Remove some unnecessary inclusions of <sys/cdefs.h> across the tree.
[dragonfly.git] / lib / libmd / sha256c.c
CommitLineData
39b242ad
MD
1/*-
2 * Copyright 2005 Colin Percival
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
3cd01911 26 * $FreeBSD: src/lib/libmd/sha256c.c,v 1.2 2006/01/17 15:35:56 phk Exp $
39b242ad
MD
27 */
28
39b242ad
MD
29#include <sys/endian.h>
30#include <sys/types.h>
31
32#include <string.h>
33
34#include "sha256.h"
35
36#if BYTE_ORDER == BIG_ENDIAN
37
38/* Copy a vector of big-endian uint32_t into a vector of bytes */
39#define be32enc_vect(dst, src, len) \
40 memcpy((void *)dst, (const void *)src, (size_t)len)
41
42/* Copy a vector of bytes into a vector of big-endian uint32_t */
43#define be32dec_vect(dst, src, len) \
44 memcpy((void *)dst, (const void *)src, (size_t)len)
45
46#else /* BYTE_ORDER != BIG_ENDIAN */
47
48/*
49 * Encode a length len/4 vector of (uint32_t) into a length len vector of
50 * (unsigned char) in big-endian form. Assumes len is a multiple of 4.
51 */
52static void
53be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
54{
55 size_t i;
56
57 for (i = 0; i < len / 4; i++)
58 be32enc(dst + i * 4, src[i]);
59}
60
61/*
62 * Decode a big-endian length len vector of (unsigned char) into a length
63 * len/4 vector of (uint32_t). Assumes len is a multiple of 4.
64 */
65static void
66be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
67{
68 size_t i;
69
70 for (i = 0; i < len / 4; i++)
71 dst[i] = be32dec(src + i * 4);
72}
73
74#endif /* BYTE_ORDER != BIG_ENDIAN */
75
76/* Elementary functions used by SHA256 */
77#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
78#define Maj(x, y, z) ((x & (y | z)) | (y & z))
79#define SHR(x, n) (x >> n)
80#define ROTR(x, n) ((x >> n) | (x << (32 - n)))
81#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
82#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
83#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
84#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
85
86/* SHA256 round function */
87#define RND(a, b, c, d, e, f, g, h, k) \
88 t0 = h + S1(e) + Ch(e, f, g) + k; \
89 t1 = S0(a) + Maj(a, b, c); \
90 d += t0; \
91 h = t0 + t1;
92
93/* Adjusted round function for rotating state */
94#define RNDr(S, W, i, k) \
95 RND(S[(64 - i) % 8], S[(65 - i) % 8], \
96 S[(66 - i) % 8], S[(67 - i) % 8], \
97 S[(68 - i) % 8], S[(69 - i) % 8], \
98 S[(70 - i) % 8], S[(71 - i) % 8], \
99 W[i] + k)
100
101/*
102 * SHA256 block compression function. The 256-bit state is transformed via
103 * the 512-bit input block to produce a new state.
104 */
105static void
106SHA256_Transform(uint32_t * state, const unsigned char block[64])
107{
108 uint32_t W[64];
109 uint32_t S[8];
110 uint32_t t0, t1;
111 int i;
112
113 /* 1. Prepare message schedule W. */
114 be32dec_vect(W, block, 64);
115 for (i = 16; i < 64; i++)
116 W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];
117
118 /* 2. Initialize working variables. */
119 memcpy(S, state, 32);
120
121 /* 3. Mix. */
122 RNDr(S, W, 0, 0x428a2f98);
123 RNDr(S, W, 1, 0x71374491);
124 RNDr(S, W, 2, 0xb5c0fbcf);
125 RNDr(S, W, 3, 0xe9b5dba5);
126 RNDr(S, W, 4, 0x3956c25b);
127 RNDr(S, W, 5, 0x59f111f1);
128 RNDr(S, W, 6, 0x923f82a4);
129 RNDr(S, W, 7, 0xab1c5ed5);
130 RNDr(S, W, 8, 0xd807aa98);
131 RNDr(S, W, 9, 0x12835b01);
132 RNDr(S, W, 10, 0x243185be);
133 RNDr(S, W, 11, 0x550c7dc3);
134 RNDr(S, W, 12, 0x72be5d74);
135 RNDr(S, W, 13, 0x80deb1fe);
136 RNDr(S, W, 14, 0x9bdc06a7);
137 RNDr(S, W, 15, 0xc19bf174);
138 RNDr(S, W, 16, 0xe49b69c1);
139 RNDr(S, W, 17, 0xefbe4786);
140 RNDr(S, W, 18, 0x0fc19dc6);
141 RNDr(S, W, 19, 0x240ca1cc);
142 RNDr(S, W, 20, 0x2de92c6f);
143 RNDr(S, W, 21, 0x4a7484aa);
144 RNDr(S, W, 22, 0x5cb0a9dc);
145 RNDr(S, W, 23, 0x76f988da);
146 RNDr(S, W, 24, 0x983e5152);
147 RNDr(S, W, 25, 0xa831c66d);
148 RNDr(S, W, 26, 0xb00327c8);
149 RNDr(S, W, 27, 0xbf597fc7);
150 RNDr(S, W, 28, 0xc6e00bf3);
151 RNDr(S, W, 29, 0xd5a79147);
152 RNDr(S, W, 30, 0x06ca6351);
153 RNDr(S, W, 31, 0x14292967);
154 RNDr(S, W, 32, 0x27b70a85);
