1 /*
2 * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6 /*
7 * Cleaned-up and optimized version of MD5, based on the reference
8 * implementation provided in RFC 1321. See RSA Copyright information
9 * below.
10 */
11
12 #pragma ident "@(#)md5.c 1.27 07/04/10 SMI"
13
14 /*
15 * MD5C.C - RSA Data Security, Inc., MD5 message-digest algorithm
16 */
17
18 /*
19 * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
20 * rights reserved.
21 *
22 * License to copy and use this software is granted provided that it
23 * is identified as the "RSA Data Security, Inc. MD5 Message-Digest
24 * Algorithm" in all material mentioning or referencing this software
25 * or this function.
26 *
27 * License is also granted to make and use derivative works provided
28 * that such works are identified as "derived from the RSA Data
29 * Security, Inc. MD5 Message-Digest Algorithm" in all material
30 * mentioning or referencing the derived work.
31 *
32 * RSA Data Security, Inc. makes no representations concerning either
33 * the merchantability of this software or the suitability of this
34 * software for any particular purpose. It is provided "as is"
35 * without express or implied warranty of any kind.
36 *
37 * These notices must be retained in any copies of any part of this
38 * documentation and/or software.
39 */
40
41 #include <sys/types.h>
42 #include <sys/md5.h>
43 #include <sys/md5_consts.h> /* MD5_CONST() optimization */
44 #include "md5_byteswap.h"
45 #if !defined(_KERNEL) || defined(_BOOT)
46 #include <strings.h>
47 #endif /* !_KERNEL || _BOOT */
48
49 #ifdef _KERNEL
50 #include <sys/systm.h>
51 #endif /* _KERNEL */
52
53 static void Encode(uint8_t *, const uint32_t *, size_t);
54 static void MD5Transform(uint32_t, uint32_t, uint32_t, uint32_t, MD5_CTX *,
55 const uint8_t [64]);
56
57 static uint8_t PADDING[64] = { 0x80, /* all zeros */ };
58
59 /*
60 * F, G, H and I are the basic MD5 functions.
61 */
62 #define F(b, c, d) (((b) & (c)) | ((~b) & (d)))
63 #define G(b, c, d) (((b) & (d)) | ((c) & (~d)))
64 #define H(b, c, d) ((b) ^ (c) ^ (d))
65 #define I(b, c, d) ((c) ^ ((b) | (~d)))
66
67 /*
68 * ROTATE_LEFT rotates x left n bits.
69 */
70 #define ROTATE_LEFT(x, n) \
71 (((x) << (n)) | ((x) >> ((sizeof (x) << 3) - (n))))
72
73 /*
74 * FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4.
75 * Rotation is separate from addition to prevent recomputation.
76 */
77
78 #define FF(a, b, c, d, x, s, ac) { \
79 (a) += F((b), (c), (d)) + (x) + ((unsigned long long)(ac)); \
80 (a) = ROTATE_LEFT((a), (s)); \
81 (a) += (b); \
82 }
83
84 #define GG(a, b, c, d, x, s, ac) { \
85 (a) += G((b), (c), (d)) + (x) + ((unsigned long long)(ac)); \
86 (a) = ROTATE_LEFT((a), (s)); \
87 (a) += (b); \
88 }
89
90 #define HH(a, b, c, d, x, s, ac) { \
91 (a) += H((b), (c), (d)) + (x) + ((unsigned long long)(ac)); \
92 (a) = ROTATE_LEFT((a), (s)); \
93 (a) += (b); \
94 }
95
96 #define II(a, b, c, d, x, s, ac) { \
97 (a) += I((b), (c), (d)) + (x) + ((unsigned long long)(ac)); \
98 (a) = ROTATE_LEFT((a), (s)); \
99 (a) += (b); \
100 }
101
102 /*
103 * Loading 32-bit constants on a RISC is expensive since it involves both a
104 * `sethi' and an `or'. thus, we instead have the compiler generate `ld's to
105 * load the constants from an array called `md5_consts'. however, on intel
106 * (and other CISC processors), it is cheaper to load the constant
107 * directly. thus, the c code in MD5Transform() uses the macro MD5_CONST()
108 * which either expands to a constant or an array reference, depending on the
109 * architecture the code is being compiled for.
