6 * Written by Aaron D. Gifford <me@aarongifford.com>
8 * Copyright 2000 Aaron D. Gifford. All rights reserved.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the copyright holder nor the names of contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 #include <sys/cdefs.h>
36 #include <sys/endian.h>
37 #include <sys/types.h>
45 #define SHA512_SHORT_BLOCK_LENGTH (SHA512_BLOCK_LENGTH - 16)
48 * Macro for incrementally adding the unsigned 64-bit integer n to the
49 * unsigned 128-bit integer (represented using a two-element array of
52 #define ADDINC128(w,n) { \
53 (w)[0] += (sha2_word64)(n); \
59 /*** ENDIAN REVERSAL MACROS *******************************************/
60 #if BYTE_ORDER == LITTLE_ENDIAN
61 #define REVERSE32(w,x) { \
62 sha2_word32 tmp = (w); \
63 tmp = (tmp >> 16) | (tmp << 16); \
64 (x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \
66 #define REVERSE64(w,x) { \
67 sha2_word64 tmp = (w); \
68 tmp = (tmp >> 32) | (tmp << 32); \
69 tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \
70 ((tmp & 0x00ff00ff00ff00ffULL) << 8); \
71 (x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \
72 ((tmp & 0x0000ffff0000ffffULL) << 16); \
74 #endif /* BYTE_ORDER == LITTLE_ENDIAN */
76 /* Shift-right (used in SHA-256, SHA-384, and SHA-512): */
77 #define R(b,x) ((x) >> (b))
78 /* 32-bit Rotate-right (used in SHA-256): */
79 #define S32(b,x) (((x) >> (b)) | ((x) << (32 - (b))))
80 /* 64-bit Rotate-right (used in SHA-384 and SHA-512): */
81 #define S64(b,x) (((x) >> (b)) | ((x) << (64 - (b))))
83 /* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */
84 #define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z)))
85 #define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
87 /* Four of six logical functions used in SHA-384 and SHA-512: */
88 #define Sigma0_512(x) (S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x)))
89 #define Sigma1_512(x) (S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x)))
90 #define sigma0_512(x) (S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7, (x)))
91 #define sigma1_512(x) (S64(19, (x)) ^ S64(61, (x)) ^ R( 6, (x)))
93 typedef u_int8_t sha2_byte; /* Exactly 1 byte */
94 typedef u_int32_t sha2_word32; /* Exactly 4 bytes */
95 typedef u_int64_t sha2_word64; /* Exactly 8 bytes */
97 /* Initial hash value H for SHA-512 */
98 static const sha2_word64 sha512_initial_hash_value[8] = {
99 0x6a09e667f3bcc908ULL,
100 0xbb67ae8584caa73bULL,
101 0x3c6ef372fe94f82bULL,
102 0xa54ff53a5f1d36f1ULL,
103 0x510e527fade682d1ULL,
104 0x9b05688c2b3e6c1fULL,
105 0x1f83d9abfb41bd6bULL,
106 0x5be0cd19137e2179ULL
111 * Constant used by SHA256/384/512_End() functions for converting the
112 * digest to a readable hexadecimal character string:
114 static const char *sha2_hex_digits = "0123456789abcdef";
117 /* Hash constant words K for SHA-384 and SHA-512: */
118 static const sha2_word64 K512[80] = {
119 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
120 0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
121 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
122 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
123 0xd807aa98a3030242ULL, 0x12835b0145706fbeULL,
124 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
125 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL,
126 0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
127 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
128 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL,
129 0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL,
130 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
131 0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL,
132 0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL,
133 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
134 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
135 0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL,
