projects / reactos.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
- Update to r53061
[reactos.git] / dll / win32 / rsaenh / sha2.c
1 /*
2 * FILE: sha2.c
3 * AUTHOR: Aaron D. Gifford - http://www.aarongifford.com/
4 *
5 * Copyright (c) 2000-2001, Aaron D. Gifford
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the copyright holder nor the names of contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTOR(S) BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 #include "config.h"
34
35 #include <string.h>
36 #include <assert.h>
37 #include "sha2.h"
38
39 /*
40 * ASSERT NOTE:
41 * Some sanity checking code is included using assert(). On my FreeBSD
42 * system, this additional code can be removed by compiling with NDEBUG
43 * defined. Check your own systems manpage on assert() to see how to
44 * compile WITHOUT the sanity checking code on your system.
45 *
46 * UNROLLED TRANSFORM LOOP NOTE:
47 * You can define SHA2_UNROLL_TRANSFORM to use the unrolled transform
48 * loop version for the hash transform rounds (defined using macros
49 * later in this file). Either define on the command line, for example:
50 *
51 * cc -DSHA2_UNROLL_TRANSFORM -o sha2 sha2.c sha2prog.c
52 *
53 * or define below:
54 *
55 * #define SHA2_UNROLL_TRANSFORM
56 *
57 */
58
59 /*** SHA-256/384/512 Various Length Definitions ***********************/
60 /* NOTE: Most of these are in sha2.h */
61 #define SHA256_SHORT_BLOCK_LENGTH (SHA256_BLOCK_LENGTH - 8)
62 #define SHA384_SHORT_BLOCK_LENGTH (SHA384_BLOCK_LENGTH - 16)
63 #define SHA512_SHORT_BLOCK_LENGTH (SHA512_BLOCK_LENGTH - 16)
64
65 #define SHA2_WORD64_CONST(dw1, dw2) (((sha2_word64)(dw1) << 32) | (dw2))
66
67 /*** ENDIAN REVERSAL MACROS *******************************************/
68 #ifndef WORDS_BIGENDIAN
69 #define REVERSE32(w,x) { \
70 sha2_word32 tmp = (w); \
71 tmp = (tmp >> 16) | (tmp << 16); \
72 (x) = ((tmp & 0xff00ff00) >> 8) | ((tmp & 0x00ff00ff) << 8); \
73 }
74 #define REVERSE64(w,x) { \
75 sha2_word64 tmp = (w); \
76 tmp = (tmp >> 32) | (tmp << 32); \
77 tmp = ((tmp & SHA2_WORD64_CONST(0xff00ff00, 0xff00ff00)) >> 8) | \
78 ((tmp & SHA2_WORD64_CONST(0x00ff00ff, 0x00ff00ff)) << 8); \
79 (x) = ((tmp & SHA2_WORD64_CONST(0xffff0000, 0xffff0000)) >> 16) | \
80 ((tmp & SHA2_WORD64_CONST(0x0000ffff, 0x0000ffff)) << 16); \
81 }
82 #endif
83
84 /*
85 * Macro for incrementally adding the unsigned 64-bit integer n to the
86 * unsigned 128-bit integer (represented using a two-element array of
87 * 64-bit words):
88 */
89 #define ADDINC128(w,n) { \
90 (w)[0] += (sha2_word64)(n); \
91 if ((w)[0] < (n)) { \
92 (w)[1]++; \
93 } \
94 }
95
96 /*
97 * Macros for copying blocks of memory and for zeroing out ranges
98 * of memory. Using these macros makes it easy to switch from
99 * using memset()/memcpy() and using bzero()/bcopy().
100 *
101 * Please define either SHA2_USE_MEMSET_MEMCPY or define
102 * SHA2_USE_BZERO_BCOPY depending on which function set you
103 * choose to use:
104 */
105 #if !defined(SHA2_USE_MEMSET_MEMCPY) && !defined(SHA2_USE_BZERO_BCOPY)
106 /* Default to memset()/memcpy() if no option is specified */
107 #define SHA2_USE_MEMSET_MEMCPY 1
108 #endif
109 #if defined(SHA2_USE_MEMSET_MEMCPY) && defined(SHA2_USE_BZERO_BCOPY)
110 /* Abort with an error if BOTH options are defined */
111 #error Define either SHA2_USE_MEMSET_MEMCPY or SHA2_USE_BZERO_BCOPY, not both!
112 #endif
113
114 #ifdef SHA2_USE_MEMSET_MEMCPY
115 #define MEMSET_BZERO(p,l) memset((p), 0, (l))
116 #define MEMCPY_BCOPY(d,s,l) memcpy((d), (s), (l))
117 #endif
118 #ifdef SHA2_USE_BZERO_BCOPY
119 #define MEMSET_BZERO(p,l) bzero((p), (l))
120 #define MEMCPY_BCOPY(d,s,l) bcopy((s), (d), (l))
121 #endif
122
123
124 /*** THE SIX LOGICAL FUNCTIONS ****************************************/
125 /*
126 * Bit shifting and rotation (used by the six SHA-XYZ logical functions:
127 *
128 * NOTE: The naming of R and S appears backwards here (R is a SHIFT and
129 * S is a ROTATION) because the SHA-256/384/512 description document
130 * (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this
131 * same "backwards" definition.
