kris
/
pqcrypto
peilaus alkaen https://github.com/henrydcase/pqc.git
1
1
Fork 0
Koodi Ongelmat 1 Julkaisut 2 Wiki Toiminta
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
772 Commitit
9 Branchit
132 MiB
 
 
 
Puu: bc2fdb6921
Branchit Tagit
${ item.name }
Create branch ${ searchTerm }
from 'bc2fdb6921'
${ noResults }
pqcrypto/common/sha2.c

713 rivejä
22 KiB
Raaka Blame Historia 

  1. /* Based on the public domain implementation in

  2.  * crypto_hash/sha512/ref/ from http://bench.cr.yp.to/supercop.html

  3.  * by D. J. Bernstein */

  4. 

  5. #include <stddef.h>

  6. #include <stdint.h>

  7. #include <string.h>

  8. 

  9. #include "sha2.h"

  10. 

  11. static uint32_t load_bigendian_32(const uint8_t *x) {

  12.     return (uint32_t)(x[3]) | (((uint32_t)(x[2])) << 8) |

  13.            (((uint32_t)(x[1])) << 16) | (((uint32_t)(x[0])) << 24);

  14. }

  15. 

  16. static uint64_t load_bigendian_64(const uint8_t *x) {

  17.     return (uint64_t)(x[7]) | (((uint64_t)(x[6])) << 8) |

  18.            (((uint64_t)(x[5])) << 16) | (((uint64_t)(x[4])) << 24) |

  19.            (((uint64_t)(x[3])) << 32) | (((uint64_t)(x[2])) << 40) |

  20.            (((uint64_t)(x[1])) << 48) | (((uint64_t)(x[0])) << 56);

  21. }

  22. 

  23. static void store_bigendian_32(uint8_t *x, uint64_t u) {

  24.     x[3] = (uint8_t) u;

  25.     u >>= 8;

  26.     x[2] = (uint8_t) u;

  27.     u >>= 8;

  28.     x[1] = (uint8_t) u;

  29.     u >>= 8;

  30.     x[0] = (uint8_t) u;

  31. }

  32. 

  33. static void store_bigendian_64(uint8_t *x, uint64_t u) {

  34.     x[7] = (uint8_t) u;

  35.     u >>= 8;

  36.     x[6] = (uint8_t) u;

  37.     u >>= 8;

  38.     x[5] = (uint8_t) u;

  39.     u >>= 8;

  40.     x[4] = (uint8_t) u;

  41.     u >>= 8;

  42.     x[3] = (uint8_t) u;

  43.     u >>= 8;

  44.     x[2] = (uint8_t) u;

  45.     u >>= 8;

  46.     x[1] = (uint8_t) u;

  47.     u >>= 8;

  48.     x[0] = (uint8_t) u;

  49. }

  50. 

  51. #define SHR(x, c) ((x) >> (c))

  52. #define ROTR_32(x, c) (((x) >> (c)) | ((x) << (32 - (c))))

  53. #define ROTR_64(x, c) (((x) >> (c)) | ((x) << (64 - (c))))

  54. 

  55. #define Ch(x, y, z) (((x) & (y)) ^ (~(x) & (z)))

  56. #define Maj(x, y, z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))

  57. 

  58. #define Sigma0_32(x) (ROTR_32(x, 2) ^ ROTR_32(x,13) ^ ROTR_32(x,22))

  59. #define Sigma1_32(x) (ROTR_32(x, 6) ^ ROTR_32(x,11) ^ ROTR_32(x,25))

  60. #define sigma0_32(x) (ROTR_32(x, 7) ^ ROTR_32(x,18) ^ SHR(x, 3))

  61. #define sigma1_32(x) (ROTR_32(x,17) ^ ROTR_32(x,19) ^ SHR(x,10))

  62. 

  63. #define Sigma0_64(x) (ROTR_64(x, 28) ^ ROTR_64(x, 34) ^ ROTR_64(x, 39))

  64. #define Sigma1_64(x) (ROTR_64(x, 14) ^ ROTR_64(x, 18) ^ ROTR_64(x, 41))

  65. #define sigma0_64(x) (ROTR_64(x, 1) ^ ROTR_64(x, 8) ^ SHR(x, 7))

  66. #define sigma1_64(x) (ROTR_64(x, 19) ^ ROTR_64(x, 61) ^ SHR(x, 6))

  67. 

  68. #define M_32(w0, w14, w9, w1) w0 = sigma1_32(w14) + (w9) + sigma0_32(w1) + (w0);

  69. #define M_64(w0, w14, w9, w1) w0 = sigma1_64(w14) + (w9) + sigma0_64(w1) + (w0);

  70. 

