0

Is it possible to calculate a SHA1 hash by feeding chunks to the rep xsha1 instruction?

VIA's Padlock programming guide shows an example of calculating the SHA1 hash of a file, but it loads the entire file into memory before calling the hash instruction.
I also don't see any info regarding calculating SHA hashes in chunks. One may assume that, because you need to initialise the output buffer values, that just simply calling rep xsha1 again without reinitialising them may work, however after testing, this doesn't seem to be the case (I'm feeding it blocks of 64 bytes if that matters).

I don't know the internals of how SHA1 hashing works, but I'm guessing that there's a finalisation step which you need to somehow stop the hardware doing if loading the data in chunks.

Does anyone know of an efficient way to calculate a SHA1 hash in chunks?

0

Depends on the CPU. On VIA Nano and later, you can perform partial hashes by setting EAX to FFFFFFFF before executing the REP XSHA1/256 instruction - and the CPU won't perform the final padding (so you can simply feed the chunks into the hash, just as you usually do with hashing functions). On older models (up to C7), such a possibility is not present, EAX has to be set to zero before the hash instruction, and a full hash (i.e. including the final padding) is performed.

I successfully implemented the hack mentioned above (on Windows) and it worked [tested on VIA Nano with EAX=0 though, don't have access to an old CPU]. But yes, there's a performance penalty here, so you don't want to feed tiny chunks into the code. I suggest to buffer small chunks into a bigger buffer, say a few kilobytes, and only then perform the "interrupted hash". If you finish with less data than that, it may be better to fall back to ordinary x86 code.

Since I can't comment/reply on other posts, here's a reply to the comment below:

I'm afraid I can't share my code, but I suggest to google for "PadlockSDK_3.1_Release_20090121.zip" That's the official Via source containing the relevant functions (look e.g. inside PadlockSDK_3.1_Release_20090121\PadlockSDK_3.1_build20081128\sdk\src - there's the assembly implementation of asm_partial_sha1_op3() function).

3
  • Thanks a lot for the response! Do you have any sample code? I'm unable to get it to work unfortunately - please see: pastebin.com/PnBv3AJP When RAX is set to -1, the output appears to be random (changes each time the program is run). Note that I'm using 64-bit Linux on a VIA Nano CPU. I've managed to get the hack working (added comments above).
    – zinga
    Jul 24 '14 at 11:56
  • Thanks for the update! I didn't notice it, since I don't get any notification, but happened to look at this today. Originally I had downloaded 'PadlockSDK_Suit_2.0.2b_Release_20070703a.zip' because the link on the VIA website is dead. This 2007 version didn't have any partial hashing info (presumably because it was before the Nano). The link on VIA's site is still dead, but I managed to grab a copy from archive.org.
    – zinga
    Aug 12 '14 at 7:32
  • Aside from setting EAX to -1, there's actually one other thing required for partial hashing - the data size must be a multiple of 64, and the size sent into XSHA1 (ECX) must be divided by 64. Haven't done a full check, but this appears to give me stable results at least.
    – zinga
    Aug 12 '14 at 7:32
0

Well, I found this: http://www.logix.cz/michal/devel/padlock/phe_sum.xp

PHE saves its current state into a memory on every process switch and as well on any page fault that occurs during the run. This state includes number of bytes hashed and an intermediate result that could be used as an initial value for subsequent rounds. So far so good. The only remaining question is how to trigger a context switch or a page fault at the place we need. Solution: mmap(2) two or more pages, mprotect(2) the last one to deny all access (PROT_NONE). This creates an inaccessible piece of memory exactly at the place we need. Now we put all our input data just before this barrier and engage PHE. However we'll tell it to hash slightly more data than we put into the buffer. With these instructions PHE will crunch all our input and attempt to hash some more. At that point it hits the protected area, trigges an exception, saves current intermediate status into the memory and calls the exception handler (well, not exactly and not exactly in this order, never mind ;-). Anyway the exception handler skips over the PHE instruction (hacky hack, EIP+=4 ;-) and returns.

Clever hack, but I don't know about the performance penalty of doing this.

Doing some testing, it seems that it never completes if the file is larger than the input buffer, i.e. the hack doesn't appear to be working for me, so it seems rather fragile, though the theory sounds okay.

So from what I've found, there's no particularly ideal way to feed xsha1 in chunks. (seems a little pointless to have hardware accelerated hashing support without being able to feed it large amounts of data nicely)

1
  • I've figured out why it won't work - I'm running 64-bit Linux on a VIA Nano CPU, whereas the example is for 32-bit. I've changed EIP to RIP and removed the 64-byte padding (despite what the comment says, having it makes it fail for me). Here's my modified version of phe_sum.c: pastebin.com/7F2ssqhq Only tested on my environment, but may help others in a similar situation.
    – zinga
    Jul 24 '14 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.