Coverage Report

Created: 2024-11-21 06:47

/src/openssl/crypto/whrlpool/wp_dgst.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2005-2023 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
/**
11
 * The Whirlpool hashing function.
12
 *
13
 * See
14
 *      P.S.L.M. Barreto, V. Rijmen,
15
 *      ``The Whirlpool hashing function,''
16
 *      NESSIE submission, 2000 (tweaked version, 2001),
17
 *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>
18
 *
19
 * Based on "@version 3.0 (2003.03.12)" by Paulo S.L.M. Barreto and
20
 * Vincent Rijmen. Lookup "reference implementations" on
21
 * <http://planeta.terra.com.br/informatica/paulobarreto/>
22
 *
23
 * =============================================================================
24
 *
25
 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
26
 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
27
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
29
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
32
 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
33
 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
34
 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
35
 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36
 *
37
 */
38
39
/*
40
 * OpenSSL-specific implementation notes.
41
 *
42
 * WHIRLPOOL_Update as well as one-stroke WHIRLPOOL both expect
43
 * number of *bytes* as input length argument. Bit-oriented routine
44
 * as specified by authors is called WHIRLPOOL_BitUpdate[!] and
45
 * does not have one-stroke counterpart.
46
 *
47
 * WHIRLPOOL_BitUpdate implements byte-oriented loop, essentially
48
 * to serve WHIRLPOOL_Update. This is done for performance.
49
 *
50
 * Unlike authors' reference implementation, block processing
51
 * routine whirlpool_block is designed to operate on multi-block
52
 * input. This is done for performance.
53
 */
54
55
/*
56
 * Whirlpool low level APIs are deprecated for public use, but still ok for
57
 * internal use.
58
 */
59
#include "internal/deprecated.h"
60
61
#include <openssl/crypto.h>
62
#include "wp_local.h"
63
#include <string.h>
64
65
int WHIRLPOOL_Init(WHIRLPOOL_CTX *c)
66
0
{
67
0
    memset(c, 0, sizeof(*c));
68
0
    return 1;
69
0
}
70
71
int WHIRLPOOL_Update(WHIRLPOOL_CTX *c, const void *_inp, size_t bytes)
72
0
{
73
    /*
74
     * Well, largest suitable chunk size actually is
75
     * (1<<(sizeof(size_t)*8-3))-64, but below number is large enough for not
76
     * to care about excessive calls to WHIRLPOOL_BitUpdate...
77
     */
78
0
    size_t chunk = ((size_t)1) << (sizeof(size_t) * 8 - 4);
79
0
    const unsigned char *inp = _inp;
80
81
0
    while (bytes >= chunk) {
82
0
        WHIRLPOOL_BitUpdate(c, inp, chunk * 8);
83
0
        bytes -= chunk;
84
0
        inp += chunk;
85
0
    }
86
0
    if (bytes)
87
0
        WHIRLPOOL_BitUpdate(c, inp, bytes * 8);
88
89
0
    return 1;
90
0
}
91
92
void WHIRLPOOL_BitUpdate(WHIRLPOOL_CTX *c, const void *_inp, size_t bits)
93
0
{
94
0
    size_t n;
95
0
    unsigned int bitoff = c->bitoff,
96
0
        bitrem = bitoff % 8, inpgap = (8 - (unsigned int)bits % 8) & 7;
97
0
    const unsigned char *inp = _inp;
98
99
    /*
100
     * This 256-bit increment procedure relies on the size_t being natural
101
     * size of CPU register, so that we don't have to mask the value in order
102
     * to detect overflows.
103
     */
104
0
    c->bitlen[0] += bits;
105
0
    if (c->bitlen[0] < bits) {  /* overflow */
106
0
        n = 1;
107
0
        do {
108
0
            c->bitlen[n]++;
109
0
        } while (c->bitlen[n] == 0
110
0
                 && ++n < (WHIRLPOOL_COUNTER / sizeof(size_t)));
111
0
    }
112
0
#ifndef OPENSSL_SMALL_FOOTPRINT
113
0
 reconsider:
114
0
    if (inpgap == 0 && bitrem == 0) { /* byte-oriented loop */
115
0
        while (bits) {
116
0
            if (bitoff == 0 && (n = bits / WHIRLPOOL_BBLOCK)) {
117
0
                whirlpool_block(c, inp, n);
118
0
                inp += n * WHIRLPOOL_BBLOCK / 8;
119
0
                bits %= WHIRLPOOL_BBLOCK;
120
0
            } else {
121
0
                unsigned int byteoff = bitoff / 8;
122
123
0
                bitrem = WHIRLPOOL_BBLOCK - bitoff; /* reuse bitrem */
124
0
                if (bits >= bitrem) {
125
0
                    bits -= bitrem;
126
0
                    bitrem /= 8;
127
0
                    memcpy(c->data + byteoff, inp, bitrem);
128
0
                    inp += bitrem;
129
0
                    whirlpool_block(c, c->data, 1);
130
0
                    bitoff = 0;
131
0
                } else {
132
0
                    memcpy(c->data + byteoff, inp, bits / 8);
133
0
                    bitoff += (unsigned int)bits;
134
0
                    bits = 0;
135
0
                }
136
0
                c->bitoff = bitoff;
