1 /*
2 * Copyright 2005-2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /**
11 * The Whirlpool hashing function.
12 *
13 * See
14 * P.S.L.M. Barreto, V. Rijmen,
15 * ``The Whirlpool hashing function,''
16 * NESSIE submission, 2000 (tweaked version, 2001),
17 * <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>
18 *
19 * Based on "@version 3.0 (2003.03.12)" by Paulo S.L.M. Barreto and
20 * Vincent Rijmen. Lookup "reference implementations" on
21 * <http://planeta.terra.com.br/informatica/paulobarreto/>
22 *
23 * =============================================================================
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
26 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
27 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
29 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
32 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
33 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
34 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
35 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 *
37 */
38
39 /*
40 * OpenSSL-specific implementation notes.
41 *
42 * WHIRLPOOL_Update as well as one-stroke WHIRLPOOL both expect
43 * number of *bytes* as input length argument. Bit-oriented routine
44 * as specified by authors is called WHIRLPOOL_BitUpdate[!] and
45 * does not have one-stroke counterpart.
46 *
47 * WHIRLPOOL_BitUpdate implements byte-oriented loop, essentially
48 * to serve WHIRLPOOL_Update. This is done for performance.
49 *
50 * Unlike authors' reference implementation, block processing
51 * routine whirlpool_block is designed to operate on multi-block
52 * input. This is done for performance.
53 */
54
55 /*
56 * Whirlpool low level APIs are deprecated for public use, but still ok for
57 * internal use.
58 */
59 #include "internal/deprecated.h"
60
61 #include <openssl/crypto.h>
62 #include "wp_local.h"
63 #include <string.h>
64
WHIRLPOOL_Init(WHIRLPOOL_CTX * c)65 int WHIRLPOOL_Init(WHIRLPOOL_CTX *c)
66 {
67 memset(c, 0, sizeof(*c));
68 return 1;
69 }
70
WHIRLPOOL_Update(WHIRLPOOL_CTX * c,const void * _inp,size_t bytes)71 int WHIRLPOOL_Update(WHIRLPOOL_CTX *c, const void *_inp, size_t bytes)
72 {
73 /*
74 * Well, largest suitable chunk size actually is
75 * (1<<(sizeof(size_t)*8-3))-64, but below number is large enough for not
76 * to care about excessive calls to WHIRLPOOL_BitUpdate...
77 */
78 size_t chunk = ((size_t)1) << (sizeof(size_t) * 8 - 4);
79 const unsigned char *inp = _inp;
80
81 while (bytes >= chunk) {
82 WHIRLPOOL_BitUpdate(c, inp, chunk * 8);
83 bytes -= chunk;
84 inp += chunk;
85 }
86 if (bytes)
87 WHIRLPOOL_BitUpdate(c, inp, bytes * 8);
88
89 return 1;
90 }
91
WHIRLPOOL_BitUpdate(WHIRLPOOL_CTX * c,const void * _inp,size_t bits)92 void WHIRLPOOL_BitUpdate(WHIRLPOOL_CTX *c, const void *_inp, size_t bits)
93 {
94 size_t n;
95 unsigned int bitoff = c->bitoff,
96 bitrem = bitoff % 8, inpgap = (8 - (unsigned int)bits % 8) & 7;
97 const unsigned char *inp = _inp;
98
99 /*
100 * This 256-bit increment procedure relies on the size_t being natural
101 * size of CPU register, so that we don't have to mask the value in order
102 * to detect overflows.
103 */
104 c->bitlen[0] += bits;
105 if (c->bitlen[0] < bits) { /* overflow */
106 n = 1;
107 do {
108 c->bitlen[n]++;
109 } while (c->bitlen[n] == 0
110 && ++n < (WHIRLPOOL_COUNTER / sizeof(size_t)));
111 }
112 #ifndef OPENSSL_SMALL_FOOTPRINT
113 reconsider:
114 if (inpgap == 0 && bitrem == 0) { /* byte-oriented loop */
115 while (bits) {
116 if (bitoff == 0 && (n = bits / WHIRLPOOL_BBLOCK)) {
117 whirlpool_block(c, inp, n);
118 inp += n * WHIRLPOOL_BBLOCK / 8;
119 bits %= WHIRLPOOL_BBLOCK;
120 } else {
121 unsigned int byteoff = bitoff / 8;
