lib/sha256.c

   1 /* sha256.c - Functions to compute SHA256 and SHA224 message digest of files or
   2    memory blocks according to the NIST specification FIPS-180-2.
   3
   4    Copyright (C) 2005-2006, 2008-2018 Free Software Foundation, Inc.
   5
   6    This program is free software: you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation, either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
  18
  19 /* Written by David Madore, considerably copypasting from
  20    Scott G. Miller's sha1.c
  21 */
  22
  23 #include <config.h>
  24
  25 #if HAVE_OPENSSL_SHA256
  26 # define GL_OPENSSL_INLINE _GL_EXTERN_INLINE
  27 #endif
  28 #include "sha256.h"
  29
  30 #include <stdalign.h>
  31 #include <stdint.h>
  32 #include <stdlib.h>
  33 #include <string.h>
  34
  35 #include "af_alg.h"
  36
  37 #if USE_UNLOCKED_IO
  38 # include "unlocked-io.h"
  39 #endif
  40
  41 #ifdef WORDS_BIGENDIAN
  42 # define SWAP(n) (n)
  43 #else
  44 # define SWAP(n) \
  45     (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24))
  46 #endif
  47
  48 #define BLOCKSIZE 32768
  49 #if BLOCKSIZE % 64 != 0
  50 # error "invalid BLOCKSIZE"
  51 #endif
  52
  53 #if ! HAVE_OPENSSL_SHA256
  54 /* This array contains the bytes used to pad the buffer to the next
  55    64-byte boundary.  */
  56 static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ...  */ };
  57
  58
  59 /*
  60   Takes a pointer to a 256 bit block of data (eight 32 bit ints) and
  61   initializes it to the start constants of the SHA256 algorithm.  This
  62   must be called before using hash in the call to sha256_hash
  63 */
  64 void
  65 sha256_init_ctx (struct sha256_ctx *ctx)
  66 {
  67   ctx->state[0] = 0x6a09e667UL;
  68   ctx->state[1] = 0xbb67ae85UL;
  69   ctx->state[2] = 0x3c6ef372UL;
  70   ctx->state[3] = 0xa54ff53aUL;
  71   ctx->state[4] = 0x510e527fUL;
  72   ctx->state[5] = 0x9b05688cUL;
  73   ctx->state[6] = 0x1f83d9abUL;
  74   ctx->state[7] = 0x5be0cd19UL;
  75
  76   ctx->total[0] = ctx->total[1] = 0;
  77   ctx->buflen = 0;
  78 }
  79
  80 void
  81 sha224_init_ctx (struct sha256_ctx *ctx)
  82 {
  83   ctx->state[0] = 0xc1059ed8UL;
  84   ctx->state[1] = 0x367cd507UL;
  85   ctx->state[2] = 0x3070dd17UL;
  86   ctx->state[3] = 0xf70e5939UL;
  87   ctx->state[4] = 0xffc00b31UL;
  88   ctx->state[5] = 0x68581511UL;
  89   ctx->state[6] = 0x64f98fa7UL;
  90   ctx->state[7] = 0xbefa4fa4UL;
  91
  92   ctx->total[0] = ctx->total[1] = 0;
  93   ctx->buflen = 0;
  94 }
  95
  96 /* Copy the value from v into the memory location pointed to by *cp,
  97    If your architecture allows unaligned access this is equivalent to
  98    * (uint32_t *) cp = v  */
  99 static void
 100 set_uint32 (char *cp, uint32_t v)
 101 {
 102   memcpy (cp, &v, sizeof v);
 103 }
 104
 105 /* Put result from CTX in first 32 bytes following RESBUF.  The result
 106    must be in little endian byte order.  */
 107 void *
 108 sha256_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
 109 {
 110   int i;
 111   char *r = resbuf;
 112
 113   for (i = 0; i < 8; i++)
 114     set_uint32 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
 115
 116   return resbuf;
 117 }
 118
 119 void *
 120 sha224_read_ctx (const struct sha256_ctx *ctx, void *resbuf)
 121 {
 122   int i;
 123   char *r = resbuf;
 124
 125   for (i = 0; i < 7; i++)
 126     set_uint32 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
 127
 128   return resbuf;
 129 }
 130
 131 /* Process the remaining bytes in the internal buffer and the usual
 132    prolog according to the standard and write the result to RESBUF.  */
 133 static void
 134 sha256_conclude_ctx (struct sha256_ctx *ctx)
 135 {
 136   /* Take yet unprocessed bytes into account.  */
 137   size_t bytes = ctx->buflen;
 138   size_t size = (bytes < 56) ? 64 / 4 : 64 * 2 / 4;
 139
 140   /* Now count remaining bytes.  */
 141   ctx->total[0] += bytes;
 142   if (ctx->total[0] < bytes)
 143     ++ctx->total[1];
 144
 145   /* Put the 64-bit file length in *bits* at the end of the buffer.
