projects/linux·blob master · refs

301 lines · 9.1 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * MD5 and HMAC-MD5 library functions
4 *
5 * md5_block() is derived from cryptoapi implementation, originally based on the
6 * public domain implementation written by Colin Plumb in 1993.
7 *
8 * Copyright (c) Cryptoapi developers.
9 * Copyright (c) 2002 James Morris <[email protected]>
10 * Copyright 2025 Google LLC
11 */
12
13#include <crypto/hmac.h>
14#include <crypto/md5.h>
15#include <linux/export.h>
16#include <linux/kernel.h>
17#include <linux/module.h>
18#include <linux/string.h>
19#include <linux/wordpart.h>
20
21static const struct md5_block_state md5_iv = {
22 .h = { MD5_H0, MD5_H1, MD5_H2, MD5_H3 },
23};
24
25#define F1(x, y, z) (z ^ (x & (y ^ z)))
26#define F2(x, y, z) F1(z, x, y)
27#define F3(x, y, z) (x ^ y ^ z)
28#define F4(x, y, z) (y ^ (x | ~z))
29
30#define MD5STEP(f, w, x, y, z, in, s) \
31 (w += f(x, y, z) + in, w = rol32(w, s) + x)
32
33static void md5_block(struct md5_block_state *state,
34 const u8 data[MD5_BLOCK_SIZE])
35{
36 u32 in[MD5_BLOCK_WORDS];
37 u32 a, b, c, d;
38
39 memcpy(in, data, MD5_BLOCK_SIZE);
40 le32_to_cpu_array(in, ARRAY_SIZE(in));
41
42 a = state->h[0];
43 b = state->h[1];
44 c = state->h[2];
45 d = state->h[3];
46
47 MD5STEP(F1, a, b, c, d, in[0] + 0xd76aa478, 7);
48 MD5STEP(F1, d, a, b, c, in[1] + 0xe8c7b756, 12);
49 MD5STEP(F1, c, d, a, b, in[2] + 0x242070db, 17);
50 MD5STEP(F1, b, c, d, a, in[3] + 0xc1bdceee, 22);
51 MD5STEP(F1, a, b, c, d, in[4] + 0xf57c0faf, 7);
52 MD5STEP(F1, d, a, b, c, in[5] + 0x4787c62a, 12);
53 MD5STEP(F1, c, d, a, b, in[6] + 0xa8304613, 17);
54 MD5STEP(F1, b, c, d, a, in[7] + 0xfd469501, 22);
55 MD5STEP(F1, a, b, c, d, in[8] + 0x698098d8, 7);
56 MD5STEP(F1, d, a, b, c, in[9] + 0x8b44f7af, 12);
57 MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1, 17);
58 MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7be, 22);
59 MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122, 7);
60 MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193, 12);
61 MD5STEP(F1, c, d, a, b, in[14] + 0xa679438e, 17);
62 MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821, 22);
63
64 MD5STEP(F2, a, b, c, d, in[1] + 0xf61e2562, 5);
65 MD5STEP(F2, d, a, b, c, in[6] + 0xc040b340, 9);
66 MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51, 14);
67 MD5STEP(F2, b, c, d, a, in[0] + 0xe9b6c7aa, 20);
68 MD5STEP(F2, a, b, c, d, in[5] + 0xd62f105d, 5);
69 MD5STEP(F2, d, a, b, c, in[10] + 0x02441453, 9);
70 MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681, 14);
71 MD5STEP(F2, b, c, d, a, in[4] + 0xe7d3fbc8, 20);
72 MD5STEP(F2, a, b, c, d, in[9] + 0x21e1cde6, 5);
73 MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6, 9);
74 MD5STEP(F2, c, d, a, b, in[3] + 0xf4d50d87, 14);
75 MD5STEP(F2, b, c, d, a, in[8] + 0x455a14ed, 20);
76 MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905, 5);
77 MD5STEP(F2, d, a, b, c, in[2] + 0xfcefa3f8, 9);
78 MD5STEP(F2, c, d, a, b, in[7] + 0x676f02d9, 14);
79 MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);
80
81 MD5STEP(F3, a, b, c, d, in[5] + 0xfffa3942, 4);
82 MD5STEP(F3, d, a, b, c, in[8] + 0x8771f681, 11);
83 MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122, 16);
84 MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380c, 23);
85 MD5STEP(F3, a, b, c, d, in[1] + 0xa4beea44, 4);
86 MD5STEP(F3, d, a, b, c, in[4] + 0x4bdecfa9, 11);
