OSX/libsecurity_cryptkit/lib/HmacSha1Legacy.c

   1 /*
   2  * Copyright (c) 2000-2001,2011-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 /*
  20         File:           HmacSha1Legacy.c
  21         Contains:       HMAC/SHA1, bug-for-bug compatible with BSAFE 4.0.
  22         Copyright (c) 2001,2011-2014 Apple Inc. All Rights Reserved.
  23 */
  24
  25 #include "ckconfig.h"
  26
  27 #include "HmacSha1Legacy.h"
  28 #include "ckSHA1.h"
  29 #include <string.h>
  30 #include <stdlib.h>
  31 #include <Security/SecBase.h>
  32 #define kHMACSHA1DigestSize  20
  33
  34 /* XXX These should really be in ckSHA1.h */
  35 #define kSHA1DigestSize         20
  36 #define kSHA1BlockSize          64
  37
  38 /*
  39  * bug-for-bug compatible with BSAFE 4.0. See
  40  * BSafe/bsource/algs/ahchhmac.c.
  41  *
  42  * This implementation, and the BSAFE implementation it emulates, work fine
  43  * when calculating a MAC in a single update (init, update, final). They
  44  * generate nonconforming MACs when performing multiple updates because
  45  * the entire algorithm - both inner and outer digests - are performed
  46  * in the update() step. As a result, if one e.g. calculates a MAC of
  47  * a block of text with one update, and then calculates the MAC over the
  48  * same block of text via two updates, different results will obtain.ÊThe
  49  * incorrect result from the multiple-update scenario is repeatable if and
  50  * only if the same boundaries (same update sizes) are observed on each operation.
  51  *
  52  * Because all of the data to be MAC'd is in fact protected by both levels of
  53  * SHA1, and all of the key bits are used, this nonconforming implementation is
  54  * believed to be as strong, cryptographically, as a conforming SHA1HMAC
  55  * implementation.
  56  */
  57 struct hmacLegacyContext {
  58         sha1Obj sha1Context;
  59         UInt8   k_ipad[kSHA1BlockSize];
  60         UInt8   k_opad[kSHA1BlockSize];
  61 };
  62
  63 hmacLegacyContextRef hmacLegacyAlloc(void)
  64 {
  65         hmacLegacyContextRef hmac =
  66                 (hmacLegacyContextRef)malloc(sizeof(struct hmacLegacyContext));
  67         memset(hmac, 0, sizeof(struct hmacLegacyContext));
  68         return hmac;
  69 }
  70
  71 void hmacLegacyFree(
  72         hmacLegacyContextRef hmac)
  73 {
  74         if(hmac != NULL) {
  75                 if(hmac->sha1Context != NULL) {
  76                         sha1Free (hmac->sha1Context);
  77                 }
  78                 memset(hmac, 0, sizeof(struct hmacLegacyContext));
  79                 free(hmac);
  80         }
  81 }
  82
  83 /* reusable init */
  84 OSStatus hmacLegacyInit(
  85         hmacLegacyContextRef hmac,
  86         const void *keyPtr,
  87         UInt32 keyLen)
  88 {
  89         UInt8   *key;
  90         UInt32  byte;
  91
  92         if(hmac->sha1Context == NULL) {
  93                 hmac->sha1Context = sha1Alloc();
  94                 if(hmac->sha1Context == NULL) {
  95                         return errSecAllocate;
  96                 }
  97         }
  98         else {
  99                 sha1Reinit(hmac->sha1Context);
 100         }
 101         /* this implementation requires a 20-byte key */
 102         if (keyLen != kSHA1DigestSize) {
 103                 /* FIXME */
 104                 return errSecParam;
 105         }
 106         key = (UInt8*)keyPtr;
 107
 108         /* The HMAC_SHA_1 transform looks like:
 109            SHA1 (K XOR opad || SHA1 (K XOR ipad || text))
 110            Where K is a n byte key
 111            ipad is the byte 0x36 repeated 64 times.
 112            opad is the byte 0x5c repeated 64 times.
 113            text is the data being protected.
 114           */
 115         /* Copy the key into k_ipad and k_opad while doing the XOR. */
 116         for (byte = 0; byte < keyLen; byte++)
 117         {
 118                 hmac->k_ipad[byte] = key[byte] ^ 0x36;
 119                 hmac->k_opad[byte] = key[byte] ^ 0x5c;
 120         }
 121
 122         /* Fill the remainder of k_ipad and k_opad with 0 XORed with
 123          * appropriate value. */
 124         memset (hmac->k_ipad + keyLen, 0x36, kSHA1BlockSize - keyLen);
 125         memset (hmac->k_opad + keyLen, 0x5c, kSHA1BlockSize - keyLen);
 126
 127         /* remainder happens in update */
 128         return errSecSuccess;
 129 }
 130
 131 OSStatus hmacLegacyUpdate(
 132         hmacLegacyContextRef hmac,
 133         const void *textPtr,
 134         UInt32 textLen)
 135 {
 136         UInt8 innerDigest[kSHA1DigestSize];
 137
 138         /* compute SHA1(k_ipad || data) ==> innerDigest */
 139         sha1AddData (hmac->sha1Context, hmac->k_ipad, kSHA1BlockSize);
 140         sha1AddData (hmac->sha1Context, (UInt8*)textPtr, textLen);
 141         memcpy (innerDigest, sha1Digest(hmac->sha1Context), kSHA1DigestSize);
 142
 143         /* reset context (BSAFE does this implicitly in a final() call) */
 144         sha1Reinit(hmac->sha1Context);
 145
 146         /* compute SHA1(k_opad || innerDigest) */
 147         sha1AddData (hmac->sha1Context, hmac->k_opad, kSHA1BlockSize);
 148         sha1AddData (hmac->sha1Context, innerDigest, kSHA1DigestSize);
 149
 150         /* if there is another update coming, it gets added in to existing
 151          * context; if the next step is a final, the current digest state is used. */
 152         return errSecSuccess;
 153 }
 154
 155 OSStatus hmacLegacyFinal(
 156         hmacLegacyContextRef hmac,
 157         void *resultPtr)                // caller mallocs, must be HMACSHA1_OUT_SIZE bytes
 158 {
 159         memcpy (resultPtr, sha1Digest (hmac->sha1Context), kSHA1DigestSize);
 160         return errSecSuccess;
 161 }
 162