source: rtems/cpukit/libmd/sha512c.c @ 0e16fa45

5
Last change on this file since 0e16fa45 was 1bcd0378, checked in by Sebastian Huber <sebastian.huber@…>, on 11/13/14 at 12:18:24

Add SHA256 and SHA512 support
  • Property mode set to 100644
File size: 9.8 KB
Line 
1/*-
2 * Copyright 2005 Colin Percival
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD$");
29
30#include <sys/endian.h>
31#include <sys/types.h>
32
33#include <string.h>
34
35#include "sha512.h"
36
37#if BYTE_ORDER == BIG_ENDIAN
38
39/* Copy a vector of big-endian uint64_t into a vector of bytes */
40#define be64enc_vect(dst, src, len)     \
41        memcpy((void *)dst, (const void *)src, (size_t)len)
42
43/* Copy a vector of bytes into a vector of big-endian uint64_t */
44#define be64dec_vect(dst, src, len)     \
45        memcpy((void *)dst, (const void *)src, (size_t)len)
46
47#else /* BYTE_ORDER != BIG_ENDIAN */
48
49/*
50 * Encode a length len/4 vector of (uint64_t) into a length len vector of
51 * (unsigned char) in big-endian form.  Assumes len is a multiple of 8.
52 */
53static void
54be64enc_vect(unsigned char *dst, const uint64_t *src, size_t len)
55{
56        size_t i;
57
58        for (i = 0; i < len / 8; i++)
59                be64enc(dst + i * 8, src[i]);
60}
61
62/*
63 * Decode a big-endian length len vector of (unsigned char) into a length
64 * len/4 vector of (uint64_t).  Assumes len is a multiple of 8.
65 */
66static void
67be64dec_vect(uint64_t *dst, const unsigned char *src, size_t len)
68{
69        size_t i;
70
71        for (i = 0; i < len / 8; i++)
72                dst[i] = be64dec(src + i * 8);
73}
74
75#endif /* BYTE_ORDER != BIG_ENDIAN */
76
77/* Elementary functions used by SHA512 */
78#define Ch(x, y, z)     ((x & (y ^ z)) ^ z)
79#define Maj(x, y, z)    ((x & (y | z)) | (y & z))
80#define SHR(x, n)       (x >> n)
81#define ROTR(x, n)      ((x >> n) | (x << (64 - n)))
82#define S0(x)           (ROTR(x, 28) ^ ROTR(x, 34) ^ ROTR(x, 39))
83#define S1(x)           (ROTR(x, 14) ^ ROTR(x, 18) ^ ROTR(x, 41))
84#define s0(x)           (ROTR(x, 1) ^ ROTR(x, 8) ^ SHR(x, 7))
85#define s1(x)           (ROTR(x, 19) ^ ROTR(x, 61) ^ SHR(x, 6))
86
87/* SHA512 round function */
88#define RND(a, b, c, d, e, f, g, h, k)                  \
89        t0 = h + S1(e) + Ch(e, f, g) + k;               \
90        t1 = S0(a) + Maj(a, b, c);                      \
91        d += t0;                                        \
92        h  = t0 + t1;
93
94/* Adjusted round function for rotating state */
95#define RNDr(S, W, i, k)                        \
96        RND(S[(80 - i) % 8], S[(81 - i) % 8],   \
97            S[(82 - i) % 8], S[(83 - i) % 8],   \
98            S[(84 - i) % 8], S[(85 - i) % 8],   \
99            S[(86 - i) % 8], S[(87 - i) % 8],   \
100            W[i] + k)
101
102/*
103 * SHA512 block compression function.  The 512-bit state is transformed via
104 * the 512-bit input block to produce a new state.
