[dragonfly.git] / lib / libmd / sha256c.c

/*-
 * Copyright 2005 Colin Percival
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD: src/lib/libmd/sha256c.c,v 1.2 2006/01/17 15:35:56 phk Exp $
 * $DragonFly: src/lib/libmd/sha256c.c,v 1.2 2008/09/11 20:25:34 swildner Exp $
 */

#include <sys/cdefs.h>
#include <sys/endian.h>
#include <sys/types.h>

#include <string.h>

#include "sha256.h"

#if BYTE_ORDER == BIG_ENDIAN

/* Copy a vector of big-endian uint32_t into a vector of bytes */
#define be32enc_vect(dst, src, len)	\
	memcpy((void *)dst, (const void *)src, (size_t)len)

/* Copy a vector of bytes into a vector of big-endian uint32_t */
#define be32dec_vect(dst, src, len)	\
	memcpy((void *)dst, (const void *)src, (size_t)len)

#else /* BYTE_ORDER != BIG_ENDIAN */

/*
 * Encode a length len/4 vector of (uint32_t) into a length len vector of
 * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
 */
static void
be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
{
	size_t i;

	for (i = 0; i < len / 4; i++)
		be32enc(dst + i * 4, src[i]);
}

/*
 * Decode a big-endian length len vector of (unsigned char) into a length
 * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
 */
static void
be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
{
	size_t i;

	for (i = 0; i < len / 4; i++)
		dst[i] = be32dec(src + i * 4);
}

#endif /* BYTE_ORDER != BIG_ENDIAN */

/* Elementary functions used by SHA256 */
#define Ch(x, y, z)	((x & (y ^ z)) ^ z)
#define Maj(x, y, z)	((x & (y | z)) | (y & z))
#define SHR(x, n)	(x >> n)
#define ROTR(x, n)	((x >> n) | (x << (32 - n)))
#define S0(x)		(ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
#define S1(x)		(ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
#define s0(x)		(ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
#define s1(x)		(ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))

/* SHA256 round function */
#define RND(a, b, c, d, e, f, g, h, k)			\
	t0 = h + S1(e) + Ch(e, f, g) + k;		\
	t1 = S0(a) + Maj(a, b, c);			\
	d += t0;					\
	h  = t0 + t1;

/* Adjusted round function for rotating state */
#define RNDr(S, W, i, k)			\
	RND(S[(64 - i) % 8], S[(65 - i) % 8],	\
	    S[(66 - i) % 8], S[(67 - i) % 8],	\
	    S[(68 - i) % 8], S[(69 - i) % 8],	\
	    S[(70 - i) % 8], S[(71 - i) % 8],	\
	    W[i] + k)

/*
 * SHA256 block compression function.  The 256-bit state is transformed via
 * the 512-bit input block to produce a new state.
 */
static void
SHA256_Transform(uint32_t * state, const unsigned char block[64])
{
	uint32_t W[64];
	uint32_t S[8];
	uint32_t t0, t1;
	int i;

	/* 1. Prepare message schedule W. */
	be32dec_vect(W, block, 64);
	for (i = 16; i < 64; i++)
		W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];

	/* 2. Initialize working variables. */
	memcpy(S, state, 32);

