1 /* rmd160.c - RIPE-MD160
2 * Copyright (C) 1998, 2001, 2002, 2003 Free Software Foundation, Inc.
4 * This file is part of Libgcrypt.
6 * Libgcrypt is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU Lesser General Public License as
8 * published by the Free Software Foundation; either version 2.1 of
9 * the License, or (at your option) any later version.
11 * Libgcrypt is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
28 #include "cipher.h" /* Only used for the rmd160_hash_buffer() prototype. */
33 /*********************************
34 * RIPEMD-160 is not patented, see (as of 25.10.97)
35 * http://www.esat.kuleuven.ac.be/~bosselae/ripemd160.html
36 * Note that the code uses Little Endian byteorder, which is good for
37 * 386 etc, but we must add some conversion when used on a big endian box.
40 * Pseudo-code for RIPEMD-160
42 * RIPEMD-160 is an iterative hash function that operates on 32-bit words.
43 * The round function takes as input a 5-word chaining variable and a 16-word
44 * message block and maps this to a new chaining variable. All operations are
45 * defined on 32-bit words. Padding is identical to that of MD4.
48 * RIPEMD-160: definitions
51 * nonlinear functions at bit level: exor, mux, -, mux, -
53 * f(j, x, y, z) = x XOR y XOR z (0 <= j <= 15)
54 * f(j, x, y, z) = (x AND y) OR (NOT(x) AND z) (16 <= j <= 31)
55 * f(j, x, y, z) = (x OR NOT(y)) XOR z (32 <= j <= 47)
56 * f(j, x, y, z) = (x AND z) OR (y AND NOT(z)) (48 <= j <= 63)
57 * f(j, x, y, z) = x XOR (y OR NOT(z)) (64 <= j <= 79)
60 * added constants (hexadecimal)
62 * K(j) = 0x00000000 (0 <= j <= 15)
63 * K(j) = 0x5A827999 (16 <= j <= 31) int(2**30 x sqrt(2))
64 * K(j) = 0x6ED9EBA1 (32 <= j <= 47) int(2**30 x sqrt(3))
65 * K(j) = 0x8F1BBCDC (48 <= j <= 63) int(2**30 x sqrt(5))
66 * K(j) = 0xA953FD4E (64 <= j <= 79) int(2**30 x sqrt(7))
67 * K'(j) = 0x50A28BE6 (0 <= j <= 15) int(2**30 x cbrt(2))
68 * K'(j) = 0x5C4DD124 (16 <= j <= 31) int(2**30 x cbrt(3))
69 * K'(j) = 0x6D703EF3 (32 <= j <= 47) int(2**30 x cbrt(5))
70 * K'(j) = 0x7A6D76E9 (48 <= j <= 63) int(2**30 x cbrt(7))
71 * K'(j) = 0x00000000 (64 <= j <= 79)
74 * selection of message word
76 * r(j) = j (0 <= j <= 15)
77 * r(16..31) = 7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8
78 * r(32..47) = 3, 10, 14, 4, 9, 15, 8, 1, 2, 7, 0, 6, 13, 11, 5, 12
79 * r(48..63) = 1, 9, 11, 10, 0, 8, 12, 4, 13, 3, 7, 15, 14, 5, 6, 2
80 * r(64..79) = 4, 0, 5, 9, 7, 12, 2, 10, 14, 1, 3, 8, 11, 6, 15, 13
81 * r0(0..15) = 5, 14, 7, 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12