132 */
133 /* Shift-right (used in SHA-256, SHA-384, and SHA-512): */
134 #define R(b,x) ((x) >> (b))
135 /* 32-bit Rotate-right (used in SHA-256): */
136 #define S32(b,x) (((x) >> (b)) | ((x) << (32 - (b))))
137 /* 64-bit Rotate-right (used in SHA-384 and SHA-512): */
138 #define S64(b,x) (((x) >> (b)) | ((x) << (64 - (b))))
139
140 /* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */
141 #define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z)))
142 #define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
143
144 /* Four of six logical functions used in SHA-256: */
145 #define Sigma0_256(x) (S32(2, (x)) ^ S32(13, (x)) ^ S32(22, (x)))
146 #define Sigma1_256(x) (S32(6, (x)) ^ S32(11, (x)) ^ S32(25, (x)))
147 #define sigma0_256(x) (S32(7, (x)) ^ S32(18, (x)) ^ R(3 , (x)))
148 #define sigma1_256(x) (S32(17, (x)) ^ S32(19, (x)) ^ R(10, (x)))
149
150 /* Four of six logical functions used in SHA-384 and SHA-512: */
151 #define Sigma0_512(x) (S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x)))
152 #define Sigma1_512(x) (S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x)))
153 #define sigma0_512(x) (S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7, (x)))
154 #define sigma1_512(x) (S64(19, (x)) ^ S64(61, (x)) ^ R( 6, (x)))
155
156 /*** INTERNAL FUNCTION PROTOTYPES *************************************/
157 /* NOTE: These should not be accessed directly from outside this
158 * library -- they are intended for private internal visibility/use
159 * only.
160 */
161 void SHA512_Last(SHA512_CTX*);
162 void SHA256_Transform(SHA256_CTX*, const sha2_word32*);
163 void SHA512_Transform(SHA512_CTX*, const sha2_word64*);
164
165
166 /*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/
167 /* Hash constant words K for SHA-256: */
168 static const sha2_word32 K256[64] = {
169 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
170 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
171 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
172 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
173 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
174 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
175 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
176 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
177 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
178 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
179 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
180 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
181 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
182 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
183 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
184 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
185 };
186
187 /* Initial hash value H for SHA-256: */
188 static const sha2_word32 sha256_initial_hash_value[8] = {
189 0x6a09e667,
190 0xbb67ae85,
191 0x3c6ef372,
192 0xa54ff53a,
193 0x510e527f,
194 0x9b05688c,
195 0x1f83d9ab,
196 0x5be0cd19
197 };
198
199 /* Hash constant words K for SHA-384 and SHA-512: */
200 static const sha2_word64 K512[80] = {
201 SHA2_WORD64_CONST(0x428a2f98, 0xd728ae22), SHA2_WORD64_CONST(0x71374491, 0x23ef65cd),
202 SHA2_WORD64_CONST(0xb5c0fbcf, 0xec4d3b2f), SHA2_WORD64_CONST(0xe9b5dba5, 0x8189dbbc),
203 SHA2_WORD64_CONST(0x3956c25b, 0xf348b538), SHA2_WORD64_CONST(0x59f111f1, 0xb605d019),
204 SHA2_WORD64_CONST(0x923f82a4, 0xaf194f9b), SHA2_WORD64_CONST(0xab1c5ed5, 0xda6d8118),
205 SHA2_WORD64_CONST(0xd807aa98, 0xa3030242), SHA2_WORD64_CONST(0x12835b01, 0x45706fbe),
206 SHA2_WORD64_CONST(0x243185be, 0x4ee4b28c), SHA2_WORD64_CONST(0x550c7dc3, 0xd5ffb4e2),
207 SHA2_WORD64_CONST(0x72be5d74, 0xf27b896f), SHA2_WORD64_CONST(0x80deb1fe, 0x3b1696b1),
208 SHA2_WORD64_CONST(0x9bdc06a7, 0x25c71235), SHA2_WORD64_CONST(0xc19bf174, 0xcf692694),
209 SHA2_WORD64_CONST(0xe49b69c1, 0x9ef14ad2), SHA2_WORD64_CONST(0xefbe4786, 0x384f25e3),
210 SHA2_WORD64_CONST(0x0fc19dc6, 0x8b8cd5b5), SHA2_WORD64_CONST(0x240ca1cc, 0x77ac9c65),
211 SHA2_WORD64_CONST(0x2de92c6f, 0x592b0275), SHA2_WORD64_CONST(0x4a7484aa, 0x6ea6e483),
