g = f
f = e
e = d + T1
d = c
c = b
b = a
a = T1 + T2
4. Compute the intermediate hash value H(i):
H(i)0 = a + H(i-1)0
H(i)1 = b + H(i-1)1
H(i)2 = c + H(i-1)2
H(i)3 = d + H(i-1)3
H(i)4 = e + H(i-1)4
H(i)5 = f + H(i-1)5
H(i)6 = g + H(i-1)6
H(i)7 = h + H(i-1)7
After the above computations have been sequentially performed for all
of the blocks in the message, the final output is calculated. For
SHA-256, this is the concatenation of all of H(N)0, H(N)1, through
H(N)7. For SHA-224, this is the concatenation of H(N)0, H(N)1,
through H(N)6.
6.3. SHA-384 and SHA-512 Initialization
For SHA-384, the initial hash value, H(0), consists of the following
eight 64-bit words, in hex. These words were obtained by taking the
first sixty-four bits of the fractional parts of the square roots of
the ninth through sixteenth prime numbers.
H(0)0 = cbbb9d5dc1059ed8
H(0)1 = 629a292a367cd507
H(0)2 = 9159015a3070dd17
H(0)3 = 152fecd8f70e5939
H(0)4 = 67332667ffc00b31
H(0)5 = 8eb44a8768581511
H(0)6 = db0c2e0d64f98fa7
H(0)7 = 47b5481dbefa4fa4
For SHA-512, the initial hash value, H(0), consists of the following
eight 64-bit words, in hex. These words were obtained by taking the
first sixty-four bits of the fractional parts of the square roots of
the first eight prime numbers.
H(0)0 = 6a09e667f3bcc908
H(0)1 = bb67ae8584caa73b
H(0)2 = 3c6ef372fe94f82b
H(0)3 = a54ff53a5f1d36f1
H(0)4 = 510e527fade682d1
H(0)5 = 9b05688c2b3e6c1f
H(0)6 = 1f83d9abfb41bd6b
H(0)7 = 5be0cd19137e2179
6.4. SHA-384 and SHA-512 Processing
SHA-384 and SHA-512 perform identical processing on message blocks
and differ only in how H(0) is initialized and how they produce their
final output. They may be used to hash a message, M, having a length
of L bits, where 0 <= L < 2^128. The algorithm uses (1) a message
schedule of eighty 64-bit words, (2) eight working variables of 64
bits each, and (3) a hash value of eight 64-bit words.
The words of the message schedule are labeled W0, W1, ..., W79. The
eight working variables are labeled a, b, c, d, e, f, g, and h. The
words of the hash value are labeled H(i)0, H(i)1, ..., H(i)7, which
will hold the initial hash value, H(0), replaced by each successive
intermediate hash value (after each message block is processed),
H(i), and ending with the final hash value, H(N) after all N blocks
are processed.
The input message is padded as described in Section 4.2 above, then
parsed into 1024-bit blocks, which are considered to be composed of
16 64-bit words M(i)0, M(i)1, ..., M(i)15. The following
computations are then performed for each of the N message blocks.
All addition is performed modulo 2^64.
For i = 1 to N
1. Prepare the message schedule W:
For t = 0 to 15
Wt = M(i)t
For t = 16 to 79
Wt = SSIG1(W(t-2)) + W(t-7) + SSIG0(t-15) + W(t-16)
2. Initialize the working variables:
a = H(i-1)0
b = H(i-1)1
c = H(i-1)2
d = H(i-1)3
e = H(i-1)4
f = H(i-1)5
g = H(i-1)6
h = H(i-1)7
3. Perform the main hash computation:
For t = 0 to 79
T1 = h + BSIG1(e) + CH(e,f,g) + Kt + Wt
T2 = BSIG0(a) + MAJ(a,b,c)
h = g
g = f
f = e
e = d + T1
d = c
c = b
b = a
a = T1 + T2
4. Compute the intermediate hash value H(i):
H(i)0 = a + H(i-1)0
H(i)1 = b + H(i-1)1
H(i)2 = c + H(i-1)2
H(i)3 = d + H(i-1)3
H(i)4 = e + H(i-1)4
H(i)5 = f + H(i-1)5
H(i)6 = g + H(i-1)6
H(i)7 = h + H(i-1)7
After the above computations have been sequentially performed for all
of the blocks in the message, the final output is calculated. For
SHA-512, this is the concatenation of all of H(N)0, H(N)1, through
H(N)7. For SHA-384, this is the concatenation of H(N)0, H(N)1,
through H(N)5.
7. SHA-Based HMACs
HMAC is a method for computing a keyed MAC (message authentication
code) using a hash function as described in [RFC2104]. It uses a key
to mix in with the input text to produce the final hash.
Sample code is also provided, in Section 8.3 below, to perform HMAC
based on any of the SHA algorithms described herein. The sample code
found in [RFC2104] was written in terms of a specified text size.