136 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
137 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL,
138 0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
139 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
140 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL,
141 0xd192e819d6ef5218ULL, 0xd69906245565a910ULL,
142 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
143 0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL,
144 0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL,
145 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
146 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
147 0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL,
148 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
149 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL,
150 0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
151 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
152 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL,
153 0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL,
154 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
155 0x28db77f523047d84ULL, 0x32caab7b40c72493ULL,
156 0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL,
157 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
158 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
160 /*** SHA-512: *********************************************************/
161 void SHA512_Init(SHA512_CTX* context) {
162 if (context == NULL) {
165 bcopy(sha512_initial_hash_value, context->state, SHA512_DIGEST_LENGTH);
166 bzero(context->buffer, SHA512_BLOCK_LENGTH);
167 context->bitcount[0] = context->bitcount[1] = 0;
170 /* Unrolled SHA-512 round macros: */
171 #if BYTE_ORDER == LITTLE_ENDIAN
173 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \
174 REVERSE64(*data++, W512[j]); \
175 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
178 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)), \
182 #else /* BYTE_ORDER == LITTLE_ENDIAN */
184 #define ROUND512_0_TO_15(a,b,c,d,e,f,g,h) \
185 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
186 K512[j] + (W512[j] = *data++); \
188 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
191 #endif /* BYTE_ORDER == LITTLE_ENDIAN */
193 #define ROUND512(a,b,c,d,e,f,g,h) \
194 s0 = W512[(j+1)&0x0f]; \
195 s0 = sigma0_512(s0); \
196 s1 = W512[(j+14)&0x0f]; \
197 s1 = sigma1_512(s1); \
198 T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + K512[j] + \
199 (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); \
201 (h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
205 SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) {
206 sha2_word64 a, b, c, d, e, f, g, h, s0, s1;
207 sha2_word64 T1 = 0, /*T2 = 0, */*W512 = (sha2_word64*)context->buffer;
210 /* Initialize registers with the prev. intermediate value */
211 a = context->state[0];
212 b = context->state[1];
213 c = context->state[2];
214 d = context->state[3];
215 e = context->state[4];
216 f = context->state[5];
217 g = context->state[6];
218 h = context->state[7];
222 ROUND512_0_TO_15(a,b,c,d,e,f,g,h);
223 ROUND512_0_TO_15(h,a,b,c,d,e,f,g);
224 ROUND512_0_TO_15(g,h,a,b,c,d,e,f);
225 ROUND512_0_TO_15(f,g,h,a,b,c,d,e);
226 ROUND512_0_TO_15(e,f,g,h,a,b,c,d);
227 ROUND512_0_TO_15(d,e,f,g,h,a,b,c);
228 ROUND512_0_TO_15(c,d,e,f,g,h,a,b);
229 ROUND512_0_TO_15(b,c,d,e,f,g,h,a);
232 /* Now for the remaining rounds up to 79: */
234 ROUND512(a,b,c,d,e,f,g,h);
235 ROUND512(h,a,b,c,d,e,f,g);
236 ROUND512(g,h,a,b,c,d,e,f);
237 ROUND512(f,g,h,a,b,c,d,e);
238 ROUND512(e,f,g,h,a,b,c,d);
239 ROUND512(d,e,f,g,h,a,b,c);
240 ROUND512(c,d,e,f,g,h,a,b);
241 ROUND512(b,c,d,e,f,g,h,a);
244 /* Compute the current intermediate hash value */
245 context->state[0] += a;
246 context->state[1] += b;
247 context->state[2] += c;
248 context->state[3] += d;
249 context->state[4] += e;
250 context->state[5] += f;
251 context->state[6] += g;