 146      Use set_uint32 rather than a simple assignment, to avoid risk of
 147      unaligned access.  */
 148   set_uint32 ((char *) &ctx->buffer[size - 2],
 149               SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29)));
 150   set_uint32 ((char *) &ctx->buffer[size - 1],
 151               SWAP (ctx->total[0] << 3));
 152
 153   memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 4 - bytes);
 154
 155   /* Process last bytes.  */
 156   sha256_process_block (ctx->buffer, size * 4, ctx);
 157 }
 158
 159 void *
 160 sha256_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
 161 {
 162   sha256_conclude_ctx (ctx);
 163   return sha256_read_ctx (ctx, resbuf);
 164 }
 165
 166 void *
 167 sha224_finish_ctx (struct sha256_ctx *ctx, void *resbuf)
 168 {
 169   sha256_conclude_ctx (ctx);
 170   return sha224_read_ctx (ctx, resbuf);
 171 }
 172 #endif
 173
 174 /* Compute SHA256 message digest for bytes read from STREAM.  The
 175    resulting message digest number will be written into the 32 bytes
 176    beginning at RESBLOCK.  */
 177 int
 178 sha256_stream (FILE *stream, void *resblock)
 179 {
 180   struct sha256_ctx ctx;
 181   size_t sum;
 182   char *buffer;
 183
 184   {
 185     int ret = afalg_stream (stream, "sha256", resblock, SHA256_DIGEST_SIZE);
 186     if (!ret)
 187       return 0;
 188
 189     if (ret == -EIO)
 190       return 1;
 191   }
 192
 193   buffer = malloc (BLOCKSIZE + 72);
 194   if (!buffer)
 195     return 1;
 196
 197   /* Initialize the computation context.  */
 198   sha256_init_ctx (&ctx);
 199
 200   /* Iterate over full file contents.  */
 201   while (1)
 202     {
 203       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 204          computation function processes the whole buffer so that with the
 205          next round of the loop another block can be read.  */
 206       size_t n;
 207       sum = 0;
 208
 209       /* Read block.  Take care for partial reads.  */
 210       while (1)
 211         {
 212           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 213
 214           sum += n;
 215
 216           if (sum == BLOCKSIZE)
 217             break;
 218
 219           if (n == 0)
 220             {
 221               /* Check for the error flag IFF N == 0, so that we don't
 222                  exit the loop after a partial read due to e.g., EAGAIN
 223                  or EWOULDBLOCK.  */
 224               if (ferror (stream))
 225                 {
 226                   free (buffer);
 227                   return 1;
 228                 }
 229               goto process_partial_block;
 230             }
 231
 232           /* We've read at least one byte, so ignore errors.  But always
 233              check for EOF, since feof may be true even though N > 0.
