doc: Add RFC documents

1 files changed, 1235 insertions, 0 deletions

diff --git a/doc/rfc/rfc3174.txt b/doc/rfc/rfc3174.txt
new file mode 100644
index 0000000..ebe515d
--- /dev/null
+++ b/doc/rfc/rfc3174.txt
@@ -0,0 +1,1235 @@
+
+
+
+
+
+
+Network Working Group                                   D. Eastlake, 3rd
+Request for Comments: 3174                                      Motorola
+Category: Informational                                         P. Jones
+                                                           Cisco Systems
+                                                          September 2001
+
+
+                   US Secure Hash Algorithm 1 (SHA1)
+
+Status of this Memo
+
+   This memo provides information for the Internet community.  It does
+   not specify an Internet standard of any kind.  Distribution of this
+   memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (2001).  All Rights Reserved.
+
+Abstract
+
+   The purpose of this document is to make the SHA-1 (Secure Hash
+   Algorithm 1) hash algorithm conveniently available to the Internet
+   community.  The United States of America has adopted the SHA-1 hash
+   algorithm described herein as a Federal Information Processing
+   Standard.  Most of the text herein was taken by the authors from FIPS
+   180-1.  Only the C code implementation is "original".
+
+Acknowledgements
+
+   Most of the text herein was taken from [FIPS 180-1].  Only the C code
+   implementation is "original" but its style is similar to the
+   previously published MD4 and MD5 RFCs [RFCs 1320, 1321].
+
+   The SHA-1 is based on principles similar to those used by Professor
+   Ronald L. Rivest of MIT when designing the MD4 message digest
+   algorithm [MD4] and is modeled after that algorithm [RFC 1320].
+
+   Useful comments from the following, which have been incorporated
+   herein, are gratefully acknowledged:
+
+      Tony Hansen
+      Garrett Wollman
+
+
+
+
+
+
+
+
+Eastlake & Jones             Informational                      [Page 1]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+Table of Contents
+
+   1. Overview of Contents...........................................  2
+   2. Definitions of Bit Strings and Integers........................  3
+   3. Operations on Words............................................  3
+   4. Message Padding................................................  4
+   5. Functions and Constants Used...................................  6
+   6. Computing the Message Digest...................................  6
+   6.1 Method 1......................................................  6
+   6.2 Method 2......................................................  7
+   7. C Code.........................................................  8
+   7.1 .h file.......................................................  8
+   7.2 .c file....................................................... 10
+   7.3 Test Driver................................................... 18
+   8. Security Considerations........................................ 20
+   References........................................................ 21
+   Authors' Addresses................................................ 21
+   Full Copyright Statement.......................................... 22
+
+1. Overview of Contents
+
+   NOTE: The text below is mostly taken from [FIPS 180-1] and assertions
+   therein of the security of SHA-1 are made by the US Government, the
+   author of [FIPS 180-1], and not by the authors of this document.
+
+   This document specifies a Secure Hash Algorithm, SHA-1, for computing
+   a condensed representation of a message or a data file.  When a
+   message of any length < 2^64 bits is input, the SHA-1 produces a
+   160-bit output called a message digest.  The message digest can then,
+   for example, be input to a signature algorithm which generates or
+   verifies the signature for the message.  Signing the message digest
+   rather than the message often improves the efficiency of the process
+   because the message digest is usually much smaller in size than the
+   message.  The same hash algorithm must be used by the verifier of a
+   digital signature as was used by the creator of the digital
+   signature.  Any change to the message in transit will, with very high
+   probability, result in a different message digest, and the signature
+   will fail to verify.
+
+   The SHA-1 is called secure because it is computationally infeasible
+   to find a message which corresponds to a given message digest, or to
+   find two different messages which produce the same message digest.
+   Any change to a message in transit will, with very high probability,
+   result in a different message digest, and the signature will fail to
+   verify.
+
+
+
+
+
+
+Eastlake & Jones             Informational                      [Page 2]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+   Section 2 below defines the terminology and functions used as
+   building blocks to form SHA-1.
+
+2. Definitions of Bit Strings and Integers
+
+   The following terminology related to bit strings and integers will be
+   used:
+
+   a. A hex digit is an element of the set {0, 1, ... , 9, A, ... , F}.
+      A hex digit is the representation of a 4-bit string.  Examples:  7
+      = 0111, A = 1010.