	/* 3. Mix. */
	RNDr(S, W, 0, 0x428a2f98);
	RNDr(S, W, 1, 0x71374491);
	RNDr(S, W, 2, 0xb5c0fbcf);
	RNDr(S, W, 3, 0xe9b5dba5);
	RNDr(S, W, 4, 0x3956c25b);
	RNDr(S, W, 5, 0x59f111f1);
	RNDr(S, W, 6, 0x923f82a4);
	RNDr(S, W, 7, 0xab1c5ed5);
	RNDr(S, W, 8, 0xd807aa98);
	RNDr(S, W, 9, 0x12835b01);
	RNDr(S, W, 10, 0x243185be);
	RNDr(S, W, 11, 0x550c7dc3);
	RNDr(S, W, 12, 0x72be5d74);
	RNDr(S, W, 13, 0x80deb1fe);
	RNDr(S, W, 14, 0x9bdc06a7);
	RNDr(S, W, 15, 0xc19bf174);
	RNDr(S, W, 16, 0xe49b69c1);
	RNDr(S, W, 17, 0xefbe4786);
	RNDr(S, W, 18, 0x0fc19dc6);
	RNDr(S, W, 19, 0x240ca1cc);
	RNDr(S, W, 20, 0x2de92c6f);
	RNDr(S, W, 21, 0x4a7484aa);
	RNDr(S, W, 22, 0x5cb0a9dc);
	RNDr(S, W, 23, 0x76f988da);
	RNDr(S, W, 24, 0x983e5152);
	RNDr(S, W, 25, 0xa831c66d);
	RNDr(S, W, 26, 0xb00327c8);
	RNDr(S, W, 27, 0xbf597fc7);
	RNDr(S, W, 28, 0xc6e00bf3);
	RNDr(S, W, 29, 0xd5a79147);
	RNDr(S, W, 30, 0x06ca6351);
	RNDr(S, W, 31, 0x14292967);
	RNDr(S, W, 32, 0x27b70a85);
	RNDr(S, W, 33, 0x2e1b2138);
	RNDr(S, W, 34, 0x4d2c6dfc);
	RNDr(S, W, 35, 0x53380d13);
	RNDr(S, W, 36, 0x650a7354);
	RNDr(S, W, 37, 0x766a0abb);
	RNDr(S, W, 38, 0x81c2c92e);
	RNDr(S, W, 39, 0x92722c85);
	RNDr(S, W, 40, 0xa2bfe8a1);
	RNDr(S, W, 41, 0xa81a664b);
	RNDr(S, W, 42, 0xc24b8b70);
	RNDr(S, W, 43, 0xc76c51a3);
	RNDr(S, W, 44, 0xd192e819);
	RNDr(S, W, 45, 0xd6990624);
	RNDr(S, W, 46, 0xf40e3585);
	RNDr(S, W, 47, 0x106aa070);
	RNDr(S, W, 48, 0x19a4c116);
	RNDr(S, W, 49, 0x1e376c08);
	RNDr(S, W, 50, 0x2748774c);
	RNDr(S, W, 51, 0x34b0bcb5);
	RNDr(S, W, 52, 0x391c0cb3);
	RNDr(S, W, 53, 0x4ed8aa4a);
	RNDr(S, W, 54, 0x5b9cca4f);
	RNDr(S, W, 55, 0x682e6ff3);
	RNDr(S, W, 56, 0x748f82ee);
	RNDr(S, W, 57, 0x78a5636f);
	RNDr(S, W, 58, 0x84c87814);
	RNDr(S, W, 59, 0x8cc70208);
	RNDr(S, W, 60, 0x90befffa);
	RNDr(S, W, 61, 0xa4506ceb);
	RNDr(S, W, 62, 0xbef9a3f7);
	RNDr(S, W, 63, 0xc67178f2);

	/* 4. Mix local working variables into global state */
	for (i = 0; i < 8; i++)
		state[i] += S[i];
}

static unsigned char PAD[64] = {
	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* Add padding and terminating bit-count. */
static void
SHA256_Pad(SHA256_CTX * ctx)
{
	unsigned char len[8];
	uint32_t r, plen;

	/*
	 * Convert length to a vector of bytes -- we do this now rather
	 * than later because the length will change after we pad.
	 */
	be32enc_vect(len, ctx->count, 8);

	/* Add 1--64 bytes so that the resulting length is 56 mod 64 */
	r = (ctx->count[1] >> 3) & 0x3f;
	plen = (r < 56) ? (56 - r) : (120 - r);
	SHA256_Update(ctx, PAD, (size_t)plen);

	/* Add the terminating bit-count */
	SHA256_Update(ctx, len, 8);
}

/* SHA-256 initialization.  Begins a SHA-256 operation. */
void
SHA256_Init(SHA256_CTX * ctx)
{

	/* Zero bits processed so far */
	ctx->count[0] = ctx->count[1] = 0;

	/* Magic initialization constants */
	ctx->state[0] = 0x6A09E667;
	ctx->state[1] = 0xBB67AE85;
	ctx->state[2] = 0x3C6EF372;
	ctx->state[3] = 0xA54FF53A;
	ctx->state[4] = 0x510E527F;
	ctx->state[5] = 0x9B05688C;
	ctx->state[6] = 0x1F83D9AB;
	ctx->state[7] = 0x5BE0CD19;
}

/* Add bytes into the hash */
void
SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len)
{
	uint32_t bitlen[2];
	uint32_t r;
	const unsigned char *src = in;

	/* Number of bytes left in the buffer from previous updates */
	r = (ctx->count[1] >> 3) & 0x3f;

