lib/sha512.c

   1 /* sha512.c - Functions to compute SHA512 and SHA384 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-2.
   3
   4    Copyright (C) 2005, 2006 Free Software Foundation, Inc.
   5
   6    This program is free software; you can redistribute it and/or modify it
   7    under the terms of the GNU General Public License as published by the
   8    Free Software Foundation; either version 2, or (at your option) any
   9    later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software Foundation,
  18    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  19
  20 /* Written by David Madore, considerably copypasting from
  21    Scott G. Miller's sha1.c
  22 */
  23
  24 #include <config.h>
  25
  26 #include "sha512.h"
  27
  28 #include <stddef.h>
  29 #include <string.h>
  30
  31 #if USE_UNLOCKED_IO
  32 # include "unlocked-io.h"
  33 #endif
  34
  35 #ifdef WORDS_BIGENDIAN
  36 # define SWAP(n) (n)
  37 #else
  38 # define SWAP(n) \
  39     (((n) << 56) | (((n) & 0xff00) << 40) | (((n) & 0xff0000UL) << 24) \
  40      | (((n) & 0xff000000UL) << 8) | (((n) >> 8) & 0xff000000UL) \
  41      | (((n) >> 24) & 0xff0000UL) | (((n) >> 40) & 0xff00UL) | ((n) >> 56))
  42 #endif
  43
  44 #define BLOCKSIZE 4096
  45 #if BLOCKSIZE % 128 != 0
  46 # error "invalid BLOCKSIZE"
  47 #endif
  48
  49 /* This array contains the bytes used to pad the buffer to the next
  50    128-byte boundary.  */
  51 static const unsigned char fillbuf[128] = { 0x80, 0 /* , 0, 0, ...  */ };
  52
  53
  54 /*
  55   Takes a pointer to a 512 bit block of data (eight 64 bit ints) and
  56   intializes it to the start constants of the SHA512 algorithm.  This
  57   must be called before using hash in the call to sha512_hash
  58 */
  59 void
  60 sha512_init_ctx (struct sha512_ctx *ctx)
  61 {
  62   ctx->state[0] = 0x6a09e667f3bcc908ULL;
  63   ctx->state[1] = 0xbb67ae8584caa73bULL;
  64   ctx->state[2] = 0x3c6ef372fe94f82bULL;
  65   ctx->state[3] = 0xa54ff53a5f1d36f1ULL;
  66   ctx->state[4] = 0x510e527fade682d1ULL;
  67   ctx->state[5] = 0x9b05688c2b3e6c1fULL;
  68   ctx->state[6] = 0x1f83d9abfb41bd6bULL;
  69   ctx->state[7] = 0x5be0cd19137e2179ULL;
  70
  71   ctx->total[0] = ctx->total[1] = 0;
  72   ctx->buflen = 0;
  73 }
  74
  75 void
  76 sha384_init_ctx (struct sha512_ctx *ctx)
  77 {
  78   ctx->state[0] = 0xcbbb9d5dc1059ed8ULL;
  79   ctx->state[1] = 0x629a292a367cd507ULL;
  80   ctx->state[2] = 0x9159015a3070dd17ULL;
  81   ctx->state[3] = 0x152fecd8f70e5939ULL;
  82   ctx->state[4] = 0x67332667ffc00b31ULL;
  83   ctx->state[5] = 0x8eb44a8768581511ULL;
  84   ctx->state[6] = 0xdb0c2e0d64f98fa7ULL;
  85   ctx->state[7] = 0x47b5481dbefa4fa4ULL;
  86
  87   ctx->total[0] = ctx->total[1] = 0;
  88   ctx->buflen = 0;
  89 }
  90
  91 /* Put result from CTX in first 64 bytes following RESBUF.  The result
  92    must be in little endian byte order.
