xref: /openssh-portable/openbsd-compat/sha2.c (revision 09159594)
1 /*	$OpenBSD: sha2.c,v 1.27 2019/06/07 22:56:36 dtucker Exp $	*/
2 
3 /*
4  * FILE:	sha2.c
5  * AUTHOR:	Aaron D. Gifford <me@aarongifford.com>
6  *
7  * Copyright (c) 2000-2001, Aaron D. Gifford
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the copyright holder nor the names of contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTOR(S) BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * $From: sha2.c,v 1.1 2001/11/08 00:01:51 adg Exp adg $
35  */
36 
37 #include <sys/types.h>
38 
39 #include <string.h>
40 #include <sha2.h>
41 
42 /*
43  * UNROLLED TRANSFORM LOOP NOTE:
44  * You can define SHA2_UNROLL_TRANSFORM to use the unrolled transform
45  * loop version for the hash transform rounds (defined using macros
46  * later in this file).  Either define on the command line, for example:
47  *
48  *   cc -DSHA2_UNROLL_TRANSFORM -o sha2 sha2.c sha2prog.c
49  *
50  * or define below:
51  *
52  *   #define SHA2_UNROLL_TRANSFORM
53  *
54  */
55 #ifndef SHA2_SMALL
56 #if defined(__amd64__) || defined(__i386__)
57 #define SHA2_UNROLL_TRANSFORM
58 #endif
59 #endif
60 
61 /*** SHA-224/256/384/512 Machine Architecture Definitions *****************/
62 /*
63  * BYTE_ORDER NOTE:
64  *
65  * Please make sure that your system defines BYTE_ORDER.  If your
66  * architecture is little-endian, make sure it also defines
67  * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
68  * equivilent.
69  *
70  * If your system does not define the above, then you can do so by
71  * hand like this:
72  *
73  *   #define LITTLE_ENDIAN 1234
74  *   #define BIG_ENDIAN    4321
75  *
76  * And for little-endian machines, add:
77  *
78  *   #define BYTE_ORDER LITTLE_ENDIAN
79  *
80  * Or for big-endian machines:
81  *
82  *   #define BYTE_ORDER BIG_ENDIAN
83  *
84  * The FreeBSD machine this was written on defines BYTE_ORDER
85  * appropriately by including <sys/types.h> (which in turn includes
86  * <machine/endian.h> where the appropriate definitions are actually
87  * made).
88  */
89 #if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN)
90 #error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN
91 #endif
92 
93 
94 /*** SHA-224/256/384/512 Various Length Definitions ***********************/
95 /* NOTE: Most of these are in sha2.h */
96 #define SHA224_SHORT_BLOCK_LENGTH	(SHA224_BLOCK_LENGTH - 8)
97 #define SHA256_SHORT_BLOCK_LENGTH	(SHA256_BLOCK_LENGTH - 8)
98 #define SHA384_SHORT_BLOCK_LENGTH	(SHA384_BLOCK_LENGTH - 16)
99 #define SHA512_SHORT_BLOCK_LENGTH	(SHA512_BLOCK_LENGTH - 16)
100 
101 /*** ENDIAN SPECIFIC COPY MACROS **************************************/
102 #define BE_8_TO_32(dst, cp) do {					\
103 	(dst) = (u_int32_t)(cp)[3] | ((u_int32_t)(cp)[2] << 8) |	\
104 	    ((u_int32_t)(cp)[1] << 16) | ((u_int32_t)(cp)[0] << 24);	\
105 } while(0)
106 
107 #define BE_8_TO_64(dst, cp) do {					\
108 	(dst) = (u_int64_t)(cp)[7] | ((u_int64_t)(cp)[6] << 8) |	\
109 	    ((u_int64_t)(cp)[5] << 16) | ((u_int64_t)(cp)[4] << 24) |	\
110 	    ((u_int64_t)(cp)[3] << 32) | ((u_int64_t)(cp)[2] << 40) |	\
111 	    ((u_int64_t)(cp)[1] << 48) | ((u_int64_t)(cp)[0] << 56);	\
112 } while (0)
113 
114 #define BE_64_TO_8(cp, src) do {					\
115 	(cp)[0] = (src) >> 56;						\
116         (cp)[1] = (src) >> 48;						\
117 	(cp)[2] = (src) >> 40;						\
118 	(cp)[3] = (src) >> 32;						\
119 	(cp)[4] = (src) >> 24;						\
120 	(cp)[5] = (src) >> 16;						\
121 	(cp)[6] = (src) >> 8;						\
122 	(cp)[7] = (src);						\
123 } while (0)
124 
125 #define BE_32_TO_8(cp, src) do {					\
126 	(cp)[0] = (src) >> 24;						\
127 	(cp)[1] = (src) >> 16;						\
128 	(cp)[2] = (src) >> 8;						\
129 	(cp)[3] = (src);						\
130 } while (0)
131 
132 /*
133  * Macro for incrementally adding the unsigned 64-bit integer n to the
134  * unsigned 128-bit integer (represented using a two-element array of
135  * 64-bit words):
136  */
137 #define ADDINC128(w,n) do {						\
138 	(w)[0] += (u_int64_t)(n);					\
139 	if ((w)[0] < (n)) {						\
140 		(w)[1]++;						\
141 	}								\
142 } while (0)
143 
144 /*** THE SIX LOGICAL FUNCTIONS ****************************************/
145 /*
146  * Bit shifting and rotation (used by the six SHA-XYZ logical functions:
147  *
148  *   NOTE:  The naming of R and S appears backwards here (R is a SHIFT and
149  *   S is a ROTATION) because the SHA-224/256/384/512 description document
150  *   (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this
151  *   same "backwards" definition.