+
+   b. A word equals a 32-bit string which may be represented as a
+      sequence of 8 hex digits.  To convert a word to 8 hex digits each
+      4-bit string is converted to its hex equivalent as described in
+      (a) above.  Example:
+
+      1010 0001 0000 0011 1111 1110 0010 0011 = A103FE23.
+
+   c. An integer between 0 and 2^32 - 1 inclusive may be represented as
+      a word.  The least significant four bits of the integer are
+      represented by the right-most hex digit of the word
+      representation.  Example: the integer 291 = 2^8+2^5+2^1+2^0 =
+      256+32+2+1 is represented by the hex word, 00000123.
+
+      If z is an integer, 0 <= z < 2^64, then z = (2^32)x + y where 0 <=
+      x < 2^32 and 0 <= y < 2^32.  Since x and y can be represented as
+      words X and Y, respectively, z can be represented as the pair of
+      words (X,Y).
+
+   d. block = 512-bit string.  A block (e.g., B) may be represented as a
+      sequence of 16 words.
+
+3. Operations on Words
+
+   The following logical operators will be applied to words:
+
+   a. Bitwise logical word operations
+
+      X AND Y  =  bitwise logical "and" of  X and Y.
+
+      X OR Y   =  bitwise logical "inclusive-or" of X and Y.
+
+      X XOR Y  =  bitwise logical "exclusive-or" of X and Y.
+
+      NOT X    =  bitwise logical "complement" of X.
+
+
+
+
+
+Eastlake & Jones             Informational                      [Page 3]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+      Example:
+
+               01101100101110011101001001111011
+         XOR   01100101110000010110100110110111
+               --------------------------------
+           =   00001001011110001011101111001100
+
+   b. The operation X + Y is defined as follows:  words X and Y
+      represent integers x and y, where 0 <= x < 2^32 and 0 <= y < 2^32.
+      For positive integers n and m, let n mod m be the remainder upon
+      dividing n by m.  Compute
+
+         z  =  (x + y) mod 2^32.
+
+      Then 0 <= z < 2^32.  Convert z to a word,  Z, and define Z = X +
+      Y.
+
+   c. The circular left shift operation S^n(X), where X is a word and n
+      is an integer with 0 <= n < 32, is defined by
+
+         S^n(X)  =  (X << n) OR (X >> 32-n).
+
+      In the above, X << n is obtained as follows: discard the left-most
+      n bits of X and then pad the result with n zeroes on the right
+      (the result will still be 32 bits).  X >> n is obtained by
+      discarding the right-most n bits of X and then padding the result
+      with n zeroes on the left.  Thus S^n(X) is equivalent to a
+      circular shift of X by n positions to the left.
+
+4. Message Padding
+
+   SHA-1 is used to compute a message digest for a message or data file
+   that is provided as input.  The message or data file should be
+   considered to be a bit string.  The length of the message is the
+   number of bits in the message (the empty message has length 0).  If
+   the number of bits in a message is a multiple of 8, for compactness
+   we can represent the message in hex.  The purpose of message padding
+   is to make the total length of a padded message a multiple of 512.
+   SHA-1 sequentially processes blocks of 512 bits when computing the
+   message digest.  The following specifies how this padding shall be
+   performed.  As a summary, a "1" followed by m "0"s followed by a 64-
+   bit integer are appended to the end of the message to produce a
+   padded message of length 512 * n.  The 64-bit integer is the length
+   of the original message.  The padded message is then processed by the
+   SHA-1 as n 512-bit blocks.
+
+
+
+
+
+
+Eastlake & Jones             Informational                      [Page 4]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+   Suppose a message has length l < 2^64.  Before it is input to the
+   SHA-1, the message is padded on the right as follows:
+
+   a. "1" is appended.  Example: if the original message is "01010000",
+      this is padded to "010100001".
+
+   b. "0"s are appended.  The number of "0"s will depend on the original
+      length of the message.  The last 64 bits of the last 512-bit block
+      are reserved
+
+      for the length l of the original message.
+
+      Example:  Suppose the original message is the bit string
+
+         01100001 01100010 01100011 01100100 01100101.
+
+      After step (a) this gives
+
+         01100001 01100010 01100011 01100100 01100101 1.
+
+      Since l = 40, the number of bits in the above is 41 and 407 "0"s
+      are appended, making the total now 448.  This gives (in hex)
+
+         61626364 65800000 00000000 00000000
+         00000000 00000000 00000000 00000000
+         00000000 00000000 00000000 00000000
+         00000000 00000000.
+
+   c. Obtain the 2-word representation of l, the number of bits in the
+      original message.  If l < 2^32 then the first word is all zeroes.
