md4.c

Go to the documentation of this file.

//
// Md4.c
//
// Copyright (c) Microsoft Corporation. Licensed under the MIT license.
//
 
//
// This module contains the routines to implement MD4 from RFC 1320
//
//
// This is a new implementation, NOT based on the existing ones in RSA32.lib.
// There are 2 versions in RSA32.lib, one from RSA data security and one from
// Scott Fields.
//
// MD4 and MD5 are extremely similar. Having already done a new MD5 implementation it
// was very little work to copy the code & turn it into an MD4 implementation.
// In fact, it was easier than reviewing & modifying the old code to bring it up to
// the current implementation guidelines.
//
// This also ensures that this file is not a derived work from RSA data security
// code which simplifies the copyright situation.
//
// We dropped the assembler implementation. MD4 is so weak that it should be removed
// from use, not sped up.
//
 
#include "precomp.h"
 
//
// See the symcrypt.h file for documentation on what the various functions do.
//
 
const SYMCRYPT_HASH SymCryptMd4Algorithm_default = {
    &SymCryptMd4Init,
    &SymCryptMd4Append,
    &SymCryptMd4Result,
    &SymCryptMd4AppendBlocks,
    &SymCryptMd4StateCopy,
    sizeof( SYMCRYPT_MD4_STATE ),
    SYMCRYPT_MD4_RESULT_SIZE,
    SYMCRYPT_MD4_INPUT_BLOCK_SIZE,
    SYMCRYPT_FIELD_OFFSET( SYMCRYPT_MD4_STATE, chain ),
    SYMCRYPT_FIELD_SIZE( SYMCRYPT_MD4_STATE, chain ),
};
 
const PCSYMCRYPT_HASH SymCryptMd4Algorithm = &SymCryptMd4Algorithm_default;
 
//
// The round constants used by MD4
//
//
static const UINT32 md4Const[3] = {
    0x00000000UL,
    0x5A827999UL,
    0x6ED9EBA1UL,
    };
 
//
// Round rotation amounts. This array is optimized away by the compiler
// as we inline all our rotations.
//
static const int md4Rotate[48] = {
    3, 7, 11, 19,
    3, 7, 11, 19,
    3, 7, 11, 19,
    3, 7, 11, 19,
 
    3, 5, 9, 13,
    3, 5, 9, 13,
    3, 5, 9, 13,
    3, 5, 9, 13,
 
    3, 9, 11, 15,
    3, 9, 11, 15,
    3, 9, 11, 15,
    3, 9, 11, 15,
 
};
 
//
// Message word index table. This array is optimized away by the compiler
// as we inline all our accesses.
//
static const int md4MsgIndex[48] = {
     0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15,
     0,  4,  8, 12,  1,  5,  9, 13,  2,  6, 10, 14,  3,  7, 11, 15,
     0,  8,  4, 12,  2, 10,  6, 14,  1,  9,  5, 13,  3, 11,  7, 15,
};
 
//
// Initial state
//
static const UINT32 md4InitialState[4] = {
    0x67452301UL,
    0xefcdab89UL,
    0x98badcfeUL,
    0x10325476UL,
};
 
 
//
// SymCryptMd4
//
#define ALG MD4
#define Alg Md4
#include "hash_pattern.c"
#undef ALG
#undef Alg
 
 
 
//
// SymCryptmd4Init
//
VOID
SYMCRYPT_CALL
SymCryptMd4Init( _Out_ PSYMCRYPT_MD4_STATE pState )
{
    SYMCRYPT_SET_MAGIC( pState );
 
    pState->dataLengthL = 0;
    pState->dataLengthH = 0;
    pState->bytesInBuffer = 0;
 
    memcpy( &pState->chain.H[0], &md4InitialState[0], sizeof( md4InitialState ) );
 
    //
    // There is no need to initialize the buffer part of the state as that will be
    // filled before it is used.
    //
}
 
 
//
// SymCryptMd4Append
//
VOID
SYMCRYPT_CALL
SymCryptMd4Append( _Inout_              PSYMCRYPT_MD4_STATE    pState,
                   _In_reads_( cbData ) PCBYTE                 pbData,
                                        SIZE_T                 cbData )
{
    SymCryptHashAppendInternal( SymCryptMd4Algorithm, (PSYMCRYPT_COMMON_HASH_STATE)pState, pbData, cbData );
}
 
 
//
// SymCryptmd4Result
//
VOID
SYMCRYPT_CALL
SymCryptMd4Result(
    _Inout_                                 PSYMCRYPT_MD4_STATE pState,
   _Out_writes_( SYMCRYPT_MD4_RESULT_SIZE ) PBYTE               pbResult )
{
    SymCryptHashCommonPaddingMd4Style( SymCryptMd4Algorithm, (PSYMCRYPT_COMMON_HASH_STATE)pState );
 
    //
    // Write the output in the correct byte order
    //
    SymCryptUint32ToLsbFirst( &pState->chain.H[0], pbResult, 4 );
 