152  */
153 /* Shift-right (used in SHA-224, SHA-256, SHA-384, and SHA-512): */
154 #define R(b,x) 		((x) >> (b))
155 /* 32-bit Rotate-right (used in SHA-224 and SHA-256): */
156 #define S32(b,x)	(((x) >> (b)) | ((x) << (32 - (b))))
157 /* 64-bit Rotate-right (used in SHA-384 and SHA-512): */
158 #define S64(b,x)	(((x) >> (b)) | ((x) << (64 - (b))))
159 
160 /* Two of six logical functions used in SHA-224, SHA-256, SHA-384, and SHA-512: */
161 #define Ch(x,y,z)	(((x) & (y)) ^ ((~(x)) & (z)))
162 #define Maj(x,y,z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
163 
164 /* Four of six logical functions used in SHA-224 and SHA-256: */
165 #define Sigma0_256(x)	(S32(2,  (x)) ^ S32(13, (x)) ^ S32(22, (x)))
166 #define Sigma1_256(x)	(S32(6,  (x)) ^ S32(11, (x)) ^ S32(25, (x)))
167 #define sigma0_256(x)	(S32(7,  (x)) ^ S32(18, (x)) ^ R(3 ,   (x)))
168 #define sigma1_256(x)	(S32(17, (x)) ^ S32(19, (x)) ^ R(10,   (x)))
169 
170 /* Four of six logical functions used in SHA-384 and SHA-512: */
171 #define Sigma0_512(x)	(S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x)))
172 #define Sigma1_512(x)	(S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x)))
173 #define sigma0_512(x)	(S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7,   (x)))
174 #define sigma1_512(x)	(S64(19, (x)) ^ S64(61, (x)) ^ R( 6,   (x)))
175 
176 
177 /*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/
178 /* Hash constant words K for SHA-224 and SHA-256: */
179 static const u_int32_t K256[64] = {
180 	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
181 	0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
182 	0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
183 	0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
184 	0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
185 	0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
186 	0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
187 	0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
188 	0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
189 	0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
190 	0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
191 	0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
192 	0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
193 	0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
194 	0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
195 	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
196 };
197 
198 /* Initial hash value H for SHA-256: */
199 static const u_int32_t sha256_initial_hash_value[8] = {
200 	0x6a09e667UL,
201 	0xbb67ae85UL,
202 	0x3c6ef372UL,
203 	0xa54ff53aUL,
204 	0x510e527fUL,
205 	0x9b05688cUL,
206 	0x1f83d9abUL,
207 	0x5be0cd19UL
208 };
209 
210 /* Hash constant words K for SHA-384 and SHA-512: */
211 static const u_int64_t K512[80] = {
212 	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
213 	0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
214 	0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
215 	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
216 	0xd807aa98a3030242ULL, 0x12835b0145706fbeULL,
217 	0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
218 	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL,
219 	0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
220 	0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
221 	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL,
222 	0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL,
223 	0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
224 	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL,
225 	0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL,
226 	0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
