sha2.c revision 1.9
1 /* $NetBSD: sha2.c,v 1.9 2009/06/11 18:46:37 joerg Exp $ */ 2 /* $KAME: sha2.c,v 1.9 2003/07/20 00:28:38 itojun Exp $ */ 3 4 /* 5 * sha2.c 6 * 7 * Version 1.0.0beta1 8 * 9 * Written by Aaron D. Gifford <me (at) aarongifford.com> 10 * 11 * Copyright 2000 Aaron D. Gifford. All rights reserved. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. Neither the name of the copyright holder nor the names of contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 */ 38 39 #include <sys/cdefs.h> 40 41 #if defined(_KERNEL) || defined(_STANDALONE) 42 __KERNEL_RCSID(0, "$NetBSD: sha2.c,v 1.9 2009/06/11 18:46:37 joerg Exp $"); 43 44 #include <lib/libkern/libkern.h> 45 46 #else 47 48 #if defined(LIBC_SCCS) && !defined(lint) 49 __RCSID("$NetBSD: sha2.c,v 1.9 2009/06/11 18:46:37 joerg Exp $"); 50 #endif /* LIBC_SCCS and not lint */ 51 52 #include "namespace.h" 53 #include <assert.h> 54 #include <string.h> 55 56 #endif 57 58 #include <sys/types.h> 59 #include <sys/param.h> 60 #include <sys/sha2.h> 61 #include <sys/endian.h> 62 63 /* 64 * ASSERT NOTE: 65 * Some sanity checking code is included using assert(). On my FreeBSD 66 * system, this additional code can be removed by compiling with NDEBUG 67 * defined. Check your own systems manpage on assert() to see how to 68 * compile WITHOUT the sanity checking code on your system. 69 * 70 * UNROLLED TRANSFORM LOOP NOTE: 71 * You can define SHA2_UNROLL_TRANSFORM to use the unrolled transform 72 * loop version for the hash transform rounds (defined using macros 73 * later in this file). Either define on the command line, for example: 74 * 75 * cc -DSHA2_UNROLL_TRANSFORM -o sha2 sha2.c sha2prog.c 76 * 77 * or define below: 78 * 79 * #define SHA2_UNROLL_TRANSFORM 80 * 81 */ 82 83 #if defined(__bsdi__) || defined(__FreeBSD__) 84 #define assert(x) 85 #endif 86 87 88 /*** SHA-256/384/512 Machine Architecture Definitions *****************/ 89 /* 90 * BYTE_ORDER NOTE: 91 * 92 * Please make sure that your system defines BYTE_ORDER. If your 93 * architecture is little-endian, make sure it also defines 94 * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are 95 * equivilent. 96 * 97 * If your system does not define the above, then you can do so by 98 * hand like this: 99 * 100 * #define LITTLE_ENDIAN 1234 101 * #define BIG_ENDIAN 4321 102 * 103 * And for little-endian machines, add: 104 * 105 * #define BYTE_ORDER LITTLE_ENDIAN 106 * 107 * Or for big-endian machines: 108 * 109 * #define BYTE_ORDER BIG_ENDIAN 110 * 111 * The FreeBSD machine this was written on defines BYTE_ORDER 112 * appropriately by including <sys/types.h> (which in turn includes 113 * <machine/endian.h> where the appropriate definitions are actually 114 * made). 115 */ 116 #if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN) 117 #error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN 118 #endif 119 120 /* 121 * Define the followingsha2_* types to types of the correct length on 122 * the native archtecture. Most BSD systems and Linux define u_intXX_t 123 * types. Machines with recent ANSI C headers, can use the standard C99 124 * uintXX_t definintions from inttypes.h by defining SHA2_USE_INTTYPES_H 125 * during compile or in the sha.h header file. 126 * 127 * Machines that support neither u_intXX_t nor inttypes.h's uintXX_t 128 * will need to define these three typedefs below (and the appropriate 129 * ones in sha.h too) by hand according to their system architecture. 