Feature request: SHA-256 support

[ethindp]

A user wishes to use my Noise C++ library to write a Bitchat implementation, which (apparently) uses Noise. However, the cryptographic requirements of Bitchat explicitly state that SHA-256 is used. The document also weirdly says that PBKDf2 is used for "derive[ing] channel keys", though I have no idea what that exactly means. If the "cryptographic primitives" section is all that is important for the cryptographic stuff, then all we're missing is SHA-256. You can find the entire document here: https://github.com/permissionlesstech/bitchat/blob/main/BRING_THE_NOISE.md#cryptographic-primitives

[LoupVaillant]

SHA-256 is out of scope. As are BLAKE2s and AES. But I agree they’re all useful. I’ll put them on my TODO list, and once they’re done, they’ll be available separately. I may link them from Monocypher’s website, but I really think they don’t belong in Monocypher proper.

In fact if it were just me, Monocypher would not even support Ed25519 (and thus would not have had SHA-512). But I needed it for my tests, and almost nobody (to my knowledge) uses the EdDSA/BLAKE2b variant. I’d like it to remain the sole exception.

So, not closing this right now, the work still needs to be done. It just won’t be included right here. 😃

[raysan5]

Reecently an SHA-256 implementation was added to raylib, it was validate against other implementation.

In case it could be useful for anyone:

// Compute SHA-256 hash code
// NOTE: Returns a static int[8] array (32 bytes)
unsigned int *ComputeSHA256(unsigned char *data, int dataSize)
{
    #define SHA256_ROTATE_RIGHT(x, c) ((x >> c) | (x << ((sizeof(unsigned int)*8) - c)))
    #define SHA256_A0(x) (SHA256_ROTATE_RIGHT(x, 7) ^ SHA256_ROTATE_RIGHT(x, 18) ^ (x >> 3))
    #define SHA256_A1(x) (SHA256_ROTATE_RIGHT(x, 17) ^ SHA256_ROTATE_RIGHT(x, 19) ^ (x >> 10))

    static const unsigned int k[64] = {
        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
        0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
        0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
        0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
        0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
        0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
        0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
        0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
        0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
    };

    static unsigned int hash[8] = { 0 };
    hash[0] = 0x6A09e667;
    hash[1] = 0xbb67ae85;
    hash[2] = 0x3c6ef372;
    hash[3] = 0xa54ff53a;
    hash[4] = 0x510e527f;
    hash[5] = 0x9b05688c;
    hash[6] = 0x1f83d9ab;
    hash[7] = 0x5be0cd19;

    const unsigned long long int bitLen = ((unsigned long long int)dataSize)*8;
    unsigned long long int paddedSize = dataSize + sizeof(dataSize);
    paddedSize += (64 - (paddedSize%64));
    unsigned char *buffer = (unsigned char *)calloc(paddedSize, sizeof(unsigned char));

    memcpy(buffer, data, dataSize);
    buffer[dataSize] = 0x80;
    for (int i = 1; i <= sizeof(bitLen); i++)
        buffer[(paddedSize - sizeof(bitLen)) + (i - 1)] = (bitLen >> (8*(sizeof(bitLen) - i))) & 0xFF;

    for (unsigned long long int blockN = 0; blockN < paddedSize/64; blockN++)
    {
        unsigned int a = hash[0];
        unsigned int b = hash[1];
        unsigned int c = hash[2];
        unsigned int d = hash[3];
        unsigned int e = hash[4];
        unsigned int f = hash[5];
        unsigned int g = hash[6];
        unsigned int h = hash[7];

        unsigned char *block = buffer + (blockN*64);
        unsigned int w[64] = { 0 };
        for (int i = 0; i < 16; i++)
        {
            w[i] = ((unsigned int)block[i*4 + 0] << 24) |
                   ((unsigned int)block[i*4 + 1] << 16) |
                   ((unsigned int)block[i*4 + 2] << 8)  |
                   ((unsigned int)block[i*4 + 3]);
        }
        for (int t = 16; t < 64; t++) w[t] = SHA256_A1(w[t - 2]) + w[t - 7] + SHA256_A0(w[t - 15]) + w[t - 16];

        for (unsigned long long int t = 0; t < 64; t++)
        {
            unsigned int e1 = (SHA256_ROTATE_RIGHT(e, 6) ^ SHA256_ROTATE_RIGHT(e, 11) ^ SHA256_ROTATE_RIGHT(e, 25));
            unsigned int ch = ((e & f) ^ (~e & g));
            unsigned int t1 = (h + e1 + ch + k[t] + w[t]);
            unsigned int e0 = (SHA256_ROTATE_RIGHT(a, 2) ^ SHA256_ROTATE_RIGHT(a, 13) ^ SHA256_ROTATE_RIGHT(a, 22));
            unsigned int maj = ((a & b) ^ (a & c) ^ (b & c));
            unsigned int t2 = e0 + maj;

            h = g;
            g = f;
            f = e;
            e = d + t1;
            d = c;
            c = b;
            b = a;
            a = t1 + t2;
        }

        hash[0] += a;
        hash[1] += b;
        hash[2] += c;
        hash[3] += d;
        hash[4] += e;
        hash[5] += f;
        hash[6] += g;
        hash[7] += h;
    }

    free(buffer);
    return hash;
}

[ethindp]

I originally opened this issue because someone was asking for it to use my Noise protocol framework in their Bitchat implementation, which required SHA-256, and since my implementation uses Monocypher I naturally don't support that hash function. The individual who opened the issue was generally dismissive of my replies and I eventually closed the issue and indicated to them that they may be better off seeing if Bitchat can support BLAKE2B instead. Modifying my library to support other hash functions would not be super hard but would require quite a bit of refactoring that I am unwilling to do on the basis that there is no demand for it.
All of that said, though, it would be neat if Monocypher either supported these or had pluggable implementations so to speak, so happy to leave this open.