2 * $KAME: sha2.c,v 1.8 2001/11/08 01:07:52 itojun Exp $
3 * $FreeBSD: src/sys/crypto/sha2/sha2.c,v 1.2.2.2 2002/03/05 08:36:47 ume Exp $
4 * $DragonFly: src/sys/crypto/sha2/sha2.c,v 1.4 2004/02/12 23:14:05 joerg Exp $
11 * Written by Aaron D. Gifford <me@aarongifford.com>
13 * Copyright 2000 Aaron D. Gifford. All rights reserved.
15 * Redistribution and use in source and binary forms, with or without
16 * modification, are permitted provided that the following conditions
18 * 1. Redistributions of source code must retain the above copyright
19 * notice, this list of conditions and the following disclaimer.
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in the
22 * documentation and/or other materials provided with the distribution.
23 * 3. Neither the name of the copyright holder nor the names of contributors
24 * may be used to endorse or promote products derived from this software
25 * without specific prior written permission.
27 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42 #include <sys/types.h>
44 #include <sys/systm.h>
45 #include <machine/endian.h>
46 #include <crypto/sha2/sha2.h>
50 * Some sanity checking code is included using assert(). On my FreeBSD
51 * system, this additional code can be removed by compiling with NDEBUG
52 * defined. Check your own systems manpage on assert() to see how to
53 * compile WITHOUT the sanity checking code on your system.
55 * UNROLLED TRANSFORM LOOP NOTE:
56 * You can define SHA2_UNROLL_TRANSFORM to use the unrolled transform
57 * loop version for the hash transform rounds (defined using macros
58 * later in this file). Either define on the command line, for example:
60 * cc -DSHA2_UNROLL_TRANSFORM -o sha2 sha2.c sha2prog.c
64 * #define SHA2_UNROLL_TRANSFORM
68 #if defined(__DragonFly__) || defined(__bsdi__) || defined(__FreeBSD__)
73 /*** SHA-256/384/512 Machine Architecture Definitions *****************/
77 * Please make sure that your system defines BYTE_ORDER. If your
78 * architecture is little-endian, make sure it also defines
79 * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
82 * If your system does not define the above, then you can do so by
85 * #define LITTLE_ENDIAN 1234
86 * #define BIG_ENDIAN 4321
88 * And for little-endian machines, add:
90 * #define BYTE_ORDER LITTLE_ENDIAN
92 * Or for big-endian machines:
94 * #define BYTE_ORDER BIG_ENDIAN
96 * The FreeBSD machine this was written on defines BYTE_ORDER
97 * appropriately by including <sys/types.h> (which in turn includes
98 * <machine/endian.h> where the appropriate definitions are actually
101 #if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN)
102 #error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN
106 * Define the followingsha2_* types to types of the correct length on
107 * the native archtecture. Most BSD systems and Linux define u_intXX_t
108 * types. Machines with very recent ANSI C headers, can use the
109 * uintXX_t definintions from inttypes.h by defining SHA2_USE_INTTYPES_H
110 * during compile or in the sha.h header file.
112 * Machines that support neither u_intXX_t nor inttypes.h's uintXX_t
113 * will need to define these three typedefs below (and the appropriate
114 * ones in sha.h too) by hand according to their system architecture.
116 * Thank you, Jun-ichiro itojun Hagino, for suggesting using u_intXX_t
117 * types and pointing out recent ANSI C support for uintXX_t in inttypes.h.
119 #if 0 /*def SHA2_USE_INTTYPES_H*/
121 typedef uint8_t sha2_byte
; /* Exactly 1 byte */
122 typedef uint32_t sha2_word32
; /* Exactly 4 bytes */
123 typedef uint64_t sha2_word64
; /* Exactly 8 bytes */
125 #else /* SHA2_USE_INTTYPES_H */
127 typedef u_int8_t sha2_byte
; /* Exactly 1 byte */
128 typedef u_int32_t sha2_word32
; /* Exactly 4 bytes */
129 typedef u_int64_t sha2_word64
; /* Exactly 8 bytes */
131 #endif /* SHA2_USE_INTTYPES_H */
134 /*** SHA-256/384/512 Various Length Definitions ***********************/
135 /* NOTE: Most of these are in sha2.h */
136 #define SHA256_SHORT_BLOCK_LENGTH (SHA256_BLOCK_LENGTH - 8)
137 #define SHA384_SHORT_BLOCK_LENGTH (SHA384_BLOCK_LENGTH - 16)
138 #define SHA512_SHORT_BLOCK_LENGTH (SHA512_BLOCK_LENGTH - 16)
141 /*** ENDIAN REVERSAL MACROS *******************************************/
142 #if BYTE_ORDER == LITTLE_ENDIAN
143 #define REVERSE32(w,x) { \
144 sha2_word32 tmp = (w); \
145 tmp = (tmp >> 16) | (tmp << 16); \
146 (x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \
148 #define REVERSE64(w,x) { \
149 sha2_word64 tmp = (w); \
150 tmp = (tmp >> 32) | (tmp << 32); \
151 tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \
152 ((tmp & 0x00ff00ff00ff00ffULL) << 8); \
153 (x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \
154 ((tmp & 0x0000ffff0000ffffULL) << 16); \
156 #endif /* BYTE_ORDER == LITTLE_ENDIAN */
159 * Macro for incrementally adding the unsigned 64-bit integer n to the
160 * unsigned 128-bit integer (represented using a two-element array of
163 #define ADDINC128(w,n) { \
164 (w)[0] += (sha2_word64)(n); \
165 if ((w)[0] < (n)) { \
170 /*** THE SIX LOGICAL FUNCTIONS ****************************************/
172 * Bit shifting and rotation (used by the six SHA-XYZ logical functions:
174 * NOTE: The naming of R and S appears backwards here (R is a SHIFT and
175 * S is a ROTATION) because the SHA-256/384/512 description document
176 * (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this
177 * same "backwards" definition.