212 SHA2_WORD64_CONST(0x5cb0a9dc, 0xbd41fbd4), SHA2_WORD64_CONST(0x76f988da, 0x831153b5),
213 SHA2_WORD64_CONST(0x983e5152, 0xee66dfab), SHA2_WORD64_CONST(0xa831c66d, 0x2db43210),
214 SHA2_WORD64_CONST(0xb00327c8, 0x98fb213f), SHA2_WORD64_CONST(0xbf597fc7, 0xbeef0ee4),
215 SHA2_WORD64_CONST(0xc6e00bf3, 0x3da88fc2), SHA2_WORD64_CONST(0xd5a79147, 0x930aa725),
216 SHA2_WORD64_CONST(0x06ca6351, 0xe003826f), SHA2_WORD64_CONST(0x14292967, 0x0a0e6e70),
217 SHA2_WORD64_CONST(0x27b70a85, 0x46d22ffc), SHA2_WORD64_CONST(0x2e1b2138, 0x5c26c926),
218 SHA2_WORD64_CONST(0x4d2c6dfc, 0x5ac42aed), SHA2_WORD64_CONST(0x53380d13, 0x9d95b3df),
219 SHA2_WORD64_CONST(0x650a7354, 0x8baf63de), SHA2_WORD64_CONST(0x766a0abb, 0x3c77b2a8),
220 SHA2_WORD64_CONST(0x81c2c92e, 0x47edaee6), SHA2_WORD64_CONST(0x92722c85, 0x1482353b),
221 SHA2_WORD64_CONST(0xa2bfe8a1, 0x4cf10364), SHA2_WORD64_CONST(0xa81a664b, 0xbc423001),
222 SHA2_WORD64_CONST(0xc24b8b70, 0xd0f89791), SHA2_WORD64_CONST(0xc76c51a3, 0x0654be30),
223 SHA2_WORD64_CONST(0xd192e819, 0xd6ef5218), SHA2_WORD64_CONST(0xd6990624, 0x5565a910),
224 SHA2_WORD64_CONST(0xf40e3585, 0x5771202a), SHA2_WORD64_CONST(0x106aa070, 0x32bbd1b8),
225 SHA2_WORD64_CONST(0x19a4c116, 0xb8d2d0c8), SHA2_WORD64_CONST(0x1e376c08, 0x5141ab53),
226 SHA2_WORD64_CONST(0x2748774c, 0xdf8eeb99), SHA2_WORD64_CONST(0x34b0bcb5, 0xe19b48a8),
227 SHA2_WORD64_CONST(0x391c0cb3, 0xc5c95a63), SHA2_WORD64_CONST(0x4ed8aa4a, 0xe3418acb),
228 SHA2_WORD64_CONST(0x5b9cca4f, 0x7763e373), SHA2_WORD64_CONST(0x682e6ff3, 0xd6b2b8a3),
229 SHA2_WORD64_CONST(0x748f82ee, 0x5defb2fc), SHA2_WORD64_CONST(0x78a5636f, 0x43172f60),
230 SHA2_WORD64_CONST(0x84c87814, 0xa1f0ab72), SHA2_WORD64_CONST(0x8cc70208, 0x1a6439ec),
231 SHA2_WORD64_CONST(0x90befffa, 0x23631e28), SHA2_WORD64_CONST(0xa4506ceb, 0xde82bde9),
232 SHA2_WORD64_CONST(0xbef9a3f7, 0xb2c67915), SHA2_WORD64_CONST(0xc67178f2, 0xe372532b),
233 SHA2_WORD64_CONST(0xca273ece, 0xea26619c), SHA2_WORD64_CONST(0xd186b8c7, 0x21c0c207),
234 SHA2_WORD64_CONST(0xeada7dd6, 0xcde0eb1e), SHA2_WORD64_CONST(0xf57d4f7f, 0xee6ed178),
235 SHA2_WORD64_CONST(0x06f067aa, 0x72176fba), SHA2_WORD64_CONST(0x0a637dc5, 0xa2c898a6),
236 SHA2_WORD64_CONST(0x113f9804, 0xbef90dae), SHA2_WORD64_CONST(0x1b710b35, 0x131c471b),
237 SHA2_WORD64_CONST(0x28db77f5, 0x23047d84), SHA2_WORD64_CONST(0x32caab7b, 0x40c72493),
238 SHA2_WORD64_CONST(0x3c9ebe0a, 0x15c9bebc), SHA2_WORD64_CONST(0x431d67c4, 0x9c100d4c),
239 SHA2_WORD64_CONST(0x4cc5d4be, 0xcb3e42b6), SHA2_WORD64_CONST(0x597f299c, 0xfc657e2a),
240 SHA2_WORD64_CONST(0x5fcb6fab, 0x3ad6faec), SHA2_WORD64_CONST(0x6c44198c, 0x4a475817)
241 };
242
243 /* Initial hash value H for SHA-384 */
244 static const sha2_word64 sha384_initial_hash_value[8] = {
245 SHA2_WORD64_CONST(0xcbbb9d5d, 0xc1059ed8),
246 SHA2_WORD64_CONST(0x629a292a, 0x367cd507),
247 SHA2_WORD64_CONST(0x9159015a, 0x3070dd17),
248 SHA2_WORD64_CONST(0x152fecd8, 0xf70e5939),
249 SHA2_WORD64_CONST(0x67332667, 0xffc00b31),
250 SHA2_WORD64_CONST(0x8eb44a87, 0x68581511),
251 SHA2_WORD64_CONST(0xdb0c2e0d, 0x64f98fa7),
252 SHA2_WORD64_CONST(0x47b5481d, 0xbefa4fa4)
253 };
254
255 /* Initial hash value H for SHA-512 */
256 static const sha2_word64 sha512_initial_hash_value[8] = {
257 SHA2_WORD64_CONST(0x6a09e667, 0xf3bcc908),
258 SHA2_WORD64_CONST(0xbb67ae85, 0x84caa73b),
259 SHA2_WORD64_CONST(0x3c6ef372, 0xfe94f82b),
260 SHA2_WORD64_CONST(0xa54ff53a, 0x5f1d36f1),
261 SHA2_WORD64_CONST(0x510e527f, 0xade682d1),
262 SHA2_WORD64_CONST(0x9b05688c, 0x2b3e6c1f),
263 SHA2_WORD64_CONST(0x1f83d9ab, 0xfb41bd6b),
264 SHA2_WORD64_CONST(0x5be0cd19, 0x137e2179)
265 };
266
267 /*
268 * Constant used by SHA256/384/512_End() functions for converting the
269 * digest to a readable hexadecimal character string:
270 */
271 static const char sha2_hex_digits[] = "0123456789abcdef";
272
273
274 /*** SHA-256: *********************************************************/
275 void SHA256_Init(SHA256_CTX* context) {
276 if (context == NULL) {
277 return;
278 }
279 MEMCPY_BCOPY(context->state, sha256_initial_hash_value, SHA256_DIGEST_LENGTH);
280 MEMSET_BZERO(context->buffer, SHA256_BLOCK_LENGTH);
281 context->bitcount = 0;