82 * r0(16..31)= 6, 11, 3, 7, 0, 13, 5, 10, 14, 15, 8, 12, 4, 9, 1, 2
83 * r0(32..47)= 15, 5, 1, 3, 7, 14, 6, 9, 11, 8, 12, 2, 10, 0, 4, 13
84 * r0(48..63)= 8, 6, 4, 1, 3, 11, 15, 0, 5, 12, 2, 13, 9, 7, 10, 14
85 * r0(64..79)= 12, 15, 10, 4, 1, 5, 8, 7, 6, 2, 13, 14, 0, 3, 9, 11
88 * amount for rotate left (rol)
90 * s(0..15) = 11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8
91 * s(16..31) = 7, 6, 8, 13, 11, 9, 7, 15, 7, 12, 15, 9, 11, 7, 13, 12
92 * s(32..47) = 11, 13, 6, 7, 14, 9, 13, 15, 14, 8, 13, 6, 5, 12, 7, 5
93 * s(48..63) = 11, 12, 14, 15, 14, 15, 9, 8, 9, 14, 5, 6, 8, 6, 5, 12
94 * s(64..79) = 9, 15, 5, 11, 6, 8, 13, 12, 5, 12, 13, 14, 11, 8, 5, 6
95 * s'(0..15) = 8, 9, 9, 11, 13, 15, 15, 5, 7, 7, 8, 11, 14, 14, 12, 6
96 * s'(16..31)= 9, 13, 15, 7, 12, 8, 9, 11, 7, 7, 12, 7, 6, 15, 13, 11
97 * s'(32..47)= 9, 7, 15, 11, 8, 6, 6, 14, 12, 13, 5, 14, 13, 13, 7, 5
98 * s'(48..63)= 15, 5, 8, 11, 14, 14, 6, 14, 6, 9, 12, 9, 12, 5, 15, 8
99 * s'(64..79)= 8, 5, 12, 9, 12, 5, 14, 6, 8, 13, 6, 5, 15, 13, 11, 11
102 * initial value (hexadecimal)
104 * h0 = 0x67452301; h1 = 0xEFCDAB89; h2 = 0x98BADCFE; h3 = 0x10325476;
108 * RIPEMD-160: pseudo-code
110 * It is assumed that the message after padding consists of t 16-word blocks
111 * that will be denoted with X[i][j], with 0 <= i <= t-1 and 0 <= j <= 15.
112 * The symbol [+] denotes addition modulo 2**32 and rol_s denotes cyclic left
113 * shift (rotate) over s positions.
116 * for i := 0 to t-1 {
117 * A := h0; B := h1; C := h2; D = h3; E = h4;
118 * A' := h0; B' := h1; C' := h2; D' = h3; E' = h4;
120 * T := rol_s(j)(A [+] f(j, B, C, D) [+] X[i][r(j)] [+] K(j)) [+] E;
121 * A := E; E := D; D := rol_10(C); C := B; B := T;
122 * T := rol_s'(j)(A' [+] f(79-j, B', C', D') [+] X[i][r'(j)]
124 * A' := E'; E' := D'; D' := rol_10(C'); C' := B'; B' := T;
126 * T := h1 [+] C [+] D'; h1 := h2 [+] D [+] E'; h2 := h3 [+] E [+] A';
127 * h3 := h4 [+] A [+] B'; h4 := h0 [+] B [+] C'; h0 := T;
132 * "" 9c1185a5c5e9fc54612808977ee8f548b2258d31
133 * "a" 0bdc9d2d256b3ee9daae347be6f4dc835a467ffe
134 * "abc" 8eb208f7e05d987a9b044a8e98c6b087f15a0bfc
135 * "message digest" 5d0689ef49d2fae572b881b123a85ffa21595f36
136 * "a...z" f71c27109c692c1b56bbdceb5b9d2865b3708dbc
137 * "abcdbcde...nopq" 12a053384a9c0c88e405a06c27dcf49ada62eb2b
138 * "A...Za...z0...9" b0e20b6e3116640286ed3a87a5713079b21f5189
139 * 8 times "1234567890" 9b752e45573d4b39f4dbd3323cab82bf63326bfb
140 * 1 million times "a" 52783243c1697bdbe16d37f97f68f08325dc1528
144 transform ( void *ctx, const unsigned char *data );
147 rmd160_init (void *context, unsigned int flags)