110 *
111 * Right now, i386 and amd64 are the CISC exceptions.
112 * If we get another CISC ISA, we'll have to change the ifdef.
113 */
114
115 #if defined(__i386) || defined(__amd64)
116
117 #define MD5_CONST(x) (MD5_CONST_ ## x)
118 #define MD5_CONST_e(x) MD5_CONST(x)
119 #define MD5_CONST_o(x) MD5_CONST(x)
120
121 #else
122 /*
123 * sparc/RISC optimization:
124 *
125 * while it is somewhat counter-intuitive, on sparc (and presumably other RISC
126 * machines), it is more efficient to place all the constants used in this
127 * function in an array and load the values out of the array than to manually
128 * load the constants. this is because setting a register to a 32-bit value
129 * takes two ops in most cases: a `sethi' and an `or', but loading a 32-bit
130 * value from memory only takes one `ld' (or `lduw' on v9). while this
131 * increases memory usage, the compiler can find enough other things to do
132 * while waiting to keep the pipeline does not stall. additionally, it is
133 * likely that many of these constants are cached so that later accesses do
134 * not even go out to the bus.
135 *
136 * this array is declared `static' to keep the compiler from having to
137 * bcopy() this array onto the stack frame of MD5Transform() each time it is
138 * called -- which is unacceptably expensive.
139 *
140 * the `const' is to ensure that callers are good citizens and do not try to
141 * munge the array. since these routines are going to be called from inside
142 * multithreaded kernelland, this is a good safety check. -- `constants' will
143 * end up in .rodata.
144 *
145 * unfortunately, loading from an array in this manner hurts performance under
146 * intel (and presumably other CISC machines). so, there is a macro,
147 * MD5_CONST(), used in MD5Transform(), that either expands to a reference to
148 * this array, or to the actual constant, depending on what platform this code
149 * is compiled for.
150 */
151
152 #ifdef sun4v
153
154 /*
155 * Going to load these consts in 8B chunks, so need to enforce 8B alignment
156 */
157
158 /* CSTYLED */
159 #pragma align 64 (md5_consts)
160 #define _MD5_CHECK_ALIGNMENT
161
162 #endif /* sun4v */
163
164 static const uint32_t md5_consts[] = {
165 MD5_CONST_0, MD5_CONST_1, MD5_CONST_2, MD5_CONST_3,
166 MD5_CONST_4, MD5_CONST_5, MD5_CONST_6, MD5_CONST_7,
167 MD5_CONST_8, MD5_CONST_9, MD5_CONST_10, MD5_CONST_11,
168 MD5_CONST_12, MD5_CONST_13, MD5_CONST_14, MD5_CONST_15,
169 MD5_CONST_16, MD5_CONST_17, MD5_CONST_18, MD5_CONST_19,
170 MD5_CONST_20, MD5_CONST_21, MD5_CONST_22, MD5_CONST_23,
171 MD5_CONST_24, MD5_CONST_25, MD5_CONST_26, MD5_CONST_27,
172 MD5_CONST_28, MD5_CONST_29, MD5_CONST_30, MD5_CONST_31,
173 MD5_CONST_32, MD5_CONST_33, MD5_CONST_34, MD5_CONST_35,
174 MD5_CONST_36, MD5_CONST_37, MD5_CONST_38, MD5_CONST_39,
175 MD5_CONST_40, MD5_CONST_41, MD5_CONST_42, MD5_CONST_43,
176 MD5_CONST_44, MD5_CONST_45, MD5_CONST_46, MD5_CONST_47,
177 MD5_CONST_48, MD5_CONST_49, MD5_CONST_50, MD5_CONST_51,
178 MD5_CONST_52, MD5_CONST_53, MD5_CONST_54, MD5_CONST_55,
179 MD5_CONST_56, MD5_CONST_57, MD5_CONST_58, MD5_CONST_59,
180 MD5_CONST_60, MD5_CONST_61, MD5_CONST_62, MD5_CONST_63
181 };
182
183
184 #ifdef sun4v
185 /*
186 * To reduce the number of loads, load consts in 64-bit
187 * chunks and then split.