122
123 bitrem = WHIRLPOOL_BBLOCK - bitoff; /* reuse bitrem */
124 if (bits >= bitrem) {
125 bits -= bitrem;
126 bitrem /= 8;
127 memcpy(c->data + byteoff, inp, bitrem);
128 inp += bitrem;
129 whirlpool_block(c, c->data, 1);
130 bitoff = 0;
131 } else {
132 memcpy(c->data + byteoff, inp, bits / 8);
133 bitoff += (unsigned int)bits;
134 bits = 0;
135 }
136 c->bitoff = bitoff;
137 }
138 }
139 } else /* bit-oriented loop */
140 #endif
141 {
142 /*-
143 inp
144 |
145 +-------+-------+-------
146 |||||||||||||||||||||
147 +-------+-------+-------
148 +-------+-------+-------+-------+-------
149 |||||||||||||| c->data
150 +-------+-------+-------+-------+-------
151 |
152 c->bitoff/8
153 */
154 while (bits) {
155 unsigned int byteoff = bitoff / 8;
156 unsigned char b;
157
158 #ifndef OPENSSL_SMALL_FOOTPRINT
159 if (bitrem == inpgap) {
160 c->data[byteoff++] |= inp[0] & (0xff >> inpgap);
161 inpgap = 8 - inpgap;
162 bitoff += inpgap;
163 bitrem = 0; /* bitoff%8 */
164 bits -= inpgap;
165 inpgap = 0; /* bits%8 */
166 inp++;
167 if (bitoff == WHIRLPOOL_BBLOCK) {
168 whirlpool_block(c, c->data, 1);
169 bitoff = 0;
170 }
171 c->bitoff = bitoff;
172 goto reconsider;
173 } else
174 #endif
175 if (bits > 8) {
176 b = ((inp[0] << inpgap) | (inp[1] >> (8 - inpgap)));
177 b &= 0xff;
178 if (bitrem)
179 c->data[byteoff++] |= b >> bitrem;
180 else
181 c->data[byteoff++] = b;
182 bitoff += 8;
183 bits -= 8;
184 inp++;
185 if (bitoff >= WHIRLPOOL_BBLOCK) {
186 whirlpool_block(c, c->data, 1);
187 byteoff = 0;
188 bitoff %= WHIRLPOOL_BBLOCK;
189 }
190 if (bitrem)
191 c->data[byteoff] = b << (8 - bitrem);
192 } else { /* remaining less than or equal to 8 bits */
193
194 b = (inp[0] << inpgap) & 0xff;
195 if (bitrem)
196 c->data[byteoff++] |= b >> bitrem;
197 else
198 c->data[byteoff++] = b;
199 bitoff += (unsigned int)bits;
200 if (bitoff == WHIRLPOOL_BBLOCK) {
201 whirlpool_block(c, c->data, 1);
202 byteoff = 0;
203 bitoff %= WHIRLPOOL_BBLOCK;
204 }
205 if (bitrem)
206 c->data[byteoff] = b << (8 - bitrem);
207 bits = 0;
208 }
209 c->bitoff = bitoff;
210 }
211 }
212 }
213
WHIRLPOOL_Final(unsigned char * md,WHIRLPOOL_CTX * c)214 int WHIRLPOOL_Final(unsigned char *md, WHIRLPOOL_CTX *c)
215 {
216 unsigned int bitoff = c->bitoff, byteoff = bitoff / 8;
217 size_t i, j, v;
218 unsigned char *p;
219
220 bitoff %= 8;
221 if (bitoff)
222 c->data[byteoff] |= 0x80 >> bitoff;
223 else
224 c->data[byteoff] = 0x80;
225 byteoff++;
226
227 /* pad with zeros */
228 if (byteoff > (WHIRLPOOL_BBLOCK / 8 - WHIRLPOOL_COUNTER)) {
229 if (byteoff < WHIRLPOOL_BBLOCK / 8)
230 memset(&c->data[byteoff], 0, WHIRLPOOL_BBLOCK / 8 - byteoff);
231 whirlpool_block(c, c->data, 1);
232 byteoff = 0;
233 }
234 if (byteoff < (WHIRLPOOL_BBLOCK / 8 - WHIRLPOOL_COUNTER))
235 memset(&c->data[byteoff], 0,
236 (WHIRLPOOL_BBLOCK / 8 - WHIRLPOOL_COUNTER) - byteoff);
237 /* smash 256-bit c->bitlen in big-endian order */
238 p = &c->data[WHIRLPOOL_BBLOCK / 8 - 1]; /* last byte in c->data */
239 for (i = 0; i < WHIRLPOOL_COUNTER / sizeof(size_t); i++)
240 for (v = c->bitlen[i], j = 0; j < sizeof(size_t); j++, v >>= 8)
241 *p-- = (unsigned char)(v & 0xff);
242
243 whirlpool_block(c, c->data, 1);
244
245 if (md) {
246 memcpy(md, c->H.c, WHIRLPOOL_DIGEST_LENGTH);
247 OPENSSL_cleanse(c, sizeof(*c));
248 return 1;
249 }
250 return 0;
251 }
252
WHIRLPOOL(const void * inp,size_t bytes,unsigned char * md)253 unsigned char *WHIRLPOOL(const void *inp, size_t bytes, unsigned char *md)
254 {
255 WHIRLPOOL_CTX ctx;
256 static unsigned char m[WHIRLPOOL_DIGEST_LENGTH];
257
258 if (md == NULL)
259 md = m;
260 WHIRLPOOL_Init(&ctx);
261 WHIRLPOOL_Update(&ctx, inp, bytes);
262 WHIRLPOOL_Final(md, &ctx);
263 return md;
264 }
265