149 RMD160_CONTEXT *hd = context;
159 hd->bctx.nblocks = 0;
160 hd->bctx.nblocks_high = 0;
162 hd->bctx.blocksize = 64;
163 hd->bctx.bwrite = transform;
168 _gcry_rmd160_init (void *context)
170 rmd160_init (context, 0);
175 * Transform the message X which consists of 16 32-bit-words
178 transform ( void *ctx, const unsigned char *data )
180 RMD160_CONTEXT *hd = ctx;
181 register u32 a,b,c,d,e;
182 u32 aa,bb,cc,dd,ee,t;
186 for ( i = 0; i < 16; i++ )
187 x[i] = buf_get_le32(data + i * 4);
189 #define K0 0x00000000
190 #define K1 0x5A827999
191 #define K2 0x6ED9EBA1
192 #define K3 0x8F1BBCDC
193 #define K4 0xA953FD4E
194 #define KK0 0x50A28BE6
195 #define KK1 0x5C4DD124
196 #define KK2 0x6D703EF3
197 #define KK3 0x7A6D76E9
198 #define KK4 0x00000000
199 #define F0(x,y,z) ( (x) ^ (y) ^ (z) )
200 #define F1(x,y,z) ( ((x) & (y)) | (~(x) & (z)) )
201 #define F2(x,y,z) ( ((x) | ~(y)) ^ (z) )
202 #define F3(x,y,z) ( ((x) & (z)) | ((y) & ~(z)) )
203 #define F4(x,y,z) ( (x) ^ ((y) | ~(z)) )
204 #define R(a,b,c,d,e,f,k,r,s) do { t = a + f(b,c,d) + k + x[r]; \
215 R( a, b, c, d, e, F0, K0, 0, 11 );
216 R( e, a, b, c, d, F0, K0, 1, 14 );
217 R( d, e, a, b, c, F0, K0, 2, 15 );
218 R( c, d, e, a, b, F0, K0, 3, 12 );
219 R( b, c, d, e, a, F0, K0, 4, 5 );
220 R( a, b, c, d, e, F0, K0, 5, 8 );
221 R( e, a, b, c, d, F0, K0, 6, 7 );
222 R( d, e, a, b, c, F0, K0, 7, 9 );
223 R( c, d, e, a, b, F0, K0, 8, 11 );
224 R( b, c, d, e, a, F0, K0, 9, 13 );
225 R( a, b, c, d, e, F0, K0, 10, 14 );
226 R( e, a, b, c, d, F0, K0, 11, 15 );
227 R( d, e, a, b, c, F0, K0, 12, 6 );
228 R( c, d, e, a, b, F0, K0, 13, 7 );
229 R( b, c, d, e, a, F0, K0, 14, 9 );
230 R( a, b, c, d, e, F0, K0, 15, 8 );
231 R( e, a, b, c, d, F1, K1, 7, 7 );
232 R( d, e, a, b, c, F1, K1, 4, 6 );
233 R( c, d, e, a, b, F1, K1, 13, 8 );
234 R( b, c, d, e, a, F1, K1, 1, 13 );
235 R( a, b, c, d, e, F1, K1, 10, 11 );
236 R( e, a, b, c, d, F1, K1, 6, 9 );
237 R( d, e, a, b, c, F1, K1, 15, 7 );
238 R( c, d, e, a, b, F1, K1, 3, 15 );
239 R( b, c, d, e, a, F1, K1, 12, 7 );
240 R( a, b, c, d, e, F1, K1, 0, 12 );
241 R( e, a, b, c, d, F1, K1, 9, 15 );
242 R( d, e, a, b, c, F1, K1, 5, 9 );
243 R( c, d, e, a, b, F1, K1, 2, 11 );
244 R( b, c, d, e, a, F1, K1, 14, 7 );
245 R( a, b, c, d, e, F1, K1, 11, 13 );
246 R( e, a, b, c, d, F1, K1, 8, 12 );
247 R( d, e, a, b, c, F2, K2, 3, 11 );
248 R( c, d, e, a, b, F2, K2, 10, 13 );
249 R( b, c, d, e, a, F2, K2, 14, 6 );
250 R( a, b, c, d, e, F2, K2, 4, 7 );
251 R( e, a, b, c, d, F2, K2, 9, 14 );
252 R( d, e, a, b, c, F2, K2, 15, 9 );
