1/*
2 * This is an OpenSSL-compatible implementation of the RSA Data Security, Inc.
3 * MD5 Message-Digest Algorithm (RFC 1321).
4 *
5 * Homepage:
6 * http://openwall.info/wiki/people/solar/software/public-domain-source-code/md5
7 *
8 * Author:
9 * Alexander Peslyak, better known as Solar Designer <solar at openwall.com>
10 *
11 * This software was written by Alexander Peslyak in 2001. No copyright is
12 * claimed, and the software is hereby placed in the public domain.
13 * In case this attempt to disclaim copyright and place the software in the
14 * public domain is deemed null and void, then the software is
15 * Copyright (c) 2001 Alexander Peslyak and it is hereby released to the
16 * general public under the following terms:
17 *
18 * Redistribution and use in source and binary forms, with or without
19 * modification, are permitted.
20 *
21 * There's ABSOLUTELY NO WARRANTY, express or implied.
22 *
23 * (This is a heavily cut-down "BSD license".)
24 *
25 * This differs from Colin Plumb's older public domain implementation in that
26 * no exactly 32-bit integer data type is required (any 32-bit or wider
27 * unsigned integer data type will do), there's no compile-time endianness
28 * configuration, and the function prototypes match OpenSSL's. No code from
29 * Colin Plumb's implementation has been reused; this comment merely compares
30 * the properties of the two independent implementations.
31 *
32 * The primary goals of this implementation are portability and ease of use.
33 * It is meant to be fast, but not as fast as possible. Some known
34 * optimizations are not included to reduce source code size and avoid
35 * compile-time configuration.
36 */
37
38#include <string.h>
39
40#include "md5.h"
41
42/*
43 * The basic MD5 functions.
44 *
45 * F and G are optimized compared to their RFC 1321 definitions for
46 * architectures that lack an AND-NOT instruction, just like in Colin Plumb's
47 * implementation.
48 */
49#define F(x, y, z) ((z) ^ ((x) & ((y) ^ (z))))
50#define G(x, y, z) ((y) ^ ((z) & ((x) ^ (y))))
51#define H(x, y, z) (((x) ^ (y)) ^ (z))
52#define H2(x, y, z) ((x) ^ ((y) ^ (z)))
53#define I(x, y, z) ((y) ^ ((x) | ~(z)))
54
55/*
56 * The MD5 transformation for all four rounds.
57 */
58#define STEP(f, a, b, c, d, x, t, s) \
59 (a) += f((b), (c), (d)) + (x) + (t); \
60 (a) = (((a) << (s)) | (((a) & 0xffffffff) >> (32 - (s)))); \
61 (a) += (b);
62
63/*
64 * SET reads 4 input bytes in little-endian byte order and stores them in a
65 * properly aligned word in host byte order.
66 *
67 * The check for little-endian architectures that tolerate unaligned memory
68 * accesses is just an optimization. Nothing will break if it fails to detect
69 * a suitable architecture.
70 *
71 * Unfortunately, this optimization may be a C strict aliasing rules violation
72 * if the caller's data buffer has effective type that cannot be aliased by
73 * MD5_u32plus. In practice, this problem may occur if these MD5 routines are
74 * inlined into a calling function, or with future and dangerously advanced
75 * link-time optimizations. For the time being, keeping these MD5 routines in
76 * their own translation unit avoids the problem.
77 */
78#if defined(__i386__) || defined(__x86_64__) || defined(__vax__)
79#define SET(n) \
80 (*(MD5_u32plus *)&ptr[(n) * 4])
81#define GET(n) \
82 SET(n)
83#else
84#define SET(n) \
85 (ctx->block[(n)] = \
86 (MD5_u32plus)ptr[(n) * 4] | \
87 ((MD5_u32plus)ptr[(n) * 4 + 1] << 8) | \
88 ((MD5_u32plus)ptr[(n) * 4 + 2] << 16) | \
89 ((MD5_u32plus)ptr[(n) * 4 + 3] << 24))
90#define GET(n) \
91 (ctx->block[(n)])
92#endif
93
94/*
95 * This processes one or more 64-byte data blocks, but does NOT update the bit
96 * counters. There are no alignment requirements.
