tc/crypto/Sha2.c

   1 /*
   2  ---------------------------------------------------------------------------
   3  Copyright (c) 2002, Dr Brian Gladman, Worcester, UK.   All rights reserved.
   4
   5  LICENSE TERMS
   6
   7  The free distribution and use of this software is allowed (with or without
   8  changes) provided that:
   9
  10   1. source code distributions include the above copyright notice, this
  11      list of conditions and the following disclaimer;
  12
  13   2. binary distributions include the above copyright notice, this list
  14      of conditions and the following disclaimer in their documentation;
  15
  16   3. the name of the copyright holder is not used to endorse products
  17      built using this software without specific written permission.
  18
  19  DISCLAIMER
  20
  21  This software is provided 'as is' with no explicit or implied warranties
  22  in respect of its properties, including, but not limited to, correctness
  23  and/or fitness for purpose.
  24  ---------------------------------------------------------------------------
  25  Issue Date: 01/08/2005
  26
  27  This is a byte oriented version of SHA2 that operates on arrays of bytes
  28  stored in memory. This code implements sha256, sha384 and sha512 but the
  29  latter two functions rely on efficient 64-bit integer operations that
  30  may not be very efficient on 32-bit machines
  31
  32  The sha256 functions use a type 'sha256_ctx' to hold details of the
  33  current hash state and uses the following three calls:
  34
  35        void sha256_begin(sha256_ctx ctx[1])
  36        void sha256_hash(const unsigned char data[],
  37                             unsigned long len, sha256_ctx ctx[1])
  38        void sha_end1(unsigned char hval[], sha256_ctx ctx[1])
  39
  40  The first subroutine initialises a hash computation by setting up the
  41  context in the sha256_ctx context. The second subroutine hashes 8-bit
  42  bytes from array data[] into the hash state withinh sha256_ctx context,
  43  the number of bytes to be hashed being given by the the unsigned long
  44  integer len.  The third subroutine completes the hash calculation and
  45  places the resulting digest value in the array of 8-bit bytes hval[].
  46
  47  The sha384 and sha512 functions are similar and use the interfaces:
  48
  49        void sha384_begin(sha384_ctx ctx[1]);
  50        void sha384_hash(const unsigned char data[],
  51                             unsigned long len, sha384_ctx ctx[1]);
  52        void sha384_end(unsigned char hval[], sha384_ctx ctx[1]);
  53
  54        void sha512_begin(sha512_ctx ctx[1]);
  55        void sha512_hash(const unsigned char data[],
  56                             unsigned long len, sha512_ctx ctx[1]);
  57        void sha512_end(unsigned char hval[], sha512_ctx ctx[1]);
  58
  59  In addition there is a function sha2 that can be used to call all these
  60  functions using a call with a hash length parameter as follows:
  61
  62        int sha2_begin(unsigned long len, sha2_ctx ctx[1]);
  63        void sha2_hash(const unsigned char data[],
  64                             unsigned long len, sha2_ctx ctx[1]);
  65        void sha2_end(unsigned char hval[], sha2_ctx ctx[1]);
  66
  67  My thanks to Erik Andersen <andersen@codepoet.org> for testing this code
  68  on big-endian systems and for his assistance with corrections
  69 */
  70
  71 #include "Common/Endian.h"
  72 #define PLATFORM_BYTE_ORDER BYTE_ORDER
  73 #define IS_LITTLE_ENDIAN LITTLE_ENDIAN
  74
  75 #if 0
  76 #define UNROLL_SHA2     /* for SHA2 loop unroll     */
  77 #endif
  78
  79 #include <string.h>     /* for memcpy() etc.        */
  80
  81 #include "Sha2.h"
  82
  83 #if defined(__cplusplus)
  84 extern "C"
  85 {
  86 #endif
  87