+      Append these two words to the padded message.
+
+      Example: Suppose the original message is as in (b).  Then l = 40
+      (note that l is computed before any padding).  The two-word
+      representation of 40 is hex 00000000 00000028.  Hence the final
+      padded message is hex
+
+         61626364 65800000 00000000 00000000
+         00000000 00000000 00000000 00000000
+         00000000 00000000 00000000 00000000
+         00000000 00000000 00000000 00000028.
+
+      The padded message will contain 16 * n words for some n > 0.
+      The padded message is regarded as a sequence of n blocks M(1) ,
+      M(2), first characters (or bits) of the message.
+
+
+
+
+
+
+Eastlake & Jones             Informational                      [Page 5]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+5. Functions and Constants Used
+
+   A sequence of logical functions f(0), f(1),..., f(79) is used in
+   SHA-1.  Each f(t), 0 <= t <= 79, operates on three 32-bit words B, C,
+   D and produces a 32-bit word as output.  f(t;B,C,D) is defined as
+   follows: for words B, C, D,
+
+      f(t;B,C,D) = (B AND C) OR ((NOT B) AND D)         ( 0 <= t <= 19)
+
+      f(t;B,C,D) = B XOR C XOR D                        (20 <= t <= 39)
+
+      f(t;B,C,D) = (B AND C) OR (B AND D) OR (C AND D)  (40 <= t <= 59)
+
+      f(t;B,C,D) = B XOR C XOR D                        (60 <= t <= 79).
+
+   A sequence of constant words K(0), K(1), ... , K(79) is used in the
+   SHA-1.  In hex these are given by
+
+      K(t) = 5A827999         ( 0 <= t <= 19)
+
+      K(t) = 6ED9EBA1         (20 <= t <= 39)
+
+      K(t) = 8F1BBCDC         (40 <= t <= 59)
+
+      K(t) = CA62C1D6         (60 <= t <= 79).
+
+6. Computing the Message Digest
+
+   The methods given in 6.1 and 6.2 below yield the same message digest.
+   Although using method 2 saves sixty-four 32-bit words of storage, it
+   is likely to lengthen execution time due to the increased complexity
+   of the address computations for the { W[t] } in step (c).  There are
+   other computation methods which give identical results.
+
+6.1 Method 1
+
+   The message digest is computed using the message padded as described
+   in section 4.  The computation is described using two buffers, each
+   consisting of five 32-bit words, and a sequence of eighty 32-bit
+   words.  The words of the first 5-word buffer are labeled A,B,C,D,E.
+   The words of the second 5-word buffer are labeled H0, H1, H2, H3, H4.
+   The words of the 80-word sequence are labeled W(0), W(1),..., W(79).
+   A single word buffer TEMP is also employed.
+
+   To generate the message digest, the 16-word blocks M(1), M(2),...,
+   M(n) defined in section 4 are processed in order.  The processing of
+   each M(i) involves 80 steps.
+
+
+
+
+Eastlake & Jones             Informational                      [Page 6]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+   Before processing any blocks, the H's are initialized as follows: in
+   hex,
+
+      H0 = 67452301
+
+      H1 = EFCDAB89
+
+      H2 = 98BADCFE
+
+      H3 = 10325476
+
+      H4 = C3D2E1F0.
+
+   Now M(1), M(2), ... , M(n) are processed.  To process M(i), we
+   proceed as follows:
+
+      a. Divide M(i) into 16 words W(0), W(1), ... , W(15), where W(0)
+         is the left-most word.
+
+      b. For t = 16 to 79 let
+
+         W(t) = S^1(W(t-3) XOR W(t-8) XOR W(t-14) XOR W(t-16)).
+
+      c. Let A = H0, B = H1, C = H2, D = H3, E = H4.
+
+      d. For t = 0 to 79 do
+
+         TEMP = S^5(A) + f(t;B,C,D) + E + W(t) + K(t);
+
+         E = D;  D = C;  C = S^30(B);  B = A; A = TEMP;
+
+      e. Let H0 = H0 + A, H1 = H1 + B, H2 = H2 + C, H3 = H3 + D, H4 = H4
+         + E.
+
+   After processing M(n), the message digest is the 160-bit string
+   represented by the 5 words
+
+         H0 H1 H2 H3 H4.