97 */
98static const void *body(MD5_CTX *ctx, const void *data, unsigned long size)
99{
100 const unsigned char *ptr;
101 MD5_u32plus a, b, c, d;
102 MD5_u32plus saved_a, saved_b, saved_c, saved_d;
103
104 ptr = (const unsigned char *)data;
105
106 a = ctx->a;
107 b = ctx->b;
108 c = ctx->c;
109 d = ctx->d;
110
111 do {
112 saved_a = a;
113 saved_b = b;
114 saved_c = c;
115 saved_d = d;
116
117/* Round 1 */
118 STEP(F, a, b, c, d, SET(0), 0xd76aa478, 7)
119 STEP(F, d, a, b, c, SET(1), 0xe8c7b756, 12)
120 STEP(F, c, d, a, b, SET(2), 0x242070db, 17)
121 STEP(F, b, c, d, a, SET(3), 0xc1bdceee, 22)
122 STEP(F, a, b, c, d, SET(4), 0xf57c0faf, 7)
123 STEP(F, d, a, b, c, SET(5), 0x4787c62a, 12)
124 STEP(F, c, d, a, b, SET(6), 0xa8304613, 17)
125 STEP(F, b, c, d, a, SET(7), 0xfd469501, 22)
126 STEP(F, a, b, c, d, SET(8), 0x698098d8, 7)
127 STEP(F, d, a, b, c, SET(9), 0x8b44f7af, 12)
128 STEP(F, c, d, a, b, SET(10), 0xffff5bb1, 17)
129 STEP(F, b, c, d, a, SET(11), 0x895cd7be, 22)
130 STEP(F, a, b, c, d, SET(12), 0x6b901122, 7)
131 STEP(F, d, a, b, c, SET(13), 0xfd987193, 12)
132 STEP(F, c, d, a, b, SET(14), 0xa679438e, 17)
133 STEP(F, b, c, d, a, SET(15), 0x49b40821, 22)
134
135/* Round 2 */
136 STEP(G, a, b, c, d, GET(1), 0xf61e2562, 5)
137 STEP(G, d, a, b, c, GET(6), 0xc040b340, 9)
138 STEP(G, c, d, a, b, GET(11), 0x265e5a51, 14)
139 STEP(G, b, c, d, a, GET(0), 0xe9b6c7aa, 20)
140 STEP(G, a, b, c, d, GET(5), 0xd62f105d, 5)
141 STEP(G, d, a, b, c, GET(10), 0x02441453, 9)
142 STEP(G, c, d, a, b, GET(15), 0xd8a1e681, 14)
143 STEP(G, b, c, d, a, GET(4), 0xe7d3fbc8, 20)
144 STEP(G, a, b, c, d, GET(9), 0x21e1cde6, 5)
145 STEP(G, d, a, b, c, GET(14), 0xc33707d6, 9)
146 STEP(G, c, d, a, b, GET(3), 0xf4d50d87, 14)
147 STEP(G, b, c, d, a, GET(8), 0x455a14ed, 20)
148 STEP(G, a, b, c, d, GET(13), 0xa9e3e905, 5)
149 STEP(G, d, a, b, c, GET(2), 0xfcefa3f8, 9)
150 STEP(G, c, d, a, b, GET(7), 0x676f02d9, 14)
151 STEP(G, b, c, d, a, GET(12), 0x8d2a4c8a, 20)
152
153/* Round 3 */
154 STEP(H, a, b, c, d, GET(5), 0xfffa3942, 4)
155 STEP(H2, d, a, b, c, GET(8), 0x8771f681, 11)
156 STEP(H, c, d, a, b, GET(11), 0x6d9d6122, 16)
157 STEP(H2, b, c, d, a, GET(14), 0xfde5380c, 23)
158 STEP(H, a, b, c, d, GET(1), 0xa4beea44, 4)
159 STEP(H2, d, a, b, c, GET(4), 0x4bdecfa9, 11)
160 STEP(H, c, d, a, b, GET(7), 0xf6bb4b60, 16)
161 STEP(H2, b, c, d, a, GET(10), 0xbebfbc70, 23)
162 STEP(H, a, b, c, d, GET(13), 0x289b7ec6, 4)
163 STEP(H2, d, a, b, c, GET(0), 0xeaa127fa, 11)
164 STEP(H, c, d, a, b, GET(3), 0xd4ef3085, 16)
165 STEP(H2, b, c, d, a, GET(6), 0x04881d05, 23)
166 STEP(H, a, b, c, d, GET(9), 0xd9d4d039, 4)
167 STEP(H2, d, a, b, c, GET(12), 0xe6db99e5, 11)
168 STEP(H, c, d, a, b, GET(15), 0x1fa27cf8, 16)
169 STEP(H2, b, c, d, a, GET(2), 0xc4ac5665, 23)
170
171/* Round 4 */