188 *
189 * No need to mask upper 32-bits, as just interested in
190 * low 32-bits (saves an & operation and means that this
191 * optimization doesn't increases the icount.
192 */
193 #define MD5_CONST_e(x) (md5_consts64[x/2] >> 32)
194 #define MD5_CONST_o(x) (md5_consts64[x/2])
195
196 #else
197
198 #define MD5_CONST_e(x) (md5_consts[x])
199 #define MD5_CONST_o(x) (md5_consts[x])
200
201 #endif /* sun4v */
202
203 #endif
204
205 /*
206 * MD5Init()
207 *
208 * purpose: initializes the md5 context and begins and md5 digest operation
209 * input: MD5_CTX * : the context to initialize.
210 * output: void
211 */
212
213 void
214 MD5Init(MD5_CTX *ctx)
215 {
216 ctx->count[0] = ctx->count[1] = 0;
217
218 /* load magic initialization constants */
219 ctx->state[0] = MD5_INIT_CONST_1;
220 ctx->state[1] = MD5_INIT_CONST_2;
221 ctx->state[2] = MD5_INIT_CONST_3;
222 ctx->state[3] = MD5_INIT_CONST_4;
223 }
224
225 /*
226 * MD5Update()
227 *
228 * purpose: continues an md5 digest operation, using the message block
229 * to update the context.
230 * input: MD5_CTX * : the context to update
231 * uint8_t * : the message block
232 * uint32_t : the length of the message block in bytes
233 * output: void
234 *
235 * MD5 crunches in 64-byte blocks. All numeric constants here are related to
236 * that property of MD5.
237 */
238
239 void
240 MD5Update(MD5_CTX *ctx, const void *inpp, unsigned int input_len)
241 {
242 uint32_t i, buf_index, buf_len;
243 #ifdef sun4v
244 uint32_t old_asi;
245 #endif /* sun4v */
246 const unsigned char *input = (const unsigned char *)inpp;
247
248 /* compute (number of bytes computed so far) mod 64 */
249 buf_index = (ctx->count[0] >> 3) & 0x3F;
250
251 /* update number of bits hashed into this MD5 computation so far */
252 if ((ctx->count[0] += (input_len << 3)) < (input_len << 3))
253 ctx->count[1]++;
254 ctx->count[1] += (input_len >> 29);
255
256 buf_len = 64 - buf_index;
257
258 /* transform as many times as possible */
259 i = 0;
260 if (input_len >= buf_len) {
261
262 /*
263 * general optimization:
264 *
265 * only do initial bcopy() and MD5Transform() if
266 * buf_index != 0. if buf_index == 0, we're just
267 * wasting our time doing the bcopy() since there
268 * wasn't any data left over from a previous call to
269 * MD5Update().
270 */
271
272 #ifdef sun4v
273 /*
274 * For N1 use %asi register. However, costly to repeatedly set
275 * in MD5Transform. Therefore, set once here.
276 * Should probably restore the old value afterwards...
277 */
278 old_asi = get_little();
279 set_little(0x88);
280 #endif /* sun4v */
281
282 if (buf_index) {
283 bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
284
285 MD5Transform(ctx->state[0], ctx->state[1],
286 ctx->state[2], ctx->state[3], ctx,
287 ctx->buf_un.buf8);
288
289 i = buf_len;
290 }
291
292 for (; i + 63 < input_len; i += 64)
293 MD5Transform(ctx->state[0], ctx->state[1],
294 ctx->state[2], ctx->state[3], ctx, &input[i]);
295
296
297 #ifdef sun4v
298 /*
299 * Restore old %ASI value
300 */
301 set_little(old_asi);
302 #endif /* sun4v */
303
304 /*
305 * general optimization:
306 *
307 * if i and input_len are the same, return now instead
308 * of calling bcopy(), since the bcopy() in this
309 * case will be an expensive nop.