130 * 131 * Thank you, Jun-ichiro itojun Hagino, for suggesting using u_intXX_t 132 * types and pointing out recent ANSI C support for uintXX_t in inttypes.h. 133 */ 134 #if 1 /*def SHA2_USE_INTTYPES_H*/ 135 136 typedef uint8_t sha2_byte; /* Exactly 1 byte */ 137 typedef uint32_t sha2_word32; /* Exactly 4 bytes */ 138 typedef uint64_t sha2_word64; /* Exactly 8 bytes */ 139 140 #else /* SHA2_USE_INTTYPES_H */ 141 142 typedef u_int8_t sha2_byte; /* Exactly 1 byte */ 143 typedef u_int32_t sha2_word32; /* Exactly 4 bytes */ 144 typedef u_int64_t sha2_word64; /* Exactly 8 bytes */ 145 146 #endif /* SHA2_USE_INTTYPES_H */ 147 148 149 /*** SHA-256/384/512 Various Length Definitions ***********************/ 150 /* NOTE: Most of these are in sha2.h */ 151 #define SHA256_SHORT_BLOCK_LENGTH (SHA256_BLOCK_LENGTH - 8) 152 #define SHA384_SHORT_BLOCK_LENGTH (SHA384_BLOCK_LENGTH - 16) 153 #define SHA512_SHORT_BLOCK_LENGTH (SHA512_BLOCK_LENGTH - 16) 154 155 /* 156 * Macro for incrementally adding the unsigned 64-bit integer n to the 157 * unsigned 128-bit integer (represented using a two-element array of 158 * 64-bit words): 159 */ 160 #define ADDINC128(w,n) { \ 161 (w)[0] += (sha2_word64)(n); \ 162 if ((w)[0] < (n)) { \ 163 (w)[1]++; \ 164 } \ 165 } 166 167 /*** THE SIX LOGICAL FUNCTIONS ****************************************/ 168 /* 169 * Bit shifting and rotation (used by the six SHA-XYZ logical functions: 170 * 171 * NOTE: The naming of R and S appears backwards here (R is a SHIFT and 172 * S is a ROTATION) because the SHA-256/384/512 description document 173 * (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this 174 * same "backwards" definition. 175 */ 176 /* Shift-right (used in SHA-256, SHA-384, and SHA-512): */ 177 #define R(b,x) ((x) >> (b)) 178 /* 32-bit Rotate-right (used in SHA-256): */ 179 #define S32(b,x) (((x) >> (b)) | ((x) << (32 - (b)))) 180 /* 64-bit Rotate-right (used in SHA-384 and SHA-512): */ 181 #define S64(b,x) (((x) >> (b)) | ((x) << (64 - (b)))) 182 183 /* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */ 184 #define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z))) 185 #define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) 186 187 /* Four of six logical functions used in SHA-256: */ 188 #define Sigma0_256(x) (S32(2, (x)) ^ S32(13, (x)) ^ S32(22, (x))) 189 #define Sigma1_256(x) (S32(6, (x)) ^ S32(11, (x)) ^ S32(25, (x))) 190 #define sigma0_256(x) (S32(7, (x)) ^ S32(18, (x)) ^ R(3 , (x))) 191 #define sigma1_256(x) (S32(17, (x)) ^ S32(19, (x)) ^ R(10, (x))) 192 193 /* Four of six logical functions used in SHA-384 and SHA-512: */ 194 #define Sigma0_512(x) (S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x))) 195 #define Sigma1_512(x) (S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x))) 196 #define sigma0_512(x) (S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7, (x))) 197 #define sigma1_512(x) (S64(19, (x)) ^ S64(61, (x)) ^ R( 6, (x))) 198 199 /*** INTERNAL FUNCTION PROTOTYPES *************************************/ 200 /* NOTE: These should not be accessed directly from outside this 201 * library -- they are intended for private internal visibility/use 202 * only. 203 */ 204 static void SHA512_Last(SHA512_CTX*); 205 void SHA224_Transform(SHA224_CTX*, const sha2_word64*); 206 void SHA256_Transform(SHA256_CTX*, const sha2_word32*); 207 void SHA384_Transform(SHA384_CTX*, const sha2_word64*); 208 void SHA512_Transform(SHA512_CTX*, const sha2_word64*); 209 210 211 /*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/ 212 /* Hash constant words K for SHA-256: */ 213 static const sha2_word32 K256[64] = { 214 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 215 0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 216 0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL, 217 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL, 218 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL, 219 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 220 0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 221 0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL, 222 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL, 223 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL, 224 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 225 0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 226 0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL, 227 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL, 228 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL, 229 