179 /* Shift-right (used in SHA-256, SHA-384, and SHA-512): */
180 #define R(b,x) ((x) >> (b))
181 /* 32-bit Rotate-right (used in SHA-256): */
182 #define S32(b,x) (((x) >> (b)) | ((x) << (32 - (b))))
183 /* 64-bit Rotate-right (used in SHA-384 and SHA-512): */
184 #define S64(b,x) (((x) >> (b)) | ((x) << (64 - (b))))
186 /* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */
187 #define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z)))
188 #define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
190 /* Four of six logical functions used in SHA-256: */
191 #define Sigma0_256(x) (S32(2, (x)) ^ S32(13, (x)) ^ S32(22, (x)))
192 #define Sigma1_256(x) (S32(6, (x)) ^ S32(11, (x)) ^ S32(25, (x)))
193 #define sigma0_256(x) (S32(7, (x)) ^ S32(18, (x)) ^ R(3 , (x)))
194 #define sigma1_256(x) (S32(17, (x)) ^ S32(19, (x)) ^ R(10, (x)))
196 /* Four of six logical functions used in SHA-384 and SHA-512: */
197 #define Sigma0_512(x) (S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x)))
198 #define Sigma1_512(x) (S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x)))
199 #define sigma0_512(x) (S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7, (x)))
200 #define sigma1_512(x) (S64(19, (x)) ^ S64(61, (x)) ^ R( 6, (x)))
202 /*** INTERNAL FUNCTION PROTOTYPES *************************************/
203 /* NOTE: These should not be accessed directly from outside this
204 * library -- they are intended for private internal visibility/use
207 void SHA512_Last(SHA512_CTX
*);
208 void SHA256_Transform(SHA256_CTX
*, const sha2_word32
*);
209 void SHA512_Transform(SHA512_CTX
*, const sha2_word64
*);
212 /*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/
213 /* Hash constant words K for SHA-256: */
214 const static sha2_word32 K256
[64] = {
215 0x428a2f98UL
, 0x71374491UL
, 0xb5c0fbcfUL
, 0xe9b5dba5UL
,
216 0x3956c25bUL
, 0x59f111f1UL
, 0x923f82a4UL
, 0xab1c5ed5UL
,
217 0xd807aa98UL
, 0x12835b01UL
, 0x243185beUL
, 0x550c7dc3UL
,
218 0x72be5d74UL
, 0x80deb1feUL
, 0x9bdc06a7UL
, 0xc19bf174UL
,
219 0xe49b69c1UL
, 0xefbe4786UL
, 0x0fc19dc6UL
, 0x240ca1ccUL
,
220 0x2de92c6fUL
, 0x4a7484aaUL
, 0x5cb0a9dcUL
, 0x76f988daUL
,
221 0x983e5152UL
, 0xa831c66dUL
, 0xb00327c8UL
, 0xbf597fc7UL
,
222 0xc6e00bf3UL
, 0xd5a79147UL
, 0x06ca6351UL
, 0x14292967UL
,
223 0x27b70a85UL
, 0x2e1b2138UL
, 0x4d2c6dfcUL
, 0x53380d13UL
,
224 0x650a7354UL
, 0x766a0abbUL
, 0x81c2c92eUL
, 0x92722c85UL
,
225 0xa2bfe8a1UL
, 0xa81a664bUL
, 0xc24b8b70UL
, 0xc76c51a3UL
,
226 0xd192e819UL
, 0xd6990624UL
, 0xf40e3585UL
, 0x106aa070UL
,
227 0x19a4c116UL
, 0x1e376c08UL
, 0x2748774cUL
, 0x34b0bcb5UL
,
228 0x391c0cb3UL
, 0x4ed8aa4aUL
, 0x5b9cca4fUL
, 0x682e6ff3UL
,
229 0x748f82eeUL
, 0x78a5636fUL
, 0x84c87814UL
, 0x8cc70208UL
,
230 0x90befffaUL
, 0xa4506cebUL
, 0xbef9a3f7UL
, 0xc67178f2UL
233 /* Initial hash value H for SHA-256: */
234 const static sha2_word32 sha256_initial_hash_value
[8] = {
245 /* Hash constant words K for SHA-384 and SHA-512: */
246 const static sha2_word64 K512
[80] = {
247 0x428a2f98d728ae22ULL
, 0x7137449123ef65cdULL
,
248 0xb5c0fbcfec4d3b2fULL
, 0xe9b5dba58189dbbcULL
,
249 0x3956c25bf348b538ULL
, 0x59f111f1b605d019ULL
,
250 0x923f82a4af194f9bULL
, 0xab1c5ed5da6d8118ULL
,
251 0xd807aa98a3030242ULL
, 0x12835b0145706fbeULL
,
252 0x243185be4ee4b28cULL
, 0x550c7dc3d5ffb4e2ULL
,
253 0x72be5d74f27b896fULL
, 0x80deb1fe3b1696b1ULL
,
254 0x9bdc06a725c71235ULL
, 0xc19bf174cf692694ULL
,
255 0xe49b69c19ef14ad2ULL
, 0xefbe4786384f25e3ULL
,
256 0x0fc19dc68b8cd5b5ULL
, 0x240ca1cc77ac9c65ULL
,
257 0x2de92c6f592b0275ULL
, 0x4a7484aa6ea6e483ULL
