agentd/
sha.rs

1// SPDX-License-Identifier: AGPL-3.0-only
2//! A compact, dependency-free SHA-256 (FIPS 180-4) — content identity: workflow
3//! hashes, skill body hashes, artifact digests. A checkpoint envelope binds the
4//! graph it was taken from by
5//! `sha256(canonical graph JSON)`; resume refuses a mismatch. Hand-rolled like
6//! the cron parser and FNV-1a (the minimalism moat): ~60 lines, byte-oriented,
7//! verified against the FIPS/NIST test vectors below. Also backs
8//! [`hmac_sha256`] for inbound webhook signature verification (RFC 2104);
9//! agentd's own outbound request signing (RFC 9421) uses `ring` under aauth.
10
11const K: [u32; 64] = [
12    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
13    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
14    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
15    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
16    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
17    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
18    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
19    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
20];
21
22/// SHA-256 of `bytes` — the raw 32-byte digest.
23pub fn sha256(bytes: &[u8]) -> [u8; 32] {
24    let mut h: [u32; 8] = [
25        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab,
26        0x5be0cd19,
27    ];
28    // Pad: message || 0x80 || zeros || 64-bit big-endian bit length.
29    let bitlen = (bytes.len() as u64).wrapping_mul(8);
30    let mut msg = bytes.to_vec();
31    msg.push(0x80);
32    while msg.len() % 64 != 56 {
33        msg.push(0);
34    }
35    msg.extend_from_slice(&bitlen.to_be_bytes());
36
37    let mut w = [0u32; 64];
38    // `as_chunks` rather than `chunks_exact`: the chunk size is a constant, so
39    // the compiler hands back fixed-size ARRAYS and `from_be_bytes` takes one
40    // directly — no indexing and no bounds checks to elide. The padding above
41    // makes the length an exact multiple of 64, so the remainder is empty by
42    // construction; the compression still runs once PER block.
43    let (blocks, _) = msg.as_chunks::<64>();
44    for block in blocks {
45        let (words, _) = block.as_chunks::<4>();
46        for (i, c) in words.iter().enumerate() {
47            w[i] = u32::from_be_bytes(*c);
48        }
49        for i in 16..64 {
50            let s0 = w[i - 15].rotate_right(7) ^ w[i - 15].rotate_right(18) ^ (w[i - 15] >> 3);
51            let s1 = w[i - 2].rotate_right(17) ^ w[i - 2].rotate_right(19) ^ (w[i - 2] >> 10);
52            w[i] = w[i - 16]
53                .wrapping_add(s0)
54                .wrapping_add(w[i - 7])
55                .wrapping_add(s1);
56        }
57        let [mut a, mut b, mut c, mut d, mut e, mut f, mut g, mut hh] = h;
58        for i in 0..64 {
59            let s1 = e.rotate_right(6) ^ e.rotate_right(11) ^ e.rotate_right(25);
60            let ch = (e & f) ^ (!e & g);
61            let t1 = hh
62                .wrapping_add(s1)
63                .wrapping_add(ch)
64                .wrapping_add(K[i])
65                .wrapping_add(w[i]);
66            let s0 = a.rotate_right(2) ^ a.rotate_right(13) ^ a.rotate_right(22);
67            let maj = (a & b) ^ (a & c) ^ (b & c);
68            let t2 = s0.wrapping_add(maj);
69            hh = g;
70            g = f;
71            f = e;
72            e = d.wrapping_add(t1);
73            d = c;
74            c = b;
75            b = a;
76            a = t1.wrapping_add(t2);
77        }
78        for (s, v) in h.iter_mut().zip([a, b, c, d, e, f, g, hh]) {
79            *s = s.wrapping_add(v);
80        }
81    }
82    let mut out = [0u8; 32];
83    for (i, v) in h.iter().enumerate() {
84        out[i * 4..i * 4 + 4].copy_from_slice(&v.to_be_bytes());
85    }
86    out
87}
88
89/// SHA-256 of `bytes`, lowercase hex.
90pub fn sha256_hex(bytes: &[u8]) -> String {
91    let d = sha256(bytes);
92    let mut out = String::with_capacity(64);
93    for b in d {
94        out.push_str(&format!("{b:02x}"));
95    }
96    out
97}
98
99/// HMAC-SHA256 (RFC 2104), hand-rolled over [`sha256`] — for inbound **webhook
100/// signature verification** (GitHub/Stripe-style `X-Signature: sha256=…`). Kept
101/// dependency-free like the rest of the moat; agentd's own outbound request
102/// signing (RFC 9421) uses `ring` under `--features aauth`.