	/* Convert the length into a number of bits */
	bitlen[1] = ((uint32_t)len) << 3;
	bitlen[0] = (uint32_t)(len >> 29);

	/* Update number of bits */
	if ((ctx->count[1] += bitlen[1]) < bitlen[1])
		ctx->count[0]++;
	ctx->count[0] += bitlen[0];

	/* Handle the case where we don't need to perform any transforms */
	if (len < 64 - r) {
		memcpy(&ctx->buf[r], src, len);
		return;
	}

	/* Finish the current block */
	memcpy(&ctx->buf[r], src, 64 - r);
	SHA256_Transform(ctx->state, ctx->buf);
	src += 64 - r;
	len -= 64 - r;

	/* Perform complete blocks */
	while (len >= 64) {
		SHA256_Transform(ctx->state, src);
		src += 64;
		len -= 64;
	}

	/* Copy left over data into buffer */
	memcpy(ctx->buf, src, len);
}

/*
 * SHA-256 finalization.  Pads the input data, exports the hash value,
 * and clears the context state.
 */
void
SHA256_Final(unsigned char digest[32], SHA256_CTX * ctx)
{

	/* Add padding */
	SHA256_Pad(ctx);

	/* Write the hash */
	be32enc_vect(digest, ctx->state, 32);

	/* Clear the context state */
	memset((void *)ctx, 0, sizeof(*ctx));
}
Commit	Line	Data
39b242ad MD	1	/*-
	2	* Copyright 2005 Colin Percival
	3	* All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	15	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	16	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	17	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	18	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	19	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	20	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	21	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	22	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	23	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	24	* SUCH DAMAGE.
	25	*
3cd01911 SW	26	* $FreeBSD: src/lib/libmd/sha256c.c,v 1.2 2006/01/17 15:35:56 phk Exp $
3cd01911 SW	27	* $DragonFly: src/lib/libmd/sha256c.c,v 1.2 2008/09/11 20:25:34 swildner Exp $
39b242ad MD	28	*/
	29
	30	#include <sys/cdefs.h>
	31	#include <sys/endian.h>
	32	#include <sys/types.h>
	33
	34	#include <string.h>
	35
	36	#include "sha256.h"
	37
	38	#if BYTE_ORDER == BIG_ENDIAN
	39
	40	/* Copy a vector of big-endian uint32_t into a vector of bytes */
	41	#define be32enc_vect(dst, src, len) \
	42	memcpy((void )dst, (const void )src, (size_t)len)
	43
	44	/* Copy a vector of bytes into a vector of big-endian uint32_t */
	45	#define be32dec_vect(dst, src, len) \
	46	memcpy((void )dst, (const void )src, (size_t)len)
	47
	48	#else /* BYTE_ORDER != BIG_ENDIAN */
	49
	50	/*
	51	* Encode a length len/4 vector of (uint32_t) into a length len vector of
	52	* (unsigned char) in big-endian form. Assumes len is a multiple of 4.
	53	*/
	54	static void
	55	be32enc_vect(unsigned char dst, const uint32_t src, size_t len)
	56	{
	57	size_t i;
	58
	59	for (i = 0; i < len / 4; i++)
	60	be32enc(dst + i * 4, src[i]);
	61	}
	62
	63	/*
	64	* Decode a big-endian length len vector of (unsigned char) into a length
	65	* len/4 vector of (uint32_t). Assumes len is a multiple of 4.
	66	*/
	67	static void
	68	be32dec_vect(uint32_t dst, const unsigned char src, size_t len)
	69	{
	70	size_t i;
	71
	72	for (i = 0; i < len / 4; i++)
	73	dst[i] = be32dec(src + i * 4);
	74	}
	75
	76	#endif /* BYTE_ORDER != BIG_ENDIAN */
	77
	78	/* Elementary functions used by SHA256 */