253 R( c, d, e, a, b, F2, K2, 8, 13 );
254 R( b, c, d, e, a, F2, K2, 1, 15 );
255 R( a, b, c, d, e, F2, K2, 2, 14 );
256 R( e, a, b, c, d, F2, K2, 7, 8 );
257 R( d, e, a, b, c, F2, K2, 0, 13 );
258 R( c, d, e, a, b, F2, K2, 6, 6 );
259 R( b, c, d, e, a, F2, K2, 13, 5 );
260 R( a, b, c, d, e, F2, K2, 11, 12 );
261 R( e, a, b, c, d, F2, K2, 5, 7 );
262 R( d, e, a, b, c, F2, K2, 12, 5 );
263 R( c, d, e, a, b, F3, K3, 1, 11 );
264 R( b, c, d, e, a, F3, K3, 9, 12 );
265 R( a, b, c, d, e, F3, K3, 11, 14 );
266 R( e, a, b, c, d, F3, K3, 10, 15 );
267 R( d, e, a, b, c, F3, K3, 0, 14 );
268 R( c, d, e, a, b, F3, K3, 8, 15 );
269 R( b, c, d, e, a, F3, K3, 12, 9 );
270 R( a, b, c, d, e, F3, K3, 4, 8 );
271 R( e, a, b, c, d, F3, K3, 13, 9 );
272 R( d, e, a, b, c, F3, K3, 3, 14 );
273 R( c, d, e, a, b, F3, K3, 7, 5 );
274 R( b, c, d, e, a, F3, K3, 15, 6 );
275 R( a, b, c, d, e, F3, K3, 14, 8 );
276 R( e, a, b, c, d, F3, K3, 5, 6 );
277 R( d, e, a, b, c, F3, K3, 6, 5 );
278 R( c, d, e, a, b, F3, K3, 2, 12 );
279 R( b, c, d, e, a, F4, K4, 4, 9 );
280 R( a, b, c, d, e, F4, K4, 0, 15 );
281 R( e, a, b, c, d, F4, K4, 5, 5 );
282 R( d, e, a, b, c, F4, K4, 9, 11 );
283 R( c, d, e, a, b, F4, K4, 7, 6 );
284 R( b, c, d, e, a, F4, K4, 12, 8 );
285 R( a, b, c, d, e, F4, K4, 2, 13 );
286 R( e, a, b, c, d, F4, K4, 10, 12 );
287 R( d, e, a, b, c, F4, K4, 14, 5 );
288 R( c, d, e, a, b, F4, K4, 1, 12 );
289 R( b, c, d, e, a, F4, K4, 3, 13 );
290 R( a, b, c, d, e, F4, K4, 8, 14 );
291 R( e, a, b, c, d, F4, K4, 11, 11 );
292 R( d, e, a, b, c, F4, K4, 6, 8 );
293 R( c, d, e, a, b, F4, K4, 15, 5 );
294 R( b, c, d, e, a, F4, K4, 13, 6 );
296 aa = a; bb = b; cc = c; dd = d; ee = e;
304 R( a, b, c, d, e, F4, KK0, 5, 8);
305 R( e, a, b, c, d, F4, KK0, 14, 9);
306 R( d, e, a, b, c, F4, KK0, 7, 9);
307 R( c, d, e, a, b, F4, KK0, 0, 11);
308 R( b, c, d, e, a, F4, KK0, 9, 13);
309 R( a, b, c, d, e, F4, KK0, 2, 15);
310 R( e, a, b, c, d, F4, KK0, 11, 15);
311 R( d, e, a, b, c, F4, KK0, 4, 5);
312 R( c, d, e, a, b, F4, KK0, 13, 7);
313 R( b, c, d, e, a, F4, KK0, 6, 7);
314 R( a, b, c, d, e, F4, KK0, 15, 8);
315 R( e, a, b, c, d, F4, KK0, 8, 11);
316 R( d, e, a, b, c, F4, KK0, 1, 14);
317 R( c, d, e, a, b, F4, KK0, 10, 14);
318 R( b, c, d, e, a, F4, KK0, 3, 12);
319 R( a, b, c, d, e, F4, KK0, 12, 6);
320 R( e, a, b, c, d, F3, KK1, 6, 9);
321 R( d, e, a, b, c, F3, KK1, 11, 13);
322 R( c, d, e, a, b, F3, KK1, 3, 15);
323 R( b, c, d, e, a, F3, KK1, 7, 7);
324 R( a, b, c, d, e, F3, KK1, 0, 12);
325 R( e, a, b, c, d, F3, KK1, 13, 8);
326 R( d, e, a, b, c, F3, KK1, 5, 9);
327 R( c, d, e, a, b, F3, KK1, 10, 11);