282 }
283
284 #ifdef SHA2_UNROLL_TRANSFORM
285
286 /* Unrolled SHA-256 round macros: */
287
288 #ifndef WORDS_BIGENDIAN
289
290 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) \
291 REVERSE32(*data++, W256[j]); \
292 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
293 K256[j] + W256[j]; \
294 (d) += T1; \
295 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
296 j++
297
298
299 #else
300
301 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) \
302 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
303 K256[j] + (W256[j] = *data++); \
304 (d) += T1; \
305 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
306 j++
307
308 #endif
309
310 #define ROUND256(a,b,c,d,e,f,g,h) \
311 s0 = W256[(j+1)&0x0f]; \
312 s0 = sigma0_256(s0); \
313 s1 = W256[(j+14)&0x0f]; \
314 s1 = sigma1_256(s1); \
315 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + K256[j] + \
316 (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); \
317 (d) += T1; \
318 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
319 j++
320
321 void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) {
322 sha2_word32 a, b, c, d, e, f, g, h, s0, s1;
323 sha2_word32 T1, *W256;
324 int j;
325
326 W256 = (sha2_word32*)context->buffer;
327
328 /* Initialize registers with the prev. intermediate value */
329 a = context->state[0];
330 b = context->state[1];
331 c = context->state[2];
332 d = context->state[3];
333 e = context->state[4];
334 f = context->state[5];
335 g = context->state[6];
336 h = context->state[7];
337
338 j = 0;
339 do {
340 /* Rounds 0 to 15 (unrolled): */
341 ROUND256_0_TO_15(a,b,c,d,e,f,g,h);
342 ROUND256_0_TO_15(h,a,b,c,d,e,f,g);
343 ROUND256_0_TO_15(g,h,a,b,c,d,e,f);
344 ROUND256_0_TO_15(f,g,h,a,b,c,d,e);
345 ROUND256_0_TO_15(e,f,g,h,a,b,c,d);
346 ROUND256_0_TO_15(d,e,f,g,h,a,b,c);
347 ROUND256_0_TO_15(c,d,e,f,g,h,a,b);
348 ROUND256_0_TO_15(b,c,d,e,f,g,h,a);
349 } while (j < 16);
350
351 /* Now for the remaining rounds to 64: */
352 do {
353 ROUND256(a,b,c,d,e,f,g,h);
354 ROUND256(h,a,b,c,d,e,f,g);
355 ROUND256(g,h,a,b,c,d,e,f);
356 ROUND256(f,g,h,a,b,c,d,e);
357 ROUND256(e,f,g,h,a,b,c,d);
358 ROUND256(d,e,f,g,h,a,b,c);
359 ROUND256(c,d,e,f,g,h,a,b);
360 ROUND256(b,c,d,e,f,g,h,a);
361 } while (j < 64);
362
363 /* Compute the current intermediate hash value */
364 context->state[0] += a;
365 context->state[1] += b;
366 context->state[2] += c;
367 context->state[3] += d;
368 context->state[4] += e;
369 context->state[5] += f;
370 context->state[6] += g;
371 context->state[7] += h;
372
373 /* Clean up */
374 a = b = c = d = e = f = g = h = T1 = 0;
375 }
376
377 #else /* SHA2_UNROLL_TRANSFORM */
378
379 void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) {
380 sha2_word32 a, b, c, d, e, f, g, h, s0, s1;
381 sha2_word32 T1, T2, *W256;
382 int j;
383
384 W256 = (sha2_word32*)context->buffer;
385
386 /* Initialize registers with the prev. intermediate value */
387 a = context->state[0];
388 b = context->state[1];
389 c = context->state[2];
390 d = context->state[3];
391 e = context->state[4];
392 f = context->state[5];
393 g = context->state[6];
394 h = context->state[7];
395
396 j = 0;
397 do {
398 #ifndef WORDS_BIGENDIAN
399 /* Copy data while converting to host byte order */
400 REVERSE32(*data++,W256[j]);
401 /* Apply the SHA-256 compression function to update a..h */
402 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + W256[j];
403 #else
404 /* Apply the SHA-256 compression function to update a..h with copy */
405 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + (W256[j] = *data++);
406 #endif
407 T2 = Sigma0_256(a) + Maj(a, b, c);
408 h = g;
409 g = f;
410 f = e;
411 e = d + T1;
412 d = c;
413 c = b;
414 b = a;
415 a = T1 + T2;
416
417 j++;
418 } while (j < 16);
419
420 do {
421 /* Part of the message block expansion: */
422 s0 = W256[(j+1)&0x0f];
423 s0 = sigma0_256(s0);
424 s1 = W256[(j+14)&0x0f];
425 s1 = sigma1_256(s1);
426
427 /* Apply the SHA-256 compression function to update a..h */
428 T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] +
429 (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0);
