sha256.go

Documentation: crypto/sha256

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Package sha256 implements the SHA224 and SHA256 hash algorithms as defined
     6  // in FIPS 180-4.
     7  package sha256
     8  
     9  import (
    10  	"crypto"
    11  	"crypto/internal/boring"
    12  	"encoding/binary"
    13  	"errors"
    14  	"hash"
    15  )
    16  
    17  func init() {
    18  	crypto.RegisterHash(crypto.SHA224, New224)
    19  	crypto.RegisterHash(crypto.SHA256, New)
    20  }
    21  
    22  // The size of a SHA256 checksum in bytes.
    23  const Size = 32
    24  
    25  // The size of a SHA224 checksum in bytes.
    26  const Size224 = 28
    27  
    28  // The blocksize of SHA256 and SHA224 in bytes.
    29  const BlockSize = 64
    30  
    31  const (
    32  	chunk     = 64
    33  	init0     = 0x6A09E667
    34  	init1     = 0xBB67AE85
    35  	init2     = 0x3C6EF372
    36  	init3     = 0xA54FF53A
    37  	init4     = 0x510E527F
    38  	init5     = 0x9B05688C
    39  	init6     = 0x1F83D9AB
    40  	init7     = 0x5BE0CD19
    41  	init0_224 = 0xC1059ED8
    42  	init1_224 = 0x367CD507
    43  	init2_224 = 0x3070DD17
    44  	init3_224 = 0xF70E5939
    45  	init4_224 = 0xFFC00B31
    46  	init5_224 = 0x68581511
    47  	init6_224 = 0x64F98FA7
    48  	init7_224 = 0xBEFA4FA4
    49  )
    50  
    51  // digest represents the partial evaluation of a checksum.
    52  type digest struct {
    53  	h     [8]uint32
    54  	x     [chunk]byte
    55  	nx    int
    56  	len   uint64
    57  	is224 bool // mark if this digest is SHA-224
    58  }
    59  
    60  const (
    61  	magic224      = "sha\x02"
    62  	magic256      = "sha\x03"
    63  	marshaledSize = len(magic256) + 8*4 + chunk + 8
    64  )
    65  
    66  func (d *digest) MarshalBinary() ([]byte, error) {
    67  	b := make([]byte, 0, marshaledSize)
    68  	if d.is224 {
    69  		b = append(b, magic224...)
    70  	} else {
    71  		b = append(b, magic256...)
    72  	}
    73  	b = appendUint32(b, d.h[0])
    74  	b = appendUint32(b, d.h[1])
    75  	b = appendUint32(b, d.h[2])
    76  	b = appendUint32(b, d.h[3])
    77  	b = appendUint32(b, d.h[4])
    78  	b = appendUint32(b, d.h[5])
    79  	b = appendUint32(b, d.h[6])
    80  	b = appendUint32(b, d.h[7])
    81  	b = append(b, d.x[:d.nx]...)
    82  	b = b[:len(b)+len(d.x)-int(d.nx)] // already zero
    83  	b = appendUint64(b, d.len)
    84  	return b, nil
    85  }
    86  
    87  func (d *digest) UnmarshalBinary(b []byte) error {
    88  	if len(b) < len(magic224) || (d.is224 && string(b[:len(magic224)]) != magic224) || (!d.is224 && string(b[:len(magic256)]) != magic256) {
    89  		return errors.New("crypto/sha256: invalid hash state identifier")
    90  	}
    91  	if len(b) != marshaledSize {
    92  		return errors.New("crypto/sha256: invalid hash state size")
    93  	}
    94  	b = b[len(magic224):]
    95  	b, d.h[0] = consumeUint32(b)
    96  	b, d.h[1] = consumeUint32(b)
    97  	b, d.h[2] = consumeUint32(b)
    98  	b, d.h[3] = consumeUint32(b)
    99  	b, d.h[4] = consumeUint32(b)
   100  	b, d.h[5] = consumeUint32(b)
   101  	b, d.h[6] = consumeUint32(b)
   102  	b, d.h[7] = consumeUint32(b)
   103  	b = b[copy(d.x[:], b):]
   104  	b, d.len = consumeUint64(b)
   105  	d.nx = int(d.len % chunk)
   106  	return nil
   107  }
   108  
   109  func appendUint64(b []byte, x uint64) []byte {
   110  	var a [8]byte
   111  	binary.BigEndian.PutUint64(a[:], x)
   112  	return append(b, a[:]...)
   113  }
   114  
   115  func appendUint32(b []byte, x uint32) []byte {
   116  	var a [4]byte
   117  	binary.BigEndian.PutUint32(a[:], x)
   118  	return append(b, a[:]...)