  88 #if defined( _MSC_VER ) && ( _MSC_VER > 800 )
  89 #pragma intrinsic(memcpy)
  90 #endif
  91
  92 #if 0 && defined(_MSC_VER)
  93 #define rotl32 _lrotl
  94 #define rotr32 _lrotr
  95 #else
  96 #define rotl32(x,n)   (((x) << n) | ((x) >> (32 - n)))
  97 #define rotr32(x,n)   (((x) >> n) | ((x) << (32 - n)))
  98 #endif
  99
 100 #if !defined(bswap_32)
 101 #define bswap_32(x) ((rotr32((x), 24) & 0x00ff00ff) | (rotr32((x), 8) & 0xff00ff00))
 102 #endif
 103
 104 #if (PLATFORM_BYTE_ORDER == IS_LITTLE_ENDIAN)
 105 #define SWAP_BYTES
 106 #else
 107 #undef  SWAP_BYTES
 108 #endif
 109
 110 #if 0
 111
 112 #define ch(x,y,z)       (((x) & (y)) ^ (~(x) & (z)))
 113 #define maj(x,y,z)      (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
 114
 115 #else   /* Thanks to Rich Schroeppel and Colin Plumb for the following      */
 116
 117 #define ch(x,y,z)       ((z) ^ ((x) & ((y) ^ (z))))
 118 #define maj(x,y,z)      (((x) & (y)) | ((z) & ((x) ^ (y))))
 119
 120 #endif
 121
 122 /* round transforms for SHA256 and SHA512 compression functions */
 123
 124 #define vf(n,i) v[(n - i) & 7]
 125
 126 #define hf(i) (p[i & 15] += \
 127     g_1(p[(i + 14) & 15]) + p[(i + 9) & 15] + g_0(p[(i + 1) & 15]))
 128
 129 #define v_cycle(i,j)                                \
 130     vf(7,i) += (j ? hf(i) : p[i]) + k_0[i+j]        \
 131     + s_1(vf(4,i)) + ch(vf(4,i),vf(5,i),vf(6,i));   \
 132     vf(3,i) += vf(7,i);                             \
 133     vf(7,i) += s_0(vf(0,i))+ maj(vf(0,i),vf(1,i),vf(2,i))
 134
 135 #if defined(SHA_224) || defined(SHA_256)
 136
 137 #define SHA256_MASK (SHA256_BLOCK_SIZE - 1)
 138
 139 #if defined(SWAP_BYTES)
 140 #define bsw_32(p,n) \
 141     { int _i = (n); while(_i--) ((uint_32t*)p)[_i] = bswap_32(((uint_32t*)p)[_i]); }
 142 #else
 143 #define bsw_32(p,n)
 144 #endif
 145
 146 #define s_0(x)  (rotr32((x),  2) ^ rotr32((x), 13) ^ rotr32((x), 22))
 147 #define s_1(x)  (rotr32((x),  6) ^ rotr32((x), 11) ^ rotr32((x), 25))
 148 #define g_0(x)  (rotr32((x),  7) ^ rotr32((x), 18) ^ ((x) >>  3))
 149 #define g_1(x)  (rotr32((x), 17) ^ rotr32((x), 19) ^ ((x) >> 10))
 150 #define k_0     k256
 151
 152 /* rotated SHA256 round definition. Rather than swapping variables as in    */
 153 /* FIPS-180, different variables are 'rotated' on each round, returning     */
 154 /* to their starting positions every eight rounds                           */
 155
 156 #define q(n)  v##n
 157
 158 #define one_cycle(a,b,c,d,e,f,g,h,k,w)  \
 159     q(h) += s_1(q(e)) + ch(q(e), q(f), q(g)) + k + w; \
 160     q(d) += q(h); q(h) += s_0(q(a)) + maj(q(a), q(b), q(c))
 161
 162 /* SHA256 mixing data   */
 163
 164 const uint_32t k256[64] =
 165 {   0x428a2f98ul, 0x71374491ul, 0xb5c0fbcful, 0xe9b5dba5ul,
 166     0x3956c25bul, 0x59f111f1ul, 0x923f82a4ul, 0xab1c5ed5ul,
 167     0xd807aa98ul, 0x12835b01ul, 0x243185beul, 0x550c7dc3ul,
 168     0x72be5d74ul, 0x80deb1feul, 0x9bdc06a7ul, 0xc19bf174ul,
 169     0xe49b69c1ul, 0xefbe4786ul, 0x0fc19dc6ul, 0x240ca1ccul,
 170     0x2de92c6ful, 0x4a7484aaul, 0x5cb0a9dcul, 0x76f988daul,
 171     0x983e5152ul, 0xa831c66dul, 0xb00327c8ul, 0xbf597fc7ul,
 172     0xc6e00bf3ul, 0xd5a79147ul, 0x06ca6351ul, 0x14292967ul,
 173     0x27b70a85ul, 0x2e1b2138ul, 0x4d2c6dfcul, 0x53380d13ul,
 174     0x650a7354ul, 0x766a0abbul, 0x81c2c92eul, 0x92722c85ul,
 175     0xa2bfe8a1ul, 0xa81a664bul, 0xc24b8b70ul, 0xc76c51a3ul,
 176     0xd192e819ul, 0xd6990624ul, 0xf40e3585ul, 0x106aa070ul,
 177     0x19a4c116ul, 0x1e376c08ul, 0x2748774cul, 0x34b0bcb5ul,
 178     0x391c0cb3ul, 0x4ed8aa4aul, 0x5b9cca4ful, 0x682e6ff3ul,
 179     0x748f82eeul, 0x78a5636ful, 0x84c87814ul, 0x8cc70208ul,
 180     0x90befffaul, 0xa4506cebul, 0xbef9a3f7ul, 0xc67178f2ul,
 181 };
 182
 183 /* Compile 64 bytes of hash data into SHA256 digest value   */