  93
  94    IMPORTANT: On some systems it is required that RESBUF is correctly
  95    aligned for a 64-bit value.  */
  96 void *
  97 sha512_read_ctx (const struct sha512_ctx *ctx, void *resbuf)
  98 {
  99   int i;
 100
 101   for (i = 0; i < 8; i++)
 102     ((uint64_t *) resbuf)[i] = SWAP (ctx->state[i]);
 103
 104   return resbuf;
 105 }
 106
 107 void *
 108 sha384_read_ctx (const struct sha512_ctx *ctx, void *resbuf)
 109 {
 110   int i;
 111
 112   for (i = 0; i < 6; i++)
 113     ((uint64_t *) resbuf)[i] = SWAP (ctx->state[i]);
 114
 115   return resbuf;
 116 }
 117
 118 /* Process the remaining bytes in the internal buffer and the usual
 119    prolog according to the standard and write the result to RESBUF.
 120
 121    IMPORTANT: On some systems it is required that RESBUF is correctly
 122    aligned for a 64-bit value.  */
 123 static void
 124 sha512_conclude_ctx (struct sha512_ctx *ctx)
 125 {
 126   /* Take yet unprocessed bytes into account.  */
 127   uint64_t bytes = ctx->buflen;
 128   size_t size = (bytes < 112) ? 128 / 8 : 128 * 2 / 8;
 129
 130   /* Now count remaining bytes.  */
 131   ctx->total[0] += bytes;
 132   if (ctx->total[0] < bytes)
 133     ++ctx->total[1];
 134
 135   /* Put the 64-bit file length in *bits* at the end of the buffer.  */
 136   ctx->buffer[size - 2] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 61));
 137   ctx->buffer[size - 1] = SWAP (ctx->total[0] << 3);
 138
 139   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 8 - bytes);
 140
 141   /* Process last bytes.  */
 142   sha512_process_block (ctx->buffer, size * 8, ctx);
 143 }
 144
 145 void *
 146 sha512_finish_ctx (struct sha512_ctx *ctx, void *resbuf)
 147 {
 148   sha512_conclude_ctx (ctx);
 149   return sha512_read_ctx (ctx, resbuf);
 150 }
 151
 152 void *
 153 sha384_finish_ctx (struct sha512_ctx *ctx, void *resbuf)
 154 {
 155   sha512_conclude_ctx (ctx);
 156   return sha384_read_ctx (ctx, resbuf);
 157 }
 158
 159 /* Compute SHA512 message digest for bytes read from STREAM.  The
 160    resulting message digest number will be written into the 64 bytes
 161    beginning at RESBLOCK.  */
 162 int
 163 sha512_stream (FILE *stream, void *resblock)
 164 {
 165   struct sha512_ctx ctx;
 166   char buffer[BLOCKSIZE + 72];
 167   size_t sum;
 168
 169   /* Initialize the computation context.  */
 170   sha512_init_ctx (&ctx);
 171
 172   /* Iterate over full file contents.  */
 173   while (1)
 174     {
 175       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 176          computation function processes the whole buffer so that with the
 177          next round of the loop another block can be read.  */
 178       size_t n;
 179       sum = 0;
 180
 181       /* Read block.  Take care for partial reads.  */
 182       while (1)
 183         {
 184           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 185
 186           sum += n;
 187
 188           if (sum == BLOCKSIZE)
 189             break;
 190
 191           if (n == 0)
 192             {
 193               /* Check for the error flag IFF N == 0, so that we don't
 194                  exit the loop after a partial read due to e.g., EAGAIN
 195                  or EWOULDBLOCK.  */
 196               if (ferror (stream))
 197                 return 1;
 198               goto process_partial_block;
 199             }
 200
 201           /* We've read at least one byte, so ignore errors.  But always
 202              check for EOF, since feof may be true even though N > 0.