328 R( b, c, d, e, a, F3, KK1, 14, 7);
329 R( a, b, c, d, e, F3, KK1, 15, 7);
330 R( e, a, b, c, d, F3, KK1, 8, 12);
331 R( d, e, a, b, c, F3, KK1, 12, 7);
332 R( c, d, e, a, b, F3, KK1, 4, 6);
333 R( b, c, d, e, a, F3, KK1, 9, 15);
334 R( a, b, c, d, e, F3, KK1, 1, 13);
335 R( e, a, b, c, d, F3, KK1, 2, 11);
336 R( d, e, a, b, c, F2, KK2, 15, 9);
337 R( c, d, e, a, b, F2, KK2, 5, 7);
338 R( b, c, d, e, a, F2, KK2, 1, 15);
339 R( a, b, c, d, e, F2, KK2, 3, 11);
340 R( e, a, b, c, d, F2, KK2, 7, 8);
341 R( d, e, a, b, c, F2, KK2, 14, 6);
342 R( c, d, e, a, b, F2, KK2, 6, 6);
343 R( b, c, d, e, a, F2, KK2, 9, 14);
344 R( a, b, c, d, e, F2, KK2, 11, 12);
345 R( e, a, b, c, d, F2, KK2, 8, 13);
346 R( d, e, a, b, c, F2, KK2, 12, 5);
347 R( c, d, e, a, b, F2, KK2, 2, 14);
348 R( b, c, d, e, a, F2, KK2, 10, 13);
349 R( a, b, c, d, e, F2, KK2, 0, 13);
350 R( e, a, b, c, d, F2, KK2, 4, 7);
351 R( d, e, a, b, c, F2, KK2, 13, 5);
352 R( c, d, e, a, b, F1, KK3, 8, 15);
353 R( b, c, d, e, a, F1, KK3, 6, 5);
354 R( a, b, c, d, e, F1, KK3, 4, 8);
355 R( e, a, b, c, d, F1, KK3, 1, 11);
356 R( d, e, a, b, c, F1, KK3, 3, 14);
357 R( c, d, e, a, b, F1, KK3, 11, 14);
358 R( b, c, d, e, a, F1, KK3, 15, 6);
359 R( a, b, c, d, e, F1, KK3, 0, 14);
360 R( e, a, b, c, d, F1, KK3, 5, 6);
361 R( d, e, a, b, c, F1, KK3, 12, 9);
362 R( c, d, e, a, b, F1, KK3, 2, 12);
363 R( b, c, d, e, a, F1, KK3, 13, 9);
364 R( a, b, c, d, e, F1, KK3, 9, 12);
365 R( e, a, b, c, d, F1, KK3, 7, 5);
366 R( d, e, a, b, c, F1, KK3, 10, 15);
367 R( c, d, e, a, b, F1, KK3, 14, 8);
368 R( b, c, d, e, a, F0, KK4, 12, 8);
369 R( a, b, c, d, e, F0, KK4, 15, 5);
370 R( e, a, b, c, d, F0, KK4, 10, 12);
371 R( d, e, a, b, c, F0, KK4, 4, 9);
372 R( c, d, e, a, b, F0, KK4, 1, 12);
373 R( b, c, d, e, a, F0, KK4, 5, 5);
374 R( a, b, c, d, e, F0, KK4, 8, 14);
375 R( e, a, b, c, d, F0, KK4, 7, 6);
376 R( d, e, a, b, c, F0, KK4, 6, 8);
377 R( c, d, e, a, b, F0, KK4, 2, 13);
378 R( b, c, d, e, a, F0, KK4, 13, 6);
379 R( a, b, c, d, e, F0, KK4, 14, 5);
380 R( e, a, b, c, d, F0, KK4, 0, 15);
381 R( d, e, a, b, c, F0, KK4, 3, 13);
382 R( c, d, e, a, b, F0, KK4, 9, 11);
383 R( b, c, d, e, a, F0, KK4, 11, 11);
387 hd->h1 = hd->h2 + e + dd;
388 hd->h2 = hd->h3 + a + ee;
389 hd->h3 = hd->h4 + b + aa;
390 hd->h4 = hd->h0 + c + bb;
393 return /*burn_stack*/ 108+5*sizeof(void*);
398 * Apply the rmd160 transform function on the buffer which must have
399 * a length 64 bytes. Do not use this function together with the
400 * other functions, use rmd160_init to initialize internal variables.