,
258 0x5cb0a9dcbd41fbd4ULL
, 0x76f988da831153b5ULL
,
259 0x983e5152ee66dfabULL
, 0xa831c66d2db43210ULL
,
260 0xb00327c898fb213fULL
, 0xbf597fc7beef0ee4ULL
,
261 0xc6e00bf33da88fc2ULL
, 0xd5a79147930aa725ULL
,
262 0x06ca6351e003826fULL
, 0x142929670a0e6e70ULL
,
263 0x27b70a8546d22ffcULL
, 0x2e1b21385c26c926ULL
,
264 0x4d2c6dfc5ac42aedULL
, 0x53380d139d95b3dfULL
,
265 0x650a73548baf63deULL
, 0x766a0abb3c77b2a8ULL
,
266 0x81c2c92e47edaee6ULL
, 0x92722c851482353bULL
,
267 0xa2bfe8a14cf10364ULL
, 0xa81a664bbc423001ULL
,
268 0xc24b8b70d0f89791ULL
, 0xc76c51a30654be30ULL
,
269 0xd192e819d6ef5218ULL
, 0xd69906245565a910ULL
,
270 0xf40e35855771202aULL
, 0x106aa07032bbd1b8ULL
,
271 0x19a4c116b8d2d0c8ULL
, 0x1e376c085141ab53ULL
,
272 0x2748774cdf8eeb99ULL
, 0x34b0bcb5e19b48a8ULL
,
273 0x391c0cb3c5c95a63ULL
, 0x4ed8aa4ae3418acbULL
,
274 0x5b9cca4f7763e373ULL
, 0x682e6ff3d6b2b8a3ULL
,
275 0x748f82ee5defb2fcULL
, 0x78a5636f43172f60ULL
,
276 0x84c87814a1f0ab72ULL
, 0x8cc702081a6439ecULL
,
277 0x90befffa23631e28ULL
, 0xa4506cebde82bde9ULL
,
278 0xbef9a3f7b2c67915ULL
, 0xc67178f2e372532bULL
,
279 0xca273eceea26619cULL
, 0xd186b8c721c0c207ULL
,
280 0xeada7dd6cde0eb1eULL
, 0xf57d4f7fee6ed178ULL
,
281 0x06f067aa72176fbaULL
, 0x0a637dc5a2c898a6ULL
,
282 0x113f9804bef90daeULL
, 0x1b710b35131c471bULL
,
283 0x28db77f523047d84ULL
, 0x32caab7b40c72493ULL
,
284 0x3c9ebe0a15c9bebcULL
, 0x431d67c49c100d4cULL
,
285 0x4cc5d4becb3e42b6ULL
, 0x597f299cfc657e2aULL
,
286 0x5fcb6fab3ad6faecULL
, 0x6c44198c4a475817ULL
289 /* Initial hash value H for SHA-384 */
290 const static sha2_word64 sha384_initial_hash_value
[8] = {
291 0xcbbb9d5dc1059ed8ULL
,
292 0x629a292a367cd507ULL
,
293 0x9159015a3070dd17ULL
,
294 0x152fecd8f70e5939ULL
,
295 0x67332667ffc00b31ULL
,
296 0x8eb44a8768581511ULL
,
297 0xdb0c2e0d64f98fa7ULL
,
298 0x47b5481dbefa4fa4ULL
301 /* Initial hash value H for SHA-512 */
302 const static sha2_word64 sha512_initial_hash_value
[8] = {
303 0x6a09e667f3bcc908ULL
,
304 0xbb67ae8584caa73bULL
,
305 0x3c6ef372fe94f82bULL
,
306 0xa54ff53a5f1d36f1ULL
,
307 0x510e527fade682d1ULL
,
308 0x9b05688c2b3e6c1fULL
,
309 0x1f83d9abfb41bd6bULL
,
310 0x5be0cd19137e2179ULL
314 * Constant used by SHA256/384/512_End() functions for converting the
315 * digest to a readable hexadecimal character string:
317 static const char *sha2_hex_digits
= "0123456789abcdef";
320 /*** SHA-256: *********************************************************/
321 void SHA256_Init(SHA256_CTX
* context
) {
322 if (context
== (SHA256_CTX
*)0) {
325 bcopy(sha256_initial_hash_value
, context
->state
, SHA256_DIGEST_LENGTH
);
326 bzero(context
->buffer
, SHA256_BLOCK_LENGTH
);
327 context
->bitcount
= 0;
330 #ifdef SHA2_UNROLL_TRANSFORM
332 /* Unrolled SHA-256 round macros: */
334 #if BYTE_ORDER == LITTLE_ENDIAN
336 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) \
337 REVERSE32(*data++, W256[j]); \
338 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
341 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
345 #else /* BYTE_ORDER == LITTLE_ENDIAN */
347 #define ROUND256_0_TO_15(a,b,c,d,e,f,g,h) \
348 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
349 K256[j] + (W256[j] = *data++); \
351 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
354 #endif /* BYTE_ORDER == LITTLE_ENDIAN */
356 #define ROUND256(a,b,c,d,e,f,g,h) \
357 s0 = W256[(j+1)&0x0f]; \
358 s0 = sigma0_256(s0); \
359 s1 = W256[(j+14)&0x0f]; \
360 s1 = sigma1_256(s1); \
361 T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + K256[j] + \
362 (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); \