227 	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
228 	0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL,
229 	0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
230 	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL,
231 	0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
232 	0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
233 	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL,
234 	0xd192e819d6ef5218ULL, 0xd69906245565a910ULL,
235 	0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
236 	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL,
237 	0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL,
238 	0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
239 	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
240 	0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL,
241 	0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
242 	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL,
243 	0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
244 	0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
245 	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL,
246 	0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL,
247 	0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
248 	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL,
249 	0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL,
250 	0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
251 	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
252 };
253 
254 /* Initial hash value H for SHA-512 */
255 static const u_int64_t sha512_initial_hash_value[8] = {
256 	0x6a09e667f3bcc908ULL,
257 	0xbb67ae8584caa73bULL,
258 	0x3c6ef372fe94f82bULL,
259 	0xa54ff53a5f1d36f1ULL,
260 	0x510e527fade682d1ULL,
261 	0x9b05688c2b3e6c1fULL,
262 	0x1f83d9abfb41bd6bULL,
263 	0x5be0cd19137e2179ULL
264 };
265 
266 #if !defined(SHA2_SMALL)
267 /* Initial hash value H for SHA-224: */
268 static const u_int32_t sha224_initial_hash_value[8] = {
269 	0xc1059ed8UL,
270 	0x367cd507UL,
271 	0x3070dd17UL,
272 	0xf70e5939UL,
273 	0xffc00b31UL,
274 	0x68581511UL,
275 	0x64f98fa7UL,
276 	0xbefa4fa4UL
277 };
278 
279 /* Initial hash value H for SHA-384 */
280 static const u_int64_t sha384_initial_hash_value[8] = {
281 	0xcbbb9d5dc1059ed8ULL,
282 	0x629a292a367cd507ULL,
283 	0x9159015a3070dd17ULL,
284 	0x152fecd8f70e5939ULL,
285 	0x67332667ffc00b31ULL,
286 	0x8eb44a8768581511ULL,
287 	0xdb0c2e0d64f98fa7ULL,
288 	0x47b5481dbefa4fa4ULL
289 };
290 
291 /* Initial hash value H for SHA-512-256 */
292 static const u_int64_t sha512_256_initial_hash_value[8] = {
293 	0x22312194fc2bf72cULL,
294 	0x9f555fa3c84c64c2ULL,
295 	0x2393b86b6f53b151ULL,
296 	0x963877195940eabdULL,
297 	0x96283ee2a88effe3ULL,
298 	0xbe5e1e2553863992ULL,
299 	0x2b0199fc2c85b8aaULL,
300 	0x0eb72ddc81c52ca2ULL
301 };
302 
303 /*** SHA-224: *********************************************************/
304 void
305 SHA224Init(SHA2_CTX *context)
306 {
307 	memcpy(context->state.st32, sha224_initial_hash_value,
308 	    sizeof(sha224_initial_hash_value));
309 	memset(context->buffer, 0, sizeof(context->buffer));
310 	context->bitcount[0] = 0;
311 }
312 DEF_WEAK(SHA224Init);
313 
314 MAKE_CLONE(SHA224Transform, SHA256Transform);
315 MAKE_CLONE(SHA224Update, SHA256Update);
316 MAKE_CLONE(SHA224Pad, SHA256Pad);
317 DEF_WEAK(SHA224Transform);
318 DEF_WEAK(SHA224Update);
319 DEF_WEAK(SHA224Pad);
320 
321 void
322 SHA224Final(u_int8_t digest[SHA224_DIGEST_LENGTH], SHA2_CTX *context)
323 {
324 	SHA224Pad(context);
325 
326 #if BYTE_ORDER == LITTLE_ENDIAN
327 	int	i;
328 
329 	/* Convert TO host byte order */
330 	for (i = 0; i < 7; i++)
331 		BE_32_TO_8(digest + i * 4, context->state.st32[i]);