 203              Otherwise, we could end up calling fread after EOF.  */
 204           if (feof (stream))
 205             goto process_partial_block;
 206         }
 207
 208       /* Process buffer with BLOCKSIZE bytes.  Note that
 209                         BLOCKSIZE % 128 == 0
 210        */
 211       sha512_process_block (buffer, BLOCKSIZE, &ctx);
 212     }
 213
 214  process_partial_block:;
 215
 216   /* Process any remaining bytes.  */
 217   if (sum > 0)
 218     sha512_process_bytes (buffer, sum, &ctx);
 219
 220   /* Construct result in desired memory.  */
 221   sha512_finish_ctx (&ctx, resblock);
 222   return 0;
 223 }
 224
 225 /* FIXME: Avoid code duplication */
 226 int
 227 sha384_stream (FILE *stream, void *resblock)
 228 {
 229   struct sha512_ctx ctx;
 230   char buffer[BLOCKSIZE + 72];
 231   size_t sum;
 232
 233   /* Initialize the computation context.  */
 234   sha384_init_ctx (&ctx);
 235
 236   /* Iterate over full file contents.  */
 237   while (1)
 238     {
 239       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 240          computation function processes the whole buffer so that with the
 241          next round of the loop another block can be read.  */
 242       size_t n;
 243       sum = 0;
 244
 245       /* Read block.  Take care for partial reads.  */
 246       while (1)
 247         {
 248           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 249
 250           sum += n;
 251
 252           if (sum == BLOCKSIZE)
 253             break;
 254
 255           if (n == 0)
 256             {
 257               /* Check for the error flag IFF N == 0, so that we don't
 258                  exit the loop after a partial read due to e.g., EAGAIN
 259                  or EWOULDBLOCK.  */
 260               if (ferror (stream))
 261                 return 1;
 262               goto process_partial_block;
 263             }
 264
 265           /* We've read at least one byte, so ignore errors.  But always
 266              check for EOF, since feof may be true even though N > 0.
 267              Otherwise, we could end up calling fread after EOF.  */
 268           if (feof (stream))
 269             goto process_partial_block;
 270         }
 271
 272       /* Process buffer with BLOCKSIZE bytes.  Note that
 273                         BLOCKSIZE % 128 == 0
 274        */
 275       sha512_process_block (buffer, BLOCKSIZE, &ctx);
 276     }
 277
 278  process_partial_block:;
 279
 280   /* Process any remaining bytes.  */
 281   if (sum > 0)
 282     sha512_process_bytes (buffer, sum, &ctx);
 283
 284   /* Construct result in desired memory.  */
 285   sha384_finish_ctx (&ctx, resblock);
 286   return 0;
 287 }
 288
 289 /* Compute SHA512 message digest for LEN bytes beginning at BUFFER.  The
 290    result is always in little endian byte order, so that a byte-wise
 291    output yields to the wanted ASCII representation of the message
 292    digest.  */
 293 void *
 294 sha512_buffer (const char *buffer, size_t len, void *resblock)
 295 {
 296   struct sha512_ctx ctx;
 297
 298   /* Initialize the computation context.  */
 299   sha512_init_ctx (&ctx);
 300
 301   /* Process whole buffer but last len % 128 bytes.  */
 302   sha512_process_bytes (buffer, len, &ctx);
 303
 304   /* Put result in desired memory area.  */
 305   return sha512_finish_ctx (&ctx, resblock);
 306 }
 307
 308 void *
 309 sha384_buffer (const char *buffer, size_t len, void *resblock)
 310 {
 311   struct sha512_ctx ctx;
 312
 313   /* Initialize the computation context.  */
 314   sha384_init_ctx (&ctx);
 315