364 (h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
367 void SHA256_Transform(SHA256_CTX
* context
, const sha2_word32
* data
) {
368 sha2_word32 a
, b
, c
, d
, e
, f
, g
, h
, s0
, s1
;
369 sha2_word32 T1
, *W256
;
372 W256
= (sha2_word32
*)context
->buffer
;
374 /* Initialize registers with the prev. intermediate value */
375 a
= context
->state
[0];
376 b
= context
->state
[1];
377 c
= context
->state
[2];
378 d
= context
->state
[3];
379 e
= context
->state
[4];
380 f
= context
->state
[5];
381 g
= context
->state
[6];
382 h
= context
->state
[7];
386 /* Rounds 0 to 15 (unrolled): */
387 ROUND256_0_TO_15(a
,b
,c
,d
,e
,f
,g
,h
);
388 ROUND256_0_TO_15(h
,a
,b
,c
,d
,e
,f
,g
);
389 ROUND256_0_TO_15(g
,h
,a
,b
,c
,d
,e
,f
);
390 ROUND256_0_TO_15(f
,g
,h
,a
,b
,c
,d
,e
);
391 ROUND256_0_TO_15(e
,f
,g
,h
,a
,b
,c
,d
);
392 ROUND256_0_TO_15(d
,e
,f
,g
,h
,a
,b
,c
);
393 ROUND256_0_TO_15(c
,d
,e
,f
,g
,h
,a
,b
);
394 ROUND256_0_TO_15(b
,c
,d
,e
,f
,g
,h
,a
);
397 /* Now for the remaining rounds to 64: */
399 ROUND256(a
,b
,c
,d
,e
,f
,g
,h
);
400 ROUND256(h
,a
,b
,c
,d
,e
,f
,g
);
401 ROUND256(g
,h
,a
,b
,c
,d
,e
,f
);
402 ROUND256(f
,g
,h
,a
,b
,c
,d
,e
);
403 ROUND256(e
,f
,g
,h
,a
,b
,c
,d
);
404 ROUND256(d
,e
,f
,g
,h
,a
,b
,c
);
405 ROUND256(c
,d
,e
,f
,g
,h
,a
,b
);
406 ROUND256(b
,c
,d
,e
,f
,g
,h
,a
);
409 /* Compute the current intermediate hash value */
410 context
->state
[0] += a
;
411 context
->state
[1] += b
;
412 context
->state
[2] += c
;
413 context
->state
[3] += d
;
414 context
->state
[4] += e
;
415 context
->state
[5] += f
;
416 context
->state
[6] += g
;
417 context
->state
[7] += h
;
420 a
= b
= c
= d
= e
= f
= g
= h
= T1
= 0;
423 #else /* SHA2_UNROLL_TRANSFORM */
425 void SHA256_Transform(SHA256_CTX
* context
, const sha2_word32
* data
) {
426 sha2_word32 a
, b
, c
, d
, e
, f
, g
, h
, s0
, s1
;
427 sha2_word32 T1
, T2
, *W256
;
430 W256
= (sha2_word32
*)context
->buffer
;
432 /* Initialize registers with the prev. intermediate value */
433 a
= context
->state
[0];
434 b
= context
->state
[1];
435 c
= context
->state
[2];
436 d
= context
->state
[3];
437 e
= context
->state
[4];
438 f
= context
->state
[5];
439 g
= context
->state
[6];
440 h
= context
->state
[7];
444 #if BYTE_ORDER == LITTLE_ENDIAN
445 /* Copy data while converting to host byte order */
446 REVERSE32(*data
++,W256
[j
]);
447 /* Apply the SHA-256 compression function to update a..h */
448 T1
= h
+ Sigma1_256(e
) + Ch(e
, f
, g
) + K256
[j
] + W256
[j
];
449 #else /* BYTE_ORDER == LITTLE_ENDIAN */
450 /* Apply the SHA-256 compression function to update a..h with copy */
451 T1
= h
+ Sigma1_256(e
) + Ch(e
, f
, g
) + K256
[j
] + (W256
[j
] = *data
++);
452 #endif /* BYTE_ORDER == LITTLE_ENDIAN */
453 T2
= Sigma0_256(a
) + Maj(a
, b
, c
);
467 /* Part of the message block expansion: */
468 s0
= W256
[(j
+1)&0x0f];
470 s1
= W256
[(j
+14)&0x0f];
473 /* Apply the SHA-256 compression function to update a..h */
474 T1
= h
+ Sigma1_256(e
) + Ch(e
, f
, g
) + K256
[j
] +
475 (W256
[j
&0x0f] += s1
+ W256
[(j
+9)&0x0f] + s0
);
476 T2
= Sigma0_256(a
) + Maj(a
, b
, c
);
489 /* Compute the current intermediate hash value */
490 context
->state
[0] += a
;
491 context
->state
[1] += b
;
492 context
->state
[2] += c
;
493 context
->state
[3] += d
;
494 context
->state
[4] += e
;
495 context
->state
[5] += f
;
496 context
->state
[6] += g
;
497 context
->state
[7] += h
;
500 a
= b
= c
= d
= e
= f
= g
= h
= T1
= T2
= 0;
503 #endif /* SHA2_UNROLL_TRANSFORM */
505 void SHA256_Update(SHA256_CTX
* context