105 */
106static void
107SHA512_Transform(uint64_t * state, const unsigned char block[128])
108{
109        uint64_t W[80];
110        uint64_t S[8];
111        uint64_t t0, t1;
112        int i;
113
114        /* 1. Prepare message schedule W. */
115        be64dec_vect(W, block, 128);
116        for (i = 16; i < 80; i++)
117                W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];
118
119        /* 2. Initialize working variables. */
120        memcpy(S, state, 64);
121
122        /* 3. Mix. */
123        RNDr(S, W, 0, 0x428a2f98d728ae22ULL);
124        RNDr(S, W, 1, 0x7137449123ef65cdULL);
125        RNDr(S, W, 2, 0xb5c0fbcfec4d3b2fULL);
126        RNDr(S, W, 3, 0xe9b5dba58189dbbcULL);
127        RNDr(S, W, 4, 0x3956c25bf348b538ULL);
128        RNDr(S, W, 5, 0x59f111f1b605d019ULL);
129        RNDr(S, W, 6, 0x923f82a4af194f9bULL);
130        RNDr(S, W, 7, 0xab1c5ed5da6d8118ULL);
131        RNDr(S, W, 8, 0xd807aa98a3030242ULL);
132        RNDr(S, W, 9, 0x12835b0145706fbeULL);
133        RNDr(S, W, 10, 0x243185be4ee4b28cULL);
134        RNDr(S, W, 11, 0x550c7dc3d5ffb4e2ULL);
135        RNDr(S, W, 12, 0x72be5d74f27b896fULL);
136        RNDr(S, W, 13, 0x80deb1fe3b1696b1ULL);
137        RNDr(S, W, 14, 0x9bdc06a725c71235ULL);
138        RNDr(S, W, 15, 0xc19bf174cf692694ULL);
139        RNDr(S, W, 16, 0xe49b69c19ef14ad2ULL);
140        RNDr(S, W, 17, 0xefbe4786384f25e3ULL);
141        RNDr(S, W, 18, 0x0fc19dc68b8cd5b5ULL);
142        RNDr(S, W, 19, 0x240ca1cc77ac9c65ULL);
143        RNDr(S, W, 20, 0x2de92c6f592b0275ULL);
144        RNDr(S, W, 21, 0x4a7484aa6ea6e483ULL);
145        RNDr(S, W, 22, 0x5cb0a9dcbd41fbd4ULL);
146        RNDr(S, W, 23, 0x76f988da831153b5ULL);
147        RNDr(S, W, 24, 0x983e5152ee66dfabULL);
148        RNDr(S, W, 25, 0xa831c66d2db43210ULL);
149        RNDr(S, W, 26, 0xb00327c898fb213fULL);
150        RNDr(S, W, 27, 0xbf597fc7beef0ee4ULL);
151        RNDr(S, W, 28, 0xc6e00bf33da88fc2ULL);
152        RNDr(S, W, 29, 0xd5a79147930aa725ULL);
153        RNDr(S, W, 30, 0x06ca6351e003826fULL);
154        RNDr(S, W, 31, 0x142929670a0e6e70ULL);
155        RNDr(S, W, 32, 0x27b70a8546d22ffcULL);
156        RNDr(S, W, 33, 0x2e1b21385c26c926ULL);
157        RNDr(S, W, 34, 0x4d2c6dfc5ac42aedULL);
158        RNDr(S, W, 35, 0x53380d139d95b3dfULL);
159        RNDr(S, W, 36, 0x650a73548baf63deULL);
160        RNDr(S, W, 37, 0x766a0abb3c77b2a8ULL);
161        RNDr(S, W, 38, 0x81c2c92e47edaee6ULL);
162        RNDr(S, W, 39, 0x92722c851482353bULL);
163        RNDr(S, W, 40, 0xa2bfe8a14cf10364ULL);
164        RNDr(S, W, 41, 0xa81a664bbc423001ULL);
165        RNDr(S, W, 42, 0xc24b8b70d0f89791ULL);
166        RNDr(S, W, 43, 0xc76c51a30654be30ULL);
167        RNDr(S, W, 44, 0xd192e819d6ef5218ULL);
168        RNDr(S, W, 45, 0xd69906245565a910ULL);
169        RNDr(S, W, 46, 0xf40e35855771202aULL);
170        RNDr(S, W, 47, 0x106aa07032bbd1b8ULL);
171        RNDr(S, W, 48, 0x19a4c116b8d2d0c8ULL);
172        RNDr(S, W, 49, 0x1e376c085141ab53ULL);
173        RNDr(S, W, 50, 0x2748774cdf8eeb99ULL);
174        RNDr(S, W, 51, 0x34b0bcb5e19b48a8ULL);
175        RNDr(S, W, 52, 0x391c0cb3c5c95a63ULL);
176        RNDr(S, W, 53, 0x4ed8aa4ae3418acbULL);
177        RNDr(S, W, 54, 0x5b9cca4f7763e373ULL);
178        RNDr(S, W, 55, 0x682e6ff3d6b2b8a3ULL);
179        RNDr(S, W, 56, 0x748f82ee5defb2fcULL);
180        RNDr(S, W, 57, 0x78a5636f43172f60ULL);
181        RNDr(S, W, 58, 0x84c87814a1f0ab72ULL);
182        RNDr(S, W, 59, 0x8cc702081a6439ecULL);
183        RNDr(S, W, 60, 0x90befffa23631e28ULL);
184        RNDr(S, W, 61, 0xa4506cebde82bde9ULL);
185        RNDr(S, W, 62, 0xbef9a3f7b2c67915ULL);
186        RNDr(S, W, 63, 0xc67178f2e372532bULL);
187        RNDr(S, W, 64, 0xca273eceea26619cULL);
188        RNDr(S, W, 65, 0xd186b8c721c0c207ULL);
189        RNDr(S, W, 66, 0xeada7dd6cde0eb1eULL);
190        RNDr(S, W, 67, 0xf57d4f7fee6ed178ULL);
191        RNDr(S, W, 68, 0x06f067aa72176fbaULL);
192        RNDr(S, W, 69, 0x0a637dc5a2c898a6ULL);
193        RNDr(S, W, 70, 0x113f9804bef90daeULL);
194        RNDr(S, W, 71, 0x1b710b35131c471bULL);
195        RNDr(S, W, 72, 0x28db77f523047d84ULL);
196        RNDr(S, W, 73, 0x32caab7b40c72493ULL);
197        RNDr(S, W, 74, 0x3c9ebe0a15c9bebcULL);
