ripemd160.c 7.08 KB
Newer Older
1
/* ripemd160.c
Niels Möller's avatar
Niels Möller committed
2

3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33
   RIPE-MD160

   Copyright (C) 1998, 2001, 2002, 2003 Free Software Foundation, Inc.
   Copyright (C) 2011 Niels Möller

   This file is part of GNU Nettle.

   GNU Nettle is free software: you can redistribute it and/or
   modify it under the terms of either:

     * the GNU Lesser General Public License as published by the Free
       Software Foundation; either version 3 of the License, or (at your
       option) any later version.

   or

     * the GNU General Public License as published by the Free
       Software Foundation; either version 2 of the License, or (at your
       option) any later version.

   or both in parallel, as here.

   GNU Nettle is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   General Public License for more details.

   You should have received copies of the GNU General Public License and
   the GNU Lesser General Public License along with this program.  If
   not, see http://www.gnu.org/licenses/.
*/
Andres Mejia's avatar
Andres Mejia committed
34 35 36 37

#if HAVE_CONFIG_H
# include "config.h"
#endif
Niels Möller's avatar
Niels Möller committed
38

Andres Mejia's avatar
Andres Mejia committed
39 40 41 42
#include <string.h>
#include <assert.h>

#include "ripemd160.h"
43
#include "ripemd160-internal.h"
Andres Mejia's avatar
Andres Mejia committed
44

45 46 47
#include "macros.h"
#include "nettle-write.h"

Andres Mejia's avatar
Andres Mejia committed
48
/*********************************
49
 * RIPEMD-160 is not patented, see (as of 2011-08-28)
Andres Mejia's avatar
Andres Mejia committed
50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160
 *   http://www.esat.kuleuven.ac.be/~bosselae/ripemd160.html
 * Note that the code uses Little Endian byteorder, which is good for
 * 386 etc, but we must add some conversion when used on a big endian box.
 *
 *
 * Pseudo-code for RIPEMD-160
 *
 * RIPEMD-160 is an iterative hash function that operates on 32-bit words.
 * The round function takes as input a 5-word chaining variable and a 16-word
 * message block and maps this to a new chaining variable. All operations are
 * defined on 32-bit words. Padding is identical to that of MD4.
 *
 *
 * RIPEMD-160: definitions
 *
 *
 *   nonlinear functions at bit level: exor, mux, -, mux, -
 *
 *   f(j, x, y, z) = x XOR y XOR z      (0 <= j <= 15)
 *   f(j, x, y, z) = (x AND y) OR (NOT(x) AND z)  (16 <= j <= 31)
 *   f(j, x, y, z) = (x OR NOT(y)) XOR z    (32 <= j <= 47)
 *   f(j, x, y, z) = (x AND z) OR (y AND NOT(z))  (48 <= j <= 63)
 *   f(j, x, y, z) = x XOR (y OR NOT(z))    (64 <= j <= 79)
 *
 *
 *   added constants (hexadecimal)
 *
 *   K(j) = 0x00000000      (0 <= j <= 15)
 *   K(j) = 0x5A827999     (16 <= j <= 31)  int(2**30 x sqrt(2))
 *   K(j) = 0x6ED9EBA1     (32 <= j <= 47)  int(2**30 x sqrt(3))
 *   K(j) = 0x8F1BBCDC     (48 <= j <= 63)  int(2**30 x sqrt(5))
 *   K(j) = 0xA953FD4E     (64 <= j <= 79)  int(2**30 x sqrt(7))
 *   K'(j) = 0x50A28BE6     (0 <= j <= 15)      int(2**30 x cbrt(2))
 *   K'(j) = 0x5C4DD124    (16 <= j <= 31)      int(2**30 x cbrt(3))
 *   K'(j) = 0x6D703EF3    (32 <= j <= 47)      int(2**30 x cbrt(5))
 *   K'(j) = 0x7A6D76E9    (48 <= j <= 63)      int(2**30 x cbrt(7))
 *   K'(j) = 0x00000000    (64 <= j <= 79)
 *
 *
 *   selection of message word
 *
 *   r(j)      = j          (0 <= j <= 15)
 *   r(16..31) = 7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8
 *   r(32..47) = 3, 10, 14, 4, 9, 15, 8, 1, 2, 7, 0, 6, 13, 11, 5, 12
 *   r(48..63) = 1, 9, 11, 10, 0, 8, 12, 4, 13, 3, 7, 15, 14, 5, 6, 2
 *   r(64..79) = 4, 0, 5, 9, 7, 12, 2, 10, 14, 1, 3, 8, 11, 6, 15, 13
 *   r0(0..15) = 5, 14, 7, 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12
 *   r0(16..31)= 6, 11, 3, 7, 0, 13, 5, 10, 14, 15, 8, 12, 4, 9, 1, 2
 *   r0(32..47)= 15, 5, 1, 3, 7, 14, 6, 9, 11, 8, 12, 2, 10, 0, 4, 13
 *   r0(48..63)= 8, 6, 4, 1, 3, 11, 15, 0, 5, 12, 2, 13, 9, 7, 10, 14
 *   r0(64..79)= 12, 15, 10, 4, 1, 5, 8, 7, 6, 2, 13, 14, 0, 3, 9, 11
 *
 *
 *   amount for rotate left (rol)
 *
 *   s(0..15)  = 11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8
 *   s(16..31) = 7, 6, 8, 13, 11, 9, 7, 15, 7, 12, 15, 9, 11, 7, 13, 12
 *   s(32..47) = 11, 13, 6, 7, 14, 9, 13, 15, 14, 8, 13, 6, 5, 12, 7, 5
 *   s(48..63) = 11, 12, 14, 15, 14, 15, 9, 8, 9, 14, 5, 6, 8, 6, 5, 12
 *   s(64..79) = 9, 15, 5, 11, 6, 8, 13, 12, 5, 12, 13, 14, 11, 8, 5, 6
 *   s'(0..15) = 8, 9, 9, 11, 13, 15, 15, 5, 7, 7, 8, 11, 14, 14, 12, 6
 *   s'(16..31)= 9, 13, 15, 7, 12, 8, 9, 11, 7, 7, 12, 7, 6, 15, 13, 11
 *   s'(32..47)= 9, 7, 15, 11, 8, 6, 6, 14, 12, 13, 5, 14, 13, 13, 7, 5
 *   s'(48..63)= 15, 5, 8, 11, 14, 14, 6, 14, 6, 9, 12, 9, 12, 5, 15, 8
 *   s'(64..79)= 8, 5, 12, 9, 12, 5, 14, 6, 8, 13, 6, 5, 15, 13, 11, 11
 *
 *
 *   initial value (hexadecimal)
 *
 *   h0 = 0x67452301; h1 = 0xEFCDAB89; h2 = 0x98BADCFE; h3 = 0x10325476;
 *              h4 = 0xC3D2E1F0;
 *
 *
 * RIPEMD-160: pseudo-code
 *
 *   It is assumed that the message after padding consists of t 16-word blocks
 *   that will be denoted with X[i][j], with 0 <= i <= t-1 and 0 <= j <= 15.
 *   The symbol [+] denotes addition modulo 2**32 and rol_s denotes cyclic left
 *   shift (rotate) over s positions.
 *
 *
 *   for i := 0 to t-1 {
 *   A := h0; B := h1; C := h2; D = h3; E = h4;
 *   A' := h0; B' := h1; C' := h2; D' = h3; E' = h4;
 *   for j := 0 to 79 {
 *       T := rol_s(j)(A [+] f(j, B, C, D) [+] X[i][r(j)] [+] K(j)) [+] E;
 *       A := E; E := D; D := rol_10(C); C := B; B := T;
 *       T := rol_s'(j)(A' [+] f(79-j, B', C', D') [+] X[i][r'(j)]
                   [+] K'(j)) [+] E';
 *       A' := E'; E' := D'; D' := rol_10(C'); C' := B'; B' := T;
 *   }
 *   T := h1 [+] C [+] D'; h1 := h2 [+] D [+] E'; h2 := h3 [+] E [+] A';
 *   h3 := h4 [+] A [+] B'; h4 := h0 [+] B [+] C'; h0 := T;
 *   }
 */