332 #else
333 	memcpy(digest, context->state.st32, SHA224_DIGEST_LENGTH);
334 #endif
335 	explicit_bzero(context, sizeof(*context));
336 }
337 DEF_WEAK(SHA224Final);
338 #endif /* !defined(SHA2_SMALL) */
339 
340 /*** SHA-256: *********************************************************/
341 void
342 SHA256Init(SHA2_CTX *context)
343 {
344 	memcpy(context->state.st32, sha256_initial_hash_value,
345 	    sizeof(sha256_initial_hash_value));
346 	memset(context->buffer, 0, sizeof(context->buffer));
347 	context->bitcount[0] = 0;
348 }
349 DEF_WEAK(SHA256Init);
350 
351 #ifdef SHA2_UNROLL_TRANSFORM
352 
353 /* Unrolled SHA-256 round macros: */
354 
355 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) do {				    \
356 	BE_8_TO_32(W256[j], data);					    \
357 	data += 4;							    \
358 	T1 = (h) + Sigma1_256((e)) + Ch((e), (f), (g)) + K256[j] + W256[j]; \
359 	(d) += T1;							    \
360 	(h) = T1 + Sigma0_256((a)) + Maj((a), (b), (c));		    \
361 	j++;								    \
362 } while(0)
363 
364 #define ROUND256(a,b,c,d,e,f,g,h) do {					    \
365 	s0 = W256[(j+1)&0x0f];						    \
366 	s0 = sigma0_256(s0);						    \
367 	s1 = W256[(j+14)&0x0f];						    \
368 	s1 = sigma1_256(s1);						    \
369 	T1 = (h) + Sigma1_256((e)) + Ch((e), (f), (g)) + K256[j] +	    \
370 	     (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0);		    \
371 	(d) += T1;							    \
372 	(h) = T1 + Sigma0_256((a)) + Maj((a), (b), (c));		    \
373 	j++;								    \
374 } while(0)
375 
376 void
377 SHA256Transform(u_int32_t state[8], const u_int8_t data[SHA256_BLOCK_LENGTH])
378 {
379 	u_int32_t	a, b, c, d, e, f, g, h, s0, s1;
380 	u_int32_t	T1, W256[16];
381 	int		j;
382 
383 	/* Initialize registers with the prev. intermediate value */
384 	a = state[0];
385 	b = state[1];
386 	c = state[2];
387 	d = state[3];
388 	e = state[4];
389 	f = state[5];
390 	g = state[6];
391 	h = state[7];
392 
393 	j = 0;
394 	do {
395 		/* Rounds 0 to 15 (unrolled): */
396 		ROUND256_0_TO_15(a,b,c,d,e,f,g,h);
397 		ROUND256_0_TO_15(h,a,b,c,d,e,f,g);
398 		ROUND256_0_TO_15(g,h,a,b,c,d,e,f);
399 		ROUND256_0_TO_15(f,g,h,a,b,c,d,e);
400 		ROUND256_0_TO_15(e,f,g,h,a,b,c,d);
401 		ROUND256_0_TO_15(d,e,f,g,h,a,b,c);
402 		ROUND256_0_TO_15(c,d,e,f,g,h,a,b);
403 		ROUND256_0_TO_15(b,c,d,e,f,g,h,a);
404 	} while (j < 16);
405 
406 	/* Now for the remaining rounds up to 63: */
407 	do {
408 		ROUND256(a,b,c,d,e,f,g,h);
409 		ROUND256(h,a,b,c,d,e,f,g);
410 		ROUND256(g,h,a,b,c,d,e,f);
411 		ROUND256(f,g,h,a,b,c,d,e);
412 		ROUND256(e,f,g,h,a,b,c,d);
413 		ROUND256(d,e,f,g,h,a,b,c);
414 		ROUND256(c,d,e,f,g,h,a,b);
415 		ROUND256(b,c,d,e,f,g,h,a);
416 	} while (j < 64);
417 
418 	/* Compute the current intermediate hash value */
419 	state[0] += a;
420 	state[1] += b;
421 	state[2] += c;
422 	state[3] += d;
423 	state[4] += e;
424 	state[5] += f;
425 	state[6] += g;
426 	state[7] += h;
427 
428 	/* Clean up */
429 	a = b = c = d = e = f = g = h = T1 = 0;
430 }
431 
432 #else /* SHA2_UNROLL_TRANSFORM */
433 
434 void
435 SHA256Transform(u_int32_t state[8], const u_int8_t data[SHA256_BLOCK_LENGTH])
436 {
437 	u_int32_t	a, b, c, d, e, f, g, h, s0, s1;
438 	u_int32_t	T1, T2, W256[16];
439 	int		j;
440 
441 	/* Initialize registers with the prev. intermediate value */
442 	a = state[0];
443 	b = state[1];
444 	c = state[2];
445 	d = state[3];
446 	e = state[4];
447 	f = state[5];
448 	g = state[6];
449 	h = state[7];
450 
451 	j = 0;
452 	do {
453 		BE_8_TO_32(W256[j], data);
454 		data += 4;
455 		/* Apply the SHA-256 compression function to update a..h */
456 		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + W256[j];
457 		T2 = Sigma0_256(a) + Maj(a, b, c);
458 		h = g;
459 		g = f;