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL 230 }; 231 232 /* Initial hash value H for SHA-224: */ 233 static const sha2_word32 sha224_initial_hash_value[8] = { 234 0xc1059ed8UL, 235 0x367cd507UL, 236 0x3070dd17UL, 237 0xf70e5939UL, 238 0xffc00b31UL, 239 0x68581511UL, 240 0x64f98fa7UL, 241 0xbefa4fa4UL 242 }; 243 244 /* Initial hash value H for SHA-256: */ 245 static const sha2_word32 sha256_initial_hash_value[8] = { 246 0x6a09e667UL, 247 0xbb67ae85UL, 248 0x3c6ef372UL, 249 0xa54ff53aUL, 250 0x510e527fUL, 251 0x9b05688cUL, 252 0x1f83d9abUL, 253 0x5be0cd19UL 254 }; 255 256 /* Hash constant words K for SHA-384 and SHA-512: */ 257 static const sha2_word64 K512[80] = { 258 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 259 0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL, 260 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL, 261 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 262 0xd807aa98a3030242ULL, 0x12835b0145706fbeULL, 263 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL, 264 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 265 0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL, 266 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL, 267 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 268 0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL, 269 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL, 270 0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 271 0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL, 272 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL, 273 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 274 0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL, 275 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL, 276 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 277 0x81c2c92e47edaee6ULL, 0x92722c851482353bULL, 278 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL, 279 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 280 0xd192e819d6ef5218ULL, 0xd69906245565a910ULL, 281 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL, 282 0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 283 0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL, 284 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL, 285 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 286 0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL, 287 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL, 288 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 289 0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL, 290 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL, 291 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 292 0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL, 293 0x113f9804bef90daeULL, 0x1b710b35131c471bULL, 294 0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 295 0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL, 296 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL, 297 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL 298 }; 299 300 /* Initial hash value H for SHA-384 */ 301 static const sha2_word64 sha384_initial_hash_value[8] = { 302 0xcbbb9d5dc1059ed8ULL, 303 0x629a292a367cd507ULL, 304 0x9159015a3070dd17ULL, 305 0x152fecd8f70e5939ULL, 306 0x67332667ffc00b31ULL, 307 0x8eb44a8768581511ULL, 308 0xdb0c2e0d64f98fa7ULL, 309 0x47b5481dbefa4fa4ULL 310 }; 311 312 /* Initial hash value H for SHA-512 */ 313 static const sha2_word64 sha512_initial_hash_value[8] = { 314 0x6a09e667f3bcc908ULL, 315 0xbb67ae8584caa73bULL, 316 0x3c6ef372fe94f82bULL, 317 0xa54ff53a5f1d36f1ULL, 318 0x510e527fade682d1ULL, 319 0x9b05688c2b3e6c1fULL, 320 0x1f83d9abfb41bd6bULL, 321 0x5be0cd19137e2179ULL 322 }; 323 324 #if !defined(_KERNEL) && defined(__weak_alias) 325 __weak_alias(SHA224_Init,_SHA224_Init) 326 __weak_alias(SHA224_Update,_SHA224_Update) 327 __weak_alias(SHA224_Final,_SHA224_Final) 328 __weak_alias(SHA224_Transform,_SHA224_Transform) 329 330 __weak_alias(SHA256_Init,_SHA256_Init) 