blob: cdd143a93fa326d29bb0fac8012daaff80be39d3
1 | /* SHA-256 and SHA-512 implementation based on code by Oliver Gay |
2 | * <olivier.gay@a3.epfl.ch> under a BSD-style license. See below. |
3 | */ |
4 | |
5 | /* |
6 | * FIPS 180-2 SHA-224/256/384/512 implementation |
7 | * Last update: 02/02/2007 |
8 | * Issue date: 04/30/2005 |
9 | * |
10 | * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay@a3.epfl.ch> |
11 | * All rights reserved. |
12 | * |
13 | * Redistribution and use in source and binary forms, with or without |
14 | * modification, are permitted provided that the following conditions |
15 | * are met: |
16 | * 1. Redistributions of source code must retain the above copyright |
17 | * notice, this list of conditions and the following disclaimer. |
18 | * 2. Redistributions in binary form must reproduce the above copyright |
19 | * notice, this list of conditions and the following disclaimer in the |
20 | * documentation and/or other materials provided with the distribution. |
21 | * 3. Neither the name of the project nor the names of its contributors |
22 | * may be used to endorse or promote products derived from this software |
23 | * without specific prior written permission. |
24 | * |
25 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
26 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
27 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
28 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
29 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
30 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
31 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
32 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
33 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
34 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
35 | * SUCH DAMAGE. |
36 | */ |
37 | |
38 | #include "avb_sha.h" |
39 | |
40 | #define SHFR(x, n) (x >> n) |
41 | #define ROTR(x, n) ((x >> n) | (x << ((sizeof(x) << 3) - n))) |
42 | #define ROTL(x, n) ((x << n) | (x >> ((sizeof(x) << 3) - n))) |
43 | #define CH(x, y, z) ((x & y) ^ (~x & z)) |
44 | #define MAJ(x, y, z) ((x & y) ^ (x & z) ^ (y & z)) |
45 | |
46 | #define SHA256_F1(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22)) |
47 | #define SHA256_F2(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25)) |
48 | #define SHA256_F3(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHFR(x, 3)) |
49 | #define SHA256_F4(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHFR(x, 10)) |
50 | |
51 | #define UNPACK32(x, str) \ |
52 | { \ |
53 | *((str) + 3) = (uint8_t)((x)); \ |
54 | *((str) + 2) = (uint8_t)((x) >> 8); \ |
55 | *((str) + 1) = (uint8_t)((x) >> 16); \ |
56 | *((str) + 0) = (uint8_t)((x) >> 24); \ |
57 | } |
58 | |
59 | #define PACK32(str, x) \ |
60 | { \ |
61 | *(x) = ((uint32_t) * ((str) + 3)) | ((uint32_t) * ((str) + 2) << 8) | \ |
62 | ((uint32_t) * ((str) + 1) << 16) | \ |
63 | ((uint32_t) * ((str) + 0) << 24); \ |
64 | } |
65 | |
66 | /* Macros used for loops unrolling */ |
67 | |
68 | #define SHA256_SCR(i) \ |
69 | { w[i] = SHA256_F4(w[i - 2]) + w[i - 7] + SHA256_F3(w[i - 15]) + w[i - 16]; } |
70 | |
71 | #define SHA256_EXP(a, b, c, d, e, f, g, h, j) \ |
72 | { \ |
73 | t1 = wv[h] + SHA256_F2(wv[e]) + CH(wv[e], wv[f], wv[g]) + sha256_k[j] + \ |
74 | w[j]; \ |
75 | t2 = SHA256_F1(wv[a]) + MAJ(wv[a], wv[b], wv[c]); \ |
76 | wv[d] += t1; \ |
77 | wv[h] = t1 + t2; \ |
78 | } |
79 | |
80 | static const uint32_t sha256_h0[8] = {0x6a09e667, |
81 | 0xbb67ae85, |
82 | 0x3c6ef372, |
83 | 0xa54ff53a, |
84 | 0x510e527f, |
85 | 0x9b05688c, |
86 | 0x1f83d9ab, |
87 | 0x5be0cd19}; |
88 | |
89 | static const uint32_t sha256_k[64] = { |
90 | 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, |