 316   /* Process whole buffer but last len % 128 bytes.  */
 317   sha512_process_bytes (buffer, len, &ctx);
 318
 319   /* Put result in desired memory area.  */
 320   return sha384_finish_ctx (&ctx, resblock);
 321 }
 322
 323 void
 324 sha512_process_bytes (const void *buffer, size_t len, struct sha512_ctx *ctx)
 325 {
 326   /* When we already have some bits in our internal buffer concatenate
 327      both inputs first.  */
 328   if (ctx->buflen != 0)
 329     {
 330       size_t left_over = ctx->buflen;
 331       size_t add = 256 - left_over > len ? len : 256 - left_over;
 332
 333       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 334       ctx->buflen += add;
 335
 336       if (ctx->buflen > 128)
 337         {
 338           sha512_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 339
 340           ctx->buflen &= 127;
 341           /* The regions in the following copy operation cannot overlap.  */
 342           memcpy (ctx->buffer,
 343                   &((char *) ctx->buffer)[(left_over + add) & ~127],
 344                   ctx->buflen);
 345         }
 346
 347       buffer = (const char *) buffer + add;
 348       len -= add;
 349     }
 350
 351   /* Process available complete blocks.  */
 352   if (len >= 128)
 353     {
 354 #if !_STRING_ARCH_unaligned
 355 # define alignof(type) offsetof (struct { char c; type x; }, x)
 356 # define UNALIGNED_P(p) (((size_t) p) % alignof (uint64_t) != 0)
 357       if (UNALIGNED_P (buffer))
 358         while (len > 128)
 359           {
 360             sha512_process_block (memcpy (ctx->buffer, buffer, 128), 128, ctx);
 361             buffer = (const char *) buffer + 128;
 362             len -= 128;
 363           }
 364       else
 365 #endif
 366         {
 367           sha512_process_block (buffer, len & ~127, ctx);
 368           buffer = (const char *) buffer + (len & ~127);
 369           len &= 127;
 370         }
 371     }
 372
 373   /* Move remaining bytes in internal buffer.  */
 374   if (len > 0)
 375     {
 376       size_t left_over = ctx->buflen;
 377
 378       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 379       left_over += len;
 380       if (left_over >= 128)
 381         {
 382           sha512_process_block (ctx->buffer, 128, ctx);
 383           left_over -= 128;
 384           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 385         }
 386       ctx->buflen = left_over;
 387     }
 388 }
 389
 390 /* --- Code below is the primary difference between sha1.c and sha512.c --- */
 391
 392 /* SHA512 round constants */
 393 #define K(I) sha512_round_constants[I]
 394 static const uint64_t sha512_round_constants[80] = {
 395  0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL, 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
 396  0xd807aa98a3030242ULL, 0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL, 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
 397  0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL, 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
 398  0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL, 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
 399  0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL, 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
 400  0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL, 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL, 0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
 401  0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL, 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
