| 1 | /*** |
| 2 | * Copyright 2017 Marc Stevens <marc@marc-stevens.nl>, Dan Shumow <danshu@microsoft.com> |
| 3 | * Distributed under the MIT Software License. |
| 4 | * See accompanying file LICENSE.txt or copy at |
| 5 | * https://opensource.org/licenses/MIT |
| 6 | ***/ |
| 7 | |
| 8 | #ifndef SHA1DC_SHA1_H |
| 9 | #define SHA1DC_SHA1_H |
| 10 | |
| 11 | #if defined(__cplusplus) |
| 12 | extern "C" { |
| 13 | #endif |
| 14 | |
| 15 | #ifndef SHA1DC_NO_STANDARD_INCLUDES |
| 16 | #include <stdint.h> |
| 17 | #endif |
| 18 | |
| 19 | /* sha-1 compression function that takes an already expanded message, and additionally store intermediate states */ |
| 20 | /* only stores states ii (the state between step ii-1 and step ii) when DOSTORESTATEii is defined in ubc_check.h */ |
| 21 | void sha1_compression_states(uint32_t[5], const uint32_t[16], uint32_t[80], uint32_t[80][5]); |
| 22 | |
| 23 | /* |
| 24 | // Function type for sha1_recompression_step_T (uint32_t ihvin[5], uint32_t ihvout[5], const uint32_t me2[80], const uint32_t state[5]). |
| 25 | // Where 0 <= T < 80 |
| 26 | // me2 is an expanded message (the expansion of an original message block XOR'ed with a disturbance vector's message block difference.) |
| 27 | // state is the internal state (a,b,c,d,e) before step T of the SHA-1 compression function while processing the original message block. |
| 28 | // The function will return: |
| 29 | // ihvin: The reconstructed input chaining value. |
| 30 | // ihvout: The reconstructed output chaining value. |
| 31 | */ |
| 32 | typedef void(*sha1_recompression_type)(uint32_t*, uint32_t*, const uint32_t*, const uint32_t*); |
| 33 | |
| 34 | /* A callback function type that can be set to be called when a collision block has been found: */ |
| 35 | /* void collision_block_callback(uint64_t byteoffset, const uint32_t ihvin1[5], const uint32_t ihvin2[5], const uint32_t m1[80], const uint32_t m2[80]) */ |
| 36 | typedef void(*collision_block_callback)(uint64_t, const uint32_t*, const uint32_t*, const uint32_t*, const uint32_t*); |
| 37 | |
| 38 | /* The SHA-1 context. */ |
| 39 | typedef struct { |
| 40 | uint64_t total; |
| 41 | uint32_t ihv[5]; |
| 42 | unsigned char buffer[64]; |
| 43 | int found_collision; |
| 44 | int safe_hash; |
| 45 | int detect_coll; |
| 46 | int ubc_check; |
| 47 | int reduced_round_coll; |
| 48 | collision_block_callback callback; |
| 49 | |
| 50 | uint32_t ihv1[5]; |
| 51 | uint32_t ihv2[5]; |
| 52 | uint32_t m1[80]; |
| 53 | uint32_t m2[80]; |
| 54 | uint32_t states[80][5]; |
| 55 | } SHA1_CTX; |
| 56 | |
| 57 | /* Initialize SHA-1 context. */ |
| 58 | void SHA1DCInit(SHA1_CTX*); |
| 59 | |
| 60 | /* |
| 61 | Function to enable safe SHA-1 hashing: |
| 62 | Collision attacks are thwarted by hashing a detected near-collision block 3 times. |
| 63 | Think of it as extending SHA-1 from 80-steps to 240-steps for such blocks: |
| 64 | The best collision attacks against SHA-1 have complexity about 2^60, |
| 65 | thus for 240-steps an immediate lower-bound for the best cryptanalytic attacks would be 2^180. |
| 66 | An attacker would be better off using a generic birthday search of complexity 2^80. |
| 67 | |
| 68 | Enabling safe SHA-1 hashing will result in the correct SHA-1 hash for messages where no collision attack was detected, |
| 69 | but it will result in a different SHA-1 hash for messages where a collision attack was detected. |
| 70 | This will automatically invalidate SHA-1 based digital signature forgeries. |
| 71 | Enabled by default. |
| 72 | */ |
| 73 | void SHA1DCSetSafeHash(SHA1_CTX*, int); |
| 74 | |
| 75 | /* |
| 76 | Function to disable or enable the use of Unavoidable Bitconditions (provides a significant speed up). |
| 77 | Enabled by default |
| 78 | */ |
| 79 | void SHA1DCSetUseUBC(SHA1_CTX*, int); |
| 80 | |
| 81 | /* |
| 82 | Function to disable or enable the use of Collision Detection. |
| 83 | Enabled by default. |
| 84 | */ |
| 85 | void SHA1DCSetUseDetectColl(SHA1_CTX*, int); |
| 86 | |
| 87 | /* function to disable or enable the detection of reduced-round SHA-1 collisions */ |
| 88 | /* disabled by default */ |
| 89 | void SHA1DCSetDetectReducedRoundCollision(SHA1_CTX*, int); |
| 90 | |
| 91 | /* function to set a callback function, pass NULL to disable */ |
| 92 | /* by default no callback set */ |
| 93 | void SHA1DCSetCallback(SHA1_CTX*, collision_block_callback); |
| 94 | |
| 95 | /* update SHA-1 context with buffer contents */ |
| 96 | void SHA1DCUpdate(SHA1_CTX*, const char*, size_t); |
| 97 | |
| 98 | /* obtain SHA-1 hash from SHA-1 context */ |
| 99 | /* returns: 0 = no collision detected, otherwise = collision found => warn user for active attack */ |
| 100 | int SHA1DCFinal(unsigned char[20], SHA1_CTX*); |
| 101 | |
| 102 | #if defined(__cplusplus) |
| 103 | } |
| 104 | #endif |
| 105 | |
| 106 | #ifdef SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H |
| 107 | #include SHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H |
| 108 | #endif |
| 109 | |
| 110 | #endif |