    //
    // Wipe & re-initialize
    // We have to wipe the whole state as the initialization might be optimized away.
    //
    SymCryptWipeKnownSize( pState, sizeof( *pState ));
    SymCryptMd4Init( pState );
    }
 
 
//
// For documentation on these function see rfc-1320
//
//#define F( x, y, z )     (((x) & (y)) | ((~(x)) & (z)))
//#define G( x, y, z )    (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
 
#define F( x, y, z )    ((((z) ^ (y)) & (x)) ^ (z))
#define G( x, y, z )    ((((x) | (y)) & (z) ) | ((x) & (y)))
#define H( x, y, z )    ((x) ^ (y) ^ (z) )
 
//
// The values a-d are stored in an array called ad.
// We have unrolled the code completely. This makes both the indices into
// the ad array constant, and it makes the message addressing constant.
//
// We copy the message into our own buffer to obey the read-once rule.
// Memory is sometimes aliased so that multiple threads or processes can access
// the same memory at the same time. With MD4 there is a danger that some other
// process could modify the memory while the computation is ongoing and introduce
// changes in the computation not envisioned by the designers or cryptanalists.
// At this level in the library we cannot guarantee that this is not the case,
// and we can't trust the higher layers to respect a don't-change-it-while-computing-md4
// restriction. (In practice, such restrictions are lost through the many
// layers in the stack.)
//
 
//
// r is the round number
// ad[(r+0)%4] = a;
// ad[(r+1)%4] = d;
// ad[(r+2)%4] = c;
// ad[(r+3)%4] = b;
//
// When r increments the register re-naming is automatically correct.
//
 
//
// CROUND is the core round function
//
#define CROUND( r, Func ) { \
    ad[r%4] = ROL32( ad[r%4] + Func(ad[(r+3)%4], ad[(r+2)%4], ad[(r+1)%4]) + Wt + md4Const[r/16], md4Rotate[r] ); \
}
 
//
// IROUND is the initial round that loads the message and copies it into our buffer.
//
#define IROUND( r, Func ) { \
    Wt = SYMCRYPT_LOAD_LSBFIRST32( &pbData[ 4*md4MsgIndex[r] ] ); \
    W[r] = Wt; \
    CROUND( r, Func ); \
}
 
//
// FROUND are the subsequent rounds.
//
#define FROUND( r, Func ) { \
    Wt = W[md4MsgIndex[r]];\
    CROUND( r, Func ); \
}
 
VOID
SYMCRYPT_CALL
SymCryptMd4AppendBlocks(
    _Inout_                 PSYMCRYPT_MD4_CHAINING_STATE    pChain,
    _In_reads_( cbData )    PCBYTE                          pbData,
                            SIZE_T                          cbData,
    _Out_                   SIZE_T                        * pcbRemaining )
{
 
    SYMCRYPT_ALIGN UINT32 W[16];
    SYMCRYPT_ALIGN UINT32 ad[4];
    UINT32 Wt;
 
    ad[0] = pChain->H[0];
    ad[1] = pChain->H[3];
    ad[2] = pChain->H[2];
    ad[3] = pChain->H[1];
 
    while( cbData >= 64 )
    {
        //
        // initial rounds 1 to 16
        //
 
        IROUND(  0, F );
        IROUND(  1, F );
        IROUND(  2, F );
        IROUND(  3, F );
        IROUND(  4, F );
        IROUND(  5, F );
        IROUND(  6, F );
        IROUND(  7, F );
        IROUND(  8, F );
        IROUND(  9, F );
        IROUND( 10, F );
        IROUND( 11, F );
        IROUND( 12, F );
        IROUND( 13, F );
        IROUND( 14, F );
        IROUND( 15, F );
 
        FROUND( 16, G );
        FROUND( 17, G );
        FROUND( 18, G );
        FROUND( 19, G );
        FROUND( 20, G );
        FROUND( 21, G );
        FROUND( 22, G );
        FROUND( 23, G );
        FROUND( 24, G );
        FROUND( 25, G );
        FROUND( 26, G );
        FROUND( 27, G );
        FROUND( 28, G );
        FROUND( 29, G );
        FROUND( 30, G );
        FROUND( 31, G );
 
        FROUND( 32, H );
        FROUND( 33, H );
        FROUND( 34, H );
        FROUND( 35, H );
        FROUND( 36, H );
        FROUND( 37, H );
        FROUND( 38, H );
        FROUND( 39, H );
        FROUND( 40, H );
        FROUND( 41, H );
        FROUND( 42, H );
        FROUND( 43, H );
        FROUND( 44, H );
        FROUND( 45, H );
        FROUND( 46, H );
        FROUND( 47, H );
 
        pChain->H[0] = ad[0] = ad[0] + pChain->H[0];
        pChain->H[3] = ad[1] = ad[1] + pChain->H[3];
        pChain->H[2] = ad[2] = ad[2] + pChain->H[2];
        pChain->H[1] = ad[3] = ad[3] + pChain->H[1];
 
        pbData += 64;
        cbData -= 64;
    }
 
    *pcbRemaining = cbData;
    //
    // Wipe the variables;
    //
    SymCryptWipeKnownSize( ad, sizeof( ad ) );
    SymCryptWipeKnownSize( W, sizeof( W ) );
    SYMCRYPT_FORCE_WRITE32( &Wt, 0 );
}
 