 402  0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL, 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
 403  0xca273eceea26619cULL, 0xd186b8c721c0c207ULL, 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
 404  0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL, 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,
 405 };
 406
 407 /* Round functions.  */
 408 #define F2(A,B,C) ( ( A & B ) | ( C & ( A | B ) ) )
 409 #define F1(E,F,G) ( G ^ ( E & ( F ^ G ) ) )
 410
 411 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 412    It is assumed that LEN % 128 == 0.
 413    Most of this code comes from GnuPG's cipher/sha1.c.  */
 414
 415 void
 416 sha512_process_block (const void *buffer, size_t len, struct sha512_ctx *ctx)
 417 {
 418   const uint64_t *words = buffer;
 419   size_t nwords = len / sizeof (uint64_t);
 420   const uint64_t *endp = words + nwords;
 421   uint64_t x[16];
 422   uint64_t a = ctx->state[0];
 423   uint64_t b = ctx->state[1];
 424   uint64_t c = ctx->state[2];
 425   uint64_t d = ctx->state[3];
 426   uint64_t e = ctx->state[4];
 427   uint64_t f = ctx->state[5];
 428   uint64_t g = ctx->state[6];
 429   uint64_t h = ctx->state[7];
 430
 431   /* First increment the byte count.  FIPS PUB 180-2 specifies the possible
 432      length of the file up to 2^128 bits.  Here we only compute the
 433      number of bytes.  Do a double word increment.  */
 434   ctx->total[0] += len;
 435   if (ctx->total[0] < len)
 436     ++ctx->total[1];
 437
 438 #define S0(x) (rol64(x,63)^rol64(x,56)^(x>>7))
 439 #define S1(x) (rol64(x,45)^rol64(x,3)^(x>>6))
 440 #define SS0(x) (rol64(x,36)^rol64(x,30)^rol64(x,25))
 441 #define SS1(x) (rol64(x,50)^rol64(x,46)^rol64(x,23))
 442
 443 #define M(I) ( tm =   S1(x[(I-2)&0x0f]) + x[(I-7)&0x0f] \
 444                     + S0(x[(I-15)&0x0f]) + x[I&0x0f]    \
 445                , x[I&0x0f] = tm )
 446
 447 #define R(A,B,C,D,E,F,G,H,K,M)  do { t0 = SS0(A) + F2(A,B,C); \
 448                                      t1 = H + SS1(E)  \
 449                                       + F1(E,F,G)     \
 450                                       + K             \
 451                                       + M;            \
 452                                      D += t1;  H = t0 + t1; \
 453                                } while(0)
 454
 455   while (words < endp)
 456     {
 457       uint64_t tm;
 458       uint64_t t0, t1;
 459       int t;
 460       /* FIXME: see sha1.c for a better implementation.  */
 461       for (t = 0; t < 16; t++)
 462         {
 463           x[t] = SWAP (*words);
 464           words++;
 465         }
 466
 467       R( a, b, c, d, e, f, g, h, K( 0), x[ 0] );
 468       R( h, a, b, c, d, e, f, g, K( 1), x[ 1] );
 469       R( g, h, a, b, c, d, e, f, K( 2), x[ 2] );
 470       R( f, g, h, a, b, c, d, e, K( 3), x[ 3] );
 471       R( e, f, g, h, a, b, c, d, K( 4), x[ 4] );
 472       R( d, e, f, g, h, a, b, c, K( 5), x[ 5] );
 473       R( c, d, e, f, g, h, a, b, K( 6), x[ 6] );
 474       R( b, c, d, e, f, g, h, a, K( 7), x[ 7] );
 475       R( a, b, c, d, e, f, g, h, K( 8), x[ 8] );
 476       R( h, a, b, c, d, e, f, g, K( 9), x[ 9] );
 477       R( g, h, a, b, c, d, e, f, K(10), x[10] );
 478       R( f, g, h, a, b, c, d, e, K(11), x[11] );
 479       R( e, f, g, h, a, b, c, d, K(12), x[12] );
 480       R( d, e, f, g, h, a, b, c, K(13), x[13] );
 481       R( c, d, e, f, g, h, a, b, K(14), x[14] );
 482       R( b, c, d, e, f, g, h, a, K(15), x[15] );
 483       R( a, b, c, d, e, f, g, h, K(16), M(16) );
 484       R( h, a, b, c, d, e, f, g, K(17), M(17) );
 485       R( g, h, a, b, c, d, e, f, K(18), M(18) );