 184 /* NOTE: this routine assumes that the byte order in the    */
 185 /* ctx->wbuf[] at this point is such that low address bytes */
 186 /* in the ORIGINAL byte stream will go into the high end of */
 187 /* words on BOTH big and little endian systems              */
 188
 189 VOID_RETURN sha256_compile(sha256_ctx ctx[1])
 190 {
 191 #if !defined(UNROLL_SHA2)
 192
 193     uint_32t j, *p = ctx->wbuf, v[8];
 194
 195     memcpy(v, ctx->hash, 8 * sizeof(uint_32t));
 196
 197     for(j = 0; j < 64; j += 16)
 198     {
 199         v_cycle( 0, j); v_cycle( 1, j);
 200         v_cycle( 2, j); v_cycle( 3, j);
 201         v_cycle( 4, j); v_cycle( 5, j);
 202         v_cycle( 6, j); v_cycle( 7, j);
 203         v_cycle( 8, j); v_cycle( 9, j);
 204         v_cycle(10, j); v_cycle(11, j);
 205         v_cycle(12, j); v_cycle(13, j);
 206         v_cycle(14, j); v_cycle(15, j);
 207     }
 208
 209     ctx->hash[0] += v[0]; ctx->hash[1] += v[1];
 210     ctx->hash[2] += v[2]; ctx->hash[3] += v[3];
 211     ctx->hash[4] += v[4]; ctx->hash[5] += v[5];
 212     ctx->hash[6] += v[6]; ctx->hash[7] += v[7];
 213
 214 #else
 215
 216     uint_32t *p = ctx->wbuf,v0,v1,v2,v3,v4,v5,v6,v7;
 217
 218     v0 = ctx->hash[0]; v1 = ctx->hash[1];
 219     v2 = ctx->hash[2]; v3 = ctx->hash[3];
 220     v4 = ctx->hash[4]; v5 = ctx->hash[5];
 221     v6 = ctx->hash[6]; v7 = ctx->hash[7];
 222
 223     one_cycle(0,1,2,3,4,5,6,7,k256[ 0],p[ 0]);
 224     one_cycle(7,0,1,2,3,4,5,6,k256[ 1],p[ 1]);
 225     one_cycle(6,7,0,1,2,3,4,5,k256[ 2],p[ 2]);
 226     one_cycle(5,6,7,0,1,2,3,4,k256[ 3],p[ 3]);
 227     one_cycle(4,5,6,7,0,1,2,3,k256[ 4],p[ 4]);
 228     one_cycle(3,4,5,6,7,0,1,2,k256[ 5],p[ 5]);
 229     one_cycle(2,3,4,5,6,7,0,1,k256[ 6],p[ 6]);
 230     one_cycle(1,2,3,4,5,6,7,0,k256[ 7],p[ 7]);
 231     one_cycle(0,1,2,3,4,5,6,7,k256[ 8],p[ 8]);
 232     one_cycle(7,0,1,2,3,4,5,6,k256[ 9],p[ 9]);
 233     one_cycle(6,7,0,1,2,3,4,5,k256[10],p[10]);
 234     one_cycle(5,6,7,0,1,2,3,4,k256[11],p[11]);
 235     one_cycle(4,5,6,7,0,1,2,3,k256[12],p[12]);
 236     one_cycle(3,4,5,6,7,0,1,2,k256[13],p[13]);
 237     one_cycle(2,3,4,5,6,7,0,1,k256[14],p[14]);
 238     one_cycle(1,2,3,4,5,6,7,0,k256[15],p[15]);
 239
 240     one_cycle(0,1,2,3,4,5,6,7,k256[16],hf( 0));
 241     one_cycle(7,0,1,2,3,4,5,6,k256[17],hf( 1));
 242     one_cycle(6,7,0,1,2,3,4,5,k256[18],hf( 2));
 243     one_cycle(5,6,7,0,1,2,3,4,k256[19],hf( 3));
 244     one_cycle(4,5,6,7,0,1,2,3,k256[20],hf( 4));
 245     one_cycle(3,4,5,6,7,0,1,2,k256[21],hf( 5));
 246     one_cycle(2,3,4,5,6,7,0,1,k256[22],hf( 6));
 247     one_cycle(1,2,3,4,5,6,7,0,k256[23],hf( 7));
 248     one_cycle(0,1,2,3,4,5,6,7,k256[24],hf( 8));
 249     one_cycle(7,0,1,2,3,4,5,6,k256[25],hf( 9));
 250     one_cycle(6,7,0,1,2,3,4,5,k256[26],hf(10));
 251     one_cycle(5,6,7,0,1,2,3,4,k256[27],hf(11));
 252     one_cycle(4,5,6,7,0,1,2,3,k256[28],hf(12));
 253     one_cycle(3,4,5,6,7,0,1,2,k256[29],hf(13));
 254     one_cycle(2,3,4,5,6,7,0,1,k256[30],hf(14));
 255     one_cycle(1,2,3,4,5,6,7,0,k256[31],hf(15));
 256
 257     one_cycle(0,1,2,3,4,5,6,7,k256[32],hf( 0));
 258     one_cycle(7,0,1,2,3,4,5,6,k256[33],hf( 1));
 259     one_cycle(6,7,0,1,2,3,4,5,k256[34],hf( 2));
 260     one_cycle(5,6,7,0,1,2,3,4,k256[35],hf( 3));
 261     one_cycle(4,5,6,7,0,1,2,3,k256[36],hf( 4));
 262     one_cycle(3,4,5,6,7,0,1,2,k256[37],hf( 5));
 263     one_cycle(2,3,4,5,6,7,0,1,k256[38],hf( 6));
 264     one_cycle(1,2,3,4,5,6,7,0,k256[39],hf( 7));
 265     one_cycle(0,1,2,3,4,5,6,7,k256[40],hf( 8));
 266     one_cycle(7,0,1,2,3,4,5,6,k256[41],hf( 9));
 267     one_cycle(6,7,0,1,2,3,4,5,k256[42],hf(10));
 268     one_cycle(5,6,7,0,1,2,3,4,k256[43],hf(11));
 269     one_cycle(4,5,6,7,0,1,2,3,k256[44],hf(12));