310 */
311
312 if (input_len == i)
313 return;
314
315 buf_index = 0;
316 }
317
318 /* buffer remaining input */
319 bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
320 }
321
322 /*
323 * MD5Final()
324 *
325 * purpose: ends an md5 digest operation, finalizing the message digest and
326 * zeroing the context.
327 * input: uchar_t * : a buffer to store the digest in
328 * : The function actually uses void* because many
329 * : callers pass things other than uchar_t here.
330 * MD5_CTX * : the context to finalize, save, and zero
331 * output: void
332 */
333
334 void
335 MD5Final(void *digest, MD5_CTX *ctx)
336 {
337 uint8_t bitcount_le[sizeof (ctx->count)];
338 uint32_t index = (ctx->count[0] >> 3) & 0x3f;
339
340 /* store bit count, little endian */
341 Encode(bitcount_le, ctx->count, sizeof (bitcount_le));
342
343 /* pad out to 56 mod 64 */
344 MD5Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
345
346 /* append length (before padding) */
347 MD5Update(ctx, bitcount_le, sizeof (bitcount_le));
348
349 /* store state in digest */
350 Encode(digest, ctx->state, sizeof (ctx->state));
351
352 /* zeroize sensitive information */
353 bzero(ctx, sizeof (*ctx));
354 }
355
356 #ifndef _KERNEL
357
358 void
359 md5_calc(unsigned char *output, unsigned char *input, unsigned int inlen)
360 {
361 MD5_CTX context;
362
363 MD5Init(&context);
364 MD5Update(&context, input, inlen);
365 MD5Final(output, &context);
366 }
367
368 #endif /* !_KERNEL */
369
370 /*
371 * sparc register window optimization:
372 *
373 * `a', `b', `c', and `d' are passed into MD5Transform explicitly
374 * since it increases the number of registers available to the
375 * compiler. under this scheme, these variables can be held in
376 * %i0 - %i3, which leaves more local and out registers available.
377 */
378
379 /*
380 * MD5Transform()
381 *
382 * purpose: md5 transformation -- updates the digest based on `block'
383 * input: uint32_t : bytes 1 - 4 of the digest
384 * uint32_t : bytes 5 - 8 of the digest
385 * uint32_t : bytes 9 - 12 of the digest
386 * uint32_t : bytes 12 - 16 of the digest
387 * MD5_CTX * : the context to update
388 * uint8_t [64]: the block to use to update the digest
389 * output: void
390 */
391
392 static void
393 MD5Transform(uint32_t a, uint32_t b, uint32_t c, uint32_t d,
394 MD5_CTX *ctx, const uint8_t block[64])
395 {
396 /*
397 * general optimization:
398 *
399 * use individual integers instead of using an array. this is a
400 * win, although the amount it wins by seems to vary quite a bit.
401 */
402
403 register uint32_t x_0, x_1, x_2, x_3, x_4, x_5, x_6, x_7;
404 register uint32_t x_8, x_9, x_10, x_11, x_12, x_13, x_14, x_15;
405 #ifdef sun4v
406 unsigned long long *md5_consts64;
407
408 /* LINTED E_BAD_PTR_CAST_ALIGN */
409 md5_consts64 = (unsigned long long *) md5_consts;
410 #endif /* sun4v */
411
412 /*
413 * general optimization:
414 *
415 * the compiler (at least SC4.2/5.x) generates better code if
416 * variable use is localized. in this case, swapping the integers in
417 * this order allows `x_0 'to be swapped nearest to its first use in
418 * FF(), and likewise for `x_1' and up. note that the compiler
419 * prefers this to doing each swap right before the FF() that
420 * uses it.
421 */
422
423 /*
424 * sparc v9/v8plus optimization:
425 *
426 * if `block' is already aligned on a 4-byte boundary, use the
427 * optimized load_little_32() directly. otherwise, bcopy()
428 * into a buffer that *is* aligned on a 4-byte boundary and
429 * then do the load_little_32() on that buffer. benchmarks
430 * have shown that using the bcopy() is better than loading
431 * the bytes individually and doing the endian-swap by hand.