Since SHA is defined in terms of an arbitrary number of bits, the
sample HMAC code has been written to allow the text input to HMAC to
have an arbitrary number of octets and bits. A fixed-length
interface is also provided.
8. C Code for SHAs
Below is a demonstration implementation of these secure hash
functions in C. Section 8.1 contains the header file sha.h, which
declares all constants, structures, and functions used by the sha and
hmac functions. Section 8.2 contains the C code for sha1.c,
sha224-256.c, sha384-512.c, and usha.c along with sha-private.h,
which provides some declarations common to all the sha functions.
Section 8.3 contains the C code for the hmac functions. Section 8.4
contains a test driver to exercise the code.
For each of the digest length $$$, there is the following set of
constants, a structure, and functions:
Constants:
SHA$$$HashSize number of octets in the hash
SHA$$$HashSizeBits number of bits in the hash
SHA$$$_Message_Block_Size
number of octets used in the intermediate
message blocks
shaSuccess = 0 constant returned by each function on success
shaNull = 1 constant returned by each function when
presented with a null pointer parameter
shaInputTooLong = 2 constant returned by each function when the
input data is too long
shaStateError constant returned by each function when
SHA$$$Input is called after SHA$$$FinalBits or
SHA$$$Result.
Structure:
typedef SHA$$$Context
an opaque structure holding the complete state
for producing the hash
Functions:
int SHA$$$Reset(SHA$$$Context *);
Reset the hash context state
int SHA$$$Input(SHA$$$Context *, const uint8_t *octets,
unsigned int bytecount);
Incorporate bytecount octets into the hash.
int SHA$$$FinalBits(SHA$$$Context *, const uint8_t octet,
unsigned int bitcount);
Incorporate bitcount bits into the hash. The bits are in
the upper portion of the octet. SHA$$$Input() cannot be
called after this.
int SHA$$$Result(SHA$$$Context *,
uint8_t Message_Digest[SHA$$$HashSize]);
Do the final calculations on the hash and copy the value
into Message_Digest.
In addition, functions with the prefix USHA are provided that take a
SHAversion value (SHA$$$) to select the SHA function suite. They add
the following constants, structure, and functions:
Constants:
shaBadParam constant returned by USHA functions when
presented with a bad SHAversion (SHA$$$)
parameter
SHA$$$ SHAversion enumeration values, used by usha
and hmac functions to select the SHA function
suite
Structure:
typedef USHAContext
an opaque structure holding the complete state
for producing the hash
Functions:
int USHAReset(USHAContext *, SHAversion whichSha);
Reset the hash context state.
int USHAInput(USHAContext *,
const uint8_t *bytes, unsigned int bytecount);
Incorporate bytecount octets into the hash.
int USHAFinalBits(USHAContext *,
const uint8_t bits, unsigned int bitcount);
Incorporate bitcount bits into the hash.
int USHAResult(USHAContext *,
uint8_t Message_Digest[USHAMaxHashSize]);
Do the final calculations on the hash and copy the value
into Message_Digest. Octets in Message_Digest beyond
USHAHashSize(whichSha) are left untouched.
int USHAHashSize(enum SHAversion whichSha);
The number of octets in the given hash.
int USHAHashSizeBits(enum SHAversion whichSha);
The number of bits in the given hash.
int USHABlockSize(enum SHAversion whichSha);
The internal block size for the given hash.
The hmac functions follow the same pattern to allow any length of
text input to be used.
Structure:
typedef HMACContext an opaque structure holding the complete state
for producing the hash
Functions:
int hmacReset(HMACContext *ctx, enum SHAversion whichSha,
const unsigned char *key, int key_len);
Reset the hash context state.
int hmacInput(HMACContext *ctx, const unsigned char *text,
int text_len);
Incorporate text_len octets into the hash.
int hmacFinalBits(HMACContext *ctx, const uint8_t bits,
unsigned int bitcount);
Incorporate bitcount bits into the hash.
int hmacResult(HMACContext *ctx,
uint8_t Message_Digest[USHAMaxHashSize]);
Do the final calculations on the hash and copy the value
into Message_Digest. Octets in Message_Digest beyond
USHAHashSize(whichSha) are left untouched.
In addition, a combined interface is provided, similar to that shown
in RFC 2104, that allows a fixed-length text input to be used.
int hmac(SHAversion whichSha,
const unsigned char *text, int text_len,
const unsigned char *key, int key_len,
uint8_t Message_Digest[USHAMaxHashSize]);
Calculate the given digest for the given text and key, and
return the resulting hash. Octets in Message_Digest beyond
USHAHashSize(whichSha) are left untouched.