	79	#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
	80	#define Maj(x, y, z) ((x & (y \| z)) \| (y & z))
	81	#define SHR(x, n) (x >> n)
	82	#define ROTR(x, n) ((x >> n) \| (x << (32 - n)))
	83	#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
	84	#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
	85	#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
	86	#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
	87
	88	/* SHA256 round function */
	89	#define RND(a, b, c, d, e, f, g, h, k) \
	90	t0 = h + S1(e) + Ch(e, f, g) + k; \
	91	t1 = S0(a) + Maj(a, b, c); \
92	d += t0; \
93	h = t0 + t1;
94
95	/* Adjusted round function for rotating state */
96	#define RNDr(S, W, i, k) \
97	RND(S[(64 - i) % 8], S[(65 - i) % 8], \
98	S[(66 - i) % 8], S[(67 - i) % 8], \
99	S[(68 - i) % 8], S[(69 - i) % 8], \
100	S[(70 - i) % 8], S[(71 - i) % 8], \
101	W[i] + k)
102
103	/*
104	* SHA256 block compression function. The 256-bit state is transformed via
105	* the 512-bit input block to produce a new state.
106	*/
107	static void
108	SHA256_Transform(uint32_t * state, const unsigned char block[64])
109	{
110	uint32_t W[64];
111	uint32_t S[8];
112	uint32_t t0, t1;
113	int i;
114
115	/* 1. Prepare message schedule W. */
116	be32dec_vect(W, block, 64);
117	for (i = 16; i < 64; i++)
118	W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];
119
120	/* 2. Initialize working variables. */
121	memcpy(S, state, 32);
122
123	/* 3. Mix. */
124	RNDr(S, W, 0, 0x428a2f98);
125	RNDr(S, W, 1, 0x71374491);
126	RNDr(S, W, 2, 0xb5c0fbcf);
127	RNDr(S, W, 3, 0xe9b5dba5);
128	RNDr(S, W, 4, 0x3956c25b);
129	RNDr(S, W, 5, 0x59f111f1);
130	RNDr(S, W, 6, 0x923f82a4);
131	RNDr(S, W, 7, 0xab1c5ed5);
132	RNDr(S, W, 8, 0xd807aa98);
133	RNDr(S, W, 9, 0x12835b01);
134	RNDr(S, W, 10, 0x243185be);
135	RNDr(S, W, 11, 0x550c7dc3);
136	RNDr(S, W, 12, 0x72be5d74);
137	RNDr(S, W, 13, 0x80deb1fe);
138	RNDr(S, W, 14, 0x9bdc06a7);
139	RNDr(S, W, 15, 0xc19bf174);
140	RNDr(S, W, 16, 0xe49b69c1);
141	RNDr(S, W, 17, 0xefbe4786);
142	RNDr(S, W, 18, 0x0fc19dc6);
143	RNDr(S, W, 19, 0x240ca1cc);
144	RNDr(S, W, 20, 0x2de92c6f);
145	RNDr(S, W, 21, 0x4a7484aa);
146	RNDr(S, W, 22, 0x5cb0a9dc);
147	RNDr(S, W, 23, 0x76f988da);
148	RNDr(S, W, 24, 0x983e5152);
149	RNDr(S, W, 25, 0xa831c66d);
150	RNDr(S, W, 26, 0xb00327c8);
151	RNDr(S, W, 27, 0xbf597fc7);
152	RNDr(S, W, 28, 0xc6e00bf3);
153	RNDr(S, W, 29, 0xd5a79147);
154	RNDr(S, W, 30, 0x06ca6351);
155	RNDr(S, W, 31, 0x14292967);
156	RNDr(S, W, 32, 0x27b70a85);
157	RNDr(S, W, 33, 0x2e1b2138);
158	RNDr(S, W, 34, 0x4d2c6dfc);
159	RNDr(S, W, 35, 0x53380d13);
160	RNDr(S, W, 36, 0x650a7354);
161	RNDr(S, W, 37, 0x766a0abb);
162	RNDr(S, W, 38, 0x81c2c92e);
163	RNDr(S, W, 39, 0x92722c85);
164	RNDr(S, W, 40, 0xa2bfe8a1);
165	RNDr(S, W, 41, 0xa81a664b);
166	RNDr(S, W, 42, 0xc24b8b70);
167	RNDr(S, W, 43, 0xc76c51a3);
168	RNDr(S, W, 44, 0xd192e819);
169	RNDr(S, W, 45, 0xd6990624);
170	RNDr(S, W, 46, 0xf40e3585);
171	RNDr(S, W, 47, 0x106aa070);
172	RNDr(S, W, 48, 0x19a4c116);
173	RNDr(S, W, 49, 0x1e376c08);
174	RNDr(S, W, 50, 0x2748774c);
175	RNDr(S, W, 51, 0x34b0bcb5);
176	RNDr(S, W, 52, 0x391c0cb3);
177	RNDr(S, W, 53, 0x4ed8aa4a);
178	RNDr(S, W, 54, 0x5b9cca4f);
179	RNDr(S, W, 55, 0x682e6ff3);
180	RNDr(S, W, 56, 0x748f82ee);
181	RNDr(S, W, 57, 0x78a5636f);
182	RNDr(S, W, 58, 0x84c87814);