91 | 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, |
92 | 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, |
93 | 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, |
94 | 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, |
95 | 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, |
96 | 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, |
97 | 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, |
98 | 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, |
99 | 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, |
100 | 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2}; |
101 | |
102 | /* SHA-256 implementation */ |
103 | void avb_sha256_init(AvbSHA256Ctx* ctx) { |
104 | #ifndef UNROLL_LOOPS |
105 | int i; |
106 | for (i = 0; i < 8; i++) { |
107 | ctx->h[i] = sha256_h0[i]; |
108 | } |
109 | #else |
110 | ctx->h[0] = sha256_h0[0]; |
111 | ctx->h[1] = sha256_h0[1]; |
112 | ctx->h[2] = sha256_h0[2]; |
113 | ctx->h[3] = sha256_h0[3]; |
114 | ctx->h[4] = sha256_h0[4]; |
115 | ctx->h[5] = sha256_h0[5]; |
116 | ctx->h[6] = sha256_h0[6]; |
117 | ctx->h[7] = sha256_h0[7]; |
118 | #endif /* !UNROLL_LOOPS */ |
119 | |
120 | ctx->len = 0; |
121 | ctx->tot_len = 0; |
122 | } |
123 | |
124 | static void SHA256_transform(AvbSHA256Ctx* ctx, |
125 | const uint8_t* message, |
126 | unsigned int block_nb) { |
127 | uint32_t w[64]; |
128 | uint32_t wv[8]; |
129 | uint32_t t1, t2; |
130 | const unsigned char* sub_block; |
131 | int i; |
132 | |
133 | #ifndef UNROLL_LOOPS |
134 | int j; |
135 | #endif |
136 | |
137 | for (i = 0; i < (int)block_nb; i++) { |
138 | sub_block = message + (i << 6); |
139 | |
140 | #ifndef UNROLL_LOOPS |
141 | for (j = 0; j < 16; j++) { |
142 | PACK32(&sub_block[j << 2], &w[j]); |
143 | } |
144 | |
145 | for (j = 16; j < 64; j++) { |
146 | SHA256_SCR(j); |
147 | } |
148 | |
149 | for (j = 0; j < 8; j++) { |
150 | wv[j] = ctx->h[j]; |
151 | } |
152 | |
153 | for (j = 0; j < 64; j++) { |
154 | t1 = wv[7] + SHA256_F2(wv[4]) + CH(wv[4], wv[5], wv[6]) + sha256_k[j] + |
155 | w[j]; |
156 | t2 = SHA256_F1(wv[0]) + MAJ(wv[0], wv[1], wv[2]); |
157 | wv[7] = wv[6]; |
158 | wv[6] = wv[5]; |
159 | wv[5] = wv[4]; |
160 | wv[4] = wv[3] + t1; |
161 | wv[3] = wv[2]; |
162 | wv[2] = wv[1]; |
163 | wv[1] = wv[0]; |
164 | wv[0] = t1 + t2; |
165 | } |
166 | |
167 | for (j = 0; j < 8; j++) { |
168 | ctx->h[j] += wv[j]; |
169 | } |
170 | #else |
171 | PACK32(&sub_block[0], &w[0]); |
172 | PACK32(&sub_block[4], &w[1]); |
173 | PACK32(&sub_block[8], &w[2]); |
174 | PACK32(&sub_block[12], &w[3]); |
175 | PACK32(&sub_block[16], &w[4]); |
176 | PACK32(&sub_block[20], &w[5]); |
177 | PACK32(&sub_block[24], &w[6]); |
178 | PACK32(&sub_block[28], &w[7]); |
179 | PACK32(&sub_block[32], &w[8]); |
180 | PACK32(&sub_block[36], &w[9]); |
181 | PACK32(&sub_block[40], &w[10]); |
182 | PACK32(&sub_block[44], &w[11]); |
183 | PACK32(&sub_block[48], &w[12]); |
184 | PACK32(&sub_block[52], &w[13]); |
185 | PACK32(&sub_block[56], &w[14]); |
186 | PACK32(&sub_block[60], &w[15]); |
187 | |
188 | SHA256_SCR(16); |
189 | SHA256_SCR(17); |
190 | SHA256_SCR(18); |
191 | SHA256_SCR(19); |
192 | SHA256_SCR(20); |
193 | SHA256_SCR(21); |
194 | SHA256_SCR(22); |
195 | SHA256_SCR(23); |
196 | SHA256_SCR(24); |
197 | SHA256_SCR(25); |
198 | SHA256_SCR(26); |
199 | SHA256_SCR(27); |
200 | SHA256_SCR(28); |
201 | SHA256_SCR(29); |
202 | SHA256_SCR(30); |
203 | SHA256_SCR(31); |
204 | SHA256_SCR(32); |
205 | SHA256_SCR(33); |
206 | SHA256_SCR(34); |
207 | SHA256_SCR(35); |
208 | SHA256_SCR(36); |
209 | SHA256_SCR(37); |
210 | SHA256_SCR(38); |
211 | SHA256_SCR(39); |
212 | SHA256_SCR(40); |
213 | SHA256_SCR(41); |