  71. #define EXPAND_32           \

  72.     M_32(w0, w14, w9, w1)   \

  73.     M_32(w1, w15, w10, w2)  \

  74.     M_32(w2, w0, w11, w3)   \

  75.     M_32(w3, w1, w12, w4)   \

  76.     M_32(w4, w2, w13, w5)   \

  77.     M_32(w5, w3, w14, w6)   \

  78.     M_32(w6, w4, w15, w7)   \

  79.     M_32(w7, w5, w0, w8)    \

  80.     M_32(w8, w6, w1, w9)    \

  81.     M_32(w9, w7, w2, w10)   \

  82.     M_32(w10, w8, w3, w11)  \

  83.     M_32(w11, w9, w4, w12)  \

  84.     M_32(w12, w10, w5, w13) \

  85.     M_32(w13, w11, w6, w14) \

  86.     M_32(w14, w12, w7, w15) \

  87.     M_32(w15, w13, w8, w0)

  88. 

  89. #define EXPAND_64           \

  90.     M_64(w0, w14, w9, w1)   \

  91.     M_64(w1, w15, w10, w2)  \

  92.     M_64(w2, w0, w11, w3)   \

  93.     M_64(w3, w1, w12, w4)   \

  94.     M_64(w4, w2, w13, w5)   \

  95.     M_64(w5, w3, w14, w6)   \

  96.     M_64(w6, w4, w15, w7)   \

  97.     M_64(w7, w5, w0, w8)    \

  98.     M_64(w8, w6, w1, w9)    \

  99.     M_64(w9, w7, w2, w10)   \

  100.     M_64(w10, w8, w3, w11)  \

  101.     M_64(w11, w9, w4, w12)  \

  102.     M_64(w12, w10, w5, w13) \

  103.     M_64(w13, w11, w6, w14) \

  104.     M_64(w14, w12, w7, w15) \

  105.     M_64(w15, w13, w8, w0)

  106. 

  107. #define F_32(w, k)                                   \

  108.     T1 = h + Sigma1_32(e) + Ch(e, f, g) + (k) + (w); \

  109.     T2 = Sigma0_32(a) + Maj(a, b, c);                \

  110.     h = g;                                           \

  111.     g = f;                                           \

  112.     f = e;                                           \

  113.     e = d + T1;                                      \

  114.     d = c;                                           \

  115.     c = b;                                           \

  116.     b = a;                                           \

  117.     a = T1 + T2;

  118. 

  119. #define F_64(w, k)                                   \

  120.     T1 = h + Sigma1_64(e) + Ch(e, f, g) + (k) + (w); \

  121.     T2 = Sigma0_64(a) + Maj(a, b, c);                \

  122.     h = g;                                           \

  123.     g = f;                                           \

  124.     f = e;                                           \

  125.     e = d + T1;                                      \

  126.     d = c;                                           \

  127.     c = b;                                           \

  128.     b = a;                                           \

  129.     a = T1 + T2;

  130. 

  131. static size_t crypto_hashblocks_sha256(uint8_t *statebytes,

  132.                                        const uint8_t *in, size_t inlen) {

  133.     uint32_t state[8];

  134.     uint32_t a;

  135.     uint32_t b;

  136.     uint32_t c;

  137.     uint32_t d;

  138.     uint32_t e;

  139.     uint32_t f;

  140.     uint32_t g;

  141.     uint32_t h;

  142.     uint32_t T1;

  143.     uint32_t T2;

  144. 

  145.     a = load_bigendian_32(statebytes + 0);

  146.     state[0] = a;

  147.     b = load_bigendian_32(statebytes + 4);

  148.     state[1] = b;

  149.     c = load_bigendian_32(statebytes + 8);

  150.     state[2] = c;

  151.     d = load_bigendian_32(statebytes + 12);

  152.     state[3] = d;

  153.     e = load_bigendian_32(statebytes + 16);

  154.     state[4] = e;

  155.     f = load_bigendian_32(statebytes + 20);

  156.     state[5] = f;

  157.     g = load_bigendian_32(statebytes + 24);

  158.     state[6] = g;

  159.     h = load_bigendian_32(statebytes + 28);

  160.     state[7] = h;

  161. 

  162.     while (inlen >= 64) {

  163.         uint32_t w0  = load_bigendian_32(in + 0);

  164.         uint32_t w1  = load_bigendian_32(in + 4);

  165.         uint32_t w2  = load_bigendian_32(in + 8);

  166.         uint32_t w3  = load_bigendian_32(in + 12);

  167.         uint32_t w4  = load_bigendian_32(in + 16);

  168.         uint32_t w5  = load_bigendian_32(in + 20);

  169.         uint32_t w6  = load_bigendian_32(in + 24);

  170.         uint32_t w7  = load_bigendian_32(in + 28);

  171.         uint32_t w8  = load_bigendian_32(in + 32);

  172.         uint32_t w9  = load_bigendian_32(in + 36);

  173.         uint32_t w10 = load_bigendian_32(in + 40);

  174.         uint32_t w11 = load_bigendian_32(in + 44);

  175.         uint32_t w12 = load_bigendian_32(in + 48);

  176.         uint32_t w13 = load_bigendian_32(in + 52);

  177.         uint32_t w14 = load_bigendian_32(in + 56);

  178.         uint32_t w15 = load_bigendian_32(in + 60);

  179. 