VOID
SYMCRYPT_CALL
SymCryptMd4StateExport(
    _In_                                                    PCSYMCRYPT_MD4_STATE    pState,
    _Out_writes_bytes_( SYMCRYPT_MD4_STATE_EXPORT_SIZE )    PBYTE                   pbBlob )
{
    SYMCRYPT_ALIGN SYMCRYPT_MD4_STATE_EXPORT_BLOB    blob;           // local copy to have proper alignment.
    C_ASSERT( sizeof( blob ) == SYMCRYPT_MD4_STATE_EXPORT_SIZE );
 
    SYMCRYPT_CHECK_MAGIC( pState );
 
    SymCryptWipeKnownSize( &blob, sizeof( blob ) ); // wipe to avoid any data leakage
 
    blob.header.magic = SYMCRYPT_BLOB_MAGIC;
    blob.header.size = SYMCRYPT_MD4_STATE_EXPORT_SIZE;
    blob.header.type = SymCryptBlobTypeMd4State;
 
    //
    // Copy the relevant data. Buffer will be 0-padded.
    //
 
    SymCryptUint32ToLsbFirst( &pState->chain.H[0], &blob.chain[0], 4 );
    blob.dataLength = pState->dataLengthL;
    memcpy( &blob.buffer[0], &pState->buffer[0], blob.dataLength & 0x3f );
 
    SYMCRYPT_ASSERT( (PCBYTE) &blob + sizeof( blob ) - sizeof( SYMCRYPT_BLOB_TRAILER ) == (PCBYTE) &blob.trailer );
    SymCryptMarvin32( SymCryptMarvin32DefaultSeed, (PCBYTE) &blob, sizeof( blob ) - sizeof( SYMCRYPT_BLOB_TRAILER ), &blob.trailer.checksum[0] );
 
    memcpy( pbBlob, &blob, sizeof( blob ) );
 
//cleanup:
    SymCryptWipeKnownSize( &blob, sizeof( blob ) );
    return;
}
 
SYMCRYPT_ERROR
SYMCRYPT_CALL
SymCryptMd4StateImport(
    _Out_                                               PSYMCRYPT_MD4_STATE     pState,
    _In_reads_bytes_( SYMCRYPT_MD4_STATE_EXPORT_SIZE)   PCBYTE                  pbBlob )
{
    SYMCRYPT_ERROR                  scError = SYMCRYPT_NO_ERROR;
    SYMCRYPT_ALIGN SYMCRYPT_MD4_STATE_EXPORT_BLOB  blob;                       // local copy to have proper alignment.
    BYTE                            checksum[8];
 
    C_ASSERT( sizeof( blob ) == SYMCRYPT_MD4_STATE_EXPORT_SIZE );
    memcpy( &blob, pbBlob, sizeof( blob ) );
 
    if( blob.header.magic != SYMCRYPT_BLOB_MAGIC ||
        blob.header.size != SYMCRYPT_MD4_STATE_EXPORT_SIZE ||
        blob.header.type != SymCryptBlobTypeMd4State )
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    SymCryptMarvin32( SymCryptMarvin32DefaultSeed, (PCBYTE) &blob, sizeof( blob ) - sizeof( SYMCRYPT_BLOB_TRAILER ), checksum );
    if( memcmp( checksum, &blob.trailer.checksum[0], 8 ) != 0 )
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    SymCryptLsbFirstToUint32( &blob.chain[0], &pState->chain.H[0], 4 );
    pState->dataLengthL = blob.dataLength;
    pState->dataLengthH = 0;
    pState->bytesInBuffer = blob.dataLength & 0x3f;
    memcpy( &pState->buffer[0], &blob.buffer[0], pState->bytesInBuffer );
 
    SYMCRYPT_SET_MAGIC( pState );
 
cleanup:
    SymCryptWipeKnownSize( &blob, sizeof(blob) );
    return scError;
}
 
 
 
//
// Simple test vector for FIPS module testing
//
 
static const BYTE   md4KATAnswer[ 16 ] = {
    0xa4, 0x48, 0x01, 0x7a, 0xaf, 0x21, 0xd8, 0x52,
    0x5f, 0xc1, 0x0a, 0xe8, 0x7a, 0xa6, 0x72, 0x9d,
} ;
 
VOID
SYMCRYPT_CALL
SymCryptMd4Selftest(void)
{
    BYTE result[SYMCRYPT_MD4_RESULT_SIZE];
 
    SymCryptMd4( SymCryptTestMsg3, sizeof( SymCryptTestMsg3 ), result );
 
    SymCryptInjectError( result, sizeof( result ) );
 
    if( memcmp( result, md4KATAnswer, sizeof( result ) ) != 0 ) {
        SymCryptFatal( 'MD4t' );
    }
}