, const sha2_byte
*data
, size_t len
) {
506 unsigned int freespace
, usedspace
;
509 /* Calling with no data is valid - we do nothing */
514 assert(context
!= (SHA256_CTX
*)0 && data
!= (sha2_byte
*)0);
516 usedspace
= (context
->bitcount
>> 3) % SHA256_BLOCK_LENGTH
;
518 /* Calculate how much free space is available in the buffer */
519 freespace
= SHA256_BLOCK_LENGTH
- usedspace
;
521 if (len
>= freespace
) {
522 /* Fill the buffer completely and process it */
523 bcopy(data
, &context
->buffer
[usedspace
], freespace
);
524 context
->bitcount
+= freespace
<< 3;
527 SHA256_Transform(context
, (sha2_word32
*)context
->buffer
);
529 /* The buffer is not yet full */
530 bcopy(data
, &context
->buffer
[usedspace
], len
);
531 context
->bitcount
+= len
<< 3;
533 usedspace
= freespace
= 0;
537 while (len
>= SHA256_BLOCK_LENGTH
) {
538 /* Process as many complete blocks as we can */
539 SHA256_Transform(context
, (const sha2_word32
*)data
);
540 context
->bitcount
+= SHA256_BLOCK_LENGTH
<< 3;
541 len
-= SHA256_BLOCK_LENGTH
;
542 data
+= SHA256_BLOCK_LENGTH
;
545 /* There's left-overs, so save 'em */
546 bcopy(data
, context
->buffer
, len
);
547 context
->bitcount
+= len
<< 3;
550 usedspace
= freespace
= 0;
553 void SHA256_Final(sha2_byte digest
[], SHA256_CTX
* context
) {
554 sha2_word32
*d
= (sha2_word32
*)digest
;
555 unsigned int usedspace
;
558 assert(context
!= (SHA256_CTX
*)0);
560 /* If no digest buffer is passed, we don't bother doing this: */
561 if (digest
!= (sha2_byte
*)0) {
562 usedspace
= (context
->bitcount
>> 3) % SHA256_BLOCK_LENGTH
;
563 #if BYTE_ORDER == LITTLE_ENDIAN
564 /* Convert FROM host byte order */
565 REVERSE64(context
->bitcount
,context
->bitcount
);
568 /* Begin padding with a 1 bit: */
569 context
->buffer
[usedspace
++] = 0x80;
571 if (usedspace
<= SHA256_SHORT_BLOCK_LENGTH
) {
572 /* Set-up for the last transform: */
573 bzero(&context
->buffer
[usedspace
], SHA256_SHORT_BLOCK_LENGTH
- usedspace
);
575 if (usedspace
< SHA256_BLOCK_LENGTH
) {
576 bzero(&context
->buffer
[usedspace
], SHA256_BLOCK_LENGTH
- usedspace
);
578 /* Do second-to-last transform: */
579 SHA256_Transform(context
, (sha2_word32
*)context
->buffer
);
581 /* And set-up for the last transform: */
582 bzero(context
->buffer
, SHA256_SHORT_BLOCK_LENGTH
);
585 /* Set-up for the last transform: */
586 bzero(context
->buffer
, SHA256_SHORT_BLOCK_LENGTH
);
588 /* Begin padding with a 1 bit: */
589 *context
->buffer
= 0x80;
591 /* Set the bit count: */
592 *(sha2_word64
*)&context
->buffer
[SHA256_SHORT_BLOCK_LENGTH
] = context
->bitcount
;
594 /* Final transform: */
595 SHA256_Transform(context
, (sha2_word32
*)context
->buffer
);
597 #if BYTE_ORDER == LITTLE_ENDIAN
599 /* Convert TO host byte order */
601 for (j
= 0; j
< 8; j
++) {
602 REVERSE32(context
->state
[j
],context
->state
[j
]);
603 *d
++ = context
->state
[j
];
607 bcopy(context
->state
, d
, SHA256_DIGEST_LENGTH
);
611 /* Clean up state data: */
612 bzero(context
, sizeof(context
));
616 char *SHA256_End(SHA256_CTX
* context
, char buffer
[]) {
617 sha2_byte digest
[SHA256_DIGEST_LENGTH
], *d
= digest
;
621 assert(context
!= (SHA256_CTX
*)0);
623 if (buffer
!= (char*)0) {
624 SHA256_Final(digest
, context
);
626 for (i
= 0; i
< SHA256_DIGEST_LENGTH
; i
++) {
627 *buffer
++ = sha2_hex_digits
[(*d
& 0xf0) >> 4];
628 *buffer
++ = sha2_hex_digits
[*d
& 0x0f];
633 bzero(context
, sizeof(context
));
635 bzero(digest
, SHA256_DIGEST_LENGTH
);
639 char* SHA256_Data(const sha2_byte
* data
, size_t len
, char digest
[SHA256_DIGEST_STRING_LENGTH
]) {
642 SHA256_Init(&context
