6b851e536b
Update sha1dc from the latest version by the upstream maintainer[1]. See commita0103914c2("sha1dc: update from upstream", 2017-05-20) for the latest update. That update was done sans some whitespace changes by upstream, which is why the diff here isn't the same as the upstream cc46554..e139984. It also brings in a change[2] upstream made which should hopefully address the breakage in 2.13.1 on Cygwin, see [3]. Cygwin defines both _BIG_ENDIAN and _LITTLE_ENDIAN. Adam Dinwoodie reports on the mailing list that that upstream commit fixes the issue on Cygwin[4]. 1.e1399840b52.a24eef58c03. <20170606100355.GC25777@dinwoodie.org> (https://public-inbox.org/git/20170606100355.GC25777@dinwoodie.org/) 4. <20170606124323.GD25777@dinwoodie.org> (https://public-inbox.org/git/20170606124323.GD25777@dinwoodie.org/) Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
111 lines
4.0 KiB
C
111 lines
4.0 KiB
C
/***
|
|
* Copyright 2017 Marc Stevens <marc@marc-stevens.nl>, Dan Shumow <danshu@microsoft.com>
|
|
* Distributed under the MIT Software License.
|
|
* See accompanying file LICENSE.txt or copy at
|
|
* https://opensource.org/licenses/MIT
|
|
***/
|
|
|
|
#ifndef SHA1DC_SHA1_H
|
|
#define SHA1DC_SHA1_H
|
|
|
|
#if defined(__cplusplus)
|
|
extern "C" {
|
|
#endif
|
|
|
|
#ifndef SHA1DC_NO_STANDARD_INCLUDES
|
|
#include <stdint.h>
|
|
#endif
|
|
|
|
/* sha-1 compression function that takes an already expanded message, and additionally store intermediate states */
|
|
/* only stores states ii (the state between step ii-1 and step ii) when DOSTORESTATEii is defined in ubc_check.h */
|
|
void sha1_compression_states(uint32_t[5], const uint32_t[16], uint32_t[80], uint32_t[80][5]);
|
|
|
|
/*
|
|
// Function type for sha1_recompression_step_T (uint32_t ihvin[5], uint32_t ihvout[5], const uint32_t me2[80], const uint32_t state[5]).
|
|
// Where 0 <= T < 80
|
|
// me2 is an expanded message (the expansion of an original message block XOR'ed with a disturbance vector's message block difference.)
|
|
// state is the internal state (a,b,c,d,e) before step T of the SHA-1 compression function while processing the original message block.
|
|
// The function will return:
|
|
// ihvin: The reconstructed input chaining value.
|
|
// ihvout: The reconstructed output chaining value.
|
|
*/
|
|
typedef void(*sha1_recompression_type)(uint32_t*, uint32_t*, const uint32_t*, const uint32_t*);
|
|
|
|
/* A callback function type that can be set to be called when a collision block has been found: */
|
|
/* void collision_block_callback(uint64_t byteoffset, const uint32_t ihvin1[5], const uint32_t ihvin2[5], const uint32_t m1[80], const uint32_t m2[80]) */
|
|
typedef void(*collision_block_callback)(uint64_t, const uint32_t*, const uint32_t*, const uint32_t*, const uint32_t*);
|
|
|
|
/* The SHA-1 context. */
|
|
typedef struct {
|
|
uint64_t total;
|
|
uint32_t ihv[5];
|
|
unsigned char buffer[64];
|
|
int found_collision;
|
|
int safe_hash;
|
|
int detect_coll;
|
|
int ubc_check;
|
|
int reduced_round_coll;
|
|
collision_block_callback callback;
|
|
|
|
uint32_t ihv1[5];
|
|
uint32_t ihv2[5];
|
|
uint32_t m1[80];
|
|
uint32_t m2[80];
|
|
uint32_t states[80][5];
|
|
} SHA1_CTX;
|
|
|
|
/* Initialize SHA-1 context. */
|
|
void SHA1DCInit(SHA1_CTX*);
|
|
|
|
/*
|
|
Function to enable safe SHA-1 hashing:
|
|
Collision attacks are thwarted by hashing a detected near-collision block 3 times.
|
|
Think of it as extending SHA-1 from 80-steps to 240-steps for such blocks:
|
|
The best collision attacks against SHA-1 have complexity about 2^60,
|
|
thus for 240-steps an immediate lower-bound for the best cryptanalytic attacks would be 2^180.
|
|
An attacker would be better off using a generic birthday search of complexity 2^80.
|
|
|
|
Enabling safe SHA-1 hashing will result in the correct SHA-1 hash for messages where no collision attack was detected,
|
|
but it will result in a different SHA-1 hash for messages where a collision attack was detected.
|
|
This will automatically invalidate SHA-1 based digital signature forgeries.
|
|
Enabled by default.
|
|
*/
|
|
void SHA1DCSetSafeHash(SHA1_CTX*, int);
|
|
|
|
/*
|
|
Function to disable or enable the use of Unavoidable Bitconditions (provides a significant speed up).
|
|
Enabled by default
|
|
*/
|
|
void SHA1DCSetUseUBC(SHA1_CTX*, int);
|
|
|
|
/*
|
|
Function to disable or enable the use of Collision Detection.
|
|
Enabled by default.
|
|
*/
|
|
void SHA1DCSetUseDetectColl(SHA1_CTX*, int);
|
|
|
|
/* function to disable or enable the detection of reduced-round SHA-1 collisions */
|
|
/* disabled by default */
|
|
void SHA1DCSetDetectReducedRoundCollision(SHA1_CTX*, int);
|
|
|
|
/* function to set a callback function, pass NULL to disable */
|
|
/* by default no callback set */
|
|
void SHA1DCSetCallback(SHA1_CTX*, collision_block_callback);
|
|
|
|
/* update SHA-1 context with buffer contents */
|
|
void SHA1DCUpdate(SHA1_CTX*, const char*, size_t);
|
|
|
|
/* obtain SHA-1 hash from SHA-1 context */
|
|
/* returns: 0 = no collision detected, otherwise = collision found => warn user for active attack */
|
|
int SHA1DCFinal(unsigned char[20], SHA1_CTX*);
|
|
|
|
#if defined(__cplusplus)
|
|
}
|
|
#endif
|
|
|
|
#ifdef SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H
|
|
#include SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H
|
|
#endif
|
|
|
|
#endif
|