 270     one_cycle(3,4,5,6,7,0,1,2,k256[45],hf(13));
 271     one_cycle(2,3,4,5,6,7,0,1,k256[46],hf(14));
 272     one_cycle(1,2,3,4,5,6,7,0,k256[47],hf(15));
 273
 274     one_cycle(0,1,2,3,4,5,6,7,k256[48],hf( 0));
 275     one_cycle(7,0,1,2,3,4,5,6,k256[49],hf( 1));
 276     one_cycle(6,7,0,1,2,3,4,5,k256[50],hf( 2));
 277     one_cycle(5,6,7,0,1,2,3,4,k256[51],hf( 3));
 278     one_cycle(4,5,6,7,0,1,2,3,k256[52],hf( 4));
 279     one_cycle(3,4,5,6,7,0,1,2,k256[53],hf( 5));
 280     one_cycle(2,3,4,5,6,7,0,1,k256[54],hf( 6));
 281     one_cycle(1,2,3,4,5,6,7,0,k256[55],hf( 7));
 282     one_cycle(0,1,2,3,4,5,6,7,k256[56],hf( 8));
 283     one_cycle(7,0,1,2,3,4,5,6,k256[57],hf( 9));
 284     one_cycle(6,7,0,1,2,3,4,5,k256[58],hf(10));
 285     one_cycle(5,6,7,0,1,2,3,4,k256[59],hf(11));
 286     one_cycle(4,5,6,7,0,1,2,3,k256[60],hf(12));
 287     one_cycle(3,4,5,6,7,0,1,2,k256[61],hf(13));
 288     one_cycle(2,3,4,5,6,7,0,1,k256[62],hf(14));
 289     one_cycle(1,2,3,4,5,6,7,0,k256[63],hf(15));
 290
 291     ctx->hash[0] += v0; ctx->hash[1] += v1;
 292     ctx->hash[2] += v2; ctx->hash[3] += v3;
 293     ctx->hash[4] += v4; ctx->hash[5] += v5;
 294     ctx->hash[6] += v6; ctx->hash[7] += v7;
 295 #endif
 296 }
 297
 298 /* SHA256 hash data in an array of bytes into hash buffer   */
 299 /* and call the hash_compile function as required.          */
 300
 301 VOID_RETURN sha256_hash(const unsigned char data[], unsigned long len, sha256_ctx ctx[1])
 302 {   uint_32t pos = (uint_32t)(ctx->count[0] & SHA256_MASK),
 303              space = SHA256_BLOCK_SIZE - pos;
 304     const unsigned char *sp = data;
 305
 306     if((ctx->count[0] += len) < len)
 307         ++(ctx->count[1]);
 308
 309     while(len >= space)     /* tranfer whole blocks while possible  */
 310     {
 311         memcpy(((unsigned char*)ctx->wbuf) + pos, sp, space);
 312         sp += space; len -= space; space = SHA256_BLOCK_SIZE; pos = 0;
 313         bsw_32(ctx->wbuf, SHA256_BLOCK_SIZE >> 2)
 314         sha256_compile(ctx);
 315     }
 316
 317     memcpy(((unsigned char*)ctx->wbuf) + pos, sp, len);
 318 }
 319
 320 /* SHA256 Final padding and digest calculation  */
 321
 322 static void sha_end1(unsigned char hval[], sha256_ctx ctx[1], const unsigned int hlen)
 323 {   uint_32t    i = (uint_32t)(ctx->count[0] & SHA256_MASK);
 324
 325     /* put bytes in the buffer in an order in which references to   */
 326     /* 32-bit words will put bytes with lower addresses into the    */
 327     /* top of 32 bit words on BOTH big and little endian machines   */
 328     bsw_32(ctx->wbuf, (i + 3) >> 2)
 329
 330     /* we now need to mask valid bytes and add the padding which is */
 331     /* a single 1 bit and as many zero bits as necessary. Note that */
 332     /* we can always add the first padding byte here because the    */
 333     /* buffer always has at least one empty slot                    */
 334     ctx->wbuf[i >> 2] &= 0xffffff80 << 8 * (~i & 3);
 335     ctx->wbuf[i >> 2] |= 0x00000080 << 8 * (~i & 3);
 336
 337     /* we need 9 or more empty positions, one for the padding byte  */
 338     /* (above) and eight for the length count.  If there is not     */
 339     /* enough space pad and empty the buffer                        */
 340     if(i > SHA256_BLOCK_SIZE - 9)
 341     {
 342         if(i < 60) ctx->wbuf[15] = 0;
 343         sha256_compile(ctx);
 344         i = 0;
 345     }
 346     else    /* compute a word index for the empty buffer positions  */
 347         i = (i >> 2) + 1;
 348
 349     while(i < 14) /* and zero pad all but last two positions        */
 350         ctx->wbuf[i++] = 0;
 351
 352     /* the following 32-bit length fields are assembled in the      */
 353     /* wrong byte order on little endian machines but this is       */