);
643 SHA256_Update(&context
, data
, len
);
644 return SHA256_End(&context
, digest
);
648 /*** SHA-512: *********************************************************/
649 void SHA512_Init(SHA512_CTX
* context
) {
650 if (context
== (SHA512_CTX
*)0) {
653 bcopy(sha512_initial_hash_value
, context
->state
, SHA512_DIGEST_LENGTH
);
654 bzero(context
->buffer
, SHA512_BLOCK_LENGTH
);
655 context
->bitcount
[0] = context
->bitcount
[1] = 0;
658 #ifdef SHA2_UNROLL_TRANSFORM
660 /* Unrolled SHA-512 round macros: */
661 #if BYTE_ORDER == LITTLE_ENDIAN
663 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \
664 REVERSE64(*data++, W512[j]); \
665 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
668 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)), \
672 #else /* BYTE_ORDER == LITTLE_ENDIAN */
674 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \
675 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
676 K512[j] + (W512[j] = *data++); \
678 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
681 #endif /* BYTE_ORDER == LITTLE_ENDIAN */
683 #define ROUND512(a,b,c,d,e,f,g,h) \
684 s0 = W512[(j+1)&0x0f]; \
685 s0 = sigma0_512(s0); \
686 s1 = W512[(j+14)&0x0f]; \
687 s1 = sigma1_512(s1); \
688 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + K512[j] + \
689 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); \
691 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
694 void SHA512_Transform(SHA512_CTX
* context
, const sha2_word64
* data
) {
695 sha2_word64 a
, b
, c
, d
, e
, f
, g
, h
, s0
, s1
;
696 sha2_word64 T1
, *W512
= (sha2_word64
*)context
->buffer
;
699 /* Initialize registers with the prev. intermediate value */
700 a
= context
->state
[0];
701 b
= context
->state
[1];
702 c
= context
->state
[2];
703 d
= context
->state
[3];
704 e
= context
->state
[4];
705 f
= context
->state
[5];
706 g
= context
->state
[6];
707 h
= context
->state
[7];
711 ROUND512_0_TO_15(a
,b
,c
,d
,e
,f
,g
,h
);
712 ROUND512_0_TO_15(h
,a
,b
,c
,d
,e
,f
,g
);
713 ROUND512_0_TO_15(g
,h
,a
,b
,c
,d
,e
,f
);
714 ROUND512_0_TO_15(f
,g
,h
,a
,b
,c
,d
,e
);
715 ROUND512_0_TO_15(e
,f
,g
,h
,a
,b
,c
,d
);
716 ROUND512_0_TO_15(d
,e
,f
,g
,h
,a
,b
,c
);
717 ROUND512_0_TO_15(c
,d
,e
,f
,g
,h
,a
,b
);
718 ROUND512_0_TO_15(b
,c
,d
,e
,f
,g
,h
,a
);
721 /* Now for the remaining rounds up to 79: */
723 ROUND512(a
,b
,c
,d
,e
,f
,g
,h
);
724 ROUND512(h
,a
,b
,c
,d
,e
,f
,g
);
725 ROUND512(g
,h
,a
,b
,c
,d
,e
,f
);
726 ROUND512(f
,g
,h
,a
,b
,c
,d
,e
);
727 ROUND512(e
,f
,g
,h
,a
,b
,c
,d
);
728 ROUND512(d
,e
,f
,g
,h
,a
,b
,c
);
729 ROUND512(c
,d
,e
,f
,g
,h
,a
,b
);
730 ROUND512(b
,c
,d
,e
,f
,g
,h
,a
);
733 /* Compute the current intermediate hash value */
734 context
->state
[0] += a
;
735 context
->state
[1] += b
;
736 context
->state
[2] += c
;
737 context
->state
[3] += d
;
738 context
->state
[4] += e
;
739 context
->state
[5] += f
;
740 context
->state
[6] += g
;
741 context
->state
[7] += h
;
744 a
= b
= c
= d
= e
= f
= g
= h
= T1
= 0;
747 #else /* SHA2_UNROLL_TRANSFORM */
749 void SHA512_Transform(SHA512_CTX
* context
, const sha2_word64
* data
) {
750 sha2_word64 a
, b
, c
, d
, e
, f
, g
, h
, s0
, s1
;
751 sha2_word64 T1
, T2
, *W512
= (sha2_word64
*)context
->buffer
;
754 /* Initialize registers with the prev. intermediate value */
755 a
= context
->state
[0];
756 b
= context
->state
[1];
757 c
= context
->state
[2];
758 d
= context
->state
[3];
759 e
= context
->state
[4];
760 f
= context
->state
[5];
761 g
= context
->state
[6];
762 h
= context
->state
[7];
766 #if BYTE_ORDER == LITTLE_ENDIAN