 234              Otherwise, we could end up calling fread after EOF.  */
 235           if (feof (stream))
 236             goto process_partial_block;
 237         }
 238
 239       /* Process buffer with BLOCKSIZE bytes.  Note that
 240                         BLOCKSIZE % 64 == 0
 241        */
 242       sha256_process_block (buffer, BLOCKSIZE, &ctx);
 243     }
 244
 245  process_partial_block:;
 246
 247   /* Process any remaining bytes.  */
 248   if (sum > 0)
 249     sha256_process_bytes (buffer, sum, &ctx);
 250
 251   /* Construct result in desired memory.  */
 252   sha256_finish_ctx (&ctx, resblock);
 253   free (buffer);
 254   return 0;
 255 }
 256
 257 /* FIXME: Avoid code duplication */
 258 int
 259 sha224_stream (FILE *stream, void *resblock)
 260 {
 261   struct sha256_ctx ctx;
 262   size_t sum;
 263   char *buffer;
 264
 265   {
 266     int ret = afalg_stream(stream, "sha224", resblock, SHA224_DIGEST_SIZE);
 267     if (!ret)
 268       return 0;
 269
 270     if (ret == -EIO)
 271       return 1;
 272   }
 273
 274   buffer = malloc (BLOCKSIZE + 72);
 275   if (!buffer)
 276     return 1;
 277
 278   /* Initialize the computation context.  */
 279   sha224_init_ctx (&ctx);
 280
 281   /* Iterate over full file contents.  */
 282   while (1)
 283     {
 284       /* We read the file in blocks of BLOCKSIZE bytes.  One call of the
 285          computation function processes the whole buffer so that with the
 286          next round of the loop another block can be read.  */
 287       size_t n;
 288       sum = 0;
 289
 290       /* Read block.  Take care for partial reads.  */
 291       while (1)
 292         {
 293           n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
 294
 295           sum += n;
 296
 297           if (sum == BLOCKSIZE)
 298             break;
 299
 300           if (n == 0)
 301             {
 302               /* Check for the error flag IFF N == 0, so that we don't
 303                  exit the loop after a partial read due to e.g., EAGAIN
 304                  or EWOULDBLOCK.  */
 305               if (ferror (stream))
 306                 {
 307                   free (buffer);
 308                   return 1;
 309                 }
 310               goto process_partial_block;
 311             }
 312
 313           /* We've read at least one byte, so ignore errors.  But always
 314              check for EOF, since feof may be true even though N > 0.
 315              Otherwise, we could end up calling fread after EOF.  */
 316           if (feof (stream))
 317             goto process_partial_block;
 318         }
 319
 320       /* Process buffer with BLOCKSIZE bytes.  Note that
 321                         BLOCKSIZE % 64 == 0
 322        */
 323       sha256_process_block (buffer, BLOCKSIZE, &ctx);
 324     }
 325
 326  process_partial_block:;
 327
 328   /* Process any remaining bytes.  */
 329   if (sum > 0)
 330     sha256_process_bytes (buffer, sum, &ctx);
 331
 332   /* Construct result in desired memory.  */
 333   sha224_finish_ctx (&ctx, resblock);
 334   free (buffer);
 335   return 0;
 336 }
 337
 338 #if ! HAVE_OPENSSL_SHA256
 339 /* Compute SHA512 message digest for LEN bytes beginning at BUFFER.  The
 340    result is always in little endian byte order, so that a byte-wise
 341    output yields to the wanted ASCII representation of the message
 342    digest.  */
 343 void *
 344 sha256_buffer (const char *buffer, size_t len, void *resblock)
 345 {
 346   struct sha256_ctx ctx;
 347
 348   /* Initialize the computation context.  */
 349   sha256_init_ctx (&ctx);
 350
 351   /* Process whole buffer but last len % 64 bytes.  */
 352   sha256_process_bytes (buffer, len, &ctx);
 353
 354   /* Put result in desired memory area.  */
 355   return sha256_finish_ctx (&ctx, resblock);
 356 }
 357
 358 void *
 359 sha224_buffer (const char *buffer, size_t len, void *resblock)
 360 {
 361   struct sha256_ctx ctx;
 362
 363   /* Initialize the computation context.  */
 364   sha224_init_ctx (&ctx);
 365