432 *
433 * even though it's quite tempting to assign to do:
434 *
435 * blk = bcopy(blk, ctx->buf_un.buf32, sizeof (ctx->buf_un.buf32));
436 *
437 * and only have one set of LOAD_LITTLE_32()'s, the compiler (at least
438 * SC4.2/5.x) *does not* like that, so please resist the urge.
439 */
440
441 #ifdef _MD5_CHECK_ALIGNMENT
442 if ((uintptr_t)block & 0x3) { /* not 4-byte aligned? */
443 bcopy(block, ctx->buf_un.buf32, sizeof (ctx->buf_un.buf32));
444
445 #ifdef sun4v
446 x_15 = LOAD_LITTLE_32_f(ctx->buf_un.buf32);
447 x_14 = LOAD_LITTLE_32_e(ctx->buf_un.buf32);
448 x_13 = LOAD_LITTLE_32_d(ctx->buf_un.buf32);
449 x_12 = LOAD_LITTLE_32_c(ctx->buf_un.buf32);
450 x_11 = LOAD_LITTLE_32_b(ctx->buf_un.buf32);
451 x_10 = LOAD_LITTLE_32_a(ctx->buf_un.buf32);
452 x_9 = LOAD_LITTLE_32_9(ctx->buf_un.buf32);
453 x_8 = LOAD_LITTLE_32_8(ctx->buf_un.buf32);
454 x_7 = LOAD_LITTLE_32_7(ctx->buf_un.buf32);
455 x_6 = LOAD_LITTLE_32_6(ctx->buf_un.buf32);
456 x_5 = LOAD_LITTLE_32_5(ctx->buf_un.buf32);
457 x_4 = LOAD_LITTLE_32_4(ctx->buf_un.buf32);
458 x_3 = LOAD_LITTLE_32_3(ctx->buf_un.buf32);
459 x_2 = LOAD_LITTLE_32_2(ctx->buf_un.buf32);
460 x_1 = LOAD_LITTLE_32_1(ctx->buf_un.buf32);
461 x_0 = LOAD_LITTLE_32_0(ctx->buf_un.buf32);
462 #else
463 x_15 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 15);
464 x_14 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 14);
465 x_13 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 13);
466 x_12 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 12);
467 x_11 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 11);
468 x_10 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 10);
469 x_9 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 9);
470 x_8 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 8);
471 x_7 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 7);
472 x_6 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 6);
473 x_5 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 5);
474 x_4 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 4);
475 x_3 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 3);
476 x_2 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 2);
477 x_1 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 1);
478 x_0 = LOAD_LITTLE_32(ctx->buf_un.buf32 + 0);
479 #endif /* sun4v */
480 } else
481 #endif
482 {
483
484 #ifdef sun4v
485 /* LINTED E_BAD_PTR_CAST_ALIGN */
486 x_15 = LOAD_LITTLE_32_f(block);