767 /* Convert TO host byte order */
768 REVERSE64(*data
++, W512
[j
]);
769 /* Apply the SHA-512 compression function to update a..h */
770 T1
= h
+ Sigma1_512(e
) + Ch(e
, f
, g
) + K512
[j
] + W512
[j
];
771 #else /* BYTE_ORDER == LITTLE_ENDIAN */
772 /* Apply the SHA-512 compression function to update a..h with copy */
773 T1
= h
+ Sigma1_512(e
) + Ch(e
, f
, g
) + K512
[j
] + (W512
[j
] = *data
++);
774 #endif /* BYTE_ORDER == LITTLE_ENDIAN */
775 T2
= Sigma0_512(a
) + Maj(a
, b
, c
);
789 /* Part of the message block expansion: */
790 s0
= W512
[(j
+1)&0x0f];
792 s1
= W512
[(j
+14)&0x0f];
795 /* Apply the SHA-512 compression function to update a..h */
796 T1
= h
+ Sigma1_512(e
) + Ch(e
, f
, g
) + K512
[j
] +
797 (W512
[j
&0x0f] += s1
+ W512
[(j
+9)&0x0f] + s0
);
798 T2
= Sigma0_512(a
) + Maj(a
, b
, c
);
811 /* Compute the current intermediate hash value */
812 context
->state
[0] += a
;
813 context
->state
[1] += b
;
814 context
->state
[2] += c
;
815 context
->state
[3] += d
;
816 context
->state
[4] += e
;
817 context
->state
[5] += f
;
818 context
->state
[6] += g
;
819 context
->state
[7] += h
;
822 a
= b
= c
= d
= e
= f
= g
= h
= T1
= T2
= 0;
825 #endif /* SHA2_UNROLL_TRANSFORM */
827 void SHA512_Update(SHA512_CTX
* context
, const sha2_byte
*data
, size_t len
) {
828 unsigned int freespace
, usedspace
;
831 /* Calling with no data is valid - we do nothing */
836 assert(context
!= (SHA512_CTX
*)0 && data
!= (sha2_byte
*)0);
838 usedspace
= (context
->bitcount
[0] >> 3) % SHA512_BLOCK_LENGTH
;
840 /* Calculate how much free space is available in the buffer */
841 freespace
= SHA512_BLOCK_LENGTH
- usedspace
;
843 if (len
>= freespace
) {
844 /* Fill the buffer completely and process it */
845 bcopy(data
, &context
->buffer
[usedspace
], freespace
);
846 ADDINC128(context
->bitcount
, freespace
<< 3);
849 SHA512_Transform(context
, (sha2_word64
*)context
->buffer
);
851 /* The buffer is not yet full */
852 bcopy(data
, &context
->buffer
[usedspace
], len
);
853 ADDINC128(context
->bitcount
, len
<< 3);
855 usedspace
= freespace
= 0;
859 while (len
>= SHA512_BLOCK_LENGTH
) {
860 /* Process as many complete blocks as we can */
861 SHA512_Transform(context
, (const sha2_word64
*)data
);
862 ADDINC128(context
->bitcount
, SHA512_BLOCK_LENGTH
<< 3);
863 len
-= SHA512_BLOCK_LENGTH
;
864 data
+= SHA512_BLOCK_LENGTH
;
867 /* There's left-overs, so save 'em */
868 bcopy(data
, context
->buffer
, len
);
869 ADDINC128(context
->bitcount
, len
<< 3);
872 usedspace
= freespace
= 0;
875 void SHA512_Last(SHA512_CTX
* context
) {
876 unsigned int usedspace
;
878 usedspace
= (context
->bitcount
[0] >> 3) % SHA512_BLOCK_LENGTH
;
879 #if BYTE_ORDER == LITTLE_ENDIAN
880 /* Convert FROM host byte order */
881 REVERSE64(context
->bitcount
[0],context
->bitcount
[0]);
882 REVERSE64(context
->bitcount
[1],context
->bitcount
[1]);
885 /* Begin padding with a 1 bit: */
886 context
->buffer
[usedspace
++] = 0x80;
888 if (usedspace
<= SHA512_SHORT_BLOCK_LENGTH
) {
889 /* Set-up for the last transform: */
890 bzero(&context
->buffer
[usedspace
], SHA512_SHORT_BLOCK_LENGTH
- usedspace
);
892 if (usedspace
< SHA512_BLOCK_LENGTH
) {
893 bzero(&context
->buffer
[usedspace
], SHA512_BLOCK_LENGTH
- usedspace
);
895 /* Do second-to-last transform: */
896 SHA512_Transform(context
, (sha2_word64
*)context
->buffer
);
898 /* And set-up for the last transform: */
899 bzero(context
->buffer
, SHA512_BLOCK_LENGTH
- 2);
902 /* Prepare for final transform: */
903 bzero(context
->buffer
, SHA512_SHORT_BLOCK_LENGTH
);
