[dragonfly.git] / lib / libmd / sha256c.c

/*-
 * Copyright 2005 Colin Percival
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD: src/lib/libmd/sha256c.c,v 1.2 2006/01/17 15:35:56 phk Exp $
 */

#include <sys/endian.h>
#include <sys/types.h>

#include <string.h>

#include "sha256.h"

#if BYTE_ORDER == BIG_ENDIAN

/* Copy a vector of big-endian uint32_t into a vector of bytes */
#define be32enc_vect(dst, src, len)	\
	memcpy((void *)dst, (const void *)src, (size_t)len)

/* Copy a vector of bytes into a vector of big-endian uint32_t */
#define be32dec_vect(dst, src, len)	\
	memcpy((void *)dst, (const void *)src, (size_t)len)

#else /* BYTE_ORDER != BIG_ENDIAN */

/*
 * Encode a length len/4 vector of (uint32_t) into a length len vector of
 * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
 */
static void
be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
{
	size_t i;

	for (i = 0; i < len / 4; i++)
		be32enc(dst + i * 4, src[i]);
}

/*
 * Decode a big-endian length len vector of (unsigned char) into a length
 * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
 */
static void
be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
{
	size_t i;

	for (i = 0; i < len / 4; i++)
		dst[i] = be32dec(src + i * 4);
}

#endif /* BYTE_ORDER != BIG_ENDIAN */

/* Elementary functions used by SHA256 */
#define Ch(x, y, z)	((x & (y ^ z)) ^ z)
#define Maj(x, y, z)	((x & (y | z)) | (y & z))
#define SHR(x, n)	(x >> n)
#define ROTR(x, n)	((x >> n) | (x << (32 - n)))
#define S0(x)		(ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
#define S1(x)		(ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
#define s0(x)		(ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
#define s1(x)		(ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))

/* SHA256 round function */
#define RND(a, b, c, d, e, f, g, h, k)			\
	t0 = h + S1(e) + Ch(e, f, g) + k;		\
	t1 = S0(a) + Maj(a, b, c);			\
	d += t0;					\
	h  = t0 + t1;

/* Adjusted round function for rotating state */
#define RNDr(S, W, i, k)			\
	RND(S[(64 - i) % 8], S[(65 - i) % 8],	\
	    S[(66 - i) % 8], S[(67 - i) % 8],	\
	    S[(68 - i) % 8], S[(69 - i) % 8],	\
	    S[(70 - i) % 8], S[(71 - i) % 8],	\
	    W[i] + k)

/*
 * SHA256 block compression function.  The 256-bit state is transformed via
 * the 512-bit input block to produce a new state.
 */
static void
SHA256_Transform(uint32_t * state, const unsigned char block[64])
{
	uint32_t W[64];
	uint32_t S[8];
	uint32_t t0, t1;
	int i;

	/* 1. Prepare message schedule W. */
	be32dec_vect(W, block, 64);
	for (i = 16; i < 64; i++)
		W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];

	/* 2. Initialize working variables. */
	memcpy(S, state, 32);

