|
| 1 | +//! Dependency-free SHA-256 (FIPS 180-4). |
| 2 | +//! |
| 3 | +//! Used for `proven`-state content hashing — detecting when a file changes |
| 4 | +//! after it was promoted, so the `proven -> inbox` invalidation in |
| 5 | +//! `arghda-spec.adoc` can fire. This is change-detection, not a security |
| 6 | +//! boundary, and the crate's ethos is lightweight, so we keep it hermetic |
| 7 | +//! (no `sha2` dependency tree) and pin correctness against the canonical |
| 8 | +//! NIST vectors in the tests below. |
| 9 | +
|
| 10 | +const H0: [u32; 8] = [ |
| 11 | + 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19, |
| 12 | +]; |
| 13 | + |
| 14 | +const K: [u32; 64] = [ |
| 15 | + 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, |
| 16 | + 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, |
| 17 | + 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, |
| 18 | + 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, |
| 19 | + 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, |
| 20 | + 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, |
| 21 | + 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, |
| 22 | + 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2, |
| 23 | +]; |
| 24 | + |
| 25 | +/// Lowercase hex SHA-256 digest of `data`. |
| 26 | +pub fn sha256_hex(data: &[u8]) -> String { |
| 27 | + // Pre-processing: append 0x80, pad with zeros to 56 mod 64, append the |
| 28 | + // 64-bit big-endian bit length. |
| 29 | + let mut msg = data.to_vec(); |
| 30 | + let bit_len = (data.len() as u64).wrapping_mul(8); |
| 31 | + msg.push(0x80); |
| 32 | + while msg.len() % 64 != 56 { |
| 33 | + msg.push(0); |
| 34 | + } |
| 35 | + msg.extend_from_slice(&bit_len.to_be_bytes()); |
| 36 | + |
| 37 | + let mut h = H0; |
| 38 | + for chunk in msg.chunks_exact(64) { |
| 39 | + let mut w = [0u32; 64]; |
| 40 | + for (i, word) in chunk.chunks_exact(4).take(16).enumerate() { |
| 41 | + w[i] = u32::from_be_bytes([word[0], word[1], word[2], word[3]]); |
| 42 | + } |
| 43 | + for i in 16..64 { |
| 44 | + let s0 = w[i - 15].rotate_right(7) ^ w[i - 15].rotate_right(18) ^ (w[i - 15] >> 3); |
| 45 | + let s1 = w[i - 2].rotate_right(17) ^ w[i - 2].rotate_right(19) ^ (w[i - 2] >> 10); |
| 46 | + w[i] = w[i - 16] |
| 47 | + .wrapping_add(s0) |
| 48 | + .wrapping_add(w[i - 7]) |
| 49 | + .wrapping_add(s1); |
| 50 | + } |
| 51 | + |
| 52 | + let [mut a, mut b, mut c, mut d, mut e, mut f, mut g, mut hh] = h; |
| 53 | + for (&ki, &wi) in K.iter().zip(w.iter()) { |
| 54 | + let s1 = e.rotate_right(6) ^ e.rotate_right(11) ^ e.rotate_right(25); |
| 55 | + let ch = (e & f) ^ ((!e) & g); |
| 56 | + let t1 = hh |
| 57 | + .wrapping_add(s1) |
| 58 | + .wrapping_add(ch) |
| 59 | + .wrapping_add(ki) |
| 60 | + .wrapping_add(wi); |
| 61 | + let s0 = a.rotate_right(2) ^ a.rotate_right(13) ^ a.rotate_right(22); |
| 62 | + let maj = (a & b) ^ (a & c) ^ (b & c); |
| 63 | + let t2 = s0.wrapping_add(maj); |
| 64 | + hh = g; |
| 65 | + g = f; |
| 66 | + f = e; |
| 67 | + e = d.wrapping_add(t1); |
| 68 | + d = c; |
| 69 | + c = b; |
| 70 | + b = a; |
| 71 | + a = t1.wrapping_add(t2); |
| 72 | + } |
| 73 | + for (slot, v) in h.iter_mut().zip([a, b, c, d, e, f, g, hh]) { |
| 74 | + *slot = slot.wrapping_add(v); |
| 75 | + } |
| 76 | + } |
| 77 | + |
| 78 | + let mut out = String::with_capacity(64); |
| 79 | + for word in h { |
| 80 | + out.push_str(&format!("{word:08x}")); |
| 81 | + } |
| 82 | + out |
| 83 | +} |
| 84 | + |
| 85 | +#[cfg(test)] |
| 86 | +mod tests { |
| 87 | + use super::*; |
| 88 | + |
| 89 | + // Canonical FIPS 180-4 / NIST test vectors. |
| 90 | + #[test] |
| 91 | + fn empty_string() { |
| 92 | + assert_eq!( |
| 93 | + sha256_hex(b""), |
| 94 | + "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" |
| 95 | + ); |
| 96 | + } |
| 97 | + |
| 98 | + #[test] |
| 99 | + fn abc() { |
| 100 | + assert_eq!( |
| 101 | + sha256_hex(b"abc"), |
| 102 | + "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad" |
| 103 | + ); |
| 104 | + } |
| 105 | + |
| 106 | + #[test] |
| 107 | + fn hello_world() { |
| 108 | + assert_eq!( |
| 109 | + sha256_hex(b"hello world"), |
| 110 | + "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9" |
| 111 | + ); |
| 112 | + } |
| 113 | + |
| 114 | + #[test] |
| 115 | + fn multi_block() { |
| 116 | + // 56 bytes forces a second padding block (length straddles the boundary). |
| 117 | + let input = "a".repeat(1000); |
| 118 | + assert_eq!( |
| 119 | + sha256_hex(input.as_bytes()), |
| 120 | + "41edece42d63e8d9bf515a9ba6932e1c20cbc9f5a5d134645adb5db1b9737ea3" |
| 121 | + ); |
| 122 | + } |
| 123 | +} |
0 commit comments