  180.         F_32(w0, 0x428a2f98)

  181.         F_32(w1, 0x71374491)

  182.         F_32(w2, 0xb5c0fbcf)

  183.         F_32(w3, 0xe9b5dba5)

  184.         F_32(w4, 0x3956c25b)

  185.         F_32(w5, 0x59f111f1)

  186.         F_32(w6, 0x923f82a4)

  187.         F_32(w7, 0xab1c5ed5)

  188.         F_32(w8, 0xd807aa98)

  189.         F_32(w9, 0x12835b01)

  190.         F_32(w10, 0x243185be)

  191.         F_32(w11, 0x550c7dc3)

  192.         F_32(w12, 0x72be5d74)

  193.         F_32(w13, 0x80deb1fe)

  194.         F_32(w14, 0x9bdc06a7)

  195.         F_32(w15, 0xc19bf174)

  196. 

  197.         EXPAND_32

  198. 

  199.         F_32(w0, 0xe49b69c1)

  200.         F_32(w1, 0xefbe4786)

  201.         F_32(w2, 0x0fc19dc6)

  202.         F_32(w3, 0x240ca1cc)

  203.         F_32(w4, 0x2de92c6f)

  204.         F_32(w5, 0x4a7484aa)

  205.         F_32(w6, 0x5cb0a9dc)

  206.         F_32(w7, 0x76f988da)

  207.         F_32(w8, 0x983e5152)

  208.         F_32(w9, 0xa831c66d)

  209.         F_32(w10, 0xb00327c8)

  210.         F_32(w11, 0xbf597fc7)

  211.         F_32(w12, 0xc6e00bf3)

  212.         F_32(w13, 0xd5a79147)

  213.         F_32(w14, 0x06ca6351)

  214.         F_32(w15, 0x14292967)

  215. 

  216.         EXPAND_32

  217. 

  218.         F_32(w0, 0x27b70a85)

  219.         F_32(w1, 0x2e1b2138)

  220.         F_32(w2, 0x4d2c6dfc)

  221.         F_32(w3, 0x53380d13)

  222.         F_32(w4, 0x650a7354)

  223.         F_32(w5, 0x766a0abb)

  224.         F_32(w6, 0x81c2c92e)

  225.         F_32(w7, 0x92722c85)

  226.         F_32(w8, 0xa2bfe8a1)

  227.         F_32(w9, 0xa81a664b)

  228.         F_32(w10, 0xc24b8b70)

  229.         F_32(w11, 0xc76c51a3)

  230.         F_32(w12, 0xd192e819)

  231.         F_32(w13, 0xd6990624)

  232.         F_32(w14, 0xf40e3585)

  233.         F_32(w15, 0x106aa070)

  234. 

  235.         EXPAND_32

  236. 

  237.         F_32(w0, 0x19a4c116)

  238.         F_32(w1, 0x1e376c08)

  239.         F_32(w2, 0x2748774c)

  240.         F_32(w3, 0x34b0bcb5)

  241.         F_32(w4, 0x391c0cb3)

  242.         F_32(w5, 0x4ed8aa4a)

  243.         F_32(w6, 0x5b9cca4f)

  244.         F_32(w7, 0x682e6ff3)

  245.         F_32(w8, 0x748f82ee)

  246.         F_32(w9, 0x78a5636f)

  247.         F_32(w10, 0x84c87814)

  248.         F_32(w11, 0x8cc70208)

  249.         F_32(w12, 0x90befffa)

  250.         F_32(w13, 0xa4506ceb)

  251.         F_32(w14, 0xbef9a3f7)

  252.         F_32(w15, 0xc67178f2)

  253. 

  254.         a += state[0];

  255.         b += state[1];

  256.         c += state[2];

  257.         d += state[3];

  258.         e += state[4];

  259.         f += state[5];

  260.         g += state[6];

  261.         h += state[7];

  262. 

  263.         state[0] = a;

  264.         state[1] = b;

  265.         state[2] = c;

  266.         state[3] = d;

  267.         state[4] = e;

  268.         state[5] = f;

  269.         state[6] = g;

  270.         state[7] = h;

  271. 

  272.         in += 64;

  273.         inlen -= 64;

  274.     }

  275. 