	/* 3. Mix. */
	RNDr(S, W, 0, 0x428a2f98);
	RNDr(S, W, 1, 0x71374491);
	RNDr(S, W, 2, 0xb5c0fbcf);
	RNDr(S, W, 3, 0xe9b5dba5);
	RNDr(S, W, 4, 0x3956c25b);
	RNDr(S, W, 5, 0x59f111f1);
	RNDr(S, W, 6, 0x923f82a4);
	RNDr(S, W, 7, 0xab1c5ed5);
	RNDr(S, W, 8, 0xd807aa98);
	RNDr(S, W, 9, 0x12835b01);
	RNDr(S, W, 10, 0x243185be);
	RNDr(S, W, 11, 0x550c7dc3);
	RNDr(S, W, 12, 0x72be5d74);
	RNDr(S, W, 13, 0x80deb1fe);
	RNDr(S, W, 14, 0x9bdc06a7);
	RNDr(S, W, 15, 0xc19bf174);
	RNDr(S, W, 16, 0xe49b69c1);
	RNDr(S, W, 17, 0xefbe4786);
	RNDr(S, W, 18, 0x0fc19dc6);
	RNDr(S, W, 19, 0x240ca1cc);
	RNDr(S, W, 20, 0x2de92c6f);
	RNDr(S, W, 21, 0x4a7484aa);
	RNDr(S, W, 22, 0x5cb0a9dc);
	RNDr(S, W, 23, 0x76f988da);
	RNDr(S, W, 24, 0x983e5152);
	RNDr(S, W, 25, 0xa831c66d);
	RNDr(S, W, 26, 0xb00327c8);
	RNDr(S, W, 27, 0xbf597fc7);
	RNDr(S, W, 28, 0xc6e00bf3);
	RNDr(S, W, 29, 0xd5a79147);
	RNDr(S, W, 30, 0x06ca6351);
	RNDr(S, W, 31, 0x14292967);
	RNDr(S, W, 32, 0x27b70a85);
	RNDr(S, W, 33, 0x2e1b2138);
	RNDr(S, W, 34, 0x4d2c6dfc);
	RNDr(S, W, 35, 0x53380d13);
	RNDr(S, W, 36, 0x650a7354);
	RNDr(S, W, 37, 0x766a0abb);
	RNDr(S, W, 38, 0x81c2c92e);
	RNDr(S, W, 39, 0x92722c85);
	RNDr(S, W, 40, 0xa2bfe8a1);
	RNDr(S, W, 41, 0xa81a664b);
	RNDr(S, W, 42, 0xc24b8b70);
	RNDr(S, W, 43, 0xc76c51a3);
	RNDr(S, W, 44, 0xd192e819);
	RNDr(S, W, 45, 0xd6990624);
	RNDr(S, W, 46, 0xf40e3585);
	RNDr(S, W, 47, 0x106aa070);
	RNDr(S, W, 48, 0x19a4c116);
	RNDr(S, W, 49, 0x1e376c08);
	RNDr(S, W, 50, 0x2748774c);
	RNDr(S, W, 51, 0x34b0bcb5);
	RNDr(S, W, 52, 0x391c0cb3);
	RNDr(S, W, 53, 0x4ed8aa4a);
	RNDr(S, W, 54, 0x5b9cca4f);
	RNDr(S, W, 55, 0x682e6ff3);
	RNDr(S, W, 56, 0x748f82ee);
	RNDr(S, W, 57, 0x78a5636f);
	RNDr(S, W, 58, 0x84c87814);
	RNDr(S, W, 59, 0x8cc70208);
	RNDr(S, W, 60, 0x90befffa);
	RNDr(S, W, 61, 0xa4506ceb);
	RNDr(S, W, 62, 0xbef9a3f7);
	RNDr(S, W, 63, 0xc67178f2);

	/* 4. Mix local working variables into global state */
	for (i = 0; i < 8; i++)
		state[i] += S[i];
}

static unsigned char PAD[64] = {
	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* Add padding and terminating bit-count. */
static void
SHA256_Pad(SHA256_CTX * ctx)
{
	unsigned char len[8];
	uint32_t r, plen;

	/*
	 * Convert length to a vector of bytes -- we do this now rather
	 * than later because the length will change after we pad.
	 */
	be32enc_vect(len, ctx->count, 8);

	/* Add 1--64 bytes so that the resulting length is 56 mod 64 */
	r = (ctx->count[1] >> 3) & 0x3f;
	plen = (r < 56) ? (56 - r) : (120 - r);
	SHA256_Update(ctx, PAD, (size_t)plen);

	/* Add the terminating bit-count */
	SHA256_Update(ctx, len, 8);
}

/* SHA-256 initialization.  Begins a SHA-256 operation. */
void
SHA256_Init(SHA256_CTX * ctx)
{

	/* Zero bits processed so far */
	ctx->count[0] = ctx->count[1] = 0;

	/* Magic initialization constants */
	ctx->state[0] = 0x6A09E667;
	ctx->state[1] = 0xBB67AE85;
	ctx->state[2] = 0x3C6EF372;
	ctx->state[3] = 0xA54FF53A;
	ctx->state[4] = 0x510E527F;
	ctx->state[5] = 0x9B05688C;
	ctx->state[6] = 0x1F83D9AB;
	ctx->state[7] = 0x5BE0CD19;
}

/* Add bytes into the hash */
void
SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len)
{
	uint32_t bitlen[2];
	uint32_t r;
	const unsigned char *src = in;

	/* Number of bytes left in the buffer from previous updates */
	r = (ctx->count[1] >> 3) & 0x3f;