   119  }
   120  
   121  func consumeUint64(b []byte) ([]byte, uint64) {
   122  	_ = b[7]
   123  	x := uint64(b[7]) | uint64(b[6])<<8 | uint64(b[5])<<16 | uint64(b[4])<<24 |
   124  		uint64(b[3])<<32 | uint64(b[2])<<40 | uint64(b[1])<<48 | uint64(b[0])<<56
   125  	return b[8:], x
   126  }
   127  
   128  func consumeUint32(b []byte) ([]byte, uint32) {
   129  	_ = b[3]
   130  	x := uint32(b[3]) | uint32(b[2])<<8 | uint32(b[1])<<16 | uint32(b[0])<<24
   131  	return b[4:], x
   132  }
   133  
   134  func (d *digest) Reset() {
   135  	if !d.is224 {
   136  		d.h[0] = init0
   137  		d.h[1] = init1
   138  		d.h[2] = init2
   139  		d.h[3] = init3
   140  		d.h[4] = init4
   141  		d.h[5] = init5
   142  		d.h[6] = init6
   143  		d.h[7] = init7
   144  	} else {
   145  		d.h[0] = init0_224
   146  		d.h[1] = init1_224
   147  		d.h[2] = init2_224
   148  		d.h[3] = init3_224
   149  		d.h[4] = init4_224
   150  		d.h[5] = init5_224
   151  		d.h[6] = init6_224
   152  		d.h[7] = init7_224
   153  	}
   154  	d.nx = 0
   155  	d.len = 0
   156  }
   157  
   158  // New returns a new hash.Hash computing the SHA256 checksum. The Hash
   159  // also implements encoding.BinaryMarshaler and
   160  // encoding.BinaryUnmarshaler to marshal and unmarshal the internal
   161  // state of the hash.
   162  func New() hash.Hash {
   163  	if boring.Enabled {
   164  		return boring.NewSHA256()
   165  	}
   166  	d := new(digest)
   167  	d.Reset()
   168  	return d
   169  }
   170  
   171  // New224 returns a new hash.Hash computing the SHA224 checksum.
   172  func New224() hash.Hash {
   173  	if boring.Enabled {
   174  		return boring.NewSHA224()
   175  	}
   176  	d := new(digest)
   177  	d.is224 = true
   178  	d.Reset()
   179  	return d
   180  }
   181  
   182  func (d *digest) Size() int {
   183  	if !d.is224 {
   184  		return Size
   185  	}
   186  	return Size224
   187  }
   188  
   189  func (d *digest) BlockSize() int { return BlockSize }
   190  
   191  func (d *digest) Write(p []byte) (nn int, err error) {
   192  	boring.Unreachable()
   193  	nn = len(p)
   194  	d.len += uint64(nn)
   195  	if d.nx > 0 {
   196  		n := copy(d.x[d.nx:], p)
   197  		d.nx += n
   198  		if d.nx == chunk {
   199  			block(d, d.x[:])
   200  			d.nx = 0
   201  		}
   202  		p = p[n:]
   203  	}
   204  	if len(p) >= chunk {
   205  		n := len(p) &^ (chunk - 1)
   206  		block(d, p[:n])
   207  		p = p[n:]
   208  	}
   209  	if len(p) > 0 {
   210  		d.nx = copy(d.x[:], p)
   211  	}
   212  	return
   213  }
   214  
   215  func (d *digest) Sum(in []byte) []byte {
   216  	boring.Unreachable()
   217  	// Make a copy of d so that caller can keep writing and summing.
   218  	d0 := *d
   219  	hash := d0.checkSum()
   220  	if d0.is224 {
   221  		return append(in, hash[:Size224]...)
   222  	}
   223  	return append(in, hash[:]...)
   224  }
   225  
   226  func (d *digest) checkSum() [Size]byte {
   227  	len := d.len
   228  	// Padding. Add a 1 bit and 0 bits until 56 bytes mod 64.
   229  	var tmp [64]byte
   230  	tmp[0] = 0x80
   231  	if len%64 < 56 {
   232  		d.Write(tmp[0 : 56-len%64])
   233  	} else {
   234  		d.Write(tmp[0 : 64+56-len%64])
   235  	}
   236  
   237  	// Length in bits.
   238  	len <<= 3
   239  	binary.BigEndian.PutUint64(tmp[:], len)
   240  	d.Write(tmp[0:8])
   241  
   242  	if d.nx != 0 {
   243  		panic("d.nx != 0")
   244  	}
   245  
   246  	var digest [Size]byte
   247  
   248  	binary.BigEndian.PutUint32(digest[0:], d.h[0])
   249  	binary.BigEndian.PutUint32(digest[4:], d.h[1])
   250  	binary.BigEndian.PutUint32(digest[8:], d.h[2])
   251  	binary.BigEndian.PutUint32(digest[12:], d.h[3])
   252  	binary.BigEndian.PutUint32(digest[16:], d.h[4])
   253  	binary.BigEndian.PutUint32(digest[20:], d.h[5])
   254  	binary.BigEndian.PutUint32(digest[24:], d.h[6])
   255  	if !d.is224 {
   256  		binary.BigEndian.PutUint32(digest[28:], d.h[7])
   257  	}
   258  
   259  	return digest
   260  }
   261  
   262  // Sum256 returns the SHA256 checksum of the data.
   263  func Sum256(data []byte) [Size]byte {
   264  	if boring.Enabled {
   265  		return boring.SHA256(data)
   266  	}
   267  	var d digest
   268  	d.Reset()
   269  	d.Write(data)
   270  	return d.checkSum()
   271  }
   272  
   273  // Sum224 returns the SHA224 checksum of the data.
   274  func Sum224(data []byte) [Size224]byte {
   275  	if boring.Enabled {
   276  		return boring.SHA224(data)
   277  	}
   278  	var d digest
   279  	d.is224 = true
   280  	d.Reset()
   281  	d.Write(data)
   282  	sum := d.checkSum()
   283  	ap := (*[Size224]byte)(sum[:])
   284  	return *ap
   285  }
   286
View as plain text