430 T2 = Sigma0_256(a) + Maj(a, b, c);
431 h = g;
432 g = f;
433 f = e;
434 e = d + T1;
435 d = c;
436 c = b;
437 b = a;
438 a = T1 + T2;
439
440 j++;
441 } while (j < 64);
442
443 /* Compute the current intermediate hash value */
444 context->state[0] += a;
445 context->state[1] += b;
446 context->state[2] += c;
447 context->state[3] += d;
448 context->state[4] += e;
449 context->state[5] += f;
450 context->state[6] += g;
451 context->state[7] += h;
452
453 /* Clean up */
454 a = b = c = d = e = f = g = h = T1 = T2 = 0;
455 }
456
457 #endif /* SHA2_UNROLL_TRANSFORM */
458
459 void SHA256_Update(SHA256_CTX* context, const sha2_byte *data, size_t len) {
460 unsigned int freespace, usedspace;
461
462 if (len == 0) {
463 /* Calling with no data is valid - we do nothing */
464 return;
465 }
466
467 /* Sanity check: */
468 assert(context != NULL && data != NULL);
469
470 usedspace = (context->bitcount >> 3) % SHA256_BLOCK_LENGTH;
471 if (usedspace > 0) {
472 /* Calculate how much free space is available in the buffer */
473 freespace = SHA256_BLOCK_LENGTH - usedspace;
474
475 if (len >= freespace) {
476 /* Fill the buffer completely and process it */
477 MEMCPY_BCOPY(&context->buffer[usedspace], data, freespace);
478 context->bitcount += freespace << 3;
479 len -= freespace;
480 data += freespace;
481 SHA256_Transform(context, (sha2_word32*)context->buffer);
482 } else {
483 /* The buffer is not yet full */
484 MEMCPY_BCOPY(&context->buffer[usedspace], data, len);
485 context->bitcount += len << 3;
486 /* Clean up: */
487 usedspace = freespace = 0;
488 return;
489 }
490 }
491 while (len >= SHA256_BLOCK_LENGTH) {
492 /* Process as many complete blocks as we can */
493 SHA256_Transform(context, (const sha2_word32*)data);
494 context->bitcount += SHA256_BLOCK_LENGTH << 3;
495 len -= SHA256_BLOCK_LENGTH;
496 data += SHA256_BLOCK_LENGTH;
497 }
498 if (len > 0) {
499 /* There's left-overs, so save 'em */
500 MEMCPY_BCOPY(context->buffer, data, len);
501 context->bitcount += len << 3;
502 }
503 /* Clean up: */
504 usedspace = freespace = 0;
505 }
506
507 void SHA256_Final(sha2_byte digest[], SHA256_CTX* context) {
508 sha2_word32 *d = (sha2_word32*)digest;
509 unsigned int usedspace;
510
511 /* Sanity check: */
512 assert(context != NULL);
513
514 /* If no digest buffer is passed, we don't bother doing this: */
515 if (digest != NULL) {
516 usedspace = (context->bitcount >> 3) % SHA256_BLOCK_LENGTH;
517 #ifndef WORDS_BIGENDIAN
518 /* Convert FROM host byte order */
519 REVERSE64(context->bitcount,context->bitcount);
520 #endif
521 if (usedspace > 0) {
522 /* Begin padding with a 1 bit: */
523 context->buffer[usedspace++] = 0x80;
524
525 if (usedspace <= SHA256_SHORT_BLOCK_LENGTH) {
526 /* Set-up for the last transform: */
527 MEMSET_BZERO(&context->buffer[usedspace], SHA256_SHORT_BLOCK_LENGTH - usedspace);
528 } else {
529 if (usedspace < SHA256_BLOCK_LENGTH) {
530 MEMSET_BZERO(&context->buffer[usedspace], SHA256_BLOCK_LENGTH - usedspace);
531 }
532 /* Do second-to-last transform: */
533 SHA256_Transform(context, (sha2_word32*)context->buffer);
534
535 /* And set-up for the last transform: */
536 MEMSET_BZERO(context->buffer, SHA256_SHORT_BLOCK_LENGTH);
537 }
538 } else {
539 /* Set-up for the last transform: */
540 MEMSET_BZERO(context->buffer, SHA256_SHORT_BLOCK_LENGTH);
541
542 /* Begin padding with a 1 bit: */
543 *context->buffer = 0x80;
544 }
545 /* Set the bit count: */
546 *(sha2_word64*)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = context->bitcount;
547
548 /* Final transform: */
549 SHA256_Transform(context, (sha2_word32*)context->buffer);
550
551 #ifndef WORDS_BIGENDIAN
552 {
553 /* Convert TO host byte order */
554 int j;
555 for (j = 0; j < 8; j++) {
556 REVERSE32(context->state[j],context->state[j]);
557 *d++ = context->state[j];
558 }
559 }
560 #else
561 MEMCPY_BCOPY(d, context->state, SHA256_DIGEST_LENGTH);
562 #endif
563 }
564
565 /* Clean up state data: */
566 MEMSET_BZERO(context, sizeof(context));
567 usedspace = 0;
568 }
569
570 char *SHA256_End(SHA256_CTX* context, char buffer[]) {
571 sha2_byte digest[SHA256_DIGEST_LENGTH], *d = digest;
