sha2的C實現中的錯誤散列輸出256

Question

我已經實現了基於rfc規範的sha2 256：https://tools.ietf.org/html/rfc4634。

我的實現：

#include <stdio.h> 
#include <stdlib.h> 
#include <stdint.h> 
#include <string.h> 
#include <errno.h> 

uint32_t K[] = { 
0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5, 
0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5, 
0xd807aa98,0x12835b01,0x243185be,0x550c7dc3, 
0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174, 
0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc, 
0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da, 
0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7, 
0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967, 
0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13, 
0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85, 
0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3, 
0xd192e819,0xd6990624,0xf40e3585,0x106aa070, 
0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5, 
0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3, 
0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208, 
0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2, 
}; 

uint32_t CH(uint32_t x, uint32_t y, uint32_t z) { 
    uint32_t answ = (x & y)^(~x & z); 
    return answ; 
} 

uint32_t MAJ(uint32_t x, uint32_t y, uint32_t z) { 
    uint32_t answ = (x & y)^(x & z)^(y & z); 
    return answ; 
} 

uint32_t ROTL(uint32_t x, short n) { 
    return (x << n) | (x>>(32 - n)); 
} 

uint32_t ROTR(uint32_t x, short n) { 
    return (x >> n) | (x<<(32 - n)); 
} 

uint32_t BIGS0(uint32_t x) { 
    return ROTR(x,2)^ROTR(x,13)^ROTR(x,22); 
} 

uint32_t BIGS1(uint32_t x) { 
    return ROTR(x,6)^ROTR(x,11)^ROTR(x,25); 
} 

uint32_t SSIG0(uint32_t x) { 
    return ROTR(x,7)^ROTR(x,18)^(x >> 3); 
} 

uint32_t SSIG1(uint32_t x) { 
    return ROTR(x,17)^ROTR(x,19)^(x >> 10); 
} 

uint32_t toInt(uint8_t *t) { 
    return (t[3] << 24) | (t[2] << 16) | (t[1] << 8) | t[0]; 
} 

void process(uint32_t *block) { 
    uint32_t H[] = { 
     0x6a09e667, 
     0xbb67ae85, 
     0x3c6ef372, 
     0xa54ff53a, 
     0x510e527f, 
     0x9b05688c, 
     0x1f83d9ab, 
     0x5be0cd19 
    }; 
    uint32_t *W = (uint32_t *) malloc (sizeof(uint32_t*) * 64); 
    for (int t = 0; t < 16; t++) { 
     W[t] = block[t]; 
    } 
    for (int t = 16; t < 64; t++) { 
     W[t] = SSIG1(W[t-2]) + W[t-7] + SSIG0(t-15) + W[t-16]; 
    } 
    uint32_t a = H[0]; 
    uint32_t b = H[1]; 
    uint32_t c = H[2]; 
    uint32_t d = H[3]; 
    uint32_t e = H[4]; 
    uint32_t f = H[5]; 
    uint32_t g = H[6]; 
    uint32_t h = H[7]; 
    uint32_t T1 = 0; 
    uint32_t T2 = 0; 
    for(int t =0; t < 64 ; t++) { 
     T1 = h + BIGS1(e) + CH(e,f,g) + K[t] + W[t]; 
     T2 = BIGS0(a) + MAJ(a,b,c); 
     h = g; 
     g = f; 
     f = e; 
     e = d + T1; 
     d = c; 
     c = b; 
     b = a; 
     a = T1 + T2; 
    } 
    H[0] = a + H[0]; 
    H[1] = b + H[1]; 
    H[2] = c + H[2]; 
    H[3] = d + H[3]; 
    H[4] = e + H[4]; 
    H[5] = f + H[5]; 
    H[6] = g + H[6]; 
    H[7] = h + H[7]; 
    for (int j = 0; j < 8; j++) { 
     printf("%08x", H[j]); 
    } 
    free(W); 
} 

int main(void) 
{ 
    uint32_t block[] = { 
    0x61626380, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000000, 
    0x00000018, 
    };//abc in 512 bit padded block 
    process(block); 
    return 0; 
    } 

現在我只是在做一個512的消息塊，我測試的消息是「ABC」。做所有的預處理如在填充的消息塊所需結果如下：

0x61626380 0x00000000 0x00000000 0x00000000 
0x00000000 0x00000000 0x00000000 0x00000000 
0x00000000 0x00000000 0x00000000 0x00000000 
0x00000000 0x00000000 0x00000000 0x00000018 

通過我實現餵養它後，我得到的散列爲：4b9cc43100a30340dbc8f2328e2c80a91fdbd7b8cd20962d1b64e31283c4b99d

凡爲正確的哈希值是： ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

跟蹤我的輸出並將其與在http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf第34頁提供的示例進行比較。當需要計算變量e時，我的實現在迭代16（因此t = 16）時似乎出錯。

任何幫助，將不勝感激。

Answer 1

這條線：

W[t] = SSIG1(W[t-2]) + W[t-7] + SSIG0(t-15) + W[t-16]; 

應該

W[t] = SSIG1(W[t-2]) + W[t-7] + SSIG0(W[t-15]) + W[t-16]; 

問題踢在迭代16，因爲這時候你先參考值使用分配緩衝的（以前的值只是副本初始塊）。