  276.     store_bigendian_32(statebytes + 0, state[0]);

  277.     store_bigendian_32(statebytes + 4, state[1]);

  278.     store_bigendian_32(statebytes + 8, state[2]);

  279.     store_bigendian_32(statebytes + 12, state[3]);

  280.     store_bigendian_32(statebytes + 16, state[4]);

  281.     store_bigendian_32(statebytes + 20, state[5]);

  282.     store_bigendian_32(statebytes + 24, state[6]);

  283.     store_bigendian_32(statebytes + 28, state[7]);

  284. 

  285.     return inlen;

  286. }

  287. 

  288. static size_t crypto_hashblocks_sha512(uint8_t *statebytes,

  289.                                        const uint8_t *in, size_t inlen) {

  290.     uint64_t state[8];

  291.     uint64_t a;

  292.     uint64_t b;

  293.     uint64_t c;

  294.     uint64_t d;

  295.     uint64_t e;

  296.     uint64_t f;

  297.     uint64_t g;

  298.     uint64_t h;

  299.     uint64_t T1;

  300.     uint64_t T2;

  301. 

  302.     a = load_bigendian_64(statebytes + 0);

  303.     state[0] = a;

  304.     b = load_bigendian_64(statebytes + 8);

  305.     state[1] = b;

  306.     c = load_bigendian_64(statebytes + 16);

  307.     state[2] = c;

  308.     d = load_bigendian_64(statebytes + 24);

  309.     state[3] = d;

  310.     e = load_bigendian_64(statebytes + 32);

  311.     state[4] = e;

  312.     f = load_bigendian_64(statebytes + 40);

  313.     state[5] = f;

  314.     g = load_bigendian_64(statebytes + 48);

  315.     state[6] = g;

  316.     h = load_bigendian_64(statebytes + 56);

  317.     state[7] = h;

  318. 

  319.     while (inlen >= 128) {

  320.         uint64_t w0 = load_bigendian_64(in + 0);

  321.         uint64_t w1 = load_bigendian_64(in + 8);

  322.         uint64_t w2 = load_bigendian_64(in + 16);

  323.         uint64_t w3 = load_bigendian_64(in + 24);

  324.         uint64_t w4 = load_bigendian_64(in + 32);

  325.         uint64_t w5 = load_bigendian_64(in + 40);

  326.         uint64_t w6 = load_bigendian_64(in + 48);

  327.         uint64_t w7 = load_bigendian_64(in + 56);

  328.         uint64_t w8 = load_bigendian_64(in + 64);

  329.         uint64_t w9 = load_bigendian_64(in + 72);

  330.         uint64_t w10 = load_bigendian_64(in + 80);

  331.         uint64_t w11 = load_bigendian_64(in + 88);

  332.         uint64_t w12 = load_bigendian_64(in + 96);

  333.         uint64_t w13 = load_bigendian_64(in + 104);

  334.         uint64_t w14 = load_bigendian_64(in + 112);

  335.         uint64_t w15 = load_bigendian_64(in + 120);

  336. 

  337.         F_64(w0, 0x428a2f98d728ae22ULL)

  338.         F_64(w1, 0x7137449123ef65cdULL)

  339.         F_64(w2, 0xb5c0fbcfec4d3b2fULL)

  340.         F_64(w3, 0xe9b5dba58189dbbcULL)

  341.         F_64(w4, 0x3956c25bf348b538ULL)

  342.         F_64(w5, 0x59f111f1b605d019ULL)

  343.         F_64(w6, 0x923f82a4af194f9bULL)

  344.         F_64(w7, 0xab1c5ed5da6d8118ULL)

  345.         F_64(w8, 0xd807aa98a3030242ULL)

  346.         F_64(w9, 0x12835b0145706fbeULL)

  347.         F_64(w10, 0x243185be4ee4b28cULL)

  348.         F_64(w11, 0x550c7dc3d5ffb4e2ULL)

  349.         F_64(w12, 0x72be5d74f27b896fULL)

  350.         F_64(w13, 0x80deb1fe3b1696b1ULL)

  351.         F_64(w14, 0x9bdc06a725c71235ULL)

  352.         F_64(w15, 0xc19bf174cf692694ULL)

  353. 

  354.         EXPAND_64

  355. 