214 | SHA256_SCR(42); |
215 | SHA256_SCR(43); |
216 | SHA256_SCR(44); |
217 | SHA256_SCR(45); |
218 | SHA256_SCR(46); |
219 | SHA256_SCR(47); |
220 | SHA256_SCR(48); |
221 | SHA256_SCR(49); |
222 | SHA256_SCR(50); |
223 | SHA256_SCR(51); |
224 | SHA256_SCR(52); |
225 | SHA256_SCR(53); |
226 | SHA256_SCR(54); |
227 | SHA256_SCR(55); |
228 | SHA256_SCR(56); |
229 | SHA256_SCR(57); |
230 | SHA256_SCR(58); |
231 | SHA256_SCR(59); |
232 | SHA256_SCR(60); |
233 | SHA256_SCR(61); |
234 | SHA256_SCR(62); |
235 | SHA256_SCR(63); |
236 | |
237 | wv[0] = ctx->h[0]; |
238 | wv[1] = ctx->h[1]; |
239 | wv[2] = ctx->h[2]; |
240 | wv[3] = ctx->h[3]; |
241 | wv[4] = ctx->h[4]; |
242 | wv[5] = ctx->h[5]; |
243 | wv[6] = ctx->h[6]; |
244 | wv[7] = ctx->h[7]; |
245 | |
246 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 0); |
247 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 1); |
248 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 2); |
249 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 3); |
250 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 4); |
251 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 5); |
252 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 6); |
253 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 7); |
254 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 8); |
255 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 9); |
256 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 10); |
257 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 11); |
258 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 12); |
259 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 13); |
260 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 14); |
261 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 15); |
262 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 16); |
263 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 17); |
264 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 18); |
265 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 19); |
266 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 20); |
267 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 21); |
268 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 22); |
269 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 23); |
270 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 24); |
271 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 25); |
272 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 26); |
273 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 27); |
274 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 28); |
275 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 29); |
276 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 30); |
277 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 31); |
278 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 32); |
279 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 33); |
280 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 34); |
281 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 35); |
282 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 36); |
283 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 37); |
284 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 38); |
285 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 39); |
286 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 40); |
287 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 41); |
288 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 42); |
289 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 43); |
290 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 44); |