8.1. The .h File
/**************************** sha.h ****************************/
/******************* See RFC 4634 for details ******************/
#ifndef _SHA_H_
#define _SHA_H_
/*
* Description:
* This file implements the Secure Hash Signature Standard
* algorithms as defined in the National Institute of Standards
* and Technology Federal Information Processing Standards
* Publication (FIPS PUB) 180-1 published on April 17, 1995, 180-2
* published on August 1, 2002, and the FIPS PUB 180-2 Change
* Notice published on February 28, 2004.
*
* A combined document showing all algorithms is available at
* http://csrc.nist.gov/publications/fips/
* fips180-2/fips180-2withchangenotice.pdf
*
* The five hashes are defined in these sizes:
* SHA-1 20 byte / 160 bit
* SHA-224 28 byte / 224 bit
* SHA-256 32 byte / 256 bit
* SHA-384 48 byte / 384 bit
* SHA-512 64 byte / 512 bit
*/
#include <stdint.h>
/*
* If you do not have the ISO standard stdint.h header file, then you
* must typedef the following:
* name meaning
* uint64_t unsigned 64 bit integer
* uint32_t unsigned 32 bit integer
* uint8_t unsigned 8 bit integer (i.e., unsigned char)
* int_least16_t integer of >= 16 bits
*
*/
#ifndef _SHA_enum_
#define _SHA_enum_
/*
* All SHA functions return one of these values.
*/
enum {
shaSuccess = 0,
shaNull, /* Null pointer parameter */
shaInputTooLong, /* input data too long */
shaStateError, /* called Input after FinalBits or Result */
shaBadParam /* passed a bad parameter */
};
#endif /* _SHA_enum_ */
/*
* These constants hold size information for each of the SHA
* hashing operations
*/
enum {
SHA1_Message_Block_Size = 64, SHA224_Message_Block_Size = 64,
SHA256_Message_Block_Size = 64, SHA384_Message_Block_Size = 128,
SHA512_Message_Block_Size = 128,
USHA_Max_Message_Block_Size = SHA512_Message_Block_Size,
SHA1HashSize = 20, SHA224HashSize = 28, SHA256HashSize = 32,
SHA384HashSize = 48, SHA512HashSize = 64,
USHAMaxHashSize = SHA512HashSize,
SHA1HashSizeBits = 160, SHA224HashSizeBits = 224,
SHA256HashSizeBits = 256, SHA384HashSizeBits = 384,
SHA512HashSizeBits = 512, USHAMaxHashSizeBits = SHA512HashSizeBits
};
/*
* These constants are used in the USHA (unified sha) functions.
*/
typedef enum SHAversion {
SHA1, SHA224, SHA256, SHA384, SHA512
} SHAversion;
/*
* This structure will hold context information for the SHA-1
* hashing operation.
*/
typedef struct SHA1Context {
uint32_t Intermediate_Hash[SHA1HashSize/4]; /* Message Digest */
uint32_t Length_Low; /* Message length in bits */
uint32_t Length_High; /* Message length in bits */
int_least16_t Message_Block_Index; /* Message_Block array index */
/* 512-bit message blocks */
uint8_t Message_Block[SHA1_Message_Block_Size];
int Computed; /* Is the digest computed? */
int Corrupted; /* Is the digest corrupted? */
} SHA1Context;
/*
* This structure will hold context information for the SHA-256
* hashing operation.
*/
typedef struct SHA256Context {
uint32_t Intermediate_Hash[SHA256HashSize/4]; /* Message Digest */
uint32_t Length_Low; /* Message length in bits */
uint32_t Length_High; /* Message length in bits */
int_least16_t Message_Block_Index; /* Message_Block array index */
/* 512-bit message blocks */
uint8_t Message_Block[SHA256_Message_Block_Size];
int Computed; /* Is the digest computed? */
int Corrupted; /* Is the digest corrupted? */
} SHA256Context;
/*
* This structure will hold context information for the SHA-512
* hashing operation.
*/
typedef struct SHA512Context {
#ifdef USE_32BIT_ONLY
uint32_t Intermediate_Hash[SHA512HashSize/4]; /* Message Digest */
uint32_t Length[4]; /* Message length in bits */
#else /* !USE_32BIT_ONLY */
uint64_t Intermediate_Hash[SHA512HashSize/8]; /* Message Digest */
uint64_t Length_Low, Length_High; /* Message length in bits */
#endif /* USE_32BIT_ONLY */
int_least16_t Message_Block_Index; /* Message_Block array index */
/* 1024-bit message blocks */
uint8_t Message_Block[SHA512_Message_Block_Size];
int Computed; /* Is the digest computed?*/
int Corrupted; /* Is the digest corrupted? */
} SHA512Context;
/*
* This structure will hold context information for the SHA-224
* hashing operation. It uses the SHA-256 structure for computation.
*/
typedef struct SHA256Context SHA224Context;
/*
* This structure will hold context information for the SHA-384
* hashing operation. It uses the SHA-512 structure for computation.