460 		f = e;
461 		e = d + T1;
462 		d = c;
463 		c = b;
464 		b = a;
465 		a = T1 + T2;
466 
467 		j++;
468 	} while (j < 16);
469 
470 	do {
471 		/* Part of the message block expansion: */
472 		s0 = W256[(j+1)&0x0f];
473 		s0 = sigma0_256(s0);
474 		s1 = W256[(j+14)&0x0f];
475 		s1 = sigma1_256(s1);
476 
477 		/* Apply the SHA-256 compression function to update a..h */
478 		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] +
479 		     (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0);
480 		T2 = Sigma0_256(a) + Maj(a, b, c);
481 		h = g;
482 		g = f;
483 		f = e;
484 		e = d + T1;
485 		d = c;
486 		c = b;
487 		b = a;
488 		a = T1 + T2;
489 
490 		j++;
491 	} while (j < 64);
492 
493 	/* Compute the current intermediate hash value */
494 	state[0] += a;
495 	state[1] += b;
496 	state[2] += c;
497 	state[3] += d;
498 	state[4] += e;
499 	state[5] += f;
500 	state[6] += g;
501 	state[7] += h;
502 
503 	/* Clean up */
504 	a = b = c = d = e = f = g = h = T1 = T2 = 0;
505 }
506 
507 #endif /* SHA2_UNROLL_TRANSFORM */
508 DEF_WEAK(SHA256Transform);
509 
510 void
511 SHA256Update(SHA2_CTX *context, const u_int8_t *data, size_t len)
512 {
513 	u_int64_t	freespace, usedspace;
514 
515 	/* Calling with no data is valid (we do nothing) */
516 	if (len == 0)
517 		return;
518 
519 	usedspace = (context->bitcount[0] >> 3) % SHA256_BLOCK_LENGTH;
520 	if (usedspace > 0) {
521 		/* Calculate how much free space is available in the buffer */
522 		freespace = SHA256_BLOCK_LENGTH - usedspace;
523 
524 		if (len >= freespace) {
525 			/* Fill the buffer completely and process it */
526 			memcpy(&context->buffer[usedspace], data, freespace);
527 			context->bitcount[0] += freespace << 3;
528 			len -= freespace;
529 			data += freespace;
530 			SHA256Transform(context->state.st32, context->buffer);
531 		} else {
532 			/* The buffer is not yet full */
533 			memcpy(&context->buffer[usedspace], data, len);
534 			context->bitcount[0] += (u_int64_t)len << 3;
535 			/* Clean up: */
536 			usedspace = freespace = 0;
537 			return;
538 		}
539 	}
540 	while (len >= SHA256_BLOCK_LENGTH) {
541 		/* Process as many complete blocks as we can */
542 		SHA256Transform(context->state.st32, data);
543 		context->bitcount[0] += SHA256_BLOCK_LENGTH << 3;
544 		len -= SHA256_BLOCK_LENGTH;
545 		data += SHA256_BLOCK_LENGTH;
546 	}
547 	if (len > 0) {
548 		/* There's left-overs, so save 'em */
549 		memcpy(context->buffer, data, len);
550 		context->bitcount[0] += len << 3;
551 	}
552 	/* Clean up: */
553 	usedspace = freespace = 0;
554 }
555 DEF_WEAK(SHA256Update);
556 
557 void
558 SHA256Pad(SHA2_CTX *context)
559 {
560 	unsigned int	usedspace;
561 
562 	usedspace = (context->bitcount[0] >> 3) % SHA256_BLOCK_LENGTH;
563 	if (usedspace > 0) {
564 		/* Begin padding with a 1 bit: */
565 		context->buffer[usedspace++] = 0x80;
566 
567 		if (usedspace <= SHA256_SHORT_BLOCK_LENGTH) {
568 			/* Set-up for the last transform: */
569 			memset(&context->buffer[usedspace], 0,
570 			    SHA256_SHORT_BLOCK_LENGTH - usedspace);
571 		} else {
572 			if (usedspace < SHA256_BLOCK_LENGTH) {
573 				memset(&context->buffer[usedspace], 0,
574 				    SHA256_BLOCK_LENGTH - usedspace);
575 			}
576 			/* Do second-to-last transform: */
577 			SHA256Transform(context->state.st32, context->buffer);
578 
579 			/* Prepare for last transform: */
580 			memset(context->buffer, 0, SHA256_SHORT_BLOCK_LENGTH);
581 		}
582 	} else {
583 		/* Set-up for the last transform: */
584 		memset(context->buffer, 0, SHA256_SHORT_BLOCK_LENGTH);
585 
586 		/* Begin padding with a 1 bit: */
587 		*context->buffer = 0x80;
588 	}
589 	/* Store the length of input data (in bits) in big endian format: */