+
+6.2 Method 2
+
+   The method above assumes that the sequence W(0), ... , W(79) is
+   implemented as an array of eighty 32-bit words.  This is efficient
+   from the standpoint of minimization of execution time, since the
+   addresses of W(t-3), ...  ,W(t-16) in step (b) are easily computed.
+   If space is at a premium, an alternative is to regard { W(t) } as a
+
+
+
+
+
+Eastlake & Jones             Informational                      [Page 7]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+   circular queue, which may be implemented using an array of sixteen
+   32-bit words W[0], ... W[15].  In this case, in hex let
+
+   MASK = 0000000F.  Then processing of M(i) is as follows:
+
+      a. Divide M(i) into 16 words W[0], ... , W[15], where W[0] is the
+         left-most word.
+
+      b. Let A = H0, B = H1, C = H2, D = H3, E = H4.
+
+      c. For t = 0 to 79 do
+
+         s = t AND MASK;
+
+         if (t >= 16) W[s] = S^1(W[(s + 13) AND MASK] XOR W[(s + 8) AND
+         MASK] XOR W[(s + 2) AND MASK] XOR W[s]);
+
+         TEMP = S^5(A) + f(t;B,C,D) + E + W[s] + K(t);
+
+         E = D; D = C; C = S^30(B); B = A; A = TEMP;
+
+      d. Let H0 = H0 + A, H1 = H1 + B, H2 = H2 + C, H3 = H3 + D, H4 = H4
+         + E.
+
+7. C Code
+
+   Below is a demonstration implementation of SHA-1 in C.  Section 7.1
+   contains the header file, 7.2 the C code, and 7.3 a test driver.
+
+7.1 .h file
+
+/*
+ *  sha1.h
+ *
+ *  Description:
+ *      This is the header file for code which implements the Secure
+ *      Hashing Algorithm 1 as defined in FIPS PUB 180-1 published
+ *      April 17, 1995.
+ *
+ *      Many of the variable names in this code, especially the
+ *      single character names, were used because those were the names
+ *      used in the publication.
+ *
+ *      Please read the file sha1.c for more information.
+ *
+ */
+
+
+
+
+
+Eastlake & Jones             Informational                      [Page 8]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+#ifndef _SHA1_H_
+#define _SHA1_H_
+
+#include <stdint.h>
+/*
+ * If you do not have the ISO standard stdint.h header file, then you
+ * must typdef the following:
+ *    name              meaning
+ *  uint32_t         unsigned 32 bit integer
+ *  uint8_t          unsigned 8 bit integer (i.e., unsigned char)
+ *  int_least16_t    integer of >= 16 bits
+ *
+ */
+
+#ifndef _SHA_enum_
+#define _SHA_enum_
+enum
+{
+    shaSuccess = 0,
+    shaNull,            /* Null pointer parameter */
+    shaInputTooLong,    /* input data too long */
+    shaStateError       /* called Input after Result */
+};
+#endif
+#define SHA1HashSize 20
+
+/*
+ *  This structure will hold context information for the SHA-1
+ *  hashing operation
+ */
+typedef struct SHA1Context
+{
+    uint32_t Intermediate_Hash[SHA1HashSize/4]; /* Message Digest  */
+
+    uint32_t Length_Low;            /* Message length in bits      */
+    uint32_t Length_High;           /* Message length in bits      */
+
+                               /* Index into message block array   */
+    int_least16_t Message_Block_Index;
+    uint8_t Message_Block[64];      /* 512-bit message blocks      */
+
+    int Computed;               /* Is the digest computed?         */
+    int Corrupted;             /* Is the message digest corrupted? */
+} SHA1Context;
+
+/*
+ *  Function Prototypes
+ */
+
+
+
+Eastlake & Jones             Informational                      [Page 9]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+int SHA1Reset(  SHA1Context *);
+int SHA1Input(  SHA1Context *,
+                const uint8_t *,
+                unsigned int);
+int SHA1Result( SHA1Context *,
+                uint8_t Message_Digest[SHA1HashSize]);
+
+#endif
+
+7.2 .c file
+
+/*
+ *  sha1.c
+ *
+ *  Description:
+ *      This file implements the Secure Hashing Algorithm 1 as
+ *      defined in FIPS PUB 180-1 published April 17, 1995.
+ *
+ *      The SHA-1, produces a 160-bit message digest for a given
+ *      data stream.  It should take about 2**n steps to find a
+ *      message with the same digest as a given message and
+ *      2**(n/2) to find any two messages with the same digest,
+ *      when n is the digest size in bits.  Therefore, this
+ *      algorithm can serve as a means of providing a
+ *      "fingerprint" for a message.