183	RNDr(S, W, 59, 0x8cc70208);
184	RNDr(S, W, 60, 0x90befffa);
185	RNDr(S, W, 61, 0xa4506ceb);
186	RNDr(S, W, 62, 0xbef9a3f7);
187	RNDr(S, W, 63, 0xc67178f2);
188
189	/* 4. Mix local working variables into global state */
190	for (i = 0; i < 8; i++)
191	state[i] += S[i];
192	}
193
194	static unsigned char PAD[64] = {
195	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
196	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
197	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
198	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
199	};
200
201	/* Add padding and terminating bit-count. */
202	static void
203	SHA256_Pad(SHA256_CTX * ctx)
204	{
205	unsigned char len[8];
206	uint32_t r, plen;
207
208	/*
209	* Convert length to a vector of bytes -- we do this now rather
210	* than later because the length will change after we pad.
211	*/
212	be32enc_vect(len, ctx->count, 8);
213
214	/* Add 1--64 bytes so that the resulting length is 56 mod 64 */
215	r = (ctx->count[1] >> 3) & 0x3f;
216	plen = (r < 56) ? (56 - r) : (120 - r);
217	SHA256_Update(ctx, PAD, (size_t)plen);
218
219	/* Add the terminating bit-count */
220	SHA256_Update(ctx, len, 8);
221	}
222
223	/* SHA-256 initialization. Begins a SHA-256 operation. */
224	void
225	SHA256_Init(SHA256_CTX * ctx)
226	{
227
228	/* Zero bits processed so far */
229	ctx->count[0] = ctx->count[1] = 0;
230
231	/* Magic initialization constants */
232	ctx->state[0] = 0x6A09E667;
233	ctx->state[1] = 0xBB67AE85;
234	ctx->state[2] = 0x3C6EF372;
235	ctx->state[3] = 0xA54FF53A;
236	ctx->state[4] = 0x510E527F;
237	ctx->state[5] = 0x9B05688C;
238	ctx->state[6] = 0x1F83D9AB;
239	ctx->state[7] = 0x5BE0CD19;
240	}
241
242	/* Add bytes into the hash */
243	void
3cd01911	244	SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len)
39b242ad MD	245	{
	246	uint32_t bitlen[2];
	247	uint32_t r;
3cd01911	248	const unsigned char *src = in;
39b242ad MD	249
	250	/* Number of bytes left in the buffer from previous updates */
	251	r = (ctx->count[1] >> 3) & 0x3f;
	252
	253	/* Convert the length into a number of bits */
	254	bitlen[1] = ((uint32_t)len) << 3;
	255	bitlen[0] = (uint32_t)(len >> 29);
	256
	257	/* Update number of bits */
	258	if ((ctx->count[1] += bitlen[1]) < bitlen[1])
	259	ctx->count[0]++;
	260	ctx->count[0] += bitlen[0];
	261
	262	/* Handle the case where we don't need to perform any transforms */
	263	if (len < 64 - r) {
	264	memcpy(&ctx->buf[r], src, len);
	265	return;
	266	}
	267
	268	/* Finish the current block */
	269	memcpy(&ctx->buf[r], src, 64 - r);
	270	SHA256_Transform(ctx->state, ctx->buf);
	271	src += 64 - r;
	272	len -= 64 - r;
	273
	274	/* Perform complete blocks */
	275	while (len >= 64) {
	276	SHA256_Transform(ctx->state, src);
	277	src += 64;
	278	len -= 64;
	279	}
	280
	281	/* Copy left over data into buffer */
	282	memcpy(ctx->buf, src, len);
	283	}
	284
	285	/*
	286	* SHA-256 finalization. Pads the input data, exports the hash value,
	287	* and clears the context state.
	288	*/
	289	void
	290	SHA256_Final(unsigned char digest[32], SHA256_CTX * ctx)
	291	{
	292
	293	/* Add padding */
	294	SHA256_Pad(ctx);
	295
	296	/* Write the hash */
	297	be32enc_vect(digest, ctx->state, 32);
	298
	299	/* Clear the context state */
	300	memset((void )ctx, 0, sizeof(ctx));
	301	}