	/* Convert the length into a number of bits */
	bitlen[1] = ((uint32_t)len) << 3;
	bitlen[0] = (uint32_t)(len >> 29);

	/* Update number of bits */
	if ((ctx->count[1] += bitlen[1]) < bitlen[1])
		ctx->count[0]++;
	ctx->count[0] += bitlen[0];

	/* Handle the case where we don't need to perform any transforms */
	if (len < 64 - r) {
		memcpy(&ctx->buf[r], src, len);
		return;
	}

	/* Finish the current block */
	memcpy(&ctx->buf[r], src, 64 - r);
	SHA256_Transform(ctx->state, ctx->buf);
	src += 64 - r;
	len -= 64 - r;

	/* Perform complete blocks */
	while (len >= 64) {
		SHA256_Transform(ctx->state, src);
		src += 64;
		len -= 64;
	}

	/* Copy left over data into buffer */
	memcpy(ctx->buf, src, len);
}

/*
 * SHA-256 finalization.  Pads the input data, exports the hash value,
 * and clears the context state.
 */
void
SHA256_Final(unsigned char digest[32], SHA256_CTX * ctx)
{

	/* Add padding */
	SHA256_Pad(ctx);

	/* Write the hash */
	be32enc_vect(digest, ctx->state, 32);

	/* Clear the context state */
	memset((void *)ctx, 0, sizeof(*ctx));
}
Commit	Line	Data
39b242ad MD	1	/*-
	2	* Copyright 2005 Colin Percival
	3	* All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	15	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	16	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	17	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	18	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	19	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	20	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	21	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	22	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	23	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	24	* SUCH DAMAGE.
	25	*
3cd01911	26	* $FreeBSD: src/lib/libmd/sha256c.c,v 1.2 2006/01/17 15:35:56 phk Exp $
39b242ad MD	27	*/
39b242ad MD	28
39b242ad MD	29	#include <sys/endian.h>
	30	#include <sys/types.h>
	31
	32	#include <string.h>
	33
	34	#include "sha256.h"
	35
	36	#if BYTE_ORDER == BIG_ENDIAN
	37
	38	/* Copy a vector of big-endian uint32_t into a vector of bytes */
	39	#define be32enc_vect(dst, src, len) \
	40	memcpy((void )dst, (const void )src, (size_t)len)
	41
	42	/* Copy a vector of bytes into a vector of big-endian uint32_t */
	43	#define be32dec_vect(dst, src, len) \
	44	memcpy((void )dst, (const void )src, (size_t)len)
	45
	46	#else /* BYTE_ORDER != BIG_ENDIAN */
	47
	48	/*
	49	* Encode a length len/4 vector of (uint32_t) into a length len vector of
	50	* (unsigned char) in big-endian form. Assumes len is a multiple of 4.
	51	*/
	52	static void
	53	be32enc_vect(unsigned char dst, const uint32_t src, size_t len)
	54	{
	55	size_t i;
	56
	57	for (i = 0; i < len / 4; i++)
	58	be32enc(dst + i * 4, src[i]);
	59	}
	60
	61	/*
	62	* Decode a big-endian length len vector of (unsigned char) into a length
	63	* len/4 vector of (uint32_t). Assumes len is a multiple of 4.
	64	*/
	65	static void
	66	be32dec_vect(uint32_t dst, const unsigned char src, size_t len)
	67	{
	68	size_t i;
	69
	70	for (i = 0; i < len / 4; i++)
	71	dst[i] = be32dec(src + i * 4);
	72	}
	73
	74	#endif /* BYTE_ORDER != BIG_ENDIAN */
	75
	76	/* Elementary functions used by SHA256 */
	77	#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