 366   /* Process whole buffer but last len % 64 bytes.  */
 367   sha256_process_bytes (buffer, len, &ctx);
 368
 369   /* Put result in desired memory area.  */
 370   return sha224_finish_ctx (&ctx, resblock);
 371 }
 372
 373 void
 374 sha256_process_bytes (const void *buffer, size_t len, struct sha256_ctx *ctx)
 375 {
 376   /* When we already have some bits in our internal buffer concatenate
 377      both inputs first.  */
 378   if (ctx->buflen != 0)
 379     {
 380       size_t left_over = ctx->buflen;
 381       size_t add = 128 - left_over > len ? len : 128 - left_over;
 382
 383       memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
 384       ctx->buflen += add;
 385
 386       if (ctx->buflen > 64)
 387         {
 388           sha256_process_block (ctx->buffer, ctx->buflen & ~63, ctx);
 389
 390           ctx->buflen &= 63;
 391           /* The regions in the following copy operation cannot overlap,
 392              because ctx->buflen < 64 ≤ (left_over + add) & ~63.  */
 393           memcpy (ctx->buffer,
 394                   &((char *) ctx->buffer)[(left_over + add) & ~63],
 395                   ctx->buflen);
 396         }
 397
 398       buffer = (const char *) buffer + add;
 399       len -= add;
 400     }
 401
 402   /* Process available complete blocks.  */
 403   if (len >= 64)
 404     {
 405 #if !(_STRING_ARCH_unaligned || _STRING_INLINE_unaligned)
 406 # define UNALIGNED_P(p) ((uintptr_t) (p) % alignof (uint32_t) != 0)
 407       if (UNALIGNED_P (buffer))
 408         while (len > 64)
 409           {
 410             sha256_process_block (memcpy (ctx->buffer, buffer, 64), 64, ctx);
 411             buffer = (const char *) buffer + 64;
 412             len -= 64;
 413           }
 414       else
 415 #endif
 416         {
 417           sha256_process_block (buffer, len & ~63, ctx);
 418           buffer = (const char *) buffer + (len & ~63);
 419           len &= 63;
 420         }
 421     }
 422
 423   /* Move remaining bytes in internal buffer.  */
 424   if (len > 0)
 425     {
 426       size_t left_over = ctx->buflen;
 427
 428       memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
 429       left_over += len;
 430       if (left_over >= 64)
 431         {
 432           sha256_process_block (ctx->buffer, 64, ctx);
 433           left_over -= 64;
 434           /* The regions in the following copy operation cannot overlap,
 435              because left_over ≤ 64.  */
 436           memcpy (ctx->buffer, &ctx->buffer[16], left_over);
 437         }
 438       ctx->buflen = left_over;
 439     }
 440 }
 441
 442 /* --- Code below is the primary difference between sha1.c and sha256.c --- */
 443
 444 /* SHA256 round constants */
 445 #define K(I) sha256_round_constants[I]
 446 static const uint32_t sha256_round_constants[64] = {
 447   0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
 448   0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
 449   0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
 450   0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
 451   0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
 452   0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
 453   0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
 454   0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
 455   0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
 456   0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
 457   0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
 458   0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
 459   0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
 460   0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
 461   0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
 462   0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL,
 463 };
 464
 465 /* Round functions.  */
 466 #define F2(A,B,C) ( ( A & B ) | ( C & ( A | B ) ) )
 467 #define F1(E,F,G) ( G ^ ( E & ( F ^ G ) ) )
 468
 469 /* Process LEN bytes of BUFFER, accumulating context into CTX.
