123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245 |
- /* Copyright (c) 2001, Matej Pfajfar.
- * Copyright (c) 2001-2004, Roger Dingledine.
- * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
- * Copyright (c) 2007-2019, The Tor Project, Inc. */
- /* See LICENSE for licensing information */
- /**
- * \file crypto_digest.c
- * \brief Block of functions related with digest and xof utilities and
- * operations.
- **/
- #include "lib/container/smartlist.h"
- #include "lib/crypt_ops/crypto_digest.h"
- #include "lib/crypt_ops/crypto_util.h"
- #include "lib/log/log.h"
- #include "lib/log/util_bug.h"
- #include "keccak-tiny/keccak-tiny.h"
- #include <stdlib.h>
- #include <string.h>
- #include "lib/arch/bytes.h"
- /** Set the common_digests_t in <b>ds_out</b> to contain every digest on the
- * <b>len</b> bytes in <b>m</b> that we know how to compute. Return 0 on
- * success, -1 on failure. */
- int
- crypto_common_digests(common_digests_t *ds_out, const char *m, size_t len)
- {
- tor_assert(ds_out);
- memset(ds_out, 0, sizeof(*ds_out));
- if (crypto_digest(ds_out->d[DIGEST_SHA1], m, len) < 0)
- return -1;
- if (crypto_digest256(ds_out->d[DIGEST_SHA256], m, len, DIGEST_SHA256) < 0)
- return -1;
- return 0;
- }
- /** Return the name of an algorithm, as used in directory documents. */
- const char *
- crypto_digest_algorithm_get_name(digest_algorithm_t alg)
- {
- switch (alg) {
- case DIGEST_SHA1:
- return "sha1";
- case DIGEST_SHA256:
- return "sha256";
- case DIGEST_SHA512:
- return "sha512";
- case DIGEST_SHA3_256:
- return "sha3-256";
- case DIGEST_SHA3_512:
- return "sha3-512";
- // LCOV_EXCL_START
- default:
- tor_fragile_assert();
- return "??unknown_digest??";
- // LCOV_EXCL_STOP
- }
- }
- /** Given the name of a digest algorithm, return its integer value, or -1 if
- * the name is not recognized. */
- int
- crypto_digest_algorithm_parse_name(const char *name)
- {
- if (!strcmp(name, "sha1"))
- return DIGEST_SHA1;
- else if (!strcmp(name, "sha256"))
- return DIGEST_SHA256;
- else if (!strcmp(name, "sha512"))
- return DIGEST_SHA512;
- else if (!strcmp(name, "sha3-256"))
- return DIGEST_SHA3_256;
- else if (!strcmp(name, "sha3-512"))
- return DIGEST_SHA3_512;
- else
- return -1;
- }
- /** Given an algorithm, return the digest length in bytes. */
- size_t
- crypto_digest_algorithm_get_length(digest_algorithm_t alg)
- {
- switch (alg) {
- case DIGEST_SHA1:
- return DIGEST_LEN;
- case DIGEST_SHA256:
- return DIGEST256_LEN;
- case DIGEST_SHA512:
- return DIGEST512_LEN;
- case DIGEST_SHA3_256:
- return DIGEST256_LEN;
- case DIGEST_SHA3_512:
- return DIGEST512_LEN;
- default:
- tor_assert(0); // LCOV_EXCL_LINE
- return 0; /* Unreachable */ // LCOV_EXCL_LINE
- }
- }
- /** Compute a MAC using SHA3-256 of <b>msg_len</b> bytes in <b>msg</b> using a
- * <b>key</b> of length <b>key_len</b> and a <b>salt</b> of length
- * <b>salt_len</b>. Store the result of <b>len_out</b> bytes in in
- * <b>mac_out</b>. This function can't fail. */
- void
- crypto_mac_sha3_256(uint8_t *mac_out, size_t len_out,
- const uint8_t *key, size_t key_len,
- const uint8_t *msg, size_t msg_len)
- {
- crypto_digest_t *digest;
- const uint64_t key_len_netorder = tor_htonll(key_len);
- tor_assert(mac_out);
- tor_assert(key);
- tor_assert(msg);
- digest = crypto_digest256_new(DIGEST_SHA3_256);
- /* Order matters here that is any subsystem using this function should
- * expect this very precise ordering in the MAC construction. */
- crypto_digest_add_bytes(digest, (const char *) &key_len_netorder,
- sizeof(key_len_netorder));
- crypto_digest_add_bytes(digest, (const char *) key, key_len);
- crypto_digest_add_bytes(digest, (const char *) msg, msg_len);
- crypto_digest_get_digest(digest, (char *) mac_out, len_out);
- crypto_digest_free(digest);
- }
- /* xof functions */
- /** Internal state for a eXtendable-Output Function (XOF). */
- struct crypto_xof_t {
- #ifdef OPENSSL_HAS_SHAKE3_EVP
- /* XXXX We can't enable this yet, because OpenSSL's
- * DigestFinalXOF function can't be called repeatedly on the same
- * XOF.