155 RNDr(S, W, 33, 0x2e1b2138);
156 RNDr(S, W, 34, 0x4d2c6dfc);
157 RNDr(S, W, 35, 0x53380d13);
158 RNDr(S, W, 36, 0x650a7354);
159 RNDr(S, W, 37, 0x766a0abb);
160 RNDr(S, W, 38, 0x81c2c92e);
161 RNDr(S, W, 39, 0x92722c85);
162 RNDr(S, W, 40, 0xa2bfe8a1);
163 RNDr(S, W, 41, 0xa81a664b);
164 RNDr(S, W, 42, 0xc24b8b70);
165 RNDr(S, W, 43, 0xc76c51a3);
166 RNDr(S, W, 44, 0xd192e819);
167 RNDr(S, W, 45, 0xd6990624);
168 RNDr(S, W, 46, 0xf40e3585);
169 RNDr(S, W, 47, 0x106aa070);
170 RNDr(S, W, 48, 0x19a4c116);
171 RNDr(S, W, 49, 0x1e376c08);
172 RNDr(S, W, 50, 0x2748774c);
173 RNDr(S, W, 51, 0x34b0bcb5);
174 RNDr(S, W, 52, 0x391c0cb3);
175 RNDr(S, W, 53, 0x4ed8aa4a);
176 RNDr(S, W, 54, 0x5b9cca4f);
177 RNDr(S, W, 55, 0x682e6ff3);
178 RNDr(S, W, 56, 0x748f82ee);
179 RNDr(S, W, 57, 0x78a5636f);
180 RNDr(S, W, 58, 0x84c87814);
181 RNDr(S, W, 59, 0x8cc70208);
182 RNDr(S, W, 60, 0x90befffa);
183 RNDr(S, W, 61, 0xa4506ceb);
184 RNDr(S, W, 62, 0xbef9a3f7);
185 RNDr(S, W, 63, 0xc67178f2);
186
187 /* 4. Mix local working variables into global state */
188 for (i = 0; i < 8; i++)
189 state[i] += S[i];
190}
191
192static unsigned char PAD[64] = {
193 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
194 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
195 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
196 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
197};
198
199/* Add padding and terminating bit-count. */
200static void
201SHA256_Pad(SHA256_CTX * ctx)
202{
203 unsigned char len[8];
204 uint32_t r, plen;
205
206 /*
207 * Convert length to a vector of bytes -- we do this now rather
208 * than later because the length will change after we pad.
209 */
210 be32enc_vect(len, ctx->count, 8);
211
212 /* Add 1--64 bytes so that the resulting length is 56 mod 64 */
213 r = (ctx->count[1] >> 3) & 0x3f;
214 plen = (r < 56) ? (56 - r) : (120 - r);
215 SHA256_Update(ctx, PAD, (size_t)plen);
216
217 /* Add the terminating bit-count */
218 SHA256_Update(ctx, len, 8);
219}
220
221/* SHA-256 initialization. Begins a SHA-256 operation. */
222void
223SHA256_Init(SHA256_CTX * ctx)
224{
225
226 /* Zero bits processed so far */
227 ctx->count[0] = ctx->count[1] = 0;
228
229 /* Magic initialization constants */
230 ctx->state[0] = 0x6A09E667;
231 ctx->state[1] = 0xBB67AE85;
232 ctx->state[2] = 0x3C6EF372;
233 ctx->state[3] = 0xA54FF53A;
234 ctx->state[4] = 0x510E527F;
235 ctx->state[5] = 0x9B05688C;
236 ctx->state[6] = 0x1F83D9AB;
237 ctx->state[7] = 0x5BE0CD19;
238}
239
240/* Add bytes into the hash */
241void
3cd01911 242SHA256_Update(SHA256_CTX * ctx, const void *in, size_t len)
39b242ad
MD
243{
244 uint32_t bitlen[2];
245 uint32_t r;
3cd01911 246 const unsigned char *src = in;
39b242ad
MD
247
248 /* Number of bytes left in the buffer from previous updates */
249 r = (ctx->count[1] >> 3) & 0x3f;
250
251 /* Convert the length into a number of bits */
252 bitlen[1] = ((uint32_t)len) << 3;
253 bitlen[0] = (uint32_t)(len >> 29);
254
255 /* Update number of bits */
256 if ((ctx->count[1] += bitlen[1]) < bitlen[1])
257 ctx->count[0]++;
258 ctx->count[0] += bitlen[0];
259
260 /* Handle the case where we don't need to perform any transforms */
261 if (len < 64 - r) {
262 memcpy(&ctx->buf[r], src, len);
263 return;
264 }
265
266 /* Finish the current block */
267 memcpy(&ctx->buf[r], src, 64 - r);
268 SHA256_Transform(ctx->state, ctx->buf);
269 src += 64 - r;
270 len -= 64 - r;
271
272 /* Perform complete blocks */
273 while (len >= 64) {
274 SHA256_Transform(ctx->state, src);
275 src += 64;
276 len -= 64;
277 }
278
279 /* Copy left over data into buffer */
280 memcpy(ctx->buf, src, len);
281}
282
283/*
284 * SHA-256 finalization. Pads the input data, exports the hash value,
285 * and clears the context state.
286 */
287void
288SHA256_Final(unsigned char digest[32], SHA256_CTX * ctx)
289{
290
291 /* Add padding */
292 SHA256_Pad(ctx);
293
294 /* Write the hash */
295 be32enc_vect(digest, ctx->state, 32);
296
297 /* Clear the context state */
298 memset((void *)ctx, 0, sizeof(*ctx));
299}