 354     /* corrected later since they are only ever used as 32-bit      */
 355     /* word values.                                                 */
 356     ctx->wbuf[14] = (ctx->count[1] << 3) | (ctx->count[0] >> 29);
 357     ctx->wbuf[15] = ctx->count[0] << 3;
 358     sha256_compile(ctx);
 359
 360     /* extract the hash value as bytes in case the hash buffer is   */
 361     /* mislaigned for 32-bit words                                  */
 362     for(i = 0; i < hlen; ++i)
 363         hval[i] = (unsigned char)(ctx->hash[i >> 2] >> (8 * (~i & 3)));
 364 }
 365
 366 #endif
 367
 368 #if defined(SHA_224)
 369
 370 const uint_32t i224[8] =
 371 {
 372     0xc1059ed8ul, 0x367cd507ul, 0x3070dd17ul, 0xf70e5939ul,
 373     0xffc00b31ul, 0x68581511ul, 0x64f98fa7ul, 0xbefa4fa4ul
 374 };
 375
 376 VOID_RETURN sha224_begin(sha224_ctx ctx[1])
 377 {
 378     ctx->count[0] = ctx->count[1] = 0;
 379     memcpy(ctx->hash, i224, 8 * sizeof(uint_32t));
 380 }
 381
 382 VOID_RETURN sha224_end(unsigned char hval[], sha224_ctx ctx[1])
 383 {
 384     sha_end1(hval, ctx, SHA224_DIGEST_SIZE);
 385 }
 386
 387 VOID_RETURN sha224(unsigned char hval[], const unsigned char data[], unsigned long len)
 388 {   sha224_ctx  cx[1];
 389
 390     sha224_begin(cx);
 391     sha224_hash(data, len, cx);
 392     sha_end1(hval, cx, SHA224_DIGEST_SIZE);
 393 }
 394
 395 #endif
 396
 397 #if defined(SHA_256)
 398
 399 const uint_32t i256[8] =
 400 {
 401     0x6a09e667ul, 0xbb67ae85ul, 0x3c6ef372ul, 0xa54ff53aul,
 402     0x510e527ful, 0x9b05688cul, 0x1f83d9abul, 0x5be0cd19ul
 403 };
 404
 405 VOID_RETURN sha256_begin(sha256_ctx ctx[1])
 406 {
 407     ctx->count[0] = ctx->count[1] = 0;
 408     memcpy(ctx->hash, i256, 8 * sizeof(uint_32t));
 409 }
 410
 411 VOID_RETURN sha256_end(unsigned char hval[], sha256_ctx ctx[1])
 412 {
 413     sha_end1(hval, ctx, SHA256_DIGEST_SIZE);
 414 }
 415
 416 VOID_RETURN sha256(unsigned char hval[], const unsigned char data[], unsigned long len)
 417 {   sha256_ctx  cx[1];
 418
 419     sha256_begin(cx);
 420     sha256_hash(data, len, cx);
 421     sha_end1(hval, cx, SHA256_DIGEST_SIZE);
 422 }
 423
 424 #endif
 425
 426 #if defined(SHA_384) || defined(SHA_512)
 427
 428 #define SHA512_MASK (SHA512_BLOCK_SIZE - 1)
 429
 430 #define rotr64(x,n)   (((x) >> n) | ((x) << (64 - n)))
 431
 432 #if !defined(bswap_64)
 433 #define bswap_64(x) (((uint_64t)(bswap_32((uint_32t)(x)))) << 32 | bswap_32((uint_32t)((x) >> 32)))
 434 #endif
 435
 436 #if defined(SWAP_BYTES)
 437 #define bsw_64(p,n) \
 438     { int _i = (n); while(_i--) ((uint_64t*)p)[_i] = bswap_64(((uint_64t*)p)[_i]); }
 439 #else
 440 #define bsw_64(p,n)
 441 #endif
 442
 443 /* SHA512 mixing function definitions   */
 444
 445 #ifdef   s_0
 446 # undef  s_0
 447 # undef  s_1
 448 # undef  g_0
 449 # undef  g_1
 450 # undef  k_0
 451 #endif
 452
 453 #define s_0(x)  (rotr64((x), 28) ^ rotr64((x), 34) ^ rotr64((x), 39))
 454 #define s_1(x)  (rotr64((x), 14) ^ rotr64((x), 18) ^ rotr64((x), 41))
 455 #define g_0(x)  (rotr64((x),  1) ^ rotr64((x),  8) ^ ((x) >>  7))
 456 #define g_1(x)  (rotr64((x), 19) ^ rotr64((x), 61) ^ ((x) >>  6))
 457 #define k_0     k512
 458
 459 /* SHA384/SHA512 mixing data    */
 460
 461 const uint_64t  k512[80] =
 462 {
 463     li_64(428a2f98d728ae22), li_64(7137449123ef65cd),
 464     li_64(b5c0fbcfec4d3b2f), li_64(e9b5dba58189dbbc),
 465     li_64(3956c25bf348b538), li_64(59f111f1b605d019),
 466     li_64(923f82a4af194f9b), li_64(ab1c5ed5da6d8118),
 467     li_64(d807aa98a3030242), li_64(12835b0145706fbe),
 468     li_64(243185be4ee4b28c), li_64(550c7dc3d5ffb4e2),
 469     li_64(72be5d74f27b896f), li_64(80deb1fe3b1696b1),
 470     li_64(9bdc06a725c71235), li_64(c19bf174cf692694),
 471     li_64(e49b69c19ef14ad2), li_64(efbe4786384f25e3),
