I've implemented sha2 256 based on the rfc spec found at: https://www.rfc-editor.org/rfc/rfc4634.
My implementation:
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <errno.h>
uint32_t K[] = {
0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,
0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,
0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,
0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,
0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,
0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,
0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,
0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,
0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
};
uint32_t CH(uint32_t x, uint32_t y, uint32_t z) {
uint32_t answ = (x & y) ^ (~x & z);
return answ;
}
uint32_t MAJ(uint32_t x, uint32_t y, uint32_t z) {
uint32_t answ = (x & y) ^ (x & z) ^ (y & z);
return answ;
}
uint32_t ROTL(uint32_t x, short n) {
return (x << n) | (x>>(32 - n));
}
uint32_t ROTR(uint32_t x, short n) {
return (x >> n) | (x<<(32 - n));
}
uint32_t BIGS0(uint32_t x) {
return ROTR(x,2) ^ ROTR(x,13) ^ ROTR(x,22);
}
uint32_t BIGS1(uint32_t x) {
return ROTR(x,6) ^ ROTR(x,11) ^ ROTR(x,25);
}
uint32_t SSIG0(uint32_t x) {
return ROTR(x,7) ^ ROTR(x,18) ^ (x >> 3);
}
uint32_t SSIG1(uint32_t x) {
return ROTR(x,17) ^ ROTR(x,19) ^ (x >> 10);
}
uint32_t toInt(uint8_t *t) {
return (t[3] << 24) | (t[2] << 16) | (t[1] << 8) | t[0];
}
void process(uint32_t *block) {
uint32_t H[] = {
0x6a09e667,
0xbb67ae85,
0x3c6ef372,
0xa54ff53a,
0x510e527f,
0x9b05688c,
0x1f83d9ab,
0x5be0cd19
};
uint32_t *W = (uint32_t *) malloc (sizeof(uint32_t*) * 64);
for (int t = 0; t < 16; t++) {
W[t] = block[t];
}
for (int t = 16; t < 64; t++) {
W[t] = SSIG1(W[t-2]) + W[t-7] + SSIG0(t-15) + W[t-16];
}
uint32_t a = H[0];
uint32_t b = H[1];
uint32_t c = H[2];
uint32_t d = H[3];
uint32_t e = H[4];
uint32_t f = H[5];
uint32_t g = H[6];
uint32_t h = H[7];
uint32_t T1 = 0;
uint32_t T2 = 0;
for(int t =0; t < 64 ; t++) {
T1 = h + BIGS1(e) + CH(e,f,g) + K[t] + W[t];
T2 = BIGS0(a) + MAJ(a,b,c);
h = g;
g = f;
f = e;
e = d + T1;
d = c;
c = b;
b = a;
a = T1 + T2;
}
H[0] = a + H[0];
H[1] = b + H[1];
H[2] = c + H[2];
H[3] = d + H[3];
H[4] = e + H[4];
H[5] = f + H[5];
H[6] = g + H[6];
H[7] = h + H[7];
for (int j = 0; j < 8; j++ ) {
printf("%08x", H[j] );
}
free(W);
}
int main(void)
{
uint32_t block[] = {
0x61626380,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000000,
0x00000018,
};//abc in 512 bit padded block
process(block);
return 0;
}
For now I'm only doing one 512 message block and my testing message is 'abc'. Doing all the preprocessing as required results in a padded message block as follows:
0x61626380 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000018
After feeding it through my implementation I get the hash as: 4b9cc43100a30340dbc8f2328e2c80a91fdbd7b8cd20962d1b64e31283c4b99d
Where as the correct hash is:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
Tracing my output and comparing it to the example provided at http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf page 34. My implementation seems to go wrong at iteration 16 (thus t=16) when the variable e needs to be calculated.
Any help would be appreciated.
This line:
Should be
The problem kicks in on iteration 16 because that's when you first refer to a value buffered using that assignment (earlier values were just copies of the initial block).