- *
- * We could in theory use the undocumented SHA3_absorb and SHA3_squeeze
- * functions, but let's not mess with undocumented OpenSSL internals any
- * more than we have to.
- *
- * We could also revise our XOF code so that it only allows a single
- * squeeze operation; we don't require streaming squeeze operations
- * outside the tests yet.
- */
- EVP_MD_CTX *ctx;
- #else /* !defined(OPENSSL_HAS_SHAKE3_EVP) */
- keccak_state s;
- #endif /* defined(OPENSSL_HAS_SHAKE3_EVP) */
- };
- /** Allocate a new XOF object backed by SHAKE-256. The security level
- * provided is a function of the length of the output used. Read and
- * understand FIPS-202 A.2 "Additional Consideration for Extendable-Output
- * Functions" before using this construct.
- */
- crypto_xof_t *
- crypto_xof_new(void)
- {
- crypto_xof_t *xof;
- xof = tor_malloc(sizeof(crypto_xof_t));
- #ifdef OPENSSL_HAS_SHAKE256
- xof->ctx = EVP_MD_CTX_new();
- tor_assert(xof->ctx);
- int r = EVP_DigestInit(xof->ctx, EVP_shake256());
- tor_assert(r == 1);
- #else /* !defined(OPENSSL_HAS_SHAKE256) */
- keccak_xof_init(&xof->s, 256);
- #endif /* defined(OPENSSL_HAS_SHAKE256) */
- return xof;
- }
- /** Absorb bytes into a XOF object. Must not be called after a call to
- * crypto_xof_squeeze_bytes() for the same instance, and will assert
- * if attempted.
- */
- void
- crypto_xof_add_bytes(crypto_xof_t *xof, const uint8_t *data, size_t len)
- {
- #ifdef OPENSSL_HAS_SHAKE256
- int r = EVP_DigestUpdate(xof->ctx, data, len);
- tor_assert(r == 1);
- #else
- int i = keccak_xof_absorb(&xof->s, data, len);
- tor_assert(i == 0);
- #endif /* defined(OPENSSL_HAS_SHAKE256) */
- }
- /** Squeeze bytes out of a XOF object. Calling this routine will render
- * the XOF instance ineligible to absorb further data.
- */
- void
- crypto_xof_squeeze_bytes(crypto_xof_t *xof, uint8_t *out, size_t len)
- {
- #ifdef OPENSSL_HAS_SHAKE256
- int r = EVP_DigestFinalXOF(xof->ctx, out, len);
- tor_assert(r == 1);
- #else
- int i = keccak_xof_squeeze(&xof->s, out, len);
- tor_assert(i == 0);
- #endif /* defined(OPENSSL_HAS_SHAKE256) */
- }
- /** Cleanse and deallocate a XOF object. */
- void
- crypto_xof_free_(crypto_xof_t *xof)
- {
- if (!xof)
- return;
- #ifdef OPENSSL_HAS_SHAKE256
- if (xof->ctx)
- EVP_MD_CTX_free(xof->ctx);
- #endif
- memwipe(xof, 0, sizeof(crypto_xof_t));
- tor_free(xof);
- }
- /** Compute the XOF (SHAKE256) of a <b>input_len</b> bytes at <b>input</b>,
- * putting <b>output_len</b> bytes at <b>output</b>. */
- void
- crypto_xof(uint8_t *output, size_t output_len,
- const uint8_t *input, size_t input_len)
- {
- #ifdef OPENSSL_HAS_SHA3
- EVP_MD_CTX *ctx = EVP_MD_CTX_new();
- tor_assert(ctx);
- int r = EVP_DigestInit(ctx, EVP_shake256());
- tor_assert(r == 1);
- r = EVP_DigestUpdate(ctx, input, input_len);
- tor_assert(r == 1);
- r = EVP_DigestFinalXOF(ctx, output, output_len);
- tor_assert(r == 1);
- EVP_MD_CTX_free(ctx);
- #else /* !defined(OPENSSL_HAS_SHA3) */
- crypto_xof_t *xof = crypto_xof_new();
- crypto_xof_add_bytes(xof, input, input_len);
- crypto_xof_squeeze_bytes(xof, output, output_len);
- crypto_xof_free(xof);
- #endif /* defined(OPENSSL_HAS_SHA3) */
- }
|