	78	#define Maj(x, y, z) ((x & (y \| z)) \| (y & z))
	79	#define SHR(x, n) (x >> n)
	80	#define ROTR(x, n) ((x >> n) \| (x << (32 - n)))
	81	#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
	82	#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
	83	#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
	84	#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
	85
	86	/* SHA256 round function */
	87	#define RND(a, b, c, d, e, f, g, h, k) \
	88	t0 = h + S1(e) + Ch(e, f, g) + k; \
	89	t1 = S0(a) + Maj(a, b, c); \
	90	d += t0; \
	91	h = t0 + t1;
	92
93	/* Adjusted round function for rotating state */
94	#define RNDr(S, W, i, k) \
95	RND(S[(64 - i) % 8], S[(65 - i) % 8], \
96	S[(66 - i) % 8], S[(67 - i) % 8], \
97	S[(68 - i) % 8], S[(69 - i) % 8], \
98	S[(70 - i) % 8], S[(71 - i) % 8], \
99	W[i] + k)
100
101	/*
102	* SHA256 block compression function. The 256-bit state is transformed via
103	* the 512-bit input block to produce a new state.
104	*/
105	static void
106	SHA256_Transform(uint32_t * state, const unsigned char block[64])
107	{
108	uint32_t W[64];
109	uint32_t S[8];
110	uint32_t t0, t1;
111	int i;
112
113	/* 1. Prepare message schedule W. */
114	be32dec_vect(W, block, 64);
115	for (i = 16; i < 64; i++)
116	W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];
117
118	/* 2. Initialize working variables. */
119	memcpy(S, state, 32);
120
121	/* 3. Mix. */
122	RNDr(S, W, 0, 0x428a2f98);
123	RNDr(S, W, 1, 0x71374491);
124	RNDr(S, W, 2, 0xb5c0fbcf);
125	RNDr(S, W, 3, 0xe9b5dba5);
126	RNDr(S, W, 4, 0x3956c25b);
127	RNDr(S, W, 5, 0x59f111f1);
128	RNDr(S, W, 6, 0x923f82a4);
129	RNDr(S, W, 7, 0xab1c5ed5);
130	RNDr(S, W, 8, 0xd807aa98);
131	RNDr(S, W, 9, 0x12835b01);
132	RNDr(S, W, 10, 0x243185be);
133	RNDr(S, W, 11, 0x550c7dc3);
134	RNDr(S, W, 12, 0x72be5d74);
135	RNDr(S, W, 13, 0x80deb1fe);
136	RNDr(S, W, 14, 0x9bdc06a7);
137	RNDr(S, W, 15, 0xc19bf174);
138	RNDr(S, W, 16, 0xe49b69c1);
139	RNDr(S, W, 17, 0xefbe4786);
140	RNDr(S, W, 18, 0x0fc19dc6);
141	RNDr(S, W, 19, 0x240ca1cc);
142	RNDr(S, W, 20, 0x2de92c6f);
143	RNDr(S, W, 21, 0x4a7484aa);
144	RNDr(S, W, 22, 0x5cb0a9dc);
145	RNDr(S, W, 23, 0x76f988da);
146	RNDr(S, W, 24, 0x983e5152);
147	RNDr(S, W, 25, 0xa831c66d);
148	RNDr(S, W, 26, 0xb00327c8);
149	RNDr(S, W, 27, 0xbf597fc7);
150	RNDr(S, W, 28, 0xc6e00bf3);
151	RNDr(S, W, 29, 0xd5a79147);
152	RNDr(S, W, 30, 0x06ca6351);
153	RNDr(S, W, 31, 0x14292967);
154	RNDr(S, W, 32, 0x27b70a85);
155	RNDr(S, W, 33, 0x2e1b2138);
156	RNDr(S, W, 34, 0x4d2c6dfc);
157	RNDr(S, W, 35, 0x53380d13);
158	RNDr(S, W, 36, 0x650a7354);
159	RNDr(S, W, 37, 0x766a0abb);
160	RNDr(S, W, 38, 0x81c2c92e);
161	RNDr(S, W, 39, 0x92722c85);
162	RNDr(S, W, 40, 0xa2bfe8a1);
163	RNDr(S, W, 41, 0xa81a664b);
164	RNDr(S, W, 42, 0xc24b8b70);
165	RNDr(S, W, 43, 0xc76c51a3);
166	RNDr(S, W, 44, 0xd192e819);
167	RNDr(S, W, 45, 0xd6990624);
168	RNDr(S, W, 46, 0xf40e3585);
169	RNDr(S, W, 47, 0x106aa070);
170	RNDr(S, W, 48, 0x19a4c116);
171	RNDr(S, W, 49, 0x1e376c08);
172	RNDr(S, W, 50, 0x2748774c);
173	RNDr(S, W, 51, 0x34b0bcb5);
174	RNDr(S, W, 52, 0x391c0cb3);
175	RNDr(S, W, 53, 0x4ed8aa4a);
176	RNDr(S, W, 54, 0x5b9cca4f);
177	RNDr(S, W, 55, 0x682e6ff3);
178	RNDr(S, W, 56, 0x748f82ee);