  356.         F_64(w0, 0xe49b69c19ef14ad2ULL)

  357.         F_64(w1, 0xefbe4786384f25e3ULL)

  358.         F_64(w2, 0x0fc19dc68b8cd5b5ULL)

  359.         F_64(w3, 0x240ca1cc77ac9c65ULL)

  360.         F_64(w4, 0x2de92c6f592b0275ULL)

  361.         F_64(w5, 0x4a7484aa6ea6e483ULL)

  362.         F_64(w6, 0x5cb0a9dcbd41fbd4ULL)

  363.         F_64(w7, 0x76f988da831153b5ULL)

  364.         F_64(w8, 0x983e5152ee66dfabULL)

  365.         F_64(w9, 0xa831c66d2db43210ULL)

  366.         F_64(w10, 0xb00327c898fb213fULL)

  367.         F_64(w11, 0xbf597fc7beef0ee4ULL)

  368.         F_64(w12, 0xc6e00bf33da88fc2ULL)

  369.         F_64(w13, 0xd5a79147930aa725ULL)

  370.         F_64(w14, 0x06ca6351e003826fULL)

  371.         F_64(w15, 0x142929670a0e6e70ULL)

  372. 

  373.         EXPAND_64

  374. 

  375.         F_64(w0, 0x27b70a8546d22ffcULL)

  376.         F_64(w1, 0x2e1b21385c26c926ULL)

  377.         F_64(w2, 0x4d2c6dfc5ac42aedULL)

  378.         F_64(w3, 0x53380d139d95b3dfULL)

  379.         F_64(w4, 0x650a73548baf63deULL)

  380.         F_64(w5, 0x766a0abb3c77b2a8ULL)

  381.         F_64(w6, 0x81c2c92e47edaee6ULL)

  382.         F_64(w7, 0x92722c851482353bULL)

  383.         F_64(w8, 0xa2bfe8a14cf10364ULL)

  384.         F_64(w9, 0xa81a664bbc423001ULL)

  385.         F_64(w10, 0xc24b8b70d0f89791ULL)

  386.         F_64(w11, 0xc76c51a30654be30ULL)

  387.         F_64(w12, 0xd192e819d6ef5218ULL)

  388.         F_64(w13, 0xd69906245565a910ULL)

  389.         F_64(w14, 0xf40e35855771202aULL)

  390.         F_64(w15, 0x106aa07032bbd1b8ULL)

  391. 

  392.         EXPAND_64

  393. 

  394.         F_64(w0, 0x19a4c116b8d2d0c8ULL)

  395.         F_64(w1, 0x1e376c085141ab53ULL)

  396.         F_64(w2, 0x2748774cdf8eeb99ULL)

  397.         F_64(w3, 0x34b0bcb5e19b48a8ULL)

  398.         F_64(w4, 0x391c0cb3c5c95a63ULL)

  399.         F_64(w5, 0x4ed8aa4ae3418acbULL)

  400.         F_64(w6, 0x5b9cca4f7763e373ULL)

  401.         F_64(w7, 0x682e6ff3d6b2b8a3ULL)

  402.         F_64(w8, 0x748f82ee5defb2fcULL)

  403.         F_64(w9, 0x78a5636f43172f60ULL)

  404.         F_64(w10, 0x84c87814a1f0ab72ULL)

  405.         F_64(w11, 0x8cc702081a6439ecULL)

  406.         F_64(w12, 0x90befffa23631e28ULL)

  407.         F_64(w13, 0xa4506cebde82bde9ULL)

  408.         F_64(w14, 0xbef9a3f7b2c67915ULL)

  409.         F_64(w15, 0xc67178f2e372532bULL)

  410. 

  411.         EXPAND_64

  412. 

  413.         F_64(w0, 0xca273eceea26619cULL)

  414.         F_64(w1, 0xd186b8c721c0c207ULL)

  415.         F_64(w2, 0xeada7dd6cde0eb1eULL)

  416.         F_64(w3, 0xf57d4f7fee6ed178ULL)

  417.         F_64(w4, 0x06f067aa72176fbaULL)

  418.         F_64(w5, 0x0a637dc5a2c898a6ULL)

  419.         F_64(w6, 0x113f9804bef90daeULL)

  420.         F_64(w7, 0x1b710b35131c471bULL)

  421.         F_64(w8, 0x28db77f523047d84ULL)

  422.         F_64(w9, 0x32caab7b40c72493ULL)

  423.         F_64(w10, 0x3c9ebe0a15c9bebcULL)

  424.         F_64(w11, 0x431d67c49c100d4cULL)

  425.         F_64(w12, 0x4cc5d4becb3e42b6ULL)

  426.         F_64(w13, 0x597f299cfc657e2aULL)

  427.         F_64(w14, 0x5fcb6fab3ad6faecULL)

  428.         F_64(w15, 0x6c44198c4a475817ULL)

  429. 

  430.         a += state[0];

  431.         b += state[1];

  432.         c += state[2];

  433.         d += state[3];

  434.         e += state[4];

  435.         f += state[5];

  436.         g += state[6];

  437.         h += state[7];

  438. 

