2 * Copyright (c) 2000-2001,2011-2014 Apple Inc. All Rights Reserved.
4 * The contents of this file constitute Original Code as defined in and are
5 * subject to the Apple Public Source License Version 1.2 (the 'License').
6 * You may not use this file except in compliance with the License. Please obtain
7 * a copy of the License at http://www.apple.com/publicsource and read it before
10 * This Original Code and all software distributed under the License are
11 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
12 * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
13 * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
14 * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
15 * specific language governing rights and limitations under the License.
20 File: HmacSha1Legacy.c
21 Contains: HMAC/SHA1, bug-for-bug compatible with BSAFE 4.0.
22 Copyright (c) 2001,2011-2014 Apple Inc. All Rights Reserved.
27 #include "HmacSha1Legacy.h"
31 #include <Security/SecBase.h>
32 #define kHMACSHA1DigestSize 20
34 /* XXX These should really be in ckSHA1.h */
35 #define kSHA1DigestSize 20
36 #define kSHA1BlockSize 64
39 * bug-for-bug compatible with BSAFE 4.0. See
40 * BSafe/bsource/algs/ahchhmac.c.
42 * This implementation, and the BSAFE implementation it emulates, work fine
43 * when calculating a MAC in a single update (init, update, final). They
44 * generate nonconforming MACs when performing multiple updates because
45 * the entire algorithm - both inner and outer digests - are performed
46 * in the update() step. As a result, if one e.g. calculates a MAC of
47 * a block of text with one update, and then calculates the MAC over the
48 * same block of text via two updates, different results will obtain.ÊThe
49 * incorrect result from the multiple-update scenario is repeatable if and
50 * only if the same boundaries (same update sizes) are observed on each operation.
52 * Because all of the data to be MAC'd is in fact protected by both levels of
53 * SHA1, and all of the key bits are used, this nonconforming implementation is
54 * believed to be as strong, cryptographically, as a conforming SHA1HMAC
57 struct hmacLegacyContext
{
59 UInt8 k_ipad
[kSHA1BlockSize
];
60 UInt8 k_opad
[kSHA1BlockSize
];
63 hmacLegacyContextRef
hmacLegacyAlloc(void)
65 hmacLegacyContextRef hmac
=
66 (hmacLegacyContextRef
)malloc(sizeof(struct hmacLegacyContext
));
67 memset(hmac
, 0, sizeof(struct hmacLegacyContext
));
72 hmacLegacyContextRef hmac
)
75 if(hmac
->sha1Context
!= NULL
) {
76 sha1Free (hmac
->sha1Context
);
78 memset(hmac
, 0, sizeof(struct hmacLegacyContext
));
84 OSStatus
hmacLegacyInit(
85 hmacLegacyContextRef hmac
,
92 if(hmac
->sha1Context
== NULL
) {
93 hmac
->sha1Context
= sha1Alloc();
94 if(hmac
->sha1Context
== NULL
) {
95 return errSecAllocate
;
99 sha1Reinit(hmac
->sha1Context
);
101 /* this implementation requires a 20-byte key */
102 if (keyLen
!= kSHA1DigestSize
) {
106 key
= (UInt8
*)keyPtr
;
108 /* The HMAC_SHA_1 transform looks like:
109 SHA1 (K XOR opad || SHA1 (K XOR ipad || text))
110 Where K is a n byte key
111 ipad is the byte 0x36 repeated 64 times.
112 opad is the byte 0x5c repeated 64 times.
113 text is the data being protected.
115 /* Copy the key into k_ipad and k_opad while doing the XOR. */
116 for (byte
= 0; byte
< keyLen
; byte
++)
118 hmac
->k_ipad
[byte
] = key
[byte
] ^ 0x36;
119 hmac
->k_opad
[byte
] = key
[byte
] ^ 0x5c;
122 /* Fill the remainder of k_ipad and k_opad with 0 XORed with
123 * appropriate value. */
124 memset (hmac
->k_ipad
+ keyLen
, 0x36, kSHA1BlockSize
- keyLen
);
125 memset (hmac
->k_opad
+ keyLen
, 0x5c, kSHA1BlockSize
- keyLen
);
127 /* remainder happens in update */
128 return errSecSuccess
;
131 OSStatus
hmacLegacyUpdate(
132 hmacLegacyContextRef hmac
,
136 UInt8 innerDigest
[kSHA1DigestSize
];
138 /* compute SHA1(k_ipad || data) ==> innerDigest */
139 sha1AddData (hmac
->sha1Context
, hmac
->k_ipad
, kSHA1BlockSize
);
140 sha1AddData (hmac
->sha1Context
, (UInt8
*)textPtr
, textLen
);
141 memcpy (innerDigest
, sha1Digest(hmac
->sha1Context
), kSHA1DigestSize
);
143 /* reset context (BSAFE does this implicitly in a final() call) */
144 sha1Reinit(hmac
->sha1Context
);
146 /* compute SHA1(k_opad || innerDigest) */
147 sha1AddData (hmac
->sha1Context
, hmac
->k_opad
, kSHA1BlockSize
);
148 sha1AddData (hmac
->sha1Context
, innerDigest
, kSHA1DigestSize
);
150 /* if there is another update coming, it gets added in to existing
151 * context; if the next step is a final, the current digest state is used. */
152 return errSecSuccess
;
155 OSStatus
hmacLegacyFinal(
156 hmacLegacyContextRef hmac
,
157 void *resultPtr
) // caller mallocs, must be HMACSHA1_OUT_SIZE bytes
159 memcpy (resultPtr
, sha1Digest (hmac
->sha1Context
), kSHA1DigestSize
);
160 return errSecSuccess
;