487 /* LINTED E_BAD_PTR_CAST_ALIGN */
488 x_14 = LOAD_LITTLE_32_e(block);
489 /* LINTED E_BAD_PTR_CAST_ALIGN */
490 x_13 = LOAD_LITTLE_32_d(block);
491 /* LINTED E_BAD_PTR_CAST_ALIGN */
492 x_12 = LOAD_LITTLE_32_c(block);
493 /* LINTED E_BAD_PTR_CAST_ALIGN */
494 x_11 = LOAD_LITTLE_32_b(block);
495 /* LINTED E_BAD_PTR_CAST_ALIGN */
496 x_10 = LOAD_LITTLE_32_a(block);
497 /* LINTED E_BAD_PTR_CAST_ALIGN */
498 x_9 = LOAD_LITTLE_32_9(block);
499 /* LINTED E_BAD_PTR_CAST_ALIGN */
500 x_8 = LOAD_LITTLE_32_8(block);
501 /* LINTED E_BAD_PTR_CAST_ALIGN */
502 x_7 = LOAD_LITTLE_32_7(block);
503 /* LINTED E_BAD_PTR_CAST_ALIGN */
504 x_6 = LOAD_LITTLE_32_6(block);
505 /* LINTED E_BAD_PTR_CAST_ALIGN */
506 x_5 = LOAD_LITTLE_32_5(block);
507 /* LINTED E_BAD_PTR_CAST_ALIGN */
508 x_4 = LOAD_LITTLE_32_4(block);
509 /* LINTED E_BAD_PTR_CAST_ALIGN */
510 x_3 = LOAD_LITTLE_32_3(block);
511 /* LINTED E_BAD_PTR_CAST_ALIGN */
512 x_2 = LOAD_LITTLE_32_2(block);
513 /* LINTED E_BAD_PTR_CAST_ALIGN */
514 x_1 = LOAD_LITTLE_32_1(block);
515 /* LINTED E_BAD_PTR_CAST_ALIGN */
516 x_0 = LOAD_LITTLE_32_0(block);
517 #else
518 /* LINTED E_BAD_PTR_CAST_ALIGN */
519 x_15 = LOAD_LITTLE_32(block + 60);
520 /* LINTED E_BAD_PTR_CAST_ALIGN */
521 x_14 = LOAD_LITTLE_32(block + 56);
522 /* LINTED E_BAD_PTR_CAST_ALIGN */
523 x_13 = LOAD_LITTLE_32(block + 52);
524 /* LINTED E_BAD_PTR_CAST_ALIGN */
525 x_12 = LOAD_LITTLE_32(block + 48);
526 /* LINTED E_BAD_PTR_CAST_ALIGN */
527 x_11 = LOAD_LITTLE_32(block + 44);
528 /* LINTED E_BAD_PTR_CAST_ALIGN */
529 x_10 = LOAD_LITTLE_32(block + 40);
530 /* LINTED E_BAD_PTR_CAST_ALIGN */
531 x_9 = LOAD_LITTLE_32(block + 36);
532 /* LINTED E_BAD_PTR_CAST_ALIGN */
533 x_8 = LOAD_LITTLE_32(block + 32);
534 /* LINTED E_BAD_PTR_CAST_ALIGN */
535 x_7 = LOAD_LITTLE_32(block + 28);
536 /* LINTED E_BAD_PTR_CAST_ALIGN */
537 x_6 = LOAD_LITTLE_32(block + 24);
538 /* LINTED E_BAD_PTR_CAST_ALIGN */
539 x_5 = LOAD_LITTLE_32(block + 20);
540 /* LINTED E_BAD_PTR_CAST_ALIGN */
541 x_4 = LOAD_LITTLE_32(block + 16);
542 /* LINTED E_BAD_PTR_CAST_ALIGN */
543 x_3 = LOAD_LITTLE_32(block + 12);
544 /* LINTED E_BAD_PTR_CAST_ALIGN */
545 x_2 = LOAD_LITTLE_32(block + 8);
546 /* LINTED E_BAD_PTR_CAST_ALIGN */
547 x_1 = LOAD_LITTLE_32(block + 4);
548 /* LINTED E_BAD_PTR_CAST_ALIGN */
549 x_0 = LOAD_LITTLE_32(block + 0);
550 #endif /* sun4v */
551 }
552
553 /* round 1 */
554 FF(a, b, c, d, x_0, MD5_SHIFT_11, MD5_CONST_e(0)); /* 1 */