  439.         state[0] = a;

  440.         state[1] = b;

  441.         state[2] = c;

  442.         state[3] = d;

  443.         state[4] = e;

  444.         state[5] = f;

  445.         state[6] = g;

  446.         state[7] = h;

  447. 

  448.         in += 128;

  449.         inlen -= 128;

  450.     }

  451. 

  452.     store_bigendian_64(statebytes + 0, state[0]);

  453.     store_bigendian_64(statebytes + 8, state[1]);

  454.     store_bigendian_64(statebytes + 16, state[2]);

  455.     store_bigendian_64(statebytes + 24, state[3]);

  456.     store_bigendian_64(statebytes + 32, state[4]);

  457.     store_bigendian_64(statebytes + 40, state[5]);

  458.     store_bigendian_64(statebytes + 48, state[6]);

  459.     store_bigendian_64(statebytes + 56, state[7]);

  460. 

  461.     return inlen;

  462. }

  463. 

  464. static const uint8_t iv_224[32] = {

  465.     0xc1, 0x05, 0x9e, 0xd8, 0x36, 0x7c, 0xd5, 0x07,

  466.     0x30, 0x70, 0xdd, 0x17, 0xf7, 0x0e, 0x59, 0x39,

  467.     0xff, 0xc0, 0x0b, 0x31, 0x68, 0x58, 0x15, 0x11,

  468.     0x64, 0xf9, 0x8f, 0xa7, 0xbe, 0xfa, 0x4f, 0xa4

  469. };

  470. 

  471. static const uint8_t iv_256[32] = {

  472.     0x6a, 0x09, 0xe6, 0x67, 0xbb, 0x67, 0xae, 0x85,

  473.     0x3c, 0x6e, 0xf3, 0x72, 0xa5, 0x4f, 0xf5, 0x3a,

  474.     0x51, 0x0e, 0x52, 0x7f, 0x9b, 0x05, 0x68, 0x8c,

  475.     0x1f, 0x83, 0xd9, 0xab, 0x5b, 0xe0, 0xcd, 0x19

  476. };

  477. 

  478. static const uint8_t iv_384[64] = {

  479.     0xcb, 0xbb, 0x9d, 0x5d, 0xc1, 0x05, 0x9e, 0xd8, 0x62, 0x9a, 0x29,

  480.     0x2a, 0x36, 0x7c, 0xd5, 0x07, 0x91, 0x59, 0x01, 0x5a, 0x30, 0x70,

  481.     0xdd, 0x17, 0x15, 0x2f, 0xec, 0xd8, 0xf7, 0x0e, 0x59, 0x39, 0x67,

  482.     0x33, 0x26, 0x67, 0xff, 0xc0, 0x0b, 0x31, 0x8e, 0xb4, 0x4a, 0x87,

  483.     0x68, 0x58, 0x15, 0x11, 0xdb, 0x0c, 0x2e, 0x0d, 0x64, 0xf9, 0x8f,

  484.     0xa7, 0x47, 0xb5, 0x48, 0x1d, 0xbe, 0xfa, 0x4f, 0xa4

  485. };

  486. 

  487. static const uint8_t iv_512[64] = {

  488.     0x6a, 0x09, 0xe6, 0x67, 0xf3, 0xbc, 0xc9, 0x08, 0xbb, 0x67, 0xae,

  489.     0x85, 0x84, 0xca, 0xa7, 0x3b, 0x3c, 0x6e, 0xf3, 0x72, 0xfe, 0x94,

  490.     0xf8, 0x2b, 0xa5, 0x4f, 0xf5, 0x3a, 0x5f, 0x1d, 0x36, 0xf1, 0x51,

  491.     0x0e, 0x52, 0x7f, 0xad, 0xe6, 0x82, 0xd1, 0x9b, 0x05, 0x68, 0x8c,

  492.     0x2b, 0x3e, 0x6c, 0x1f, 0x1f, 0x83, 0xd9, 0xab, 0xfb, 0x41, 0xbd,

  493.     0x6b, 0x5b, 0xe0, 0xcd, 0x19, 0x13, 0x7e, 0x21, 0x79

  494. };

  495. 

  496. void sha224_inc_init(sha224ctx *state) {

  497.     for (size_t i = 0; i < 32; ++i) {

  498.         state->ctx[i] = iv_224[i];

  499.     }

  500.     for (size_t i = 32; i < 40; ++i) {

  501.         state->ctx[i] = 0;

  502.     }

  503. }

  504. 

  505. void sha256_inc_init(sha256ctx *state) {

  506.     for (size_t i = 0; i < 32; ++i) {

  507.         state->ctx[i] = iv_256[i];

  508.     }

  509.     for (size_t i = 32; i < 40; ++i) {

  510.         state->ctx[i] = 0;

  511.     }

  512. }

  513. 