+ *
+ *  Portability Issues:
+ *      SHA-1 is defined in terms of 32-bit "words".  This code
+ *      uses <stdint.h> (included via "sha1.h" to define 32 and 8
+ *      bit unsigned integer types.  If your C compiler does not
+ *      support 32 bit unsigned integers, this code is not
+ *      appropriate.
+ *
+ *  Caveats:
+ *      SHA-1 is designed to work with messages less than 2^64 bits
+ *      long.  Although SHA-1 allows a message digest to be generated
+ *      for messages of any number of bits less than 2^64, this
+ *      implementation only works with messages with a length that is
+ *      a multiple of the size of an 8-bit character.
+ *
+ */
+
+
+
+
+
+
+
+
+
+
+Eastlake & Jones             Informational                     [Page 10]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+#include "sha1.h"
+
+/*
+ *  Define the SHA1 circular left shift macro
+ */
+#define SHA1CircularShift(bits,word) \
+                (((word) << (bits)) | ((word) >> (32-(bits))))
+
+/* Local Function Prototyptes */
+void SHA1PadMessage(SHA1Context *);
+void SHA1ProcessMessageBlock(SHA1Context *);
+
+/*
+ *  SHA1Reset
+ *
+ *  Description:
+ *      This function will initialize the SHA1Context in preparation
+ *      for computing a new SHA1 message digest.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The context to reset.
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int SHA1Reset(SHA1Context *context)
+{
+    if (!context)
+    {
+        return shaNull;
+    }
+
+    context->Length_Low             = 0;
+    context->Length_High            = 0;
+    context->Message_Block_Index    = 0;
+
+    context->Intermediate_Hash[0]   = 0x67452301;
+    context->Intermediate_Hash[1]   = 0xEFCDAB89;
+    context->Intermediate_Hash[2]   = 0x98BADCFE;
+    context->Intermediate_Hash[3]   = 0x10325476;
+    context->Intermediate_Hash[4]   = 0xC3D2E1F0;
+
+    context->Computed   = 0;
+    context->Corrupted  = 0;
+
+
+
+
+
+Eastlake & Jones             Informational                     [Page 11]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+    return shaSuccess;
+}
+
+/*
+ *  SHA1Result
+ *
+ *  Description:
+ *      This function will return the 160-bit message digest into the
+ *      Message_Digest array  provided by the caller.
+ *      NOTE: The first octet of hash is stored in the 0th element,
+ *            the last octet of hash in the 19th element.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The context to use to calculate the SHA-1 hash.
+ *      Message_Digest: [out]
+ *          Where the digest is returned.
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int SHA1Result( SHA1Context *context,
+                uint8_t Message_Digest[SHA1HashSize])
+{
+    int i;
+
+    if (!context || !Message_Digest)
+    {
+        return shaNull;
+    }
+
+    if (context->Corrupted)
+    {
+        return context->Corrupted;
+    }
+
+    if (!context->Computed)
+    {
+        SHA1PadMessage(context);
+        for(i=0; i<64; ++i)
+        {
+            /* message may be sensitive, clear it out */
+            context->Message_Block[i] = 0;
+        }
+        context->Length_Low = 0;    /* and clear length */
+        context->Length_High = 0;
+        context->Computed = 1;
+
+
+
+Eastlake & Jones             Informational                     [Page 12]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+    }
+
+    for(i = 0; i < SHA1HashSize; ++i)
+    {
+        Message_Digest[i] = context->Intermediate_Hash[i>>2]
+                            >> 8 * ( 3 - ( i & 0x03 ) );
+    }
+
+    return shaSuccess;
+}
+
+/*
+ *  SHA1Input
+ *
+ *  Description:
+ *      This function accepts an array of octets as the next portion
+ *      of the message.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The SHA context to update
+ *      message_array: [in]
+ *          An array of characters representing the next portion of
+ *          the message.