331 __weak_alias(SHA256_Update,_SHA256_Update) 332 __weak_alias(SHA256_Final,_SHA256_Final) 333 __weak_alias(SHA256_Transform,_SHA256_Transform) 334 335 __weak_alias(SHA384_Init,_SHA384_Init) 336 __weak_alias(SHA384_Update,_SHA384_Update) 337 __weak_alias(SHA384_Final,_SHA384_Final) 338 __weak_alias(SHA384_Transform,_SHA384_Transform) 339 340 __weak_alias(SHA512_Init,_SHA512_Init) 341 __weak_alias(SHA512_Update,_SHA512_Update) 342 __weak_alias(SHA512_Final,_SHA512_Final) 343 __weak_alias(SHA512_Transform,_SHA512_Transform) 344 #endif 345 346 /*** SHA-224: *********************************************************/ 347 int SHA224_Init(SHA256_CTX* context) { 348 if (context == (SHA256_CTX*)0) { 349 return 1; 350 } 351 memcpy(context->state, sha224_initial_hash_value, (size_t)(SHA256_DIGEST_LENGTH)); 352 memset(context->buffer, 0, (size_t)(SHA256_BLOCK_LENGTH)); 353 context->bitcount = 0; 354 355 return 1; 356 } 357 358 /*** SHA-256: *********************************************************/ 359 int SHA256_Init(SHA256_CTX* context) { 360 if (context == (SHA256_CTX*)0) { 361 return 1; 362 } 363 memcpy(context->state, sha256_initial_hash_value, (size_t)(SHA256_DIGEST_LENGTH)); 364 memset(context->buffer, 0, (size_t)(SHA256_BLOCK_LENGTH)); 365 context->bitcount = 0; 366 367 return 1; 368 } 369 370 void SHA224_Transform(SHA224_CTX* context, const sha2_word64* data) { 371 SHA224_Transform((SHA256_CTX*)context, data); 372 } 373 374 #ifdef SHA2_UNROLL_TRANSFORM 375 376 /* Unrolled SHA-256 round macros: */ 377 378 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) \ 379 W256[j] = be32toh(*data); \ 380 ++data; \ 381 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \ 382 K256[j] + W256[j]; \ 383 (d) += T1; \ 384 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \ 385 j++ 386 387 #define ROUND256(a,b,c,d,e,f,g,h) \ 388 s0 = W256[(j+1)&0x0f]; \ 389 s0 = sigma0_256(s0); \ 390 s1 = W256[(j+14)&0x0f]; \ 391 s1 = sigma1_256(s1); \ 392 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + K256[j] + \ 393 (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); \ 394 (d) += T1; \ 395 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \ 396 j++ 397 398 void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) { 399 sha2_word32 a, b, c, d, e, f, g, h, s0, s1; 400 sha2_word32 T1, *W256; 401 int j; 402 403 W256 = (sha2_word32*)context->buffer; 404 405 /* Initialize registers with the prev. intermediate value */ 406 a = context->state[0]; 407 b = context->state[1]; 408 c = context->state[2]; 409 d = context->state[3]; 410 e = context->state[4]; 411 f = context->state[5]; 412 g = context->state[6]; 413 h = context->state[7]; 414 415 j = 0; 416 do { 417 /* Rounds 0 to 15 (unrolled): */ 418 ROUND256_0_TO_15(a,b,c,d,e,f,g,h); 419 ROUND256_0_TO_15(h,a,b,c,d,e,f,g); 420 ROUND256_0_TO_15(g,h,a,b,c,d,e,f); 421 ROUND256_0_TO_15(f,g,h,a,b,c,d,e); 422 ROUND256_0_TO_15(e,f,g,h,a,b,c,d); 423 ROUND256_0_TO_15(d,e,f,g,h,a,b,c); 424 ROUND256_0_TO_15(c,d,e,f,g,h,a,b); 425 ROUND256_0_TO_15(b,c,d,e,f,g,h,a); 426 } while (j < 16); 427 428 /* Now for the remaining rounds to 64: */ 429 do { 430 ROUND256(a,b,c,d,e,f,g,h); 431 ROUND256(h,a,b,c,d,e,f,g); 432 ROUND256(g,h,a,b,c,d,e,f); 433 ROUND256(f,g,h,a,b,c,d,e); 434 ROUND256(e,f,g,h,a,b,c,d); 435 ROUND256(d,e,f,g,h,a,b,c); 436 ROUND256(c,d,e,f,g,h,a,b); 437 ROUND256(b,c,d,e,f,g,h,a); 438 } while (j < 64); 439 440 /* Compute the current intermediate hash value */ 441 context->state[0] += a; 442 context->state[1] += b; 443 context->state[2] += c; 444 context->state[3] += d; 445 context->state[4] += e; 446 context->state[5] += f; 447 context->state[6] += g; 448 context->state[7] += h; 449 450 /* Clean up */ 451 a = b = c = d = e = f = g = h = T1 = 0; 452 } 453 454 #else /* SHA2_UNROLL_TRANSFORM */ 455 456 void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) { 457 sha2_word32 a, b, c, d, e, f, g, h, s0, s1; 458 sha2_word32 T1, T2, *W256; 459 int j; 460 461 W256 = (sha2_word32*)(void *)context->buffer; 462 463 /* Initialize registers with the prev. intermediate value */ 464 a = context->state[0]; 465 b = context->state[1]; 466 c = context->state[2]; 467 d = context->state[3]; 468 e = context->state[4]; 469 f = context->state[5]; 470 g = context->state[6]; 471 h = context->state[7]; 472 473 j = 0; 474 do { 475 W256[j] = be32toh(*data); 476 ++data; 477 /* Apply the SHA-256 compression function to update a..h */ 478 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + W256[j]; 479 T2 = Sigma0_256(a) + Maj(a, b, c); 480 h = g; 481 g = f; 482 f = e; 483 e = d + T1; 484 d = c; 485 c = b; 486 b = a; 487 a = T1 + T2; 488 489 j++; 490 } while (j < 16); 491 492 do { 493 /* Part of the message block expansion: */ 494 s0 = W256[(j+1)&0x0f]; 495 s0 = sigma0_256(s0); 496 s1 = W256[(j+14)&0x0f]; 497 s1 = sigma1_256(s1); 498 499 /* Apply the SHA-256 compression function to update a..h */ 500 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + 501 (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); 502 T2 = Sigma0_256(a) + Maj(a, b, c); 503 h = g; 504 g = f; 505 f = e; 506 e = d + T1; 507 d = c; 508 c = b; 509 b = a; 510 a = T1 + T2; 511 512 j++; 513 } while (j < 64); 514 515 /* Compute the current intermediate hash value */ 516 context->state[0] += a; 517 context->state[1] += b; 518 context->state[2] += c; 519 context->state[3] += d; 520 context->state[4] += e; 521 context->state[5] += f; 522 context->state[6] += g; 523 context->state[7] += h; 524 525 /* Clean up */ 526 a = b = c = d = e = f = g = h = T1 = T2 = 0; 527 } 528 529 #endif /* SHA2_UNROLL_TRANSFORM */ 530 531 int SHA224_Update(SHA256_CTX *context, const sha2_byte *data, size_t len) { 532 return SHA256_Update(context, data, len); 533 } 534 535 int SHA256_Update(SHA256_CTX* context, const sha2_byte *data, size_t len) { 536 unsigned int freespace, usedspace; 537 538 if (len == 0) { 539 /* Calling with no data is valid - we do nothing */ 540 return 1; 541 } 542 543 /* Sanity check: */ 544 assert(context != (SHA256_CTX*)0 && data != (sha2_byte*)0); 545 546 usedspace = (unsigned int)((context->bitcount >> 3) % 547 SHA256_BLOCK_LENGTH); 548 if (usedspace > 0) { 549 /* Calculate how much free space is available in the buffer */ 550 freespace = SHA256_BLOCK_LENGTH - usedspace; 551 552 if (len >= freespace) { 553 /* Fill the buffer completely and process it */ 554 memcpy(&context->buffer[usedspace], data, (size_t)(freespace)); 555 context->bitcount += freespace << 3; 556 len -= freespace; 557 data += freespace; 558 SHA256_Transform(context, (sha2_word32*)(void *)context->buffer); 559 } else { 560 /* The buffer is not yet full */ 561 memcpy(&context->buffer[usedspace], data, len); 562 context->bitcount += len << 3; 563 /* Clean up: */ 564 usedspace = freespace = 0; 565 return 1; 566 } 567 } 568 /* 569 * Process as many complete blocks as possible. 570 * 571 * Check alignment of the data pointer. If it is 32bit aligned, 572 * SHA256_Transform can be called directly on the data stream, 573 * otherwise enforce the alignment by copy into the buffer. 574 */ 575 if ((uintptr_t)data % 4 == 0) { 576 while (len >= SHA256_BLOCK_LENGTH) { 577 SHA256_Transform(context, 578 (const sha2_word32 *)(const void *)data); 579 context->bitcount += SHA256_BLOCK_LENGTH << 3; 580 len -= SHA256_BLOCK_LENGTH; 581 data += SHA256_BLOCK_LENGTH; 582 } 583 } else { 584 while (len >= SHA256_BLOCK_LENGTH) { 585 memcpy(context->buffer, data, SHA256_BLOCK_LENGTH); 586 SHA256_Transform(context, 587 (const sha2_word32 *)(const void *)context->buffer); 588 context->bitcount += SHA256_BLOCK_LENGTH << 3; 589 len -= SHA256_BLOCK_LENGTH; 590 data += SHA256_BLOCK_LENGTH; 591 } 592 } 593 if (len > 0) { 594 /* There's left-overs, so save 'em */ 595 memcpy(context->buffer, data, len); 596 context->bitcount += len << 3; 597 } 598 /* Clean up: */ 599 usedspace = freespace = 0; 600 601 return 1; 602 } 603 604 static int SHA224_256_Final(sha2_byte digest[], SHA256_CTX* context, size_t len) { 605 