905 /* Begin padding with a 1 bit: */
906 *context
->buffer
= 0x80;
908 /* Store the length of input data (in bits): */
909 *(sha2_word64
*)&context
->buffer
[SHA512_SHORT_BLOCK_LENGTH
] = context
->bitcount
[1];
910 *(sha2_word64
*)&context
->buffer
[SHA512_SHORT_BLOCK_LENGTH
+8] = context
->bitcount
[0];
912 /* Final transform: */
913 SHA512_Transform(context
, (sha2_word64
*)context
->buffer
);
916 void SHA512_Final(sha2_byte digest
[], SHA512_CTX
* context
) {
917 sha2_word64
*d
= (sha2_word64
*)digest
;
920 assert(context
!= (SHA512_CTX
*)0);
922 /* If no digest buffer is passed, we don't bother doing this: */
923 if (digest
!= (sha2_byte
*)0) {
924 SHA512_Last(context
);
926 /* Save the hash data for output: */
927 #if BYTE_ORDER == LITTLE_ENDIAN
929 /* Convert TO host byte order */
931 for (j
= 0; j
< 8; j
++) {
932 REVERSE64(context
->state
[j
],context
->state
[j
]);
933 *d
++ = context
->state
[j
];
937 bcopy(context
->state
, d
, SHA512_DIGEST_LENGTH
);
941 /* Zero out state data */
942 bzero(context
, sizeof(context
));
945 char *SHA512_End(SHA512_CTX
* context
, char buffer
[]) {
946 sha2_byte digest
[SHA512_DIGEST_LENGTH
], *d
= digest
;
950 assert(context
!= (SHA512_CTX
*)0);
952 if (buffer
!= (char*)0) {
953 SHA512_Final(digest
, context
);
955 for (i
= 0; i
< SHA512_DIGEST_LENGTH
; i
++) {
956 *buffer
++ = sha2_hex_digits
[(*d
& 0xf0) >> 4];
957 *buffer
++ = sha2_hex_digits
[*d
& 0x0f];
962 bzero(context
, sizeof(context
));
964 bzero(digest
, SHA512_DIGEST_LENGTH
);
968 char* SHA512_Data(const sha2_byte
* data
, size_t len
, char digest
[SHA512_DIGEST_STRING_LENGTH
]) {
971 SHA512_Init(&context
);
972 SHA512_Update(&context
, data
, len
);
973 return SHA512_End(&context
, digest
);
977 /*** SHA-384: *********************************************************/
978 void SHA384_Init(SHA384_CTX
* context
) {
979 if (context
== (SHA384_CTX
*)0) {
982 bcopy(sha384_initial_hash_value
, context
->state
, SHA512_DIGEST_LENGTH
);
983 bzero(context
->buffer
, SHA384_BLOCK_LENGTH
);
984 context
->bitcount
[0] = context
->bitcount
[1] = 0;
987 void SHA384_Update(SHA384_CTX
* context
, const sha2_byte
* data
, size_t len
) {
988 SHA512_Update((SHA512_CTX
*)context
, data
, len
);
991 void SHA384_Final(sha2_byte digest
[], SHA384_CTX
* context
) {
992 sha2_word64
*d
= (sha2_word64
*)digest
;
995 assert(context
!= (SHA384_CTX
*)0);
997 /* If no digest buffer is passed, we don't bother doing this: */
998 if (digest
!= (sha2_byte
*)0) {
999 SHA512_Last((SHA512_CTX
*)context
);
1001 /* Save the hash data for output: */
1002 #if BYTE_ORDER == LITTLE_ENDIAN
1004 /* Convert TO host byte order */
1006 for (j
= 0; j
< 6; j
++) {
1007 REVERSE64(context
->state
[j
],context
->state
[j
]);
1008 *d
++ = context
->state
[j
];
1012 bcopy(context
->state
, d
, SHA384_DIGEST_LENGTH
);
1016 /* Zero out state data */
1017 bzero(context
, sizeof(context
));
1020 char *SHA384_End(SHA384_CTX
* context
, char buffer
[]) {
1021 sha2_byte digest
[SHA384_DIGEST_LENGTH
], *d
= digest
;
1025 assert(context
!= (SHA384_CTX
*)0);
1027 if (buffer
!= (char*)0) {
1028 SHA384_Final(digest
, context
);
1030 for (i
= 0; i
< SHA384_DIGEST_LENGTH
; i
++) {
1031 *buffer
++ = sha2_hex_digits
[(*d
& 0xf0) >> 4];
1032 *buffer
++ = sha2_hex_digits
[*d
& 0x0f];
1037 bzero(context
, sizeof(context
));
1039 bzero(digest
, SHA384_DIGEST_LENGTH
);
1043 char* SHA384_Data(const sha2_byte
* data
, size_t len
, char digest
[SHA384_DIGEST_STRING_LENGTH
]) {
1046 SHA384_Init(&context
);
1047 SHA384_Update(&context
, data
, len
);
1048 return SHA384_End(&context
, digest
);