 486       R( f, g, h, a, b, c, d, e, K(19), M(19) );
 487       R( e, f, g, h, a, b, c, d, K(20), M(20) );
 488       R( d, e, f, g, h, a, b, c, K(21), M(21) );
 489       R( c, d, e, f, g, h, a, b, K(22), M(22) );
 490       R( b, c, d, e, f, g, h, a, K(23), M(23) );
 491       R( a, b, c, d, e, f, g, h, K(24), M(24) );
 492       R( h, a, b, c, d, e, f, g, K(25), M(25) );
 493       R( g, h, a, b, c, d, e, f, K(26), M(26) );
 494       R( f, g, h, a, b, c, d, e, K(27), M(27) );
 495       R( e, f, g, h, a, b, c, d, K(28), M(28) );
 496       R( d, e, f, g, h, a, b, c, K(29), M(29) );
 497       R( c, d, e, f, g, h, a, b, K(30), M(30) );
 498       R( b, c, d, e, f, g, h, a, K(31), M(31) );
 499       R( a, b, c, d, e, f, g, h, K(32), M(32) );
 500       R( h, a, b, c, d, e, f, g, K(33), M(33) );
 501       R( g, h, a, b, c, d, e, f, K(34), M(34) );
 502       R( f, g, h, a, b, c, d, e, K(35), M(35) );
 503       R( e, f, g, h, a, b, c, d, K(36), M(36) );
 504       R( d, e, f, g, h, a, b, c, K(37), M(37) );
 505       R( c, d, e, f, g, h, a, b, K(38), M(38) );
 506       R( b, c, d, e, f, g, h, a, K(39), M(39) );
 507       R( a, b, c, d, e, f, g, h, K(40), M(40) );
 508       R( h, a, b, c, d, e, f, g, K(41), M(41) );
 509       R( g, h, a, b, c, d, e, f, K(42), M(42) );
 510       R( f, g, h, a, b, c, d, e, K(43), M(43) );
 511       R( e, f, g, h, a, b, c, d, K(44), M(44) );
 512       R( d, e, f, g, h, a, b, c, K(45), M(45) );
 513       R( c, d, e, f, g, h, a, b, K(46), M(46) );
 514       R( b, c, d, e, f, g, h, a, K(47), M(47) );
 515       R( a, b, c, d, e, f, g, h, K(48), M(48) );
 516       R( h, a, b, c, d, e, f, g, K(49), M(49) );
 517       R( g, h, a, b, c, d, e, f, K(50), M(50) );
 518       R( f, g, h, a, b, c, d, e, K(51), M(51) );
 519       R( e, f, g, h, a, b, c, d, K(52), M(52) );
 520       R( d, e, f, g, h, a, b, c, K(53), M(53) );
 521       R( c, d, e, f, g, h, a, b, K(54), M(54) );
 522       R( b, c, d, e, f, g, h, a, K(55), M(55) );
 523       R( a, b, c, d, e, f, g, h, K(56), M(56) );
 524       R( h, a, b, c, d, e, f, g, K(57), M(57) );
 525       R( g, h, a, b, c, d, e, f, K(58), M(58) );
 526       R( f, g, h, a, b, c, d, e, K(59), M(59) );
 527       R( e, f, g, h, a, b, c, d, K(60), M(60) );
 528       R( d, e, f, g, h, a, b, c, K(61), M(61) );
 529       R( c, d, e, f, g, h, a, b, K(62), M(62) );
 530       R( b, c, d, e, f, g, h, a, K(63), M(63) );
 531       R( a, b, c, d, e, f, g, h, K(64), M(64) );
 532       R( h, a, b, c, d, e, f, g, K(65), M(65) );
 533       R( g, h, a, b, c, d, e, f, K(66), M(66) );
 534       R( f, g, h, a, b, c, d, e, K(67), M(67) );
 535       R( e, f, g, h, a, b, c, d, K(68), M(68) );
 536       R( d, e, f, g, h, a, b, c, K(69), M(69) );
 537       R( c, d, e, f, g, h, a, b, K(70), M(70) );
 538       R( b, c, d, e, f, g, h, a, K(71), M(71) );
 539       R( a, b, c, d, e, f, g, h, K(72), M(72) );
 540       R( h, a, b, c, d, e, f, g, K(73), M(73) );
 541       R( g, h, a, b, c, d, e, f, K(74), M(74) );
 542       R( f, g, h, a, b, c, d, e, K(75), M(75) );
 543       R( e, f, g, h, a, b, c, d, K(76), M(76) );
 544       R( d, e, f, g, h, a, b, c, K(77), M(77) );
 545       R( c, d, e, f, g, h, a, b, K(78), M(78) );
 546       R( b, c, d, e, f, g, h, a, K(79), M(79) );
 547
 548       a = ctx->state[0] += a;
 549       b = ctx->state[1] += b;
 550       c = ctx->state[2] += c;
 551       d = ctx->state[3] += d;
 552       e = ctx->state[4] += e;
 553       f = ctx->state[5] += f;
 554       g = ctx->state[6] += g;
 555       h = ctx->state[7] += h;
 556     }
 557 }