sha2_word32 *d = (void *)digest; 606 unsigned int usedspace; 607 size_t i; 608 609 /* Sanity check: */ 610 assert(context != (SHA256_CTX*)0); 611 612 /* If no digest buffer is passed, we don't bother doing this: */ 613 if (digest != (sha2_byte*)0) { 614 usedspace = (unsigned int)((context->bitcount >> 3) % SHA256_BLOCK_LENGTH); 615 context->bitcount = htobe64(context->bitcount); 616 if (usedspace > 0) { 617 /* Begin padding with a 1 bit: */ 618 context->buffer[usedspace++] = 0x80; 619 620 if (usedspace <= SHA256_SHORT_BLOCK_LENGTH) { 621 /* Set-up for the last transform: */ 622 memset(&context->buffer[usedspace], 0, (size_t)(SHA256_SHORT_BLOCK_LENGTH - usedspace)); 623 } else { 624 if (usedspace < SHA256_BLOCK_LENGTH) { 625 memset(&context->buffer[usedspace], 0, (size_t)(SHA256_BLOCK_LENGTH - usedspace)); 626 } 627 /* Do second-to-last transform: */ 628 SHA256_Transform(context, (sha2_word32*)(void *)context->buffer); 629 630 /* And set-up for the last transform: */ 631 memset(context->buffer, 0, (size_t)(SHA256_SHORT_BLOCK_LENGTH)); 632 } 633 } else { 634 /* Set-up for the last transform: */ 635 memset(context->buffer, 0, (size_t)(SHA256_SHORT_BLOCK_LENGTH)); 636 637 /* Begin padding with a 1 bit: */ 638 *context->buffer = 0x80; 639 } 640 /* Set the bit count: */ 641 *(sha2_word64*)(void *)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = context->bitcount; 642 643 /* Final transform: */ 644 SHA256_Transform(context, (sha2_word32*)(void *)context->buffer); 645 646 for (i = 0; i < len / 4; i++) 647 d[i] = htobe32(context->state[i]); 648 } 649 650 /* Clean up state data: */ 651 memset(context, 0, sizeof(*context)); 652 usedspace = 0; 653 654 return 1; 655 } 656 657 int SHA224_Final(sha2_byte digest[], SHA256_CTX* context) { 658 return SHA224_256_Final(digest, context, SHA224_DIGEST_LENGTH); 659 } 660 661 int SHA256_Final(sha2_byte digest[], SHA256_CTX* context) { 662 return SHA224_256_Final(digest, context, SHA256_DIGEST_LENGTH); 663 } 664 665 /*** SHA-512: *********************************************************/ 666 int SHA512_Init(SHA512_CTX* context) { 667 if (context == (SHA512_CTX*)0) { 668 return 1; 669 } 670 memcpy(context->state, sha512_initial_hash_value, (size_t)(SHA512_DIGEST_LENGTH)); 671 memset(context->buffer, 0, (size_t)(SHA512_BLOCK_LENGTH)); 672 context->bitcount[0] = context->bitcount[1] = 0; 673 674 return 1; 675 } 676 677 #ifdef SHA2_UNROLL_TRANSFORM 678 679 /* Unrolled SHA-512 round macros: */ 680 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \ 681 W512[j] = be64toh(*data); \ 682 ++data; \ 683 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \ 684 K512[j] + W512[j]; \ 685 (d) += T1, \ 686 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)), \ 687 j++ 688 689 #define ROUND512(a,b,c,d,e,f,g,h) \ 690 s0 = W512[(j+1)&0x0f]; \ 691 s0 = sigma0_512(s0); \ 692 s1 = W512[(j+14)&0x0f]; \ 693 s1 = sigma1_512(s1); \ 694 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + K512[j] + \ 695 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); \ 696 (d) += T1; \ 697 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \ 698 j++ 699 700 void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) { 701 sha2_word64 a, b, c, d, e, f, g, h, s0, s1; 702 sha2_word64 T1, *W512 = (sha2_word64*)context->buffer; 703 int j; 704 705 /* Initialize registers with the prev. intermediate value */ 706 a = context->state[0]; 707 b = context->state[1]; 708 c = context->state[2]; 709 d = context->state[3]; 710 e = context->state[4]; 711 f = context->state[5]; 712 g = context->state[6]; 713 h = context->state[7]; 714 715 j = 0; 716 do { 717 ROUND512_0_TO_15(a,b,c,d,e,f,g,h); 718 ROUND512_0_TO_15(h,a,b,c,d,e,f,g); 719 ROUND512_0_TO_15(g,h,a,b,c,d,e,f); 720 ROUND512_0_TO_15(f,g,h,a,b,c,d,e); 721 ROUND512_0_TO_15(e,f,g,h,a,b,c,d); 722 ROUND512_0_TO_15(d,e,f,g,h,a,b,c); 723 ROUND512_0_TO_15(c,d,e,f,g,h,a,b); 724 ROUND512_0_TO_15(b,c,d,e,f,g,h,a); 725 } while (j < 16); 726 727 /* Now for the remaining rounds up to 