+ *      length: [in]
+ *          The length of the message in message_array
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int SHA1Input(    SHA1Context    *context,
+                  const uint8_t  *message_array,
+                  unsigned       length)
+{
+    if (!length)
+    {
+        return shaSuccess;
+    }
+
+    if (!context || !message_array)
+    {
+        return shaNull;
+    }
+
+    if (context->Computed)
+    {
+        context->Corrupted = shaStateError;
+
+
+
+Eastlake & Jones             Informational                     [Page 13]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+        return shaStateError;
+    }
+
+    if (context->Corrupted)
+    {
+         return context->Corrupted;
+    }
+    while(length-- && !context->Corrupted)
+    {
+    context->Message_Block[context->Message_Block_Index++] =
+                    (*message_array & 0xFF);
+
+    context->Length_Low += 8;
+    if (context->Length_Low == 0)
+    {
+        context->Length_High++;
+        if (context->Length_High == 0)
+        {
+            /* Message is too long */
+            context->Corrupted = 1;
+        }
+    }
+
+    if (context->Message_Block_Index == 64)
+    {
+        SHA1ProcessMessageBlock(context);
+    }
+
+    message_array++;
+    }
+
+    return shaSuccess;
+}
+
+/*
+ *  SHA1ProcessMessageBlock
+ *
+ *  Description:
+ *      This function will process the next 512 bits of the message
+ *      stored in the Message_Block array.
+ *
+ *  Parameters:
+ *      None.
+ *
+ *  Returns:
+ *      Nothing.
+ *
+ *  Comments:
+
+
+
+Eastlake & Jones             Informational                     [Page 14]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+ *      Many of the variable names in this code, especially the
+ *      single character names, were used because those were the
+ *      names used in the publication.
+ *
+ *
+ */
+void SHA1ProcessMessageBlock(SHA1Context *context)
+{
+    const uint32_t K[] =    {       /* Constants defined in SHA-1   */
+                            0x5A827999,
+                            0x6ED9EBA1,
+                            0x8F1BBCDC,
+                            0xCA62C1D6
+                            };
+    int           t;                 /* Loop counter                */
+    uint32_t      temp;              /* Temporary word value        */
+    uint32_t      W[80];             /* Word sequence               */
+    uint32_t      A, B, C, D, E;     /* Word buffers                */
+
+    /*
+     *  Initialize the first 16 words in the array W
+     */
+    for(t = 0; t < 16; t++)
+    {
+        W[t] = context->Message_Block[t * 4] << 24;
+        W[t] |= context->Message_Block[t * 4 + 1] << 16;
+        W[t] |= context->Message_Block[t * 4 + 2] << 8;
+        W[t] |= context->Message_Block[t * 4 + 3];
+    }
+
+    for(t = 16; t < 80; t++)
+    {
+       W[t] = SHA1CircularShift(1,W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16]);
+    }
+
+    A = context->Intermediate_Hash[0];
+    B = context->Intermediate_Hash[1];
+    C = context->Intermediate_Hash[2];
+    D = context->Intermediate_Hash[3];
+    E = context->Intermediate_Hash[4];
+
+    for(t = 0; t < 20; t++)
+    {
+        temp =  SHA1CircularShift(5,A) +
+                ((B & C) | ((~B) & D)) + E + W[t] + K[0];
+        E = D;
+        D = C;
+        C = SHA1CircularShift(30,B);
+
+
+
+Eastlake & Jones             Informational                     [Page 15]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+        B = A;
+        A = temp;
+    }
+
+    for(t = 20; t < 40; t++)
+    {
+        temp = SHA1CircularShift(5,A) + (B ^ C ^ D) + E + W[t] + K[1];
+        E = D;
+        D = C;
+        C = SHA1CircularShift(30,B);
+        B = A;
+        A = temp;
+    }
+
+    for(t = 40; t < 60; t++)
+    {
+        temp = SHA1CircularShift(5,A) +
+               ((B & C) | (B & D) | (C & D)) + E + W[t] + K[2];
+        E = D;
+        D = C;
+        C = SHA1CircularShift(30,B);
+        B = A;
+        A = temp;
+    }
+
+    for(t = 60; t < 80; t++)
+    {
+        temp = SHA1CircularShift(5,A) + (B ^ C ^ D) + E + W[t] + K[3];
+        E = D;
+        D = C;
+        C = SHA1CircularShift(30,B);
+        B = A;
+        A = temp;
+    }
+
+    context->Intermediate_Hash[0] += A;
+    context->Intermediate_Hash[1] += B;
+    context->Intermediate_Hash[2] += C;
+    context->Intermediate_Hash[3] += D;
+    context->Intermediate_Hash[4] += E;
+
+    context->Message_Block_Index = 0;
+}
+
+
+/*
+ *  SHA1PadMessage
+ *
+
+
+
+Eastlake & Jones             Informational                     [Page 16]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+ *  Description:
+ *      According to the standard, the message must be padded to an even
+ *      512 bits.  The first padding bit must be a '1'.  The last 64
+ *      bits represent the length of the original message.  All bits in
+ *      between should be 0.  This function will pad the message
+ *      according to those rules by filling the Message_Block array
+ *      accordingly.  It will also call the ProcessMessageBlock function
+ *      provided appropriately.  When it returns, it can be assumed that
+ *      the message digest has been computed.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The context to pad
+ *      ProcessMessageBlock: [in]
+ *          The appropriate SHA*ProcessMessageBlock function
+ *  Returns:
+ *      Nothing.
