2 * Copyright 2005 Colin Percival
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
30 #include <sys/endian.h>
31 #include <sys/types.h>
34 #include <sys/systm.h>
42 #if BYTE_ORDER == BIG_ENDIAN
44 /* Copy a vector of big-endian uint32_t into a vector of bytes */
45 #define be32enc_vect(dst, src, len) \
46 memcpy((void *)dst, (const void *)src, (size_t)len)
48 /* Copy a vector of bytes into a vector of big-endian uint32_t */
49 #define be32dec_vect(dst, src, len) \
50 memcpy((void *)dst, (const void *)src, (size_t)len)
52 #else /* BYTE_ORDER != BIG_ENDIAN */
55 * Encode a length len/4 vector of (uint32_t) into a length len vector of
56 * (unsigned char) in big-endian form. Assumes len is a multiple of 4.
59 be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
63 for (i = 0; i < len / 4; i++)
64 be32enc(dst + i * 4, src[i]);
68 * Decode a big-endian length len vector of (unsigned char) into a length
69 * len/4 vector of (uint32_t). Assumes len is a multiple of 4.
72 be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
76 for (i = 0; i < len / 4; i++)
77 dst[i] = be32dec(src + i * 4);
80 #endif /* BYTE_ORDER != BIG_ENDIAN */
82 /* SHA256 round constants. */
83 static const uint32_t K[64] = {
84 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
85 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
86 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
87 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
88 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
89 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
90 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
91 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
92 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
93 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
94 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
95 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
96 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
97 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
98 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
99 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
102 /* Elementary functions used by SHA256 */
103 #define Ch(x, y, z) ((x & (y ^ z)) ^ z)
104 #define Maj(x, y, z) ((x & (y | z)) | (y & z))
105 #define SHR(x, n) (x >> n)
106 #define ROTR(x, n) ((x >> n) | (x << (32 - n)))
107 #define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
108 #define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
109 #define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
110 #define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
112 /* SHA256 round function */
113 #define RND(a, b, c, d, e, f, g, h, k) \
114 h += S1(e) + Ch(e, f, g) + k; \
116 h += S0(a) + Maj(a, b, c);
118 /* Adjusted round function for rotating state */
119 #define RNDr(S, W, i, ii) \
120 RND(S[(64 - i) % 8], S[(65 - i) % 8], \
121 S[(66 - i) % 8], S[(67 - i) % 8], \
122 S[(68 - i) % 8], S[(69 - i) % 8], \
123 S[(70 - i) % 8], S[(71 - i) % 8], \
124 W[i + ii] + K[i + ii])
126 /* Message schedule computation */
127 #define MSCH(W, ii, i) \
128 W[i + ii + 16] = s1(W[i + ii + 14]) + W[i + ii + 9] + s0(W[i + ii + 1]) + W[i + ii]
131 * SHA256 block compression function. The 256-bit state is transformed via
132 * the 512-bit input block to produce a new state.