 472     li_64(0fc19dc68b8cd5b5), li_64(240ca1cc77ac9c65),
 473     li_64(2de92c6f592b0275), li_64(4a7484aa6ea6e483),
 474     li_64(5cb0a9dcbd41fbd4), li_64(76f988da831153b5),
 475     li_64(983e5152ee66dfab), li_64(a831c66d2db43210),
 476     li_64(b00327c898fb213f), li_64(bf597fc7beef0ee4),
 477     li_64(c6e00bf33da88fc2), li_64(d5a79147930aa725),
 478     li_64(06ca6351e003826f), li_64(142929670a0e6e70),
 479     li_64(27b70a8546d22ffc), li_64(2e1b21385c26c926),
 480     li_64(4d2c6dfc5ac42aed), li_64(53380d139d95b3df),
 481     li_64(650a73548baf63de), li_64(766a0abb3c77b2a8),
 482     li_64(81c2c92e47edaee6), li_64(92722c851482353b),
 483     li_64(a2bfe8a14cf10364), li_64(a81a664bbc423001),
 484     li_64(c24b8b70d0f89791), li_64(c76c51a30654be30),
 485     li_64(d192e819d6ef5218), li_64(d69906245565a910),
 486     li_64(f40e35855771202a), li_64(106aa07032bbd1b8),
 487     li_64(19a4c116b8d2d0c8), li_64(1e376c085141ab53),
 488     li_64(2748774cdf8eeb99), li_64(34b0bcb5e19b48a8),
 489     li_64(391c0cb3c5c95a63), li_64(4ed8aa4ae3418acb),
 490     li_64(5b9cca4f7763e373), li_64(682e6ff3d6b2b8a3),
 491     li_64(748f82ee5defb2fc), li_64(78a5636f43172f60),
 492     li_64(84c87814a1f0ab72), li_64(8cc702081a6439ec),
 493     li_64(90befffa23631e28), li_64(a4506cebde82bde9),
 494     li_64(bef9a3f7b2c67915), li_64(c67178f2e372532b),
 495     li_64(ca273eceea26619c), li_64(d186b8c721c0c207),
 496     li_64(eada7dd6cde0eb1e), li_64(f57d4f7fee6ed178),
 497     li_64(06f067aa72176fba), li_64(0a637dc5a2c898a6),
 498     li_64(113f9804bef90dae), li_64(1b710b35131c471b),
 499     li_64(28db77f523047d84), li_64(32caab7b40c72493),
 500     li_64(3c9ebe0a15c9bebc), li_64(431d67c49c100d4c),
 501     li_64(4cc5d4becb3e42b6), li_64(597f299cfc657e2a),
 502     li_64(5fcb6fab3ad6faec), li_64(6c44198c4a475817)
 503 };
 504
 505 /* Compile 128 bytes of hash data into SHA384/512 digest    */
 506 /* NOTE: this routine assumes that the byte order in the    */
 507 /* ctx->wbuf[] at this point is such that low address bytes */
 508 /* in the ORIGINAL byte stream will go into the high end of */
 509 /* words on BOTH big and little endian systems              */
 510
 511 VOID_RETURN sha512_compile(sha512_ctx ctx[1])
 512 {   uint_64t    v[8], *p = ctx->wbuf;
 513     uint_32t    j;
 514
 515     memcpy(v, ctx->hash, 8 * sizeof(uint_64t));
 516
 517     for(j = 0; j < 80; j += 16)
 518     {
 519         v_cycle( 0, j); v_cycle( 1, j);
 520         v_cycle( 2, j); v_cycle( 3, j);
 521         v_cycle( 4, j); v_cycle( 5, j);
 522         v_cycle( 6, j); v_cycle( 7, j);
 523         v_cycle( 8, j); v_cycle( 9, j);
 524         v_cycle(10, j); v_cycle(11, j);
 525         v_cycle(12, j); v_cycle(13, j);
 526         v_cycle(14, j); v_cycle(15, j);
 527     }
 528
 529     ctx->hash[0] += v[0]; ctx->hash[1] += v[1];
 530     ctx->hash[2] += v[2]; ctx->hash[3] += v[3];
 531     ctx->hash[4] += v[4]; ctx->hash[5] += v[5];
 532     ctx->hash[6] += v[6]; ctx->hash[7] += v[7];
 533 }
 534
 535 /* Compile 128 bytes of hash data into SHA256 digest value  */
 536 /* NOTE: this routine assumes that the byte order in the    */
 537 /* ctx->wbuf[] at this point is in such an order that low   */
 538 /* address bytes in the ORIGINAL byte stream placed in this */
 539 /* buffer will now go to the high end of words on BOTH big  */
 540 /* and little endian systems                                */
 541
 542 VOID_RETURN sha512_hash(const unsigned char data[], unsigned long len, sha512_ctx ctx[1])
 543 {   uint_32t pos = (uint_32t)(ctx->count[0] & SHA512_MASK),
 544              space = SHA512_BLOCK_SIZE - pos;
 545     const unsigned char *sp = data;
 546
 547     if((ctx->count[0] += len) < len)
 548         ++(ctx->count[1]);
 549