401 * Returns: 16 bytes in buffer with the mixed contentes of buffer.
404 _gcry_rmd160_mixblock ( RMD160_CONTEXT *hd, void *blockof64byte )
406 char *p = blockof64byte;
408 transform ( hd, blockof64byte );
409 #define X(a) do { *(u32*)p = hd->h##a ; p += 4; } while(0)
419 /* The routine terminates the computation
423 rmd160_final( void *context )
425 RMD160_CONTEXT *hd = context;
430 _gcry_md_block_write(hd, NULL, 0); /* flush */;
432 t = hd->bctx.nblocks;
433 if (sizeof t == sizeof hd->bctx.nblocks)
434 th = hd->bctx.nblocks_high;
436 th = hd->bctx.nblocks >> 32;
438 /* multiply by 64 to make a byte count */
440 msb = (th << 6) | (t >> 26);
443 if( (lsb += hd->bctx.count) < t )
445 /* multiply by 8 to make a bit count */
451 if( hd->bctx.count < 56 ) /* enough room */
453 hd->bctx.buf[hd->bctx.count++] = 0x80; /* pad */
454 while( hd->bctx.count < 56 )
455 hd->bctx.buf[hd->bctx.count++] = 0; /* pad */
457 else /* need one extra block */
459 hd->bctx.buf[hd->bctx.count++] = 0x80; /* pad character */
460 while( hd->bctx.count < 64 )
461 hd->bctx.buf[hd->bctx.count++] = 0;
462 _gcry_md_block_write(hd, NULL, 0); /* flush */;
463 memset(hd->bctx.buf, 0, 56 ); /* fill next block with zeroes */
465 /* append the 64 bit count */
466 buf_put_le32(hd->bctx.buf + 56, lsb);
467 buf_put_le32(hd->bctx.buf + 60, msb);
468 burn = transform( hd, hd->bctx.buf );
469 _gcry_burn_stack (burn);
472 #define X(a) do { *(u32*)p = le_bswap32(hd->h##a) ; p += 4; } while(0)
482 rmd160_read( void *context )
484 RMD160_CONTEXT *hd = context;
492 * Shortcut functions which puts the hash value of the supplied buffer
493 * into outbuf which must have a size of 20 bytes.
496 _gcry_rmd160_hash_buffer (void *outbuf, const void *buffer, size_t length )
500 _gcry_rmd160_init ( &hd );
501 _gcry_md_block_write ( &hd, buffer, length );
502 rmd160_final ( &hd );
503 memcpy ( outbuf, hd.bctx.buf, 20 );
506 static byte asn[15] = /* Object ID is 1.3.36.3.2.1 */
507 { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
508 0x02, 0x01, 0x05, 0x00, 0x04, 0x14 };
510 static gcry_md_oid_spec_t oid_spec_rmd160[] =
512 /* rsaSignatureWithripemd160 */
513 { "1.3.36.3.3.1.2" },
514 /* TeleTrust hash algorithm. */
519 gcry_md_spec_t _gcry_digest_spec_rmd160 =
521 GCRY_MD_RMD160, {0, 0},
522 "RIPEMD160", asn, DIM (asn), oid_spec_rmd160, 20,
523 rmd160_init, _gcry_md_block_write, rmd160_final, rmd160_read,
524 sizeof (RMD160_CONTEXT)