137
0
            }
138
0
        }
139
0
    } else                      /* bit-oriented loop */
140
0
#endif
141
0
    {
142
        /*-
143
                   inp
144
                   |
145
                   +-------+-------+-------
146
                      |||||||||||||||||||||
147
                   +-------+-------+-------
148
        +-------+-------+-------+-------+-------
149
        ||||||||||||||                          c->data
150
        +-------+-------+-------+-------+-------
151
                |
152
                c->bitoff/8
153
        */
154
0
        while (bits) {
155
0
            unsigned int byteoff = bitoff / 8;
156
0
            unsigned char b;
157
158
0
#ifndef OPENSSL_SMALL_FOOTPRINT
159
0
            if (bitrem == inpgap) {
160
0
                c->data[byteoff++] |= inp[0] & (0xff >> inpgap);
161
0
                inpgap = 8 - inpgap;
162
0
                bitoff += inpgap;
163
0
                bitrem = 0;     /* bitoff%8 */
164
0
                bits -= inpgap;
165
0
                inpgap = 0;     /* bits%8 */
166
0
                inp++;
167
0
                if (bitoff == WHIRLPOOL_BBLOCK) {
168
0
                    whirlpool_block(c, c->data, 1);
169
0
                    bitoff = 0;
170
0
                }
171
0
                c->bitoff = bitoff;
172
0
                goto reconsider;
173
0
            } else
174
0
#endif
175
0
            if (bits > 8) {
176
0
                b = ((inp[0] << inpgap) | (inp[1] >> (8 - inpgap)));
177
0
                b &= 0xff;
178
0
                if (bitrem)
179
0
                    c->data[byteoff++] |= b >> bitrem;
180
0
                else
181
0
                    c->data[byteoff++] = b;
182
0
                bitoff += 8;
183
0
                bits -= 8;
184
0
                inp++;
185
0
                if (bitoff >= WHIRLPOOL_BBLOCK) {
186
0
                    whirlpool_block(c, c->data, 1);
187
0
                    byteoff = 0;
188
0
                    bitoff %= WHIRLPOOL_BBLOCK;
189
0
                }
190
0
                if (bitrem)
191
0
                    c->data[byteoff] = b << (8 - bitrem);
192
0
            } else {            /* remaining less than or equal to 8 bits */
193
194
0
                b = (inp[0] << inpgap) & 0xff;
195
0
                if (bitrem)
196
0
                    c->data[byteoff++] |= b >> bitrem;
197
0
                else
198
0
                    c->data[byteoff++] = b;
199
0
                bitoff += (unsigned int)bits;
200
0
                if (bitoff == WHIRLPOOL_BBLOCK) {
201
0
                    whirlpool_block(c, c->data, 1);
202
0
                    byteoff = 0;
203
0
                    bitoff %= WHIRLPOOL_BBLOCK;
204
0
                }
205
0
                if (bitrem)
206
0
                    c->data[byteoff] = b << (8 - bitrem);
207
0
                bits = 0;
208
0
            }
209
0
            c->bitoff = bitoff;
210
0
        }
211
0
    }
212
0
}
213
214
int WHIRLPOOL_Final(unsigned char *md, WHIRLPOOL_CTX *c)
215
0
{
216
0
    unsigned int bitoff = c->bitoff, byteoff = bitoff / 8;
217
0
    size_t i, j, v;
218
0
    unsigned char *p;
219
220
0
    bitoff %= 8;
221
0
    if (bitoff)
222
0
        c->data[byteoff] |= 0x80 >> bitoff;
223
0
    else
224
0
        c->data[byteoff] = 0x80;
225
0
    byteoff++;
226
227
    /* pad with zeros */
228
0
    if (byteoff > (WHIRLPOOL_BBLOCK / 8 - WHIRLPOOL_COUNTER)) {
229
0
        if (byteoff < WHIRLPOOL_BBLOCK / 8)
230
0
            memset(&c->data[byteoff], 0, WHIRLPOOL_BBLOCK / 8 - byteoff);
231
0
        whirlpool_block(c, c->data, 1);
232
0
        byteoff = 0;
233
0
    }
234
0
    if (byteoff < (WHIRLPOOL_BBLOCK / 8 - WHIRLPOOL_COUNTER))
235
0
        memset(&c->data[byteoff], 0,
236
0
               (WHIRLPOOL_BBLOCK / 8 - WHIRLPOOL_COUNTER) - byteoff);
237
    /* smash 256-bit c->bitlen in big-endian order */
238
0
    p = &c->data[WHIRLPOOL_BBLOCK / 8 - 1]; /* last byte in c->data */
239
0
    for (i = 0; i < WHIRLPOOL_COUNTER / sizeof(size_t); i++)
240
0
        for (v = c->bitlen[i], j = 0; j < sizeof(size_t); j++, v >>= 8)
241
0
            *p-- = (unsigned char)(v & 0xff);
242
243
0
    whirlpool_block(c, c->data, 1);
244
245
0
    if (md) {
246
0
        memcpy(md, c->H.c, WHIRLPOOL_DIGEST_LENGTH);
247
0
        OPENSSL_cleanse(c, sizeof(*c));
248
0
        return 1;
249
0
    }
250
0
    return 0;
251
0
}
252
253
unsigned char *WHIRLPOOL(const void *inp, size_t bytes, unsigned char *md)
254
0
{
255
0
    WHIRLPOOL_CTX ctx;
256
0
    static unsigned char m[WHIRLPOOL_DIGEST_LENGTH];
257
258
0
    if (md == NULL)
259
0
        md = m;
260
0
    WHIRLPOOL_Init(&ctx);
261
0
    WHIRLPOOL_Update(&ctx, inp, bytes);
262
0
    WHIRLPOOL_Final(md, &ctx);
263
0
    return md;
264
0
}