590 	BE_64_TO_8(&context->buffer[SHA256_SHORT_BLOCK_LENGTH],
591 	    context->bitcount[0]);
592 
593 	/* Final transform: */
594 	SHA256Transform(context->state.st32, context->buffer);
595 
596 	/* Clean up: */
597 	usedspace = 0;
598 }
599 DEF_WEAK(SHA256Pad);
600 
601 void
602 SHA256Final(u_int8_t digest[SHA256_DIGEST_LENGTH], SHA2_CTX *context)
603 {
604 	SHA256Pad(context);
605 
606 #if BYTE_ORDER == LITTLE_ENDIAN
607 	int	i;
608 
609 	/* Convert TO host byte order */
610 	for (i = 0; i < 8; i++)
611 		BE_32_TO_8(digest + i * 4, context->state.st32[i]);
612 #else
613 	memcpy(digest, context->state.st32, SHA256_DIGEST_LENGTH);
614 #endif
615 	explicit_bzero(context, sizeof(*context));
616 }
617 DEF_WEAK(SHA256Final);
618 
619 
620 /*** SHA-512: *********************************************************/
621 void
622 SHA512Init(SHA2_CTX *context)
623 {
624 	memcpy(context->state.st64, sha512_initial_hash_value,
625 	    sizeof(sha512_initial_hash_value));
626 	memset(context->buffer, 0, sizeof(context->buffer));
627 	context->bitcount[0] = context->bitcount[1] =  0;
628 }
629 DEF_WEAK(SHA512Init);
630 
631 #ifdef SHA2_UNROLL_TRANSFORM
632 
633 /* Unrolled SHA-512 round macros: */
634 
635 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) do {				    \
636 	BE_8_TO_64(W512[j], data);					    \
637 	data += 8;							    \
638 	T1 = (h) + Sigma1_512((e)) + Ch((e), (f), (g)) + K512[j] + W512[j]; \
639 	(d) += T1;							    \
640 	(h) = T1 + Sigma0_512((a)) + Maj((a), (b), (c));		    \
641 	j++;								    \
642 } while(0)
643 
644 
645 #define ROUND512(a,b,c,d,e,f,g,h) do {					    \
646 	s0 = W512[(j+1)&0x0f];						    \
647 	s0 = sigma0_512(s0);						    \
648 	s1 = W512[(j+14)&0x0f];						    \
649 	s1 = sigma1_512(s1);						    \
650 	T1 = (h) + Sigma1_512((e)) + Ch((e), (f), (g)) + K512[j] +	    \
651              (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0);		    \
652 	(d) += T1;							    \
653 	(h) = T1 + Sigma0_512((a)) + Maj((a), (b), (c));		    \
654 	j++;								    \
655 } while(0)
656 
657 void
658 SHA512Transform(u_int64_t state[8], const u_int8_t data[SHA512_BLOCK_LENGTH])
659 {
660 	u_int64_t	a, b, c, d, e, f, g, h, s0, s1;
661 	u_int64_t	T1, W512[16];
662 	int		j;
663 
664 	/* Initialize registers with the prev. intermediate value */
665 	a = state[0];
666 	b = state[1];
667 	c = state[2];
668 	d = state[3];
669 	e = state[4];
670 	f = state[5];
671 	g = state[6];
672 	h = state[7];
673 
674 	j = 0;
675 	do {
676 		/* Rounds 0 to 15 (unrolled): */
677 		ROUND512_0_TO_15(a,b,c,d,e,f,g,h);
678 		ROUND512_0_TO_15(h,a,b,c,d,e,f,g);
679 		ROUND512_0_TO_15(g,h,a,b,c,d,e,f);
680 		ROUND512_0_TO_15(f,g,h,a,b,c,d,e);
681 		ROUND512_0_TO_15(e,f,g,h,a,b,c,d);
682 		ROUND512_0_TO_15(d,e,f,g,h,a,b,c);
683 		ROUND512_0_TO_15(c,d,e,f,g,h,a,b);
684 		ROUND512_0_TO_15(b,c,d,e,f,g,h,a);
685 	} while (j < 16);
686 
687 	/* Now for the remaining rounds up to 79: */
688 	do {
689 		ROUND512(a,b,c,d,e,f,g,h);
690 		ROUND512(h,a,b,c,d,e,f,g);
691 		ROUND512(g,h,a,b,c,d,e,f);
692 		ROUND512(f,g,h,a,b,c,d,e);
693 		ROUND512(e,f,g,h,a,b,c,d);
694 		ROUND512(d,e,f,g,h,a,b,c);
695 		ROUND512(c,d,e,f,g,h,a,b);
696 		ROUND512(b,c,d,e,f,g,h,a);
697 	} while (j < 80);
698 
699 	/* Compute the current intermediate hash value */
700 	state[0] += a;
701 	state[1] += b;
702 	state[2] += c;
703 	state[3] += d;
704 	state[4] += e;
705 	state[5] += f;
706 	state[6] += g;
707 	state[7] += h;
708 
709 	/* Clean up */
710 	a = b = c = d = e = f = g = h = T1 = 0;
711 }
712 
713 #else /* SHA2_UNROLL_TRANSFORM */
714 
715 void
716 SHA512Transform(u_int64_t state[8], const u_int8_t data[SHA512_BLOCK_LENGTH])
717 {
718 	u_int64_t	a, b, c, d, e, f, g, h, s0, s1;