87 MD5STEP(F3, c, d, a, b, in[7] + 0xf6bb4b60, 16);
88 MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70, 23);
89 MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6, 4);
90 MD5STEP(F3, d, a, b, c, in[0] + 0xeaa127fa, 11);
91 MD5STEP(F3, c, d, a, b, in[3] + 0xd4ef3085, 16);
92 MD5STEP(F3, b, c, d, a, in[6] + 0x04881d05, 23);
93 MD5STEP(F3, a, b, c, d, in[9] + 0xd9d4d039, 4);
94 MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5, 11);
95 MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);
96 MD5STEP(F3, b, c, d, a, in[2] + 0xc4ac5665, 23);
97
98 MD5STEP(F4, a, b, c, d, in[0] + 0xf4292244, 6);
99 MD5STEP(F4, d, a, b, c, in[7] + 0x432aff97, 10);
100 MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7, 15);
101 MD5STEP(F4, b, c, d, a, in[5] + 0xfc93a039, 21);
102 MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3, 6);
103 MD5STEP(F4, d, a, b, c, in[3] + 0x8f0ccc92, 10);
104 MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47d, 15);
105 MD5STEP(F4, b, c, d, a, in[1] + 0x85845dd1, 21);
106 MD5STEP(F4, a, b, c, d, in[8] + 0x6fa87e4f, 6);
107 MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);
108 MD5STEP(F4, c, d, a, b, in[6] + 0xa3014314, 15);
109 MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1, 21);
110 MD5STEP(F4, a, b, c, d, in[4] + 0xf7537e82, 6);
111 MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235, 10);
112 MD5STEP(F4, c, d, a, b, in[2] + 0x2ad7d2bb, 15);
113 MD5STEP(F4, b, c, d, a, in[9] + 0xeb86d391, 21);
114
115 state->h[0] += a;
116 state->h[1] += b;
117 state->h[2] += c;
118 state->h[3] += d;
119}
120
121static void md5_blocks(struct md5_block_state *state,
122 const u8 *data, size_t nblocks)
123{
124 do {
125 md5_block(state, data);
126 data += MD5_BLOCK_SIZE;
127 } while (--nblocks);
128}
129
130void md5_init(struct md5_ctx *ctx)
131{
132 ctx->state = md5_iv;
133 ctx->bytecount = 0;
134}
135EXPORT_SYMBOL_GPL(md5_init);
136
137void md5_update(struct md5_ctx *ctx, const u8 *data, size_t len)
138{
139 size_t partial = ctx->bytecount % MD5_BLOCK_SIZE;
140
141 ctx->bytecount += len;
142
143 if (partial + len >= MD5_BLOCK_SIZE) {
144 size_t nblocks;
145
146 if (partial) {
147 size_t l = MD5_BLOCK_SIZE - partial;
148
149 memcpy(&ctx->buf[partial], data, l);
150 data += l;
151 len -= l;
152
153 md5_blocks(&ctx->state, ctx->buf, 1);
154 }
155
156 nblocks = len / MD5_BLOCK_SIZE;
157 len %= MD5_BLOCK_SIZE;
158
159 if (nblocks) {
160 md5_blocks(&ctx->state, data, nblocks);
161 data += nblocks * MD5_BLOCK_SIZE;
162 }
163 partial = 0;
164 }
165 if (len)
166 memcpy(&ctx->buf[partial], data, len);
167}
168EXPORT_SYMBOL_GPL(md5_update);
169
170static void __md5_final(struct md5_ctx *ctx, u8 out[MD5_DIGEST_SIZE])
171{
172 u64 bitcount = ctx->bytecount << 3;
173 size_t partial = ctx->bytecount % MD5_BLOCK_SIZE;
174
175 ctx->buf[partial++] = 0x80;
176 if (partial > MD5_BLOCK_SIZE - 8) {
177 memset(&ctx->buf[partial], 0, MD5_BLOCK_SIZE - partial);
178 md5_blocks(&ctx->state, ctx->buf, 1);
179 partial = 0;
180 }
181 memset(&ctx->buf[partial], 0, MD5_BLOCK_SIZE - 8 - partial);
182 *(__le64 *)&ctx->buf[MD5_BLOCK_SIZE - 8] = cpu_to_le64(bitcount);
183 md5_blocks(&ctx->state, ctx->buf, 1);
184
185 cpu_to_le32_array(ctx->state.h, ARRAY_SIZE(ctx->state.h));
186 memcpy(out, ctx->state.h, MD5_DIGEST_SIZE);
187}
188
189void md5_final(struct md5_ctx *ctx, u8 out[MD5_DIGEST_SIZE])
190{
191 __md5_final(ctx, out);
192 memzero_explicit(ctx, sizeof(*ctx));