572 int i;
573
574 /* Sanity check: */
575 assert(context != NULL);
576
577 if (buffer != NULL) {
578 SHA256_Final(digest, context);
579
580 for (i = 0; i < SHA256_DIGEST_LENGTH; i++) {
581 *buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
582 *buffer++ = sha2_hex_digits[*d & 0x0f];
583 d++;
584 }
585 *buffer = 0;
586 } else {
587 MEMSET_BZERO(context, sizeof(context));
588 }
589 MEMSET_BZERO(digest, SHA256_DIGEST_LENGTH);
590 return buffer;
591 }
592
593 char* SHA256_Data(const sha2_byte* data, size_t len, char digest[SHA256_DIGEST_STRING_LENGTH]) {
594 SHA256_CTX context;
595
596 SHA256_Init(&context);
597 SHA256_Update(&context, data, len);
598 return SHA256_End(&context, digest);
599 }
600
601
602 /*** SHA-512: *********************************************************/
603 void SHA512_Init(SHA512_CTX* context) {
604 if (context == NULL) {
605 return;
606 }
607 MEMCPY_BCOPY(context->state, sha512_initial_hash_value, SHA512_DIGEST_LENGTH);
608 MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH);
609 context->bitcount[0] = context->bitcount[1] = 0;
610 }
611
612 #ifdef SHA2_UNROLL_TRANSFORM
613
614 /* Unrolled SHA-512 round macros: */
615 #ifndef WORDS_BIGENDIAN
616
617 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \
618 REVERSE64(*data++, W512[j]); \
619 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
620 K512[j] + W512[j]; \
621 (d) += T1, \
622 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)), \
623 j++
624
625
626 #else
627
628 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \
629 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
630 K512[j] + (W512[j] = *data++); \
631 (d) += T1; \
632 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
633 j++
634
635 #endif
636
637 #define ROUND512(a,b,c,d,e,f,g,h) \
638 s0 = W512[(j+1)&0x0f]; \
639 s0 = sigma0_512(s0); \
640 s1 = W512[(j+14)&0x0f]; \
641 s1 = sigma1_512(s1); \
642 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + K512[j] + \
643 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); \
644 (d) += T1; \
645 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
646 j++
647
648 void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) {
649 sha2_word64 a, b, c, d, e, f, g, h, s0, s1;
650 sha2_word64 T1, *W512 = (sha2_word64*)context->buffer;
651 int j;
652
653 /* Initialize registers with the prev. intermediate value */
654 a = context->state[0];
655 b = context->state[1];
656 c = context->state[2];
657 d = context->state[3];
658 e = context->state[4];
659 f = context->state[5];
660 g = context->state[6];
661 h = context->state[7];
662
663 j = 0;
664 do {
665 ROUND512_0_TO_15(a,b,c,d,e,f,g,h);
666 ROUND512_0_TO_15(h,a,b,c,d,e,f,g);
667 ROUND512_0_TO_15(g,h,a,b,c,d,e,f);
668 ROUND512_0_TO_15(f,g,h,a,b,c,d,e);
669 ROUND512_0_TO_15(e,f,g,h,a,b,c,d);
670 ROUND512_0_TO_15(d,e,f,g,h,a,b,c);
671 ROUND512_0_TO_15(c,d,e,f,g,h,a,b);
672 ROUND512_0_TO_15(b,c,d,e,f,g,h,a);
673 } while (j < 16);
674
675 /* Now for the remaining rounds up to 79: */
676 do {
677 ROUND512(a,b,c,d,e,f,g,h);
678 ROUND512(h,a,b,c,d,e,f,g);
679 ROUND512(g,h,a,b,c,d,e,f);
680 ROUND512(f,g,h,a,b,c,d,e);
681 ROUND512(e,f,g,h,a,b,c,d);
682 ROUND512(d,e,f,g,h,a,b,c);
683 ROUND512(c,d,e,f,g,h,a,b);
684 ROUND512(b,c,d,e,f,g,h,a);
685 } while (j < 80);
686
687 /* Compute the current intermediate hash value */
688 context->state[0] += a;
689 context->state[1] += b;
690 context->state[2] += c;
691 context->state[3] += d;
692 context->state[4] += e;
693 context->state[5] += f;
694 context->state[6] += g;
695 context->state[7] += h;
696
697 /* Clean up */
698 a = b = c = d = e = f = g = h = T1 = 0;
699 }
700
701 #else /* SHA2_UNROLL_TRANSFORM */
702
703 void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) {
704 sha2_word64 a, b, c, d, e, f, g, h, s0, s1;
705 sha2_word64 T1, T2, *W512 = (sha2_word64*)context->buffer;
706 int j;
707
708 /* Initialize registers with the prev. intermediate value */
709 a = context->state[0];
710 b = context->state[1];
711 c = context->state[2];
712 d = context->state[3];
713 e = context->state[4];
714 f = context->state[5];