 470    It is assumed that LEN % 64 == 0.
 471    Most of this code comes from GnuPG's cipher/sha1.c.  */
 472
 473 void
 474 sha256_process_block (const void *buffer, size_t len, struct sha256_ctx *ctx)
 475 {
 476   const uint32_t *words = buffer;
 477   size_t nwords = len / sizeof (uint32_t);
 478   const uint32_t *endp = words + nwords;
 479   uint32_t x[16];
 480   uint32_t a = ctx->state[0];
 481   uint32_t b = ctx->state[1];
 482   uint32_t c = ctx->state[2];
 483   uint32_t d = ctx->state[3];
 484   uint32_t e = ctx->state[4];
 485   uint32_t f = ctx->state[5];
 486   uint32_t g = ctx->state[6];
 487   uint32_t h = ctx->state[7];
 488   uint32_t lolen = len;
 489
 490   /* First increment the byte count.  FIPS PUB 180-2 specifies the possible
 491      length of the file up to 2^64 bits.  Here we only compute the
 492      number of bytes.  Do a double word increment.  */
 493   ctx->total[0] += lolen;
 494   ctx->total[1] += (len >> 31 >> 1) + (ctx->total[0] < lolen);
 495
 496 #define rol(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
 497 #define S0(x) (rol(x,25)^rol(x,14)^(x>>3))
 498 #define S1(x) (rol(x,15)^rol(x,13)^(x>>10))
 499 #define SS0(x) (rol(x,30)^rol(x,19)^rol(x,10))
 500 #define SS1(x) (rol(x,26)^rol(x,21)^rol(x,7))
 501
 502 #define M(I) ( tm =   S1(x[(I-2)&0x0f]) + x[(I-7)&0x0f] \
 503                     + S0(x[(I-15)&0x0f]) + x[I&0x0f]    \
 504                , x[I&0x0f] = tm )
 505
 506 #define R(A,B,C,D,E,F,G,H,K,M)  do { t0 = SS0(A) + F2(A,B,C); \
 507                                      t1 = H + SS1(E)  \
 508                                       + F1(E,F,G)     \
 509                                       + K             \
 510                                       + M;            \
 511                                      D += t1;  H = t0 + t1; \
 512                                } while(0)
 513
 514   while (words < endp)
 515     {
 516       uint32_t tm;
 517       uint32_t t0, t1;
 518       int t;
 519       /* FIXME: see sha1.c for a better implementation.  */
 520       for (t = 0; t < 16; t++)
 521         {
 522           x[t] = SWAP (*words);
 523           words++;
 524         }
 525
 526       R( a, b, c, d, e, f, g, h, K( 0), x[ 0] );
 527       R( h, a, b, c, d, e, f, g, K( 1), x[ 1] );
 528       R( g, h, a, b, c, d, e, f, K( 2), x[ 2] );
 529       R( f, g, h, a, b, c, d, e, K( 3), x[ 3] );
 530       R( e, f, g, h, a, b, c, d, K( 4), x[ 4] );
 531       R( d, e, f, g, h, a, b, c, K( 5), x[ 5] );
 532       R( c, d, e, f, g, h, a, b, K( 6), x[ 6] );
 533       R( b, c, d, e, f, g, h, a, K( 7), x[ 7] );
 534       R( a, b, c, d, e, f, g, h, K( 8), x[ 8] );
 535       R( h, a, b, c, d, e, f, g, K( 9), x[ 9] );
 536       R( g, h, a, b, c, d, e, f, K(10), x[10] );
 537       R( f, g, h, a, b, c, d, e, K(11), x[11] );
 538       R( e, f, g, h, a, b, c, d, K(12), x[12] );
 539       R( d, e, f, g, h, a, b, c, K(13), x[13] );
 540       R( c, d, e, f, g, h, a, b, K(14), x[14] );
 541       R( b, c, d, e, f, g, h, a, K(15), x[15] );