135 SHA256_Transform(uint32_t * state, const unsigned char block[64])
141 /* 1. Prepare the first part of the message schedule W. */
142 be32dec_vect(W, block, 64);
144 /* 2. Initialize working variables. */
145 memcpy(S, state, 32);
148 for (i = 0; i < 64; i += 16) {
186 /* 4. Mix local working variables into global state */
187 for (i = 0; i < 8; i++)
191 static unsigned char PAD[64] = {
192 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
193 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
198 /* Add padding and terminating bit-count. */
200 SHA256_Pad(SHA256_CTX * ctx)
204 /* Figure out how many bytes we have buffered. */
205 r = (ctx->count >> 3) & 0x3f;
207 /* Pad to 56 mod 64, transforming if we finish a block en route. */
209 /* Pad to 56 mod 64. */
210 memcpy(&ctx->buf[r], PAD, 56 - r);
212 /* Finish the current block and mix. */
213 memcpy(&ctx->buf[r], PAD, 64 - r);
214 SHA256_Transform(ctx->state, ctx->buf);
216 /* The start of the final block is all zeroes. */
217 memset(&ctx->buf[0], 0, 56);
220 /* Add the terminating bit-count. */
221 be64enc(&ctx->buf[56], ctx->count);
223 /* Mix in the final block. */
224 SHA256_Transform(ctx->state, ctx->buf);
227 /* SHA-256 initialization. Begins a SHA-256 operation. */
229 SHA256_Init(SHA256_CTX * ctx)
232 /* Zero bits processed so far */
235 /* Magic initialization constants */
236 ctx->state[0] = 0x6A09E667;
237 ctx->state[1] = 0xBB67AE85;
238 ctx->state[2] = 0x3C6EF372;
239 ctx->state[3] = 0xA54FF53A;
240 ctx->state[4] = 0x510E527F;
241 ctx->state[5] = 0x9B05688C;
242 ctx->state[6] = 0x1F83D9AB;
243 ctx->state[7] = 0x5BE0CD19;
246 /* Add bytes into the hash */
248 SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len)
252 const unsigned char *src = in;
254 /* Number of bytes left in the buffer from previous updates */
255 r = (ctx->count >> 3) & 0x3f;
257 /* Convert the length into a number of bits */
260 /* Update number of bits */
261 ctx->count += bitlen;
263 /* Handle the case where we don't need to perform any transforms */
265 memcpy(&ctx->buf[r], src, len);
269 /* Finish the current block */
270 memcpy(&ctx->buf[r], src, 64 - r);
271 SHA256_Transform(ctx->state, ctx->buf);
275 /* Perform complete blocks */
277 SHA256_Transform(ctx->state, src);
282 /* Copy left over data into buffer */
283 memcpy(ctx->buf, src, len);
287 * SHA-256 finalization. Pads the input data, exports the hash value,
288 * and clears the context state.
291 SHA256_Final(unsigned char digest[static SHA256_DIGEST_LENGTH], SHA256_CTX *ctx)
298 be32enc_vect(digest, ctx->state, SHA256_DIGEST_LENGTH);
300 /* Clear the context state */
301 explicit_bzero(ctx, sizeof(*ctx));
304 /*** SHA-224: *********************************************************/
306 * the SHA224 and SHA256 transforms are identical
309 /* SHA-224 initialization. Begins a SHA-224 operation. */
311 SHA224_Init(SHA224_CTX * ctx)
314 /* Zero bits processed so far */
317 /* Magic initialization constants */
318 ctx->state[0] = 0xC1059ED8;
319 ctx->state[1] = 0x367CD507;
320 ctx->state[2] = 0x3070DD17;
321 ctx->state[3] = 0xF70E5939;
322 ctx->state[4] = 0xFFC00B31;
323 ctx->state[5] = 0x68581511;
324 ctx->state[6] = 0x64f98FA7;
325 ctx->state[7] = 0xBEFA4FA4;
328 /* Add bytes into the SHA-224 hash */
330 SHA224_Update(SHA224_CTX * ctx, const void *in, size_t len)
333 SHA256_Update((SHA256_CTX *)ctx, in, len);
337 * SHA-224 finalization. Pads the input data, exports the hash value,
338 * and clears the context state.
341 SHA224_Final(unsigned char digest[static SHA224_DIGEST_LENGTH], SHA224_CTX *ctx)
345 SHA256_Pad((SHA256_CTX *)ctx);
348 be32enc_vect(digest, ctx->state, SHA224_DIGEST_LENGTH);
350 /* Clear the context state */
351 explicit_bzero(ctx, sizeof(*ctx));
355 /* When building libmd, provide weak references. Note: this is not
356 activated in the context of compiling these sources for internal
360 __weak_reference(_libmd_SHA256_Init, SHA256_Init);
362 __weak_reference(_libmd_SHA256_Update, SHA256_Update);
364 __weak_reference(_libmd_SHA256_Final, SHA256_Final);
365 #undef SHA256_Transform
366 __weak_reference(_libmd_SHA256_Transform, SHA256_Transform);
369 __weak_reference(_libmd_SHA224_Init, SHA224_Init);
371 __weak_reference(_libmd_SHA224_Update, SHA224_Update);
373 __weak_reference(_libmd_SHA224_Final, SHA224_Final);