mejia's avatar
Andres Mejia committed
181

182
183
184
185
  /* There are 2^9 bits in one block */
  high = (ctx->count_high << 9) | (ctx->count_low >> 23);
  low = (ctx->count_low << 9) | (ctx->index << 3);
									\
Andres Mejia's avatar
Andres Mejia committed
186
  /* append the 64 bit count */
187
188
189
  LE_WRITE_UINT32(ctx->block + 56, low);
  LE_WRITE_UINT32(ctx->block + 60, high);
  _nettle_ripemd160_compress(ctx->state, ctx->block);
Andres Mejia's avatar
Andres Mejia committed
190

191
  _nettle_write_le32(length, digest, ctx->state);
Andres Mejia's avatar
Andres Mejia committed
192
193
  ripemd160_init(ctx);
}