 542       R( a, b, c, d, e, f, g, h, K(16), M(16) );
 543       R( h, a, b, c, d, e, f, g, K(17), M(17) );
 544       R( g, h, a, b, c, d, e, f, K(18), M(18) );
 545       R( f, g, h, a, b, c, d, e, K(19), M(19) );
 546       R( e, f, g, h, a, b, c, d, K(20), M(20) );
 547       R( d, e, f, g, h, a, b, c, K(21), M(21) );
 548       R( c, d, e, f, g, h, a, b, K(22), M(22) );
 549       R( b, c, d, e, f, g, h, a, K(23), M(23) );
 550       R( a, b, c, d, e, f, g, h, K(24), M(24) );
 551       R( h, a, b, c, d, e, f, g, K(25), M(25) );
 552       R( g, h, a, b, c, d, e, f, K(26), M(26) );
 553       R( f, g, h, a, b, c, d, e, K(27), M(27) );
 554       R( e, f, g, h, a, b, c, d, K(28), M(28) );
 555       R( d, e, f, g, h, a, b, c, K(29), M(29) );
 556       R( c, d, e, f, g, h, a, b, K(30), M(30) );
 557       R( b, c, d, e, f, g, h, a, K(31), M(31) );
 558       R( a, b, c, d, e, f, g, h, K(32), M(32) );
 559       R( h, a, b, c, d, e, f, g, K(33), M(33) );
 560       R( g, h, a, b, c, d, e, f, K(34), M(34) );
 561       R( f, g, h, a, b, c, d, e, K(35), M(35) );
 562       R( e, f, g, h, a, b, c, d, K(36), M(36) );
 563       R( d, e, f, g, h, a, b, c, K(37), M(37) );
 564       R( c, d, e, f, g, h, a, b, K(38), M(38) );
 565       R( b, c, d, e, f, g, h, a, K(39), M(39) );
 566       R( a, b, c, d, e, f, g, h, K(40), M(40) );
 567       R( h, a, b, c, d, e, f, g, K(41), M(41) );
 568       R( g, h, a, b, c, d, e, f, K(42), M(42) );
 569       R( f, g, h, a, b, c, d, e, K(43), M(43) );
 570       R( e, f, g, h, a, b, c, d, K(44), M(44) );
 571       R( d, e, f, g, h, a, b, c, K(45), M(45) );
 572       R( c, d, e, f, g, h, a, b, K(46), M(46) );
 573       R( b, c, d, e, f, g, h, a, K(47), M(47) );
 574       R( a, b, c, d, e, f, g, h, K(48), M(48) );
 575       R( h, a, b, c, d, e, f, g, K(49), M(49) );
 576       R( g, h, a, b, c, d, e, f, K(50), M(50) );
 577       R( f, g, h, a, b, c, d, e, K(51), M(51) );
 578       R( e, f, g, h, a, b, c, d, K(52), M(52) );
 579       R( d, e, f, g, h, a, b, c, K(53), M(53) );
 580       R( c, d, e, f, g, h, a, b, K(54), M(54) );
 581       R( b, c, d, e, f, g, h, a, K(55), M(55) );
 582       R( a, b, c, d, e, f, g, h, K(56), M(56) );
 583       R( h, a, b, c, d, e, f, g, K(57), M(57) );
 584       R( g, h, a, b, c, d, e, f, K(58), M(58) );
 585       R( f, g, h, a, b, c, d, e, K(59), M(59) );
 586       R( e, f, g, h, a, b, c, d, K(60), M(60) );
 587       R( d, e, f, g, h, a, b, c, K(61), M(61) );
 588       R( c, d, e, f, g, h, a, b, K(62), M(62) );
 589       R( b, c, d, e, f, g, h, a, K(63), M(63) );
 590
 591       a = ctx->state[0] += a;
 592       b = ctx->state[1] += b;
 593       c = ctx->state[2] += c;
 594       d = ctx->state[3] += d;
 595       e = ctx->state[4] += e;
 596       f = ctx->state[5] += f;
 597       g = ctx->state[6] += g;
 598       h = ctx->state[7] += h;
 599     }
 600 }
 601 #endif
 602
 603 /*
 604  * Hey Emacs!
 605  * Local Variables:
 606  * coding: utf-8
 607  * End:
 608  */