*/
typedef struct SHA512Context SHA384Context;
/*
* This structure holds context information for all SHA
* hashing operations.
*/
typedef struct USHAContext {
int whichSha; /* which SHA is being used */
union {
SHA1Context sha1Context;
SHA224Context sha224Context; SHA256Context sha256Context;
SHA384Context sha384Context; SHA512Context sha512Context;
} ctx;
} USHAContext;
/*
* This structure will hold context information for the HMAC
* keyed hashing operation.
*/
typedef struct HMACContext {
int whichSha; /* which SHA is being used */
int hashSize; /* hash size of SHA being used */
int blockSize; /* block size of SHA being used */
USHAContext shaContext; /* SHA context */
unsigned char k_opad[USHA_Max_Message_Block_Size];
/* outer padding - key XORd with opad */
} HMACContext;
/*
* Function Prototypes
*/
/* SHA-1 */
extern int SHA1Reset(SHA1Context *);
extern int SHA1Input(SHA1Context *, const uint8_t *bytes,
unsigned int bytecount);
extern int SHA1FinalBits(SHA1Context *, const uint8_t bits,
unsigned int bitcount);
extern int SHA1Result(SHA1Context *,
uint8_t Message_Digest[SHA1HashSize]);
/* SHA-224 */
extern int SHA224Reset(SHA224Context *);
extern int SHA224Input(SHA224Context *, const uint8_t *bytes,
unsigned int bytecount);
extern int SHA224FinalBits(SHA224Context *, const uint8_t bits,
unsigned int bitcount);
extern int SHA224Result(SHA224Context *,
uint8_t Message_Digest[SHA224HashSize]);
/* SHA-256 */
extern int SHA256Reset(SHA256Context *);
extern int SHA256Input(SHA256Context *, const uint8_t *bytes,
unsigned int bytecount);
extern int SHA256FinalBits(SHA256Context *, const uint8_t bits,
unsigned int bitcount);
extern int SHA256Result(SHA256Context *,
uint8_t Message_Digest[SHA256HashSize]);
/* SHA-384 */
extern int SHA384Reset(SHA384Context *);
extern int SHA384Input(SHA384Context *, const uint8_t *bytes,
unsigned int bytecount);
extern int SHA384FinalBits(SHA384Context *, const uint8_t bits,
unsigned int bitcount);
extern int SHA384Result(SHA384Context *,
uint8_t Message_Digest[SHA384HashSize]);
/* SHA-512 */
extern int SHA512Reset(SHA512Context *);
extern int SHA512Input(SHA512Context *, const uint8_t *bytes,
unsigned int bytecount);
extern int SHA512FinalBits(SHA512Context *, const uint8_t bits,
unsigned int bitcount);
extern int SHA512Result(SHA512Context *,
uint8_t Message_Digest[SHA512HashSize]);
/* Unified SHA functions, chosen by whichSha */
extern int USHAReset(USHAContext *, SHAversion whichSha);
extern int USHAInput(USHAContext *,
const uint8_t *bytes, unsigned int bytecount);
extern int USHAFinalBits(USHAContext *,
const uint8_t bits, unsigned int bitcount);
extern int USHAResult(USHAContext *,
uint8_t Message_Digest[USHAMaxHashSize]);
extern int USHABlockSize(enum SHAversion whichSha);
extern int USHAHashSize(enum SHAversion whichSha);
extern int USHAHashSizeBits(enum SHAversion whichSha);
/*
* HMAC Keyed-Hashing for Message Authentication, RFC2104,
* for all SHAs.
* This interface allows a fixed-length text input to be used.
*/
extern int hmac(SHAversion whichSha, /* which SHA algorithm to use */
const unsigned char *text, /* pointer to data stream */
int text_len, /* length of data stream */
const unsigned char *key, /* pointer to authentication key */
int key_len, /* length of authentication key */
uint8_t digest[USHAMaxHashSize]); /* caller digest to fill in */
/*
* HMAC Keyed-Hashing for Message Authentication, RFC2104,
* for all SHAs.
* This interface allows any length of text input to be used.
*/
extern int hmacReset(HMACContext *ctx, enum SHAversion whichSha,
const unsigned char *key, int key_len);
extern int hmacInput(HMACContext *ctx, const unsigned char *text,
int text_len);
extern int hmacFinalBits(HMACContext *ctx, const uint8_t bits,
unsigned int bitcount);
extern int hmacResult(HMACContext *ctx,
uint8_t digest[USHAMaxHashSize]);
#endif /* _SHA_H_ */
8.2. The SHA Code
This code is primarily intended as expository and could be optimized
further. For example, the assignment rotations through the variables
a, b, ..., h could be treated as a cycle and the loop unrolled,
rather than doing the explicit copying.