79: */ 728 do { 729 ROUND512(a,b,c,d,e,f,g,h); 730 ROUND512(h,a,b,c,d,e,f,g); 731 ROUND512(g,h,a,b,c,d,e,f); 732 ROUND512(f,g,h,a,b,c,d,e); 733 ROUND512(e,f,g,h,a,b,c,d); 734 ROUND512(d,e,f,g,h,a,b,c); 735 ROUND512(c,d,e,f,g,h,a,b); 736 ROUND512(b,c,d,e,f,g,h,a); 737 } while (j < 80); 738 739 /* Compute the current intermediate hash value */ 740 context->state[0] += a; 741 context->state[1] += b; 742 context->state[2] += c; 743 context->state[3] += d; 744 context->state[4] += e; 745 context->state[5] += f; 746 context->state[6] += g; 747 context->state[7] += h; 748 749 /* Clean up */ 750 a = b = c = d = e = f = g = h = T1 = 0; 751 } 752 753 #else /* SHA2_UNROLL_TRANSFORM */ 754 755 void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) { 756 sha2_word64 a, b, c, d, e, f, g, h, s0, s1; 757 sha2_word64 T1, T2, *W512 = (void *)context->buffer; 758 int j; 759 760 /* Initialize registers with the prev. intermediate value */ 761 a = context->state[0]; 762 b = context->state[1]; 763 c = context->state[2]; 764 d = context->state[3]; 765 e = context->state[4]; 766 f = context->state[5]; 767 g = context->state[6]; 768 h = context->state[7]; 769 770 j = 0; 771 do { 772 W512[j] = be64toh(*data); 773 ++data; 774 /* Apply the SHA-512 compression function to update a..h */ 775 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j]; 776 T2 = Sigma0_512(a) + Maj(a, b, c); 777 h = g; 778 g = f; 779 f = e; 780 e = d + T1; 781 d = c; 782 c = b; 783 b = a; 784 a = T1 + T2; 785 786 j++; 787 } while (j < 16); 788 789 do { 790 /* Part of the message block expansion: */ 791 s0 = W512[(j+1)&0x0f]; 792 s0 = sigma0_512(s0); 793 s1 = W512[(j+14)&0x0f]; 794 s1 = sigma1_512(s1); 795 796 /* Apply the SHA-512 compression function to update a..h */ 797 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + 798 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); 799 T2 = Sigma0_512(a) + Maj(a, b, c); 800 h = g; 801 g = f; 802 f = e; 803 e = d + T1; 804 d = c; 805 c = b; 806 b = a; 807 a = T1 + T2; 808 809 j++; 810 } while (j < 80); 811 812 /* Compute the current intermediate hash value */ 813 context->state[0] += a; 814 context->state[1] += b; 815 context->state[2] += c; 816 context->state[3] += d; 817 context->state[4] += e; 818 context->state[5] += f; 819 context->state[6] += g; 820 context->state[7] += h; 821 822 /* Clean up */ 823 a = b = c = d = e = f = g = h = T1 = T2 = 0; 824 } 825 826 #endif /* SHA2_UNROLL_TRANSFORM */ 827 828 int SHA512_Update(SHA512_CTX* context, const sha2_byte *data, size_t len) { 829 unsigned int freespace, usedspace; 830 831 if (len == 0) { 832 /* Calling with no data is valid - we do nothing */ 833 return 1; 834 } 835 836 /* Sanity check: */ 837 assert(context != (SHA512_CTX*)0 && data != (sha2_byte*)0); 838 839 usedspace = (unsigned int)((context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH); 840 if (usedspace > 0) { 841 /* Calculate how much free space is available in the buffer */ 842 freespace = SHA512_BLOCK_LENGTH - usedspace; 843 844 if (len >= freespace) { 845 /* Fill the buffer completely and process it */ 846 memcpy(&context->buffer[usedspace], data, (size_t)(freespace)); 847 ADDINC128(context->bitcount, freespace << 3); 848 len -= freespace; 849 data += freespace; 850 SHA512_Transform(context, (sha2_word64*)(void *)context->buffer); 851 } else { 852 /* The buffer is not yet full */ 853 memcpy(&context->buffer[usedspace], data, len); 854 ADDINC128(context->bitcount, len << 3); 855 /* Clean up: */ 856 usedspace = freespace = 0; 857 return 1; 858 } 859 } 860 /* 861 * Process as many complete blocks as possible. 862 * 863 * Check alignment of the data pointer. If it is 64bit aligned, 864 * SHA512_Transform can be called directly on the data stream, 865 * otherwise enforce the alignment by copy into the buffer. 