719 	u_int64_t	T1, T2, W512[16];
720 	int		j;
721 
722 	/* Initialize registers with the prev. intermediate value */
723 	a = state[0];
724 	b = state[1];
725 	c = state[2];
726 	d = state[3];
727 	e = state[4];
728 	f = state[5];
729 	g = state[6];
730 	h = state[7];
731 
732 	j = 0;
733 	do {
734 		BE_8_TO_64(W512[j], data);
735 		data += 8;
736 		/* Apply the SHA-512 compression function to update a..h */
737 		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j];
738 		T2 = Sigma0_512(a) + Maj(a, b, c);
739 		h = g;
740 		g = f;
741 		f = e;
742 		e = d + T1;
743 		d = c;
744 		c = b;
745 		b = a;
746 		a = T1 + T2;
747 
748 		j++;
749 	} while (j < 16);
750 
751 	do {
752 		/* Part of the message block expansion: */
753 		s0 = W512[(j+1)&0x0f];
754 		s0 = sigma0_512(s0);
755 		s1 = W512[(j+14)&0x0f];
756 		s1 =  sigma1_512(s1);
757 
758 		/* Apply the SHA-512 compression function to update a..h */
759 		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] +
760 		     (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0);
761 		T2 = Sigma0_512(a) + Maj(a, b, c);
762 		h = g;
763 		g = f;
764 		f = e;
765 		e = d + T1;
766 		d = c;
767 		c = b;
768 		b = a;
769 		a = T1 + T2;
770 
771 		j++;
772 	} while (j < 80);
773 
774 	/* Compute the current intermediate hash value */
775 	state[0] += a;
776 	state[1] += b;
777 	state[2] += c;
778 	state[3] += d;
779 	state[4] += e;
780 	state[5] += f;
781 	state[6] += g;
782 	state[7] += h;
783 
784 	/* Clean up */
785 	a = b = c = d = e = f = g = h = T1 = T2 = 0;
786 }
787 
788 #endif /* SHA2_UNROLL_TRANSFORM */
789 DEF_WEAK(SHA512Transform);
790 
791 void
792 SHA512Update(SHA2_CTX *context, const u_int8_t *data, size_t len)
793 {
794 	size_t	freespace, usedspace;
795 
796 	/* Calling with no data is valid (we do nothing) */
797 	if (len == 0)
798 		return;
799 
800 	usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
801 	if (usedspace > 0) {
802 		/* Calculate how much free space is available in the buffer */
803 		freespace = SHA512_BLOCK_LENGTH - usedspace;
804 
805 		if (len >= freespace) {
806 			/* Fill the buffer completely and process it */
807 			memcpy(&context->buffer[usedspace], data, freespace);
808 			ADDINC128(context->bitcount, freespace << 3);
809 			len -= freespace;
810 			data += freespace;
811 			SHA512Transform(context->state.st64, context->buffer);
812 		} else {
813 			/* The buffer is not yet full */
814 			memcpy(&context->buffer[usedspace], data, len);
815 			ADDINC128(context->bitcount, len << 3);
816 			/* Clean up: */
817 			usedspace = freespace = 0;
818 			return;
819 		}
820 	}
821 	while (len >= SHA512_BLOCK_LENGTH) {
822 		/* Process as many complete blocks as we can */
823 		SHA512Transform(context->state.st64, data);
824 		ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3);
825 		len -= SHA512_BLOCK_LENGTH;
826 		data += SHA512_BLOCK_LENGTH;
827 	}
828 	if (len > 0) {
829 		/* There's left-overs, so save 'em */
830 		memcpy(context->buffer, data, len);
831 		ADDINC128(context->bitcount, len << 3);
832 	}
833 	/* Clean up: */
834 	usedspace = freespace = 0;
835 }
836 DEF_WEAK(SHA512Update);
837 
838 void
839 SHA512Pad(SHA2_CTX *context)
840 {
841 	unsigned int	usedspace;
842 
843 	usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
844 	if (usedspace > 0) {
845 		/* Begin padding with a 1 bit: */
846 		context->buffer[usedspace++] = 0x80;
847 
848 		if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) {
849 			/* Set-up for the last transform: */
850 			memset(&context->buffer[usedspace], 0, SHA512_SHORT_BLOCK_LENGTH - usedspace);
851 		} else {
852 			if (usedspace < SHA512_BLOCK_LENGTH) {
853 				memset(&context->buffer[usedspace], 0, SHA512_BLOCK_LENGTH - usedspace);