103pub fn hmac_sha256(key: &[u8], msg: &[u8]) -> [u8; 32] {
104    const BLOCK: usize = 64;
105    let mut k = [0u8; BLOCK];
106    if key.len() > BLOCK {
107        k[..32].copy_from_slice(&sha256(key));
108    } else {
109        k[..key.len()].copy_from_slice(key);
110    }
111    let mut ipad = [0x36u8; BLOCK];
112    let mut opad = [0x5cu8; BLOCK];
113    for i in 0..BLOCK {
114        ipad[i] ^= k[i];
115        opad[i] ^= k[i];
116    }
117    let mut inner = Vec::with_capacity(BLOCK + msg.len());
118    inner.extend_from_slice(&ipad);
119    inner.extend_from_slice(msg);
120    let inner_digest = sha256(&inner);
121    let mut outer = Vec::with_capacity(BLOCK + 32);
122    outer.extend_from_slice(&opad);
123    outer.extend_from_slice(&inner_digest);
124    sha256(&outer)
125}
126
127/// Constant-time byte-slice equality (short-circuits on a length mismatch only).
128pub fn ct_eq(a: &[u8], b: &[u8]) -> bool {
129    if a.len() != b.len() {
130        return false;
131    }
132    let mut diff = 0u8;
133    for (x, y) in a.iter().zip(b) {
134        diff |= x ^ y;
135    }
136    diff == 0
137}
138
139/// Lowercase hex of a byte slice.
140pub fn to_hex(bytes: &[u8]) -> String {
141    let mut out = String::with_capacity(bytes.len() * 2);
142    for b in bytes {
143        out.push_str(&format!("{b:02x}"));
144    }
145    out
146}
147
148#[cfg(test)]
149mod tests {
150    /// A message spanning SEVERAL blocks.
151    ///
152    /// The single-block vectors cannot catch a compression loop that flattens
153    /// the word schedule across every block at once: that only goes wrong from
154    /// block two, where `w` is indexed past 64. This vector covers it.
155    #[test]
156    fn a_multi_block_message_digests_correctly() {
157        // openssl: printf 'a%.0s' {1..200} | sha256sum
158        assert_eq!(
159            sha256_hex(&[b'a'; 200]),
160            "c2a908d98f5df987ade41b5fce213067efbcc21ef2240212a41e54b5e7c28ae5"
161        );
162        // The boundary cases either side of one block: 64 bytes pads into a
163        // SECOND block, 63 fits in one.
164        assert_eq!(
165            sha256_hex(&[b'b'; 64]),
166            "a0fab1377f49a759b57f63318262ebe89fabfc990e8e93ceac2984561482b9d4"
167        );
168        assert_eq!(
169            sha256_hex(&[b'a'; 63]),
170            "7d3e74a05d7db15bce4ad9ec0658ea98e3f06eeecf16b4c6fff2da457ddc2f34"
171        );
172    }
173
174    use super::sha256_hex;
175
176    /// FIPS 180-4 / NIST CAVP known-answer vectors.
177    #[test]
178    fn known_vectors() {
179        assert_eq!(
180            sha256_hex(b""),
181            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
182        );
183        assert_eq!(
184            sha256_hex(b"abc"),
185            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
186        );
187        assert_eq!(
188            sha256_hex(b"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"),
189            "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1"
190        );
191        // The NIST million-'a' vector — exercises many blocks + the padding
192        // boundary paths.
193        assert_eq!(
194            sha256_hex("a".repeat(1_000_000).as_bytes()),
195            "cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0"
196        );
197    }
198
199    #[test]
200    fn hmac_sha256_rfc4231() {
201        use super::{ct_eq, hmac_sha256, to_hex};
202        // RFC 4231 test case 2.
203        let mac = hmac_sha256(b"Jefe", b"what do ya want for nothing?");
204        assert_eq!(
205            to_hex(&mac),
206            "5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843"
207        );
208        // A > block-size key (case 6) hashes the key first; just assert it runs
209        // and constant-time-compares to itself.
210        let long = hmac_sha256(
211            &[0xaa; 131],
212            b"Test Using Larger Than Block-Size Key - Hash Key First",
213        );
214        assert!(ct_eq(&long, &long.clone()));
215        assert!(!ct_eq(&mac, &long));
216    }
217}
agentd/sha.rs

agentd/
sha.rs