 550     while(len >= space)     /* tranfer whole blocks while possible  */
 551     {
 552         memcpy(((unsigned char*)ctx->wbuf) + pos, sp, space);
 553         sp += space; len -= space; space = SHA512_BLOCK_SIZE; pos = 0;
 554         bsw_64(ctx->wbuf, SHA512_BLOCK_SIZE >> 3);
 555         sha512_compile(ctx);
 556     }
 557
 558     memcpy(((unsigned char*)ctx->wbuf) + pos, sp, len);
 559 }
 560
 561 /* SHA384/512 Final padding and digest calculation  */
 562
 563 static void sha_end2(unsigned char hval[], sha512_ctx ctx[1], const unsigned int hlen)
 564 {   uint_32t    i = (uint_32t)(ctx->count[0] & SHA512_MASK);
 565
 566     /* put bytes in the buffer in an order in which references to   */
 567     /* 32-bit words will put bytes with lower addresses into the    */
 568     /* top of 32 bit words on BOTH big and little endian machines   */
 569     bsw_64(ctx->wbuf, (i + 7) >> 3);
 570
 571     /* we now need to mask valid bytes and add the padding which is */
 572     /* a single 1 bit and as many zero bits as necessary. Note that */
 573     /* we can always add the first padding byte here because the    */
 574     /* buffer always has at least one empty slot                    */
 575     ctx->wbuf[i >> 3] &= li_64(ffffffffffffff00) << 8 * (~i & 7);
 576     ctx->wbuf[i >> 3] |= li_64(0000000000000080) << 8 * (~i & 7);
 577
 578     /* we need 17 or more empty byte positions, one for the padding */
 579     /* byte (above) and sixteen for the length count.  If there is  */
 580     /* not enough space pad and empty the buffer                    */
 581     if(i > SHA512_BLOCK_SIZE - 17)
 582     {
 583         if(i < 120) ctx->wbuf[15] = 0;
 584         sha512_compile(ctx);
 585         i = 0;
 586     }
 587     else
 588         i = (i >> 3) + 1;
 589
 590     while(i < 14)
 591         ctx->wbuf[i++] = 0;
 592
 593     /* the following 64-bit length fields are assembled in the      */
 594     /* wrong byte order on little endian machines but this is       */
 595     /* corrected later since they are only ever used as 64-bit      */
 596     /* word values.                                                 */
 597     ctx->wbuf[14] = (ctx->count[1] << 3) | (ctx->count[0] >> 61);
 598     ctx->wbuf[15] = ctx->count[0] << 3;
 599     sha512_compile(ctx);
 600
 601     /* extract the hash value as bytes in case the hash buffer is   */
 602     /* misaligned for 32-bit words                                  */
 603     for(i = 0; i < hlen; ++i)
 604         hval[i] = (unsigned char)(ctx->hash[i >> 3] >> (8 * (~i & 7)));
 605 }
 606
 607 #endif
 608
 609 #if defined(SHA_384)
 610
 611 /* SHA384 initialisation data   */
 612
 613 const uint_64t  i384[80] =
 614 {
 615     li_64(cbbb9d5dc1059ed8), li_64(629a292a367cd507),
 616     li_64(9159015a3070dd17), li_64(152fecd8f70e5939),
 617     li_64(67332667ffc00b31), li_64(8eb44a8768581511),
 618     li_64(db0c2e0d64f98fa7), li_64(47b5481dbefa4fa4)
 619 };
 620
 621 VOID_RETURN sha384_begin(sha384_ctx ctx[1])
 622 {
 623     ctx->count[0] = ctx->count[1] = 0;
 624     memcpy(ctx->hash, i384, 8 * sizeof(uint_64t));
 625 }
 626
 627 VOID_RETURN sha384_end(unsigned char hval[], sha384_ctx ctx[1])
 628 {
 629     sha_end2(hval, ctx, SHA384_DIGEST_SIZE);
 630 }
 631
 632 VOID_RETURN sha384(unsigned char hval[], const unsigned char data[], unsigned long len)
 633 {   sha384_ctx  cx[1];
 634
 635     sha384_begin(cx);
 636     sha384_hash(data, len, cx);
 637     sha_end2(hval, cx, SHA384_DIGEST_SIZE);
 638 }
 639
 640 #endif
 641
 642 #if defined(SHA_512)
 643
 644 /* SHA512 initialisation data   */
 645
 646 const uint_64t  i512[80] =
 647 {
 648     li_64(6a09e667f3bcc908), li_64(bb67ae8584caa73b),
 649     li_64(3c6ef372fe94f82b), li_64(a54ff53a5f1d36f1),
 650     li_64(510e527fade682d1), li_64(9b05688c2b3e6c1f),