854 			}
855 			/* Do second-to-last transform: */
856 			SHA512Transform(context->state.st64, context->buffer);
857 
858 			/* And set-up for the last transform: */
859 			memset(context->buffer, 0, SHA512_BLOCK_LENGTH - 2);
860 		}
861 	} else {
862 		/* Prepare for final transform: */
863 		memset(context->buffer, 0, SHA512_SHORT_BLOCK_LENGTH);
864 
865 		/* Begin padding with a 1 bit: */
866 		*context->buffer = 0x80;
867 	}
868 	/* Store the length of input data (in bits) in big endian format: */
869 	BE_64_TO_8(&context->buffer[SHA512_SHORT_BLOCK_LENGTH],
870 	    context->bitcount[1]);
871 	BE_64_TO_8(&context->buffer[SHA512_SHORT_BLOCK_LENGTH + 8],
872 	    context->bitcount[0]);
873 
874 	/* Final transform: */
875 	SHA512Transform(context->state.st64, context->buffer);
876 
877 	/* Clean up: */
878 	usedspace = 0;
879 }
880 DEF_WEAK(SHA512Pad);
881 
882 void
883 SHA512Final(u_int8_t digest[SHA512_DIGEST_LENGTH], SHA2_CTX *context)
884 {
885 	SHA512Pad(context);
886 
887 #if BYTE_ORDER == LITTLE_ENDIAN
888 	int	i;
889 
890 	/* Convert TO host byte order */
891 	for (i = 0; i < 8; i++)
892 		BE_64_TO_8(digest + i * 8, context->state.st64[i]);
893 #else
894 	memcpy(digest, context->state.st64, SHA512_DIGEST_LENGTH);
895 #endif
896 	explicit_bzero(context, sizeof(*context));
897 }
898 DEF_WEAK(SHA512Final);
899 
900 #if !defined(SHA2_SMALL)
901 
902 /*** SHA-384: *********************************************************/
903 void
904 SHA384Init(SHA2_CTX *context)
905 {
906 	memcpy(context->state.st64, sha384_initial_hash_value,
907 	    sizeof(sha384_initial_hash_value));
908 	memset(context->buffer, 0, sizeof(context->buffer));
909 	context->bitcount[0] = context->bitcount[1] = 0;
910 }
911 DEF_WEAK(SHA384Init);
912 
913 MAKE_CLONE(SHA384Transform, SHA512Transform);
914 MAKE_CLONE(SHA384Update, SHA512Update);
915 MAKE_CLONE(SHA384Pad, SHA512Pad);
916 DEF_WEAK(SHA384Transform);
917 DEF_WEAK(SHA384Update);
918 DEF_WEAK(SHA384Pad);
919 
920 void
921 SHA384Final(u_int8_t digest[SHA384_DIGEST_LENGTH], SHA2_CTX *context)
922 {
923 	SHA384Pad(context);
924 
925 #if BYTE_ORDER == LITTLE_ENDIAN
926 	int	i;
927 
928 	/* Convert TO host byte order */
929 	for (i = 0; i < 6; i++)
930 		BE_64_TO_8(digest + i * 8, context->state.st64[i]);
931 #else
932 	memcpy(digest, context->state.st64, SHA384_DIGEST_LENGTH);
933 #endif
934 	/* Zero out state data */
935 	explicit_bzero(context, sizeof(*context));
936 }
937 DEF_WEAK(SHA384Final);
938 
939 /*** SHA-512/256: *********************************************************/
940 void
941 SHA512_256Init(SHA2_CTX *context)
942 {
943 	memcpy(context->state.st64, sha512_256_initial_hash_value,
944 	    sizeof(sha512_256_initial_hash_value));
945 	memset(context->buffer, 0, sizeof(context->buffer));
946 	context->bitcount[0] = context->bitcount[1] = 0;
947 }
948 DEF_WEAK(SHA512_256Init);
949 
950 MAKE_CLONE(SHA512_256Transform, SHA512Transform);
951 MAKE_CLONE(SHA512_256Update, SHA512Update);
952 MAKE_CLONE(SHA512_256Pad, SHA512Pad);
953 DEF_WEAK(SHA512_256Transform);
954 DEF_WEAK(SHA512_256Update);
955 DEF_WEAK(SHA512_256Pad);
956 
957 void
958 SHA512_256Final(u_int8_t digest[SHA512_256_DIGEST_LENGTH], SHA2_CTX *context)
959 {
960 	SHA512_256Pad(context);
961 
962 #if BYTE_ORDER == LITTLE_ENDIAN
963 	int	i;
964 
965 	/* Convert TO host byte order */
966 	for (i = 0; i < 4; i++)
967 		BE_64_TO_8(digest + i * 8, context->state.st64[i]);
968 #else
969 	memcpy(digest, context->state.st64, SHA512_256_DIGEST_LENGTH);
970 #endif
971 	/* Zero out state data */
972 	explicit_bzero(context, sizeof(*context));
973 }
974 DEF_WEAK(SHA512_256Final);
975 #endif /* !defined(SHA2_SMALL) */
976