193}
194EXPORT_SYMBOL_GPL(md5_final);
195
196void md5(const u8 *data, size_t len, u8 out[MD5_DIGEST_SIZE])
197{
198 struct md5_ctx ctx;
199
200 md5_init(&ctx);
201 md5_update(&ctx, data, len);
202 md5_final(&ctx, out);
203}
204EXPORT_SYMBOL_GPL(md5);
205
206static void __hmac_md5_preparekey(struct md5_block_state *istate,
207 struct md5_block_state *ostate,
208 const u8 *raw_key, size_t raw_key_len)
209{
210 union {
211 u8 b[MD5_BLOCK_SIZE];
212 unsigned long w[MD5_BLOCK_SIZE / sizeof(unsigned long)];
213 } derived_key = { 0 };
214
215 if (unlikely(raw_key_len > MD5_BLOCK_SIZE))
216 md5(raw_key, raw_key_len, derived_key.b);
217 else
218 memcpy(derived_key.b, raw_key, raw_key_len);
219
220 for (size_t i = 0; i < ARRAY_SIZE(derived_key.w); i++)
221 derived_key.w[i] ^= REPEAT_BYTE(HMAC_IPAD_VALUE);
222 *istate = md5_iv;
223 md5_blocks(istate, derived_key.b, 1);
224
225 for (size_t i = 0; i < ARRAY_SIZE(derived_key.w); i++)
226 derived_key.w[i] ^= REPEAT_BYTE(HMAC_OPAD_VALUE ^
227 HMAC_IPAD_VALUE);
228 *ostate = md5_iv;
229 md5_blocks(ostate, derived_key.b, 1);
230
231 memzero_explicit(&derived_key, sizeof(derived_key));
232}
233
234void hmac_md5_preparekey(struct hmac_md5_key *key,
235 const u8 *raw_key, size_t raw_key_len)
236{
237 __hmac_md5_preparekey(&key->istate, &key->ostate, raw_key, raw_key_len);
238}
239EXPORT_SYMBOL_GPL(hmac_md5_preparekey);
240
241void hmac_md5_init(struct hmac_md5_ctx *ctx, const struct hmac_md5_key *key)
242{
243 ctx->hash_ctx.state = key->istate;
244 ctx->hash_ctx.bytecount = MD5_BLOCK_SIZE;
245 ctx->ostate = key->ostate;
246}
247EXPORT_SYMBOL_GPL(hmac_md5_init);
248
249void hmac_md5_init_usingrawkey(struct hmac_md5_ctx *ctx,
250 const u8 *raw_key, size_t raw_key_len)
251{
252 __hmac_md5_preparekey(&ctx->hash_ctx.state, &ctx->ostate,
253 raw_key, raw_key_len);
254 ctx->hash_ctx.bytecount = MD5_BLOCK_SIZE;
255}
256EXPORT_SYMBOL_GPL(hmac_md5_init_usingrawkey);
257
258void hmac_md5_final(struct hmac_md5_ctx *ctx, u8 out[MD5_DIGEST_SIZE])
259{
260 /* Generate the padded input for the outer hash in ctx->hash_ctx.buf. */
261 __md5_final(&ctx->hash_ctx, ctx->hash_ctx.buf);
262 memset(&ctx->hash_ctx.buf[MD5_DIGEST_SIZE], 0,
263 MD5_BLOCK_SIZE - MD5_DIGEST_SIZE);
264 ctx->hash_ctx.buf[MD5_DIGEST_SIZE] = 0x80;
265 *(__le64 *)&ctx->hash_ctx.buf[MD5_BLOCK_SIZE - 8] =
266 cpu_to_le64(8 * (MD5_BLOCK_SIZE + MD5_DIGEST_SIZE));
267
268 /* Compute the outer hash, which gives the HMAC value. */
269 md5_blocks(&ctx->ostate, ctx->hash_ctx.buf, 1);
270 cpu_to_le32_array(ctx->ostate.h, ARRAY_SIZE(ctx->ostate.h));
271 memcpy(out, ctx->ostate.h, MD5_DIGEST_SIZE);
272
273 hmac_md5_zeroize_ctx(ctx);
274}
275EXPORT_SYMBOL_GPL(hmac_md5_final);
276
277void hmac_md5(const struct hmac_md5_key *key,
278 const u8 *data, size_t data_len, u8 out[MD5_DIGEST_SIZE])
279{
280 struct hmac_md5_ctx ctx;
281
282 hmac_md5_init(&ctx, key);
283 hmac_md5_update(&ctx, data, data_len);
284 hmac_md5_final(&ctx, out);
285}
286EXPORT_SYMBOL_GPL(hmac_md5);
287
288void hmac_md5_usingrawkey(const u8 *raw_key, size_t raw_key_len,
289 const u8 *data, size_t data_len,
290 u8 out[MD5_DIGEST_SIZE])
291{
292 struct hmac_md5_ctx ctx;
293
294 hmac_md5_init_usingrawkey(&ctx, raw_key, raw_key_len);
295 hmac_md5_update(&ctx, data, data_len);
296 hmac_md5_final(&ctx, out);
297}
298EXPORT_SYMBOL_GPL(hmac_md5_usingrawkey);
299
300MODULE_DESCRIPTION("MD5 and HMAC-MD5 library functions");
301MODULE_LICENSE("GPL");