 651     li_64(1f83d9abfb41bd6b), li_64(5be0cd19137e2179)
 652 };
 653
 654 VOID_RETURN sha512_begin(sha512_ctx ctx[1])
 655 {
 656     ctx->count[0] = ctx->count[1] = 0;
 657     memcpy(ctx->hash, i512, 8 * sizeof(uint_64t));
 658 }
 659
 660 VOID_RETURN sha512_end(unsigned char hval[], sha512_ctx ctx[1])
 661 {
 662     sha_end2(hval, ctx, SHA512_DIGEST_SIZE);
 663 }
 664
 665 VOID_RETURN sha512(unsigned char hval[], const unsigned char data[], unsigned long len)
 666 {   sha512_ctx  cx[1];
 667
 668     sha512_begin(cx);
 669     sha512_hash(data, len, cx);
 670     sha_end2(hval, cx, SHA512_DIGEST_SIZE);
 671 }
 672
 673 #endif
 674
 675 #if defined(SHA_2)
 676
 677 #define CTX_224(x)  ((x)->uu->ctx256)
 678 #define CTX_256(x)  ((x)->uu->ctx256)
 679 #define CTX_384(x)  ((x)->uu->ctx512)
 680 #define CTX_512(x)  ((x)->uu->ctx512)
 681
 682 /* SHA2 initialisation */
 683
 684 INT_RETURN sha2_begin(unsigned long len, sha2_ctx ctx[1])
 685 {
 686     switch(len)
 687     {
 688 #if defined(SHA_224)
 689         case 224:
 690         case  28:   CTX_256(ctx)->count[0] = CTX_256(ctx)->count[1] = 0;
 691                     memcpy(CTX_256(ctx)->hash, i224, 32);
 692                     ctx->sha2_len = 28; return EXIT_SUCCESS;
 693 #endif
 694 #if defined(SHA_256)
 695         case 256:
 696         case  32:   CTX_256(ctx)->count[0] = CTX_256(ctx)->count[1] = 0;
 697                     memcpy(CTX_256(ctx)->hash, i256, 32);
 698                     ctx->sha2_len = 32; return EXIT_SUCCESS;
 699 #endif
 700 #if defined(SHA_384)
 701         case 384:
 702         case  48:   CTX_384(ctx)->count[0] = CTX_384(ctx)->count[1] = 0;
 703                     memcpy(CTX_384(ctx)->hash, i384, 64);
 704                     ctx->sha2_len = 48; return EXIT_SUCCESS;
 705 #endif
 706 #if defined(SHA_512)
 707         case 512:
 708         case  64:   CTX_512(ctx)->count[0] = CTX_512(ctx)->count[1] = 0;
 709                     memcpy(CTX_512(ctx)->hash, i512, 64);
 710                     ctx->sha2_len = 64; return EXIT_SUCCESS;
 711 #endif
 712         default:    return EXIT_FAILURE;
 713     }
 714 }
 715
 716 VOID_RETURN sha2_hash(const unsigned char data[], unsigned long len, sha2_ctx ctx[1])
 717 {
 718     switch(ctx->sha2_len)
 719     {
 720 #if defined(SHA_224)
 721         case 28: sha224_hash(data, len, CTX_224(ctx)); return;
 722 #endif
 723 #if defined(SHA_256)
 724         case 32: sha256_hash(data, len, CTX_256(ctx)); return;
 725 #endif
 726 #if defined(SHA_384)
 727         case 48: sha384_hash(data, len, CTX_384(ctx)); return;
 728 #endif
 729 #if defined(SHA_512)
 730         case 64: sha512_hash(data, len, CTX_512(ctx)); return;
 731 #endif
 732     }
 733 }
 734
 735 VOID_RETURN sha2_end(unsigned char hval[], sha2_ctx ctx[1])
 736 {
 737     switch(ctx->sha2_len)
 738     {
 739 #if defined(SHA_224)
 740         case 28: sha_end1(hval, CTX_224(ctx), SHA224_DIGEST_SIZE); return;
 741 #endif
 742 #if defined(SHA_256)
 743         case 32: sha_end1(hval, CTX_256(ctx), SHA256_DIGEST_SIZE); return;
 744 #endif
 745 #if defined(SHA_384)
 746         case 48: sha_end2(hval, CTX_384(ctx), SHA384_DIGEST_SIZE); return;
 747 #endif
 748 #if defined(SHA_512)
 749         case 64: sha_end2(hval, CTX_512(ctx), SHA512_DIGEST_SIZE); return;
 750 #endif
 751     }
 752 }
 753
 754 INT_RETURN sha2(unsigned char hval[], unsigned long size,
 755                                 const unsigned char data[], unsigned long len)
 756 {   sha2_ctx    cx[1];
 757
 758     if(sha2_begin(size, cx) == EXIT_SUCCESS)
 759     {
 760         sha2_hash(data, len, cx); sha2_end(hval, cx); return EXIT_SUCCESS;
 761     }
 762     else
 763         return EXIT_FAILURE;
 764 }
 765
 766 #endif
 767
 768 #if defined(__cplusplus)
 769 }
 770 #endif