+ *
+ */
+
+void SHA1PadMessage(SHA1Context *context)
+{
+    /*
+     *  Check to see if the current message block is too small to hold
+     *  the initial padding bits and length.  If so, we will pad the
+     *  block, process it, and then continue padding into a second
+     *  block.
+     */
+    if (context->Message_Block_Index > 55)
+    {
+        context->Message_Block[context->Message_Block_Index++] = 0x80;
+        while(context->Message_Block_Index < 64)
+        {
+            context->Message_Block[context->Message_Block_Index++] = 0;
+        }
+
+        SHA1ProcessMessageBlock(context);
+
+        while(context->Message_Block_Index < 56)
+        {
+            context->Message_Block[context->Message_Block_Index++] = 0;
+        }
+    }
+    else
+    {
+        context->Message_Block[context->Message_Block_Index++] = 0x80;
+        while(context->Message_Block_Index < 56)
+        {
+
+
+
+Eastlake & Jones             Informational                     [Page 17]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+            context->Message_Block[context->Message_Block_Index++] = 0;
+        }
+    }
+
+    /*
+     *  Store the message length as the last 8 octets
+     */
+    context->Message_Block[56] = context->Length_High >> 24;
+    context->Message_Block[57] = context->Length_High >> 16;
+    context->Message_Block[58] = context->Length_High >> 8;
+    context->Message_Block[59] = context->Length_High;
+    context->Message_Block[60] = context->Length_Low >> 24;
+    context->Message_Block[61] = context->Length_Low >> 16;
+    context->Message_Block[62] = context->Length_Low >> 8;
+    context->Message_Block[63] = context->Length_Low;
+
+    SHA1ProcessMessageBlock(context);
+}
+
+7.3 Test Driver
+
+   The following code is a main program test driver to exercise the code
+   in sha1.c.
+
+/*
+ *  sha1test.c
+ *
+ *  Description:
+ *      This file will exercise the SHA-1 code performing the three
+ *      tests documented in FIPS PUB 180-1 plus one which calls
+ *      SHA1Input with an exact multiple of 512 bits, plus a few
+ *      error test checks.
+ *
+ *  Portability Issues:
+ *      None.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include "sha1.h"
+
+/*
+ *  Define patterns for testing
+ */
+#define TEST1   "abc"
+#define TEST2a  "abcdbcdecdefdefgefghfghighijhi"
+
+
+
+Eastlake & Jones             Informational                     [Page 18]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+#define TEST2b  "jkijkljklmklmnlmnomnopnopq"
+#define TEST2   TEST2a TEST2b
+#define TEST3   "a"
+#define TEST4a  "01234567012345670123456701234567"
+#define TEST4b  "01234567012345670123456701234567"
+    /* an exact multiple of 512 bits */
+#define TEST4   TEST4a TEST4b
+char *testarray[4] =
+{
+    TEST1,
+    TEST2,
+    TEST3,
+    TEST4
+};
+long int repeatcount[4] = { 1, 1, 1000000, 10 };
+char *resultarray[4] =
+{
+    "A9 99 3E 36 47 06 81 6A BA 3E 25 71 78 50 C2 6C 9C D0 D8 9D",
+    "84 98 3E 44 1C 3B D2 6E BA AE 4A A1 F9 51 29 E5 E5 46 70 F1",
+    "34 AA 97 3C D4 C4 DA A4 F6 1E EB 2B DB AD 27 31 65 34 01 6F",
+    "DE A3 56 A2 CD DD 90 C7 A7 EC ED C5 EB B5 63 93 4F 46 04 52"
+};
+
+int main()
+{
+    SHA1Context sha;
+    int i, j, err;
+    uint8_t Message_Digest[20];
+
+    /*
+     *  Perform SHA-1 tests
+     */
+    for(j = 0; j < 4; ++j)
+    {
+        printf( "\nTest %d: %d, '%s'\n",
+                j+1,
+                repeatcount[j],
+                testarray[j]);
+
+        err = SHA1Reset(&sha);
+        if (err)
+        {
+            fprintf(stderr, "SHA1Reset Error %d.\n", err );
+            break;    /* out of for j loop */
+        }
+
+        for(i = 0; i < repeatcount[j]; ++i)
+        {
+
+
+
+Eastlake & Jones             Informational                     [Page 19]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+            err = SHA1Input(&sha,
+                  (const unsigned char *) testarray[j],
+                  strlen(testarray[j]));
+            if (err)
+            {
+                fprintf(stderr, "SHA1Input Error %d.\n", err );
+                break;    /* out of for i loop */
+            }
+        }
+
+        err = SHA1Result(&sha, Message_Digest);
+        if (err)
+        {
