Problem - Kevin Tafuro

See Also
Implementations of SHA-256 and SHA-512 from Aaron Gifford: http://www.
aarongifford.com/computers/sha.html
Recipes 6.7, 6.8
6.6 Hashing a Single String
Problem
You have a single string of data that you would like to hash, and you don’t like the
complexity of the incremental interface.
Solution
Use an “all-in-one” interface, if available, or write your own wrapper, as shown in
the “Discussion” section.
Discussion
Hash functions are not secure by themselves—not for a password system,
not for message authentication, not for anything! If you do need a
hash function by itself, be sure to at least protect against length extension
attacks, as described in Recipe 6.7.
Complexity can certainly get you in trouble, and a simpler API can be better. While
not every API provides a single function that can perform a cryptographic hash,
many of them do. For example, OpenSSLprovides an all-in-one API for each of the
message digest algorithms it supports:
unsigned char *MD2(unsigned char *in, unsigned long n, unsigned char *md);
unsigned char *MD4(unsigned char *in, unsigned long n, unsigned char *md);
unsigned char *MD5(const unsigned char *in, unsigned long n, unsigned char *md);
unsigned char *MDC2(const unsigned char *in, unsigned long n, unsigned char *md);
unsigned char *RIPEMD160(const unsigned char *in, unsigned long n,
unsigned char *md);
unsigned char *SHA1(const unsigned char *in, unsigned long n, unsigned char *md);
APIs in this style are commonly seen, even outside the context of OpenSSL. Note
that these functions require you to pass in a buffer into which the digest is placed,
but they also return a pointer to that same buffer.
OpenSSLdoes not provide an all-in-one API for calculating message digests with the
EVP interface. However, here’s a simple wrapper that even allocates its result with
malloc( ):
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Hashing a Single String | 267