291 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 45); |
292 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 46); |
293 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 47); |
294 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 48); |
295 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 49); |
296 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 50); |
297 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 51); |
298 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 52); |
299 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 53); |
300 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 54); |
301 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 55); |
302 | SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 56); |
303 | SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 57); |
304 | SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 58); |
305 | SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 59); |
306 | SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 60); |
307 | SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 61); |
308 | SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 62); |
309 | SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 63); |
310 | |
311 | ctx->h[0] += wv[0]; |
312 | ctx->h[1] += wv[1]; |
313 | ctx->h[2] += wv[2]; |
314 | ctx->h[3] += wv[3]; |
315 | ctx->h[4] += wv[4]; |
316 | ctx->h[5] += wv[5]; |
317 | ctx->h[6] += wv[6]; |
318 | ctx->h[7] += wv[7]; |
319 | #endif /* !UNROLL_LOOPS */ |
320 | } |
321 | } |
322 | |
323 | void avb_sha256_update(AvbSHA256Ctx* ctx, const uint8_t* data, uint32_t len) { |
324 | unsigned int block_nb; |
325 | unsigned int new_len, rem_len, tmp_len; |
326 | const uint8_t* shifted_data; |
327 | |
328 | tmp_len = AVB_SHA256_BLOCK_SIZE - ctx->len; |
329 | rem_len = len < tmp_len ? len : tmp_len; |
330 | |
331 | avb_memcpy(&ctx->block[ctx->len], data, rem_len); |
332 | |
333 | if (ctx->len + len < AVB_SHA256_BLOCK_SIZE) { |
334 | ctx->len += len; |
335 | return; |
336 | } |
337 | |
338 | new_len = len - rem_len; |
339 | block_nb = new_len / AVB_SHA256_BLOCK_SIZE; |
340 | |
341 | shifted_data = data + rem_len; |
342 | |
343 | SHA256_transform(ctx, ctx->block, 1); |
344 | SHA256_transform(ctx, shifted_data, block_nb); |
345 | |
346 | rem_len = new_len % AVB_SHA256_BLOCK_SIZE; |
347 | |
348 | avb_memcpy(ctx->block, &shifted_data[block_nb << 6], rem_len); |
349 | |
350 | ctx->len = rem_len; |
351 | ctx->tot_len += (block_nb + 1) << 6; |
352 | } |
353 | |
354 | uint8_t* avb_sha256_final(AvbSHA256Ctx* ctx) { |
355 | unsigned int block_nb; |
356 | unsigned int pm_len; |
357 | unsigned int len_b; |
358 | #ifndef UNROLL_LOOPS |
359 | int i; |
360 | #endif |
361 | |
362 | block_nb = |
363 | (1 + ((AVB_SHA256_BLOCK_SIZE - 9) < (ctx->len % AVB_SHA256_BLOCK_SIZE))); |
364 | |
365 | len_b = (ctx->tot_len + ctx->len) << 3; |
366 | pm_len = block_nb << 6; |
367 | |
368 | avb_memset(ctx->block + ctx->len, 0, pm_len - ctx->len); |
369 | ctx->block[ctx->len] = 0x80; |
370 | UNPACK32(len_b, ctx->block + pm_len - 4); |
371 | |
372 | SHA256_transform(ctx, ctx->block, block_nb); |
373 | |
374 | #ifndef UNROLL_LOOPS |
375 | for (i = 0; i < 8; i++) { |
376 | UNPACK32(ctx->h[i], &ctx->buf[i << 2]); |
377 | } |
378 | #else |
379 | UNPACK32(ctx->h[0], &ctx->buf[0]); |
380 | UNPACK32(ctx->h[1], &ctx->buf[4]); |
381 | UNPACK32(ctx->h[2], &ctx->buf[8]); |
382 | UNPACK32(ctx->h[3], &ctx->buf[12]); |
383 | UNPACK32(ctx->h[4], &ctx->buf[16]); |
384 | UNPACK32(ctx->h[5], &ctx->buf[20]); |
385 | UNPACK32(ctx->h[6], &ctx->buf[24]); |
386 | UNPACK32(ctx->h[7], &ctx->buf[28]); |
387 | #endif /* !UNROLL_LOOPS */ |
388 | |
389 | return ctx->buf; |
390 | } |
391 |