c - sha2 256 的 C 实现中的错误哈希输出

Question

我已经根据 rfc 规范实现了 sha2 256:https://www.rfc-editor.org/rfc/rfc4634 .

我的实现:

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <errno.h>

uint32_t K[] = {
0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,
0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,
0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,
0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,
0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,
0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,
0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,
0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,
0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
};

uint32_t CH(uint32_t x, uint32_t y, uint32_t z) {
    uint32_t answ = (x & y) ^ (~x & z);
    return answ;
}

uint32_t MAJ(uint32_t x, uint32_t y, uint32_t z) {
    uint32_t answ = (x & y) ^ (x & z) ^ (y & z);
    return answ;
}

uint32_t ROTL(uint32_t x, short n) {
    return (x << n) | (x>>(32 - n));
}

uint32_t ROTR(uint32_t x, short n) {
    return (x >> n) | (x<<(32 - n));
}

uint32_t BIGS0(uint32_t x) {
    return ROTR(x,2) ^ ROTR(x,13) ^ ROTR(x,22);
}

uint32_t BIGS1(uint32_t x) {
    return ROTR(x,6) ^ ROTR(x,11) ^ ROTR(x,25);
}

uint32_t SSIG0(uint32_t x) {
    return ROTR(x,7) ^ ROTR(x,18) ^ (x >> 3);
}

uint32_t SSIG1(uint32_t x) {
    return ROTR(x,17) ^ ROTR(x,19) ^ (x >> 10);
}

uint32_t toInt(uint8_t *t) {
    return (t[3] << 24) | (t[2] << 16) | (t[1] << 8) | t[0];
}

void process(uint32_t *block) {
    uint32_t H[] = {
        0x6a09e667,
        0xbb67ae85,
        0x3c6ef372,
        0xa54ff53a,
        0x510e527f,
        0x9b05688c,
        0x1f83d9ab,
        0x5be0cd19
    };
    uint32_t *W = (uint32_t *) malloc (sizeof(uint32_t*) * 64);
    for (int t = 0; t < 16; t++) {
        W[t] = block[t];
    }
    for (int t = 16; t < 64; t++) {
        W[t] = SSIG1(W[t-2]) + W[t-7] + SSIG0(t-15) + W[t-16];
    }
    uint32_t a = H[0];
    uint32_t b = H[1];
    uint32_t c = H[2];
    uint32_t d = H[3];
    uint32_t e = H[4];
    uint32_t f = H[5];
    uint32_t g = H[6];
    uint32_t h = H[7];
    uint32_t T1 = 0;
    uint32_t T2 = 0;
    for(int t =0; t < 64 ; t++) {
        T1 = h + BIGS1(e) + CH(e,f,g) + K[t] + W[t];
        T2 = BIGS0(a) + MAJ(a,b,c);
        h = g;
        g = f;
        f = e;
        e = d + T1;
        d = c;
        c = b;
        b = a;
        a = T1 + T2;
    }
    H[0] = a + H[0];
    H[1] = b + H[1];
    H[2] = c + H[2];
    H[3] = d + H[3];
    H[4] = e + H[4];
    H[5] = f + H[5];
    H[6] = g + H[6];
    H[7] = h + H[7];
    for (int j = 0; j < 8; j++ ) {
        printf("%08x", H[j] );
    }
    free(W);
}

int main(void)
{
    uint32_t block[] = {
    0x61626380,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000000,
    0x00000018,
    };//abc in 512 bit padded block
    process(block);
    return 0;
   }

现在我只做一个 512 消息 block ，我的测试消息是“abc”。根据需要进行所有预处理会产生一个填充消息 block ，如下所示:

0x61626380 0x00000000 0x00000000 0x00000000 
0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000000
0x00000000 0x00000000 0x00000000 0x00000018

通过我的实现提供它后，我得到哈希为:4b9cc43100a30340dbc8f2328e2c80a91fdbd7b8cd20962d1b64e31283c4b99d

正确的散列是:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

跟踪我的输出并将其与 http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf 中提供的示例进行比较第 34 页。当需要计算变量 e 时，我的实现似乎在第 16 次迭代(因此 t=16)时出错。

如有任何帮助，我们将不胜感激。

Answer 1

这一行:

W[t] = SSIG1(W[t-2]) + W[t-7] + SSIG0(t-15) + W[t-16];

应该是

W[t] = SSIG1(W[t-2]) + W[t-7] + SSIG0(W[t-15]) + W[t-16];

问题在第 16 次迭代时开始，因为那是您第一次引用使用该赋值缓冲的值(较早的值只是初始 block 的副本)。