172 STEP(I, a, b, c, d, GET(0), 0xf4292244, 6)
173 STEP(I, d, a, b, c, GET(7), 0x432aff97, 10)
174 STEP(I, c, d, a, b, GET(14), 0xab9423a7, 15)
175 STEP(I, b, c, d, a, GET(5), 0xfc93a039, 21)
176 STEP(I, a, b, c, d, GET(12), 0x655b59c3, 6)
177 STEP(I, d, a, b, c, GET(3), 0x8f0ccc92, 10)
178 STEP(I, c, d, a, b, GET(10), 0xffeff47d, 15)
179 STEP(I, b, c, d, a, GET(1), 0x85845dd1, 21)
180 STEP(I, a, b, c, d, GET(8), 0x6fa87e4f, 6)
181 STEP(I, d, a, b, c, GET(15), 0xfe2ce6e0, 10)
182 STEP(I, c, d, a, b, GET(6), 0xa3014314, 15)
183 STEP(I, b, c, d, a, GET(13), 0x4e0811a1, 21)
184 STEP(I, a, b, c, d, GET(4), 0xf7537e82, 6)
185 STEP(I, d, a, b, c, GET(11), 0xbd3af235, 10)
186 STEP(I, c, d, a, b, GET(2), 0x2ad7d2bb, 15)
187 STEP(I, b, c, d, a, GET(9), 0xeb86d391, 21)
188
189 a += saved_a;
190 b += saved_b;
191 c += saved_c;
192 d += saved_d;
193
194 ptr += 64;
195 } while (size -= 64);
196
197 ctx->a = a;
198 ctx->b = b;
199 ctx->c = c;
200 ctx->d = d;
201
202 return ptr;
203}
204
205void MD5_Init(MD5_CTX *ctx)
206{
207 ctx->a = 0x67452301;
208 ctx->b = 0xefcdab89;
209 ctx->c = 0x98badcfe;
210 ctx->d = 0x10325476;
211
212 ctx->lo = 0;
213 ctx->hi = 0;
214}
215
216void MD5_Update(MD5_CTX *ctx, const void *data, unsigned long size)
217{
218 MD5_u32plus saved_lo;
219 unsigned long used, available;
220
221 saved_lo = ctx->lo;
222 if ((ctx->lo = (saved_lo + size) & 0x1fffffff) < saved_lo)
223 ctx->hi++;
224 ctx->hi += size >> 29;
225
226 used = saved_lo & 0x3f;
227
228 if (used) {
229 available = 64 - used;
230
231 if (size < available) {
232 memcpy(&ctx->buffer[used], data, size);
233 return;
234 }
235
236 memcpy(&ctx->buffer[used], data, available);
237 data = (const unsigned char *)data + available;
238 size -= available;
239 body(ctx, ctx->buffer, 64);
240 }
241
242 if (size >= 64) {
243 data = body(ctx, data, size & ~(unsigned long)0x3f);
244 size &= 0x3f;
245 }
246
247 memcpy(ctx->buffer, data, size);
248}
249
250#define OUT(dst, src) \
251 (dst)[0] = (unsigned char)(src); \
252 (dst)[1] = (unsigned char)((src) >> 8); \
253 (dst)[2] = (unsigned char)((src) >> 16); \
254 (dst)[3] = (unsigned char)((src) >> 24);
255
256void MD5_Final(unsigned char *result, MD5_CTX *ctx)
257{
258 unsigned long used, available;
259
260 used = ctx->lo & 0x3f;
261
262 ctx->buffer[used++] = 0x80;
263
264 available = 64 - used;
265
266 if (available < 8) {
267 memset(&ctx->buffer[used], 0, available);
268 body(ctx, ctx->buffer, 64);
269 used = 0;
270 available = 64;
271 }
272
273 memset(&ctx->buffer[used], 0, available - 8);
274
275 ctx->lo <<= 3;
276 OUT(&ctx->buffer[56], ctx->lo)
277 OUT(&ctx->buffer[60], ctx->hi)
278
279 body(ctx, ctx->buffer, 64);
280
281 OUT(&result[0], ctx->a)
282 OUT(&result[4], ctx->b)
283 OUT(&result[8], ctx->c)
284 OUT(&result[12], ctx->d)
285
286 memset(ctx, 0, sizeof(*ctx));
287}
288