+            fprintf(stderr,
+            "SHA1Result Error %d, could not compute message digest.\n",
+            err );
+        }
+        else
+        {
+            printf("\t");
+            for(i = 0; i < 20 ; ++i)
+            {
+                printf("%02X ", Message_Digest[i]);
+            }
+            printf("\n");
+        }
+        printf("Should match:\n");
+        printf("\t%s\n", resultarray[j]);
+    }
+
+    /* Test some error returns */
+    err = SHA1Input(&sha,(const unsigned char *) testarray[1], 1);
+    printf ("\nError %d. Should be %d.\n", err, shaStateError );
+    err = SHA1Reset(0);
+    printf ("\nError %d. Should be %d.\n", err, shaNull );
+    return 0;
+}
+
+8. Security Considerations
+
+   This document is intended to provide convenient open source access by
+   the Internet community to the United States of America Federal
+   Information Processing Standard Secure Hash Function SHA-1 [FIPS
+   180-1].  No independent assertion of the security of this hash
+   function by the authors for any particular use is intended.
+
+
+
+
+
+
+Eastlake & Jones             Informational                     [Page 20]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+References
+
+   [FIPS 180-1] "Secure Hash Standard", United States of American,
+                National Institute of Science and Technology, Federal
+                Information Processing Standard (FIPS) 180-1, April
+                1993.
+
+   [MD4]        "The MD4 Message Digest Algorithm," Advances in
+                Cryptology - CRYPTO '90 Proceedings, Springer-Verlag,
+                1991, pp. 303-311.
+
+   [RFC 1320]   Rivest, R., "The MD4 Message-Digest Algorithm", RFC
+                1320, April 1992.
+
+   [RFC 1321]   Rivest, R., "The MD5 Message-Digest Algorithm", RFC
+                1321, April 1992.
+
+   [RFC 1750]   Eastlake, D., Crocker, S. and J. Schiller, "Randomness
+                Requirements for Security", RFC 1750, December 1994.
+
+Authors' Addresses
+
+   Donald E. Eastlake, 3rd
+   Motorola
+   155 Beaver Street
+   Milford, MA 01757 USA
+
+   Phone:   +1 508-634-2066 (h)
+            +1 508-261-5434 (w)
+   Fax:     +1 508-261-4777
+   EMail:   Donald.Eastlake@motorola.com
+
+
+   Paul E. Jones
+   Cisco Systems, Inc.
+   7025 Kit Creek Road
+   Research Triangle Park, NC 27709 USA
+
+   Phone:   +1 919 392 6948
+   EMail:   paulej@packetizer.com
+
+
+
+
+
+
+
+
+
+
+
+Eastlake & Jones             Informational                     [Page 21]
+
+RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001
+
+
+Full Copyright Statement
+
+   Copyright (C) The Internet Society (2001).  All Rights Reserved.
+
+   This document and translations of it may be copied and furnished to
+   others, and derivative works that comment on or otherwise explain it
+   or assist in its implementation may be prepared, copied, published
+   and distributed, in whole or in part, without restriction of any
+   kind, provided that the above copyright notice and this paragraph are
+   included on all such copies and derivative works.  However, this
+   document itself may not be modified in any way, such as by removing
+   the copyright notice or references to the Internet Society or other
+   Internet organizations, except as needed for the purpose of
+   developing Internet standards in which case the procedures for
+   copyrights defined in the Internet Standards process must be
+   followed, or as required to translate it into languages other than
+   English.
+
+   The limited permissions granted above are perpetual and will not be
+   revoked by the Internet Society or its successors or assigns.
+
+   This document and the information contained herein is provided on an
+   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
+   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
+   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
+   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
+   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Acknowledgement
+
+   Funding for the RFC Editor function is currently provided by the
+   Internet Society.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Eastlake & Jones             Informational                     [Page 22]
+