  514. void sha384_inc_init(sha384ctx *state) {

  515.     for (size_t i = 0; i < 64; ++i) {

  516.         state->ctx[i] = iv_384[i];

  517.     }

  518.     for (size_t i = 64; i < 72; ++i) {

  519.         state->ctx[i] = 0;

  520.     }

  521. }

  522. 

  523. void sha512_inc_init(sha512ctx *state) {

  524.     for (size_t i = 0; i < 64; ++i) {

  525.         state->ctx[i] = iv_512[i];

  526.     }

  527.     for (size_t i = 64; i < 72; ++i) {

  528.         state->ctx[i] = 0;

  529.     }

  530. }

  531. 

  532. void sha224_inc_clone_state(sha224ctx *stateout, const sha224ctx *statein) {

  533.     memcpy(stateout, statein, sizeof(sha224ctx));

  534. }

  535. 

  536. void sha256_inc_clone_state(sha256ctx *stateout, const sha256ctx *statein) {

  537.     memcpy(stateout, statein, sizeof(sha256ctx));

  538. }

  539. 

  540. void sha384_inc_clone_state(sha384ctx *stateout, const sha384ctx *statein) {

  541.     memcpy(stateout, statein, sizeof(sha384ctx));

  542. }

  543. 

  544. void sha512_inc_clone_state(sha512ctx *stateout, const sha512ctx *statein) {

  545.     memcpy(stateout, statein, sizeof(sha512ctx));

  546. }

  547. 

  548. void sha256_inc_blocks(sha256ctx *state, const uint8_t *in, size_t inblocks) {

  549.     uint64_t bytes = load_bigendian_64(state->ctx + 32);

  550. 

  551.     crypto_hashblocks_sha256(state->ctx, in, 64 * inblocks);

  552.     bytes += 64 * inblocks;

  553. 

  554.     store_bigendian_64(state->ctx + 32, bytes);

  555. }

  556. 

  557. void sha224_inc_blocks(sha224ctx *state, const uint8_t *in, size_t inblocks) {

  558.     sha256_inc_blocks((sha256ctx*) state, in, inblocks);

  559. }

  560. 

  561. void sha512_inc_blocks(sha512ctx *state, const uint8_t *in, size_t inblocks) {

  562.     uint64_t bytes = load_bigendian_64(state->ctx + 64);

  563. 

  564.     crypto_hashblocks_sha512(state->ctx, in, 128 * inblocks);

  565.     bytes += 128 * inblocks;

  566. 

  567.     store_bigendian_64(state->ctx + 64, bytes);

  568. }

  569. 

  570. void sha384_inc_blocks(sha384ctx *state, const uint8_t *in, size_t inblocks) {

  571.     sha512_inc_blocks((sha512ctx*) state, in, inblocks);

  572. }

  573. 

  574. void sha256_inc_finalize(uint8_t *out, sha256ctx *state, const uint8_t *in, size_t inlen) {

  575.     uint8_t padded[128];

  576.     uint64_t bytes = load_bigendian_64(state->ctx + 32) + inlen;

  577. 

  578.     crypto_hashblocks_sha256(state->ctx, in, inlen);

  579.     in += inlen;

  580.     inlen &= 63;

  581.     in -= inlen;

  582. 

  583.     for (size_t i = 0; i < inlen; ++i) {

  584.         padded[i] = in[i];

  585.     }

  586.     padded[inlen] = 0x80;

  587. 

  588.     if (inlen < 56) {

  589.         for (size_t i = inlen + 1; i < 56; ++i) {

  590.             padded[i] = 0;

  591.         }

  592.         padded[56] = (uint8_t) (bytes >> 53);

  593.         padded[57] = (uint8_t) (bytes >> 45);

  594.         padded[58] = (uint8_t) (bytes >> 37);

  595.         padded[59] = (uint8_t) (bytes >> 29);

  596.         padded[60] = (uint8_t) (bytes >> 21);

  597.         padded[61] = (uint8_t) (bytes >> 13);

  598.         padded[62] = (uint8_t) (bytes >> 5);

  599.         padded[63] = (uint8_t) (bytes << 3);

  600.         crypto_hashblocks_sha256(state->ctx, padded, 64);

  601.     } else {

  602.         for (size_t i = inlen + 1; i < 120; ++i) {

  603.             padded[i] = 0;

  604.         }

  605.         padded[120] = (uint8_t) (bytes >> 53);

  606.         padded[121] = (uint8_t) (bytes >> 45);

  607.         padded[122] = (uint8_t) (bytes >> 37);

  608.         padded[123] = (uint8_t) (bytes >> 29);

  609.         padded[124] = (uint8_t) (bytes >> 21);

  610.         padded[125] = (uint8_t) (bytes >> 13);

  611.         padded[126] = (uint8_t) (bytes >> 5);

  612.         padded[127] = (uint8_t) (bytes << 3);

  613.         crypto_hashblocks_sha256(state->ctx, padded, 128);

  614.     }

  615. 