252 context->state[7] += h;
255 a = b = c = d = e = f = g = h = T1 = 0;
258 void SHA512_Update(SHA512_CTX* context, const void *data_arg, size_t len) {
259 const sha2_byte *data = (const sha2_byte *)data_arg;
260 unsigned int freespace, usedspace;
263 /* Calling with no data is valid - we do nothing */
268 assert(context != NULL && data != NULL);
270 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
272 /* Calculate how much free space is available in the buffer */
273 freespace = SHA512_BLOCK_LENGTH - usedspace;
275 if (len >= freespace) {
276 /* Fill the buffer completely and process it */
277 bcopy(data, &context->buffer[usedspace], freespace);
278 ADDINC128(context->bitcount, freespace << 3);
281 SHA512_Transform(context, (sha2_word64*)context->buffer);
283 /* The buffer is not yet full */
284 bcopy(data, &context->buffer[usedspace], len);
285 ADDINC128(context->bitcount, len << 3);
287 usedspace = freespace = 0;
291 while (len >= SHA512_BLOCK_LENGTH) {
292 /* Process as many complete blocks as we can */
293 SHA512_Transform(context, (const sha2_word64*)data);
294 ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3);
295 len -= SHA512_BLOCK_LENGTH;
296 data += SHA512_BLOCK_LENGTH;
299 /* There's left-overs, so save 'em */
300 bcopy(data, context->buffer, len);
301 ADDINC128(context->bitcount, len << 3);
304 usedspace = freespace = 0;
308 void SHA512_Last(SHA512_CTX* context) {
309 unsigned int usedspace;
311 usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
312 #if BYTE_ORDER == LITTLE_ENDIAN
313 /* Convert FROM host byte order */
314 REVERSE64(context->bitcount[0],context->bitcount[0]);
315 REVERSE64(context->bitcount[1],context->bitcount[1]);
318 /* Begin padding with a 1 bit: */
319 context->buffer[usedspace++] = 0x80;
321 if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) {
322 /* Set-up for the last transform: */
323 bzero(&context->buffer[usedspace], SHA512_SHORT_BLOCK_LENGTH - usedspace);
325 if (usedspace < SHA512_BLOCK_LENGTH) {
326 bzero(&context->buffer[usedspace], SHA512_BLOCK_LENGTH - usedspace);
328 /* Do second-to-last transform: */
329 SHA512_Transform(context, (sha2_word64*)context->buffer);
331 /* And set-up for the last transform: */
332 bzero(context->buffer, SHA512_BLOCK_LENGTH - 2);
335 /* Prepare for final transform: */
336 bzero(context->buffer, SHA512_SHORT_BLOCK_LENGTH);
338 /* Begin padding with a 1 bit: */
339 *context->buffer = 0x80;
341 /* Store the length of input data (in bits): */
342 *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1];
343 *(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0];
345 /* Final transform: */
346 SHA512_Transform(context, (sha2_word64*)context->buffer);
349 void SHA512_Final(unsigned char digest[], SHA512_CTX* context) {
350 sha2_word64 *d = (sha2_word64*)digest;
353 assert(context != NULL);
355 /* If no digest buffer is passed, we don't bother doing this: */
356 if (digest != NULL) {
357 SHA512_Last(context);
359 /* Save the hash data for output: */
360 #if BYTE_ORDER == LITTLE_ENDIAN
362 /* Convert TO host byte order */
364 for (j = 0; j < 8; j++) {
365 REVERSE64(context->state[j],context->state[j]);
366 *d++ = context->state[j];
370 bcopy(context->state, d, SHA512_DIGEST_LENGTH);
374 /* Zero out state data */
375 bzero(context, sizeof(*context));
379 char *SHA512_End(SHA512_CTX* context, char *buffer) {
380 sha2_byte digest[SHA512_DIGEST_LENGTH], *d = digest;
384 assert(context != NULL);
386 if (buffer != NULL) {
387 SHA512_Final(digest, context);
389 for (i = 0; i < SHA512_DIGEST_LENGTH; i++) {
390 *buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
391 *buffer++ = sha2_hex_digits[*d & 0x0f];
396 bzero(context, sizeof(*context));
398 bzero(digest, SHA512_DIGEST_LENGTH);
402 char* SHA512_Data(const void *data, size_t len, char *digest) {
405 SHA512_Init(&context);
406 SHA512_Update(&context, data, len);
407 return SHA512_End(&context, digest);