/* Some examples:
 * ""                    9c1185a5c5e9fc54612808977ee8f548b2258d31
 * "a"                   0bdc9d2d256b3ee9daae347be6f4dc835a467ffe
 * "abc"                 8eb208f7e05d987a9b044a8e98c6b087f15a0bfc
 * "message digest"      5d0689ef49d2fae572b881b123a85ffa21595f36
 * "a...z"               f71c27109c692c1b56bbdceb5b9d2865b3708dbc
 * "abcdbcde...nopq"     12a053384a9c0c88e405a06c27dcf49ada62eb2b
 * "A...Za...z0...9"     b0e20b6e3116640286ed3a87a5713079b21f5189
 * 8 times "1234567890"  9b752e45573d4b39f4dbd3323cab82bf63326bfb
 * 1 million times "a"   52783243c1697bdbe16d37f97f68f08325dc1528
 */

void
ripemd160_init(struct ripemd160_ctx *ctx)
{
161 162 163 164 165 166 167 168 169
  static const uint32_t iv[_RIPEMD160_DIGEST_LENGTH] =
    {
      0x67452301,
      0xEFCDAB89,
      0x98BADCFE,
      0x10325476,
      0xC3D2E1F0,
    };
  memcpy(ctx->state, iv, sizeof(ctx->state));
170
  ctx->count = 0;
Andres Mejia's avatar
Andres Mejia committed
171 172 173
  ctx->index = 0;
}

174 175
#define COMPRESS(ctx, data) (_nettle_ripemd160_compress((ctx)->state, (data)))

Andres Mejia's avatar
Andres Mejia committed
176 177 178 179
/* Update the message digest with the contents
 * of DATA with length LENGTH.
 */
void
180
ripemd160_update(struct ripemd160_ctx *ctx, size_t length, const uint8_t *data)
Andres Mejia's avatar
Andres Mejia committed
181
{
182
  MD_UPDATE(ctx, length, data, COMPRESS, ctx->count++);
Andres Mejia's avatar
Andres Mejia committed
183 184
}

185
void
186
ripemd160_digest(struct ripemd160_ctx *ctx, size_t length, uint8_t *digest)
Andres Mejia's avatar
Andres Mejia committed
187
{
188
  uint64_t bit_count;
Andres Mejia's avatar
Andres Mejia committed
189

190
  assert(length <= RIPEMD160_DIGEST_SIZE);
Andres Mejia's avatar
Andres Mejia committed
191

192
  MD_PAD(ctx, 8, COMPRESS);
Andres Mejia's avatar
Andres Mejia committed
193

194
  /* There are 2^9 bits in one block */
195
  bit_count = (ctx->count << 9) | (ctx->index << 3);
196
									\
Andres Mejia's avatar
Andres Mejia committed
197
  /* append the 64 bit count */
198
  LE_WRITE_UINT64(ctx->block + 56, bit_count);
199
  _nettle_ripemd160_compress(ctx->state, ctx->block);
Andres Mejia's avatar
Andres Mejia committed
200

201
  _nettle_write_le32(length, digest, ctx->state);
Andres Mejia's avatar
Andres Mejia committed
202 203
  ripemd160_init(ctx);
}