715 g = context->state[6];
716 h = context->state[7];
717
718 j = 0;
719 do {
720 #ifndef WORDS_BIGENDIAN
721 /* Convert TO host byte order */
722 REVERSE64(*data++, W512[j]);
723 /* Apply the SHA-512 compression function to update a..h */
724 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j];
725 #else
726 /* Apply the SHA-512 compression function to update a..h with copy */
727 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + (W512[j] = *data++);
728 #endif
729 T2 = Sigma0_512(a) + Maj(a, b, c);
730 h = g;
731 g = f;
732 f = e;
733 e = d + T1;
734 d = c;
735 c = b;
736 b = a;
737 a = T1 + T2;
738
739 j++;
740 } while (j < 16);
741
742 do {
743 /* Part of the message block expansion: */
744 s0 = W512[(j+1)&0x0f];
745 s0 = sigma0_512(s0);
746 s1 = W512[(j+14)&0x0f];
747 s1 = sigma1_512(s1);
748
749 /* Apply the SHA-512 compression function to update a..h */
750 T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] +
751 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0);
752 T2 = Sigma0_512(a) + Maj(a, b, c);
753 h = g;
754 g = f;
755 f = e;
756 e = d + T1;
757 d = c;
758 c = b;
759 b = a;
760 a = T1 + T2;
761
762 j++;
763 } while (j < 80);
764
765 /* Compute the current intermediate hash value */
766 context->state[0] += a;
767 context->state[1] += b;
768 context->state[2] += c;
769 context->state[3] += d;
770 context->state[4] += e;
771 context->state[5] += f;
772 context->state[6] += g;
773 context->state[7] += h;
774
775 /* Clean up */
776 a = b = c = d = e = f = g = h = T1 = T2 = 0;
777 }
778
779 #endif /* SHA2_UNROLL_TRANSFORM */
780
781 void SHA512_Update(SHA512_CTX* context, const sha2_byte *data, size_t len) {
782 unsigned int freespace, usedspace;
783
784 if (len == 0) {
785 /* Calling with no data is valid - we do nothing */
786 return;
787 }
788
789 /* Sanity check: */
790 assert(context != NULL && data != NULL);
791
792 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
793 if (usedspace > 0) {
794 /* Calculate how much free space is available in the buffer */
795 freespace = SHA512_BLOCK_LENGTH - usedspace;
796
797 if (len >= freespace) {
798 /* Fill the buffer completely and process it */
799 MEMCPY_BCOPY(&context->buffer[usedspace], data, freespace);
800 ADDINC128(context->bitcount, freespace << 3);
801 len -= freespace;
802 data += freespace;
803 SHA512_Transform(context, (sha2_word64*)context->buffer);
804 } else {
805 /* The buffer is not yet full */
806 MEMCPY_BCOPY(&context->buffer[usedspace], data, len);
807 ADDINC128(context->bitcount, len << 3);
808 /* Clean up: */
809 usedspace = freespace = 0;
810 return;
811 }
812 }
813 while (len >= SHA512_BLOCK_LENGTH) {
814 /* Process as many complete blocks as we can */
815 SHA512_Transform(context, (const sha2_word64*)data);
816 ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3);
817 len -= SHA512_BLOCK_LENGTH;
818 data += SHA512_BLOCK_LENGTH;
819 }
820 if (len > 0) {
821 /* There's left-overs, so save 'em */
822 MEMCPY_BCOPY(context->buffer, data, len);
823 ADDINC128(context->bitcount, len << 3);
824 }
825 /* Clean up: */
826 usedspace = freespace = 0;
827 }
828
829 void SHA512_Last(SHA512_CTX* context) {
830 unsigned int usedspace;
831
832 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
833 #ifndef WORDS_BIGENDIAN
834 /* Convert FROM host byte order */
835 REVERSE64(context->bitcount[0],context->bitcount[0]);
836 REVERSE64(context->bitcount[1],context->bitcount[1]);
837 #endif
838 if (usedspace > 0) {
839 /* Begin padding with a 1 bit: */
840 context->buffer[usedspace++] = 0x80;
841
842 if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) {
843 /* Set-up for the last transform: */
844 MEMSET_BZERO(&context->buffer[usedspace], SHA512_SHORT_BLOCK_LENGTH - usedspace);
845 } else {
846 if (usedspace < SHA512_BLOCK_LENGTH) {
847 MEMSET_BZERO(&context->buffer[usedspace], SHA512_BLOCK_LENGTH - usedspace);
848 }
849 /* Do second-to-last transform: */
850 SHA512_Transform(context, (sha2_word64*)context->buffer);
851
852 /* And set-up for the last transform: */
853 MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH - 2);
854 }
855 } else {