  616.     for (size_t i = 0; i < 32; ++i) {

  617.         out[i] = state->ctx[i];

  618.     }

  619. }

  620. 

  621. void sha224_inc_finalize(uint8_t *out, sha224ctx *state, const uint8_t *in, size_t inlen) {

  622.     sha256_inc_finalize(state->ctx, (sha256ctx*)state, in, inlen);

  623. 

  624.     for (size_t i = 0; i < 28; ++i) {

  625.         out[i] = state->ctx[i];

  626.     }

  627. }

  628. 

  629. void sha512_inc_finalize(uint8_t *out, sha512ctx *state, const uint8_t *in, size_t inlen) {

  630.     uint8_t padded[256];

  631.     uint64_t bytes = load_bigendian_64(state->ctx + 64) + inlen;

  632. 

  633.     crypto_hashblocks_sha512(state->ctx, in, inlen);

  634.     in += inlen;

  635.     inlen &= 127;

  636.     in -= inlen;

  637. 

  638.     for (size_t i = 0; i < inlen; ++i) {

  639.         padded[i] = in[i];

  640.     }

  641.     padded[inlen] = 0x80;

  642. 

  643.     if (inlen < 112) {

  644.         for (size_t i = inlen + 1; i < 119; ++i) {

  645.             padded[i] = 0;

  646.         }

  647.         padded[119] = (uint8_t) (bytes >> 61);

  648.         padded[120] = (uint8_t) (bytes >> 53);

  649.         padded[121] = (uint8_t) (bytes >> 45);

  650.         padded[122] = (uint8_t) (bytes >> 37);

  651.         padded[123] = (uint8_t) (bytes >> 29);

  652.         padded[124] = (uint8_t) (bytes >> 21);

  653.         padded[125] = (uint8_t) (bytes >> 13);

  654.         padded[126] = (uint8_t) (bytes >> 5);

  655.         padded[127] = (uint8_t) (bytes << 3);

  656.         crypto_hashblocks_sha512(state->ctx, padded, 128);

  657.     } else {

  658.         for (size_t i = inlen + 1; i < 247; ++i) {

  659.             padded[i] = 0;

  660.         }

  661.         padded[247] = (uint8_t) (bytes >> 61);

  662.         padded[248] = (uint8_t) (bytes >> 53);

  663.         padded[249] = (uint8_t) (bytes >> 45);

  664.         padded[250] = (uint8_t) (bytes >> 37);

  665.         padded[251] = (uint8_t) (bytes >> 29);

  666.         padded[252] = (uint8_t) (bytes >> 21);

  667.         padded[253] = (uint8_t) (bytes >> 13);

  668.         padded[254] = (uint8_t) (bytes >> 5);

  669.         padded[255] = (uint8_t) (bytes << 3);

  670.         crypto_hashblocks_sha512(state->ctx, padded, 256);

  671.     }

  672. 

  673.     for (size_t i = 0; i < 64; ++i) {

  674.         out[i] = state->ctx[i];

  675.     }

  676. }

  677. 

  678. void sha384_inc_finalize(uint8_t *out, sha384ctx *state, const uint8_t *in, size_t inlen) {

  679.     sha512_inc_finalize(state->ctx, (sha512ctx*)state, in, inlen);

  680. 

  681.     for (size_t i = 0; i < 48; ++i) {

  682.         out[i] = state->ctx[i];

  683.     }

  684. }

  685. 

  686. void sha224(uint8_t *out, const uint8_t *in, size_t inlen) {

  687.     sha224ctx state;

  688. 

  689.     sha224_inc_init(&state);

  690.     sha224_inc_finalize(out, &state, in, inlen);

  691. }

  692. 

  693. void sha256(uint8_t *out, const uint8_t *in, size_t inlen) {

  694.     sha256ctx state;

  695. 

  696.     sha256_inc_init(&state);

  697.     sha256_inc_finalize(out, &state, in, inlen);

  698. }

  699. 

  700. void sha384(uint8_t *out, const uint8_t *in, size_t inlen) {

  701.     sha384ctx state;

  702. 

  703.     sha384_inc_init(&state);

  704.     sha384_inc_finalize(out, &state, in, inlen);

  705. }

  706. 

  707. void sha512(uint8_t *out, const uint8_t *in, size_t inlen) {

  708.     sha512ctx state;

  709. 

  710.     sha512_inc_init(&state);

  711.     sha512_inc_finalize(out, &state, in, inlen);

  712. }