866 */ 867 if ((uintptr_t)data % 8 == 0) { 868 while (len >= SHA512_BLOCK_LENGTH) { 869 SHA512_Transform(context, 870 (const sha2_word64*)(const void *)data); 871 ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3); 872 len -= SHA512_BLOCK_LENGTH; 873 data += SHA512_BLOCK_LENGTH; 874 } 875 } else { 876 while (len >= SHA512_BLOCK_LENGTH) { 877 memcpy(context->buffer, data, SHA512_BLOCK_LENGTH); 878 SHA512_Transform(context, 879 (const void *)context->buffer); 880 ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3); 881 len -= SHA512_BLOCK_LENGTH; 882 data += SHA512_BLOCK_LENGTH; 883 } 884 } 885 if (len > 0) { 886 /* There's left-overs, so save 'em */ 887 memcpy(context->buffer, data, len); 888 ADDINC128(context->bitcount, len << 3); 889 } 890 /* Clean up: */ 891 usedspace = freespace = 0; 892 893 return 1; 894 } 895 896 static void SHA512_Last(SHA512_CTX* context) { 897 unsigned int usedspace; 898 899 usedspace = (unsigned int)((context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH); 900 context->bitcount[0] = htobe64(context->bitcount[0]); 901 context->bitcount[1] = htobe64(context->bitcount[1]); 902 if (usedspace > 0) { 903 /* Begin padding with a 1 bit: */ 904 context->buffer[usedspace++] = 0x80; 905 906 if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) { 907 /* Set-up for the last transform: */ 908 memset(&context->buffer[usedspace], 0, (size_t)(SHA512_SHORT_BLOCK_LENGTH - usedspace)); 909 } else { 910 if (usedspace < SHA512_BLOCK_LENGTH) { 911 memset(&context->buffer[usedspace], 0, (size_t)(SHA512_BLOCK_LENGTH - usedspace)); 912 } 913 /* Do second-to-last transform: */ 914 SHA512_Transform(context, (sha2_word64*)(void *)context->buffer); 915 916 /* And set-up for the last transform: */ 917 memset(context->buffer, 0, (size_t)(SHA512_BLOCK_LENGTH - 2)); 918 } 919 } else { 920 /* Prepare for final transform: */ 921 memset(context->buffer, 0, (size_t)(SHA512_SHORT_BLOCK_LENGTH)); 922 923 /* Begin padding with a 1 bit: */ 924 *context->buffer = 0x80; 925 } 926 /* Store the length of input data (in bits): */ 927 *(sha2_word64*)(void *)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1]; 928 *(sha2_word64*)(void *)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0]; 929 930 /* Final transform: */ 931 SHA512_Transform(context, (sha2_word64*)(void *)context->buffer); 932 } 933 934 int SHA512_Final(sha2_byte digest[], SHA512_CTX* context) { 935 sha2_word64 *d = (void *)digest; 936 size_t i; 937 938 /* Sanity check: */ 939 assert(context != (SHA512_CTX*)0); 940 941 /* If no digest buffer is passed, we don't bother doing this: */ 942 if (digest != (sha2_byte*)0) { 943 SHA512_Last(context); 944 945 /* Save the hash data for output: */ 946 for (i = 0; i < 8; ++i) 947 d[i] = htobe64(context->state[i]); 948 } 949 950 /* Zero out state data */ 951 memset(context, 0, sizeof(*context)); 952 953 return 1; 954 } 955 956 /*** SHA-384: *********************************************************/ 957 int SHA384_Init(SHA384_CTX* context) { 958 if (context == (SHA384_CTX*)0) { 959 return 1; 960 } 961 memcpy(context->state, sha384_initial_hash_value, (size_t)(SHA512_DIGEST_LENGTH)); 962 memset(context->buffer, 0, (size_t)(SHA384_BLOCK_LENGTH)); 963 context->bitcount[0] = context->bitcount[1] = 0; 964 965 return 1; 966 } 967 968 int SHA384_Update(SHA384_CTX* context, const sha2_byte* data, size_t len) { 969 return SHA512_Update((SHA512_CTX*)context, data, len); 970 } 971 972 void SHA384_Transform(SHA512_CTX* context, const sha2_word64* data) { 973 SHA512_Transform((SHA512_CTX*)context, data); 974 } 975 976 int SHA384_Final(sha2_byte digest[], SHA384_CTX* context) { 977 sha2_word64 *d = (void *)digest; 978 size_t i; 979 980 /* Sanity check: */ 981 assert(context != (SHA384_CTX*)0); 982 983 /* If no digest buffer is passed, we don't bother doing this: */ 984 if (digest != (sha2_byte*)0) { 985 SHA512_Last((SHA512_CTX*)context); 986 987 /* Save the hash data for output: */ 988 for (i = 0; i < 6; ++i) 989 d[i] = be64toh(context->state[i]); 990 } 991 992 /* Zero out state data */ 993 memset(context, 0, sizeof(*context)); 994 995 return 1; 996 } 997
Indexes created Mon Sep 29 21:09:56 GMT 2025