856 /* Prepare for final transform: */
857 MEMSET_BZERO(context->buffer, SHA512_SHORT_BLOCK_LENGTH);
858
859 /* Begin padding with a 1 bit: */
860 *context->buffer = 0x80;
861 }
862 /* Store the length of input data (in bits): */
863 *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1];
864 *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0];
865
866 /* Final transform: */
867 SHA512_Transform(context, (sha2_word64*)context->buffer);
868 }
869
870 void SHA512_Final(sha2_byte digest[], SHA512_CTX* context) {
871 sha2_word64 *d = (sha2_word64*)digest;
872
873 /* Sanity check: */
874 assert(context != NULL);
875
876 /* If no digest buffer is passed, we don't bother doing this: */
877 if (digest != NULL) {
878 SHA512_Last(context);
879
880 /* Save the hash data for output: */
881 #ifndef WORDS_BIGENDIAN
882 {
883 /* Convert TO host byte order */
884 int j;
885 for (j = 0; j < 8; j++) {
886 REVERSE64(context->state[j],context->state[j]);
887 *d++ = context->state[j];
888 }
889 }
890 #else
891 MEMCPY_BCOPY(d, context->state, SHA512_DIGEST_LENGTH);
892 #endif
893 }
894
895 /* Zero out state data */
896 MEMSET_BZERO(context, sizeof(context));
897 }
898
899 char *SHA512_End(SHA512_CTX* context, char buffer[]) {
900 sha2_byte digest[SHA512_DIGEST_LENGTH], *d = digest;
901 int i;
902
903 /* Sanity check: */
904 assert(context != NULL);
905
906 if (buffer != NULL) {
907 SHA512_Final(digest, context);
908
909 for (i = 0; i < SHA512_DIGEST_LENGTH; i++) {
910 *buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
911 *buffer++ = sha2_hex_digits[*d & 0x0f];
912 d++;
913 }
914 *buffer = 0;
915 } else {
916 MEMSET_BZERO(context, sizeof(context));
917 }
918 MEMSET_BZERO(digest, SHA512_DIGEST_LENGTH);
919 return buffer;
920 }
921
922 char* SHA512_Data(const sha2_byte* data, size_t len, char digest[SHA512_DIGEST_STRING_LENGTH]) {
923 SHA512_CTX context;
924
925 SHA512_Init(&context);
926 SHA512_Update(&context, data, len);
927 return SHA512_End(&context, digest);
928 }
929
930
931 /*** SHA-384: *********************************************************/
932 void SHA384_Init(SHA384_CTX* context) {
933 if (context == NULL) {
934 return;
935 }
936 MEMCPY_BCOPY(context->state, sha384_initial_hash_value, SHA512_DIGEST_LENGTH);
937 MEMSET_BZERO(context->buffer, SHA384_BLOCK_LENGTH);
938 context->bitcount[0] = context->bitcount[1] = 0;
939 }
940
941 void SHA384_Update(SHA384_CTX* context, const sha2_byte* data, size_t len) {
942 SHA512_Update((SHA512_CTX*)context, data, len);
943 }
944
945 void SHA384_Final(sha2_byte digest[], SHA384_CTX* context) {
946 sha2_word64 *d = (sha2_word64*)digest;
947
948 /* Sanity check: */
949 assert(context != NULL);
950
951 /* If no digest buffer is passed, we don't bother doing this: */
952 if (digest != NULL) {
953 SHA512_Last((SHA512_CTX*)context);
954
955 /* Save the hash data for output: */
956 #ifndef WORDS_BIGENDIAN
957 {
958 /* Convert TO host byte order */
959 int j;
960 for (j = 0; j < 6; j++) {
961 REVERSE64(context->state[j],context->state[j]);
962 *d++ = context->state[j];
963 }
964 }
965 #else
966 MEMCPY_BCOPY(d, context->state, SHA384_DIGEST_LENGTH);
967 #endif
968 }
969
970 /* Zero out state data */
971 MEMSET_BZERO(context, sizeof(context));
972 }
973
974 char *SHA384_End(SHA384_CTX* context, char buffer[]) {
975 sha2_byte digest[SHA384_DIGEST_LENGTH], *d = digest;
976 int i;
977
978 /* Sanity check: */
979 assert(context != NULL);
980
981 if (buffer != NULL) {
982 SHA384_Final(digest, context);
983
984 for (i = 0; i < SHA384_DIGEST_LENGTH; i++) {
985 *buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
986 *buffer++ = sha2_hex_digits[*d & 0x0f];
987 d++;
988 }
989 *buffer = 0;
990 } else {
991 MEMSET_BZERO(context, sizeof(context));
992 }
993 MEMSET_BZERO(digest, SHA384_DIGEST_LENGTH);
994 return buffer;
995 }
996
997 char* SHA384_Data(const sha2_byte* data, size_t len, char digest[SHA384_DIGEST_STRING_LENGTH]) {
998 SHA384_CTX context;
999
1000 SHA384_Init(&context);
1001 SHA384_Update(&context, data, len);
1002 return SHA384_End(&context, digest);
1003 }
A free Windows-compatible Operating System