179	RNDr(S, W, 57, 0x78a5636f);
180	RNDr(S, W, 58, 0x84c87814);
181	RNDr(S, W, 59, 0x8cc70208);
182	RNDr(S, W, 60, 0x90befffa);
183	RNDr(S, W, 61, 0xa4506ceb);
184	RNDr(S, W, 62, 0xbef9a3f7);
185	RNDr(S, W, 63, 0xc67178f2);
186
187	/* 4. Mix local working variables into global state */
188	for (i = 0; i < 8; i++)
189	state[i] += S[i];
190	}
191
192	static unsigned char PAD[64] = {
193	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
196	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
197	};
198
199	/* Add padding and terminating bit-count. */
200	static void
201	SHA256_Pad(SHA256_CTX * ctx)
202	{
203	unsigned char len[8];
204	uint32_t r, plen;
205
206	/*
207	* Convert length to a vector of bytes -- we do this now rather
208	* than later because the length will change after we pad.
209	*/
210	be32enc_vect(len, ctx->count, 8);
211
212	/* Add 1--64 bytes so that the resulting length is 56 mod 64 */
213	r = (ctx->count[1] >> 3) & 0x3f;
214	plen = (r < 56) ? (56 - r) : (120 - r);
215	SHA256_Update(ctx, PAD, (size_t)plen);
216
217	/* Add the terminating bit-count */
218	SHA256_Update(ctx, len, 8);
219	}
220
221	/* SHA-256 initialization. Begins a SHA-256 operation. */
222	void
223	SHA256_Init(SHA256_CTX * ctx)
224	{
225
226	/* Zero bits processed so far */
227	ctx->count[0] = ctx->count[1] = 0;
228
229	/* Magic initialization constants */
230	ctx->state[0] = 0x6A09E667;
231	ctx->state[1] = 0xBB67AE85;
232	ctx->state[2] = 0x3C6EF372;
233	ctx->state[3] = 0xA54FF53A;
234	ctx->state[4] = 0x510E527F;
235	ctx->state[5] = 0x9B05688C;
236	ctx->state[6] = 0x1F83D9AB;
237	ctx->state[7] = 0x5BE0CD19;
238	}
239
240	/* Add bytes into the hash */
241	void
3cd01911	242	SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len)
39b242ad MD	243	{
	244	uint32_t bitlen[2];
	245	uint32_t r;
3cd01911	246	const unsigned char *src = in;
39b242ad MD	247
	248	/* Number of bytes left in the buffer from previous updates */
	249	r = (ctx->count[1] >> 3) & 0x3f;
	250
	251	/* Convert the length into a number of bits */
	252	bitlen[1] = ((uint32_t)len) << 3;
	253	bitlen[0] = (uint32_t)(len >> 29);
	254
	255	/* Update number of bits */
	256	if ((ctx->count[1] += bitlen[1]) < bitlen[1])
	257	ctx->count[0]++;
	258	ctx->count[0] += bitlen[0];
	259
	260	/* Handle the case where we don't need to perform any transforms */
	261	if (len < 64 - r) {
	262	memcpy(&ctx->buf[r], src, len);
	263	return;
	264	}
	265
	266	/* Finish the current block */
	267	memcpy(&ctx->buf[r], src, 64 - r);
	268	SHA256_Transform(ctx->state, ctx->buf);
	269	src += 64 - r;
	270	len -= 64 - r;
	271
	272	/* Perform complete blocks */
	273	while (len >= 64) {
	274	SHA256_Transform(ctx->state, src);
	275	src += 64;
	276	len -= 64;
	277	}
	278
	279	/* Copy left over data into buffer */
	280	memcpy(ctx->buf, src, len);
	281	}
	282
	283	/*
	284	* SHA-256 finalization. Pads the input data, exports the hash value,
	285	* and clears the context state.
	286	*/
	287	void
	288	SHA256_Final(unsigned char digest[32], SHA256_CTX * ctx)
	289	{
	290
	291	/* Add padding */
	292	SHA256_Pad(ctx);
	293
	294	/* Write the hash */
	295	be32enc_vect(digest, ctx->state, 32);
	296
	297	/* Clear the context state */
	298	memset((void )ctx, 0, sizeof(ctx));
	299	}