198        RNDr(S, W, 75, 0x431d67c49c100d4cULL);
199        RNDr(S, W, 76, 0x4cc5d4becb3e42b6ULL);
200        RNDr(S, W, 77, 0x597f299cfc657e2aULL);
201        RNDr(S, W, 78, 0x5fcb6fab3ad6faecULL);
202        RNDr(S, W, 79, 0x6c44198c4a475817ULL);
203
204        /* 4. Mix local working variables into global state */
205        for (i = 0; i < 8; i++)
206                state[i] += S[i];
207}
208
209static const unsigned char PAD[128] = {
210        0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
211        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
212        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
213        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
214        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
215        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
216        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
217        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
218};
219
220/* Add padding and terminating bit-count. */
221static void
222SHA512_Pad(SHA512_CTX * ctx)
223{
224        unsigned char len[16];
225        uint64_t r, plen;
226
227        /*
228         * Convert length to a vector of bytes -- we do this now rather
229         * than later because the length will change after we pad.
230         */
231        be64enc_vect(len, ctx->count, 16);
232
233        /* Add 1--128 bytes so that the resulting length is 112 mod 128 */
234        r = (ctx->count[1] >> 3) & 0x7f;
235        plen = (r < 112) ? (112 - r) : (240 - r);
236        SHA512_Update(ctx, PAD, (size_t)plen);
237
238        /* Add the terminating bit-count */
239        SHA512_Update(ctx, len, 16);
240}
241
242/* SHA-512 initialization.  Begins a SHA-512 operation. */
243void
244SHA512_Init(SHA512_CTX * ctx)
245{
246
247        /* Zero bits processed so far */
248        ctx->count[0] = ctx->count[1] = 0;
249
250        /* Magic initialization constants */
251        ctx->state[0] = 0x6a09e667f3bcc908ULL;
252        ctx->state[1] = 0xbb67ae8584caa73bULL;
253        ctx->state[2] = 0x3c6ef372fe94f82bULL;
254        ctx->state[3] = 0xa54ff53a5f1d36f1ULL;
255        ctx->state[4] = 0x510e527fade682d1ULL;
256        ctx->state[5] = 0x9b05688c2b3e6c1fULL;
257        ctx->state[6] = 0x1f83d9abfb41bd6bULL;
258        ctx->state[7] = 0x5be0cd19137e2179ULL;
259}
260
261/* Add bytes into the hash */
262void
263SHA512_Update(SHA512_CTX * ctx, const void *in, size_t len)
264{
265        uint64_t bitlen[2];
266        uint64_t r;
267        const unsigned char *src = in;
268
269        /* Number of bytes left in the buffer from previous updates */
270        r = (ctx->count[1] >> 3) & 0x7f;
271
272        /* Convert the length into a number of bits */
273        bitlen[1] = ((uint64_t)len) << 3;
274        bitlen[0] = ((uint64_t)len) >> 61;
275
276        /* Update number of bits */
277        if ((ctx->count[1] += bitlen[1]) < bitlen[1])
278                ctx->count[0]++;
279        ctx->count[0] += bitlen[0];
280
281        /* Handle the case where we don't need to perform any transforms */
282        if (len < 128 - r) {
283                memcpy(&ctx->buf[r], src, len);
284                return;
285        }
286
287        /* Finish the current block */
288        memcpy(&ctx->buf[r], src, 128 - r);
289        SHA512_Transform(ctx->state, ctx->buf);
290        src += 128 - r;
291        len -= 128 - r;
292
293        /* Perform complete blocks */
294        while (len >= 128) {
295                SHA512_Transform(ctx->state, src);
296                src += 128;
297                len -= 128;
298        }
299
300        /* Copy left over data into buffer */
301        memcpy(ctx->buf, src, len);
302}
303
304/*
305 * SHA-512 finalization.  Pads the input data, exports the hash value,
306 * and clears the context state.
307 */
308void
309SHA512_Final(unsigned char digest[64], SHA512_CTX * ctx)
310{
311
312        /* Add padding */
313        SHA512_Pad(ctx);
314
315        /* Write the hash */
316        be64enc_vect(digest, ctx->state, 64);
317
318        /* Clear the context state */
319        memset((void *)ctx, 0, sizeof(*ctx));
320}
Note: See TracBrowser for help on using the repository browser.