555 FF(d, a, b, c, x_1, MD5_SHIFT_12, MD5_CONST_o(1)); /* 2 */
556 FF(c, d, a, b, x_2, MD5_SHIFT_13, MD5_CONST_e(2)); /* 3 */
557 FF(b, c, d, a, x_3, MD5_SHIFT_14, MD5_CONST_o(3)); /* 4 */
558 FF(a, b, c, d, x_4, MD5_SHIFT_11, MD5_CONST_e(4)); /* 5 */
559 FF(d, a, b, c, x_5, MD5_SHIFT_12, MD5_CONST_o(5)); /* 6 */
560 FF(c, d, a, b, x_6, MD5_SHIFT_13, MD5_CONST_e(6)); /* 7 */
561 FF(b, c, d, a, x_7, MD5_SHIFT_14, MD5_CONST_o(7)); /* 8 */
562 FF(a, b, c, d, x_8, MD5_SHIFT_11, MD5_CONST_e(8)); /* 9 */
563 FF(d, a, b, c, x_9, MD5_SHIFT_12, MD5_CONST_o(9)); /* 10 */
564 FF(c, d, a, b, x_10, MD5_SHIFT_13, MD5_CONST_e(10)); /* 11 */
565 FF(b, c, d, a, x_11, MD5_SHIFT_14, MD5_CONST_o(11)); /* 12 */
566 FF(a, b, c, d, x_12, MD5_SHIFT_11, MD5_CONST_e(12)); /* 13 */
567 FF(d, a, b, c, x_13, MD5_SHIFT_12, MD5_CONST_o(13)); /* 14 */
568 FF(c, d, a, b, x_14, MD5_SHIFT_13, MD5_CONST_e(14)); /* 15 */
569 FF(b, c, d, a, x_15, MD5_SHIFT_14, MD5_CONST_o(15)); /* 16 */
570
571 /* round 2 */
572 GG(a, b, c, d, x_1, MD5_SHIFT_21, MD5_CONST_e(16)); /* 17 */
573 GG(d, a, b, c, x_6, MD5_SHIFT_22, MD5_CONST_o(17)); /* 18 */
574 GG(c, d, a, b, x_11, MD5_SHIFT_23, MD5_CONST_e(18)); /* 19 */
575 GG(b, c, d, a, x_0, MD5_SHIFT_24, MD5_CONST_o(19)); /* 20 */
576 GG(a, b, c, d, x_5, MD5_SHIFT_21, MD5_CONST_e(20)); /* 21 */
577 GG(d, a, b, c, x_10, MD5_SHIFT_22, MD5_CONST_o(21)); /* 22 */
578 GG(c, d, a, b, x_15, MD5_SHIFT_23, MD5_CONST_e(22)); /* 23 */
579 GG(b, c, d, a, x_4, MD5_SHIFT_24, MD5_CONST_o(23)); /* 24 */
580 GG(a, b, c, d, x_9, MD5_SHIFT_21, MD5_CONST_e(24)); /* 25 */
581 GG(d, a, b, c, x_14, MD5_SHIFT_22, MD5_CONST_o(25)); /* 26 */
582 GG(c, d, a, b, x_3, MD5_SHIFT_23, MD5_CONST_e(26)); /* 27 */
583 GG(b, c, d, a, x_8, MD5_SHIFT_24, MD5_CONST_o(27)); /* 28 */
584 GG(a, b, c, d, x_13, MD5_SHIFT_21, MD5_CONST_e(28)); /* 29 */
585 GG(d, a, b, c, x_2, MD5_SHIFT_22, MD5_CONST_o(29)); /* 30 */
586 GG(c, d, a, b, x_7, MD5_SHIFT_23, MD5_CONST_e(30)); /* 31 */
587 GG(b, c, d, a, x_12, MD5_SHIFT_24, MD5_CONST_o(31)); /* 32 */
588
589 /* round 3 */
590 HH(a, b, c, d, x_5, MD5_SHIFT_31, MD5_CONST_e(32)); /* 33 */
591 HH(d, a, b, c, x_8, MD5_SHIFT_32, MD5_CONST_o(33)); /* 34 */
592 HH(c, d, a, b, x_11, MD5_SHIFT_33, MD5_CONST_e(34)); /* 35 */
593 HH(b, c, d, a, x_14, MD5_SHIFT_34, MD5_CONST_o(35)); /* 36 */
594 HH(a, b, c, d, x_1, MD5_SHIFT_31, MD5_CONST_e(36)); /* 37 */
595 HH(d, a, b, c, x_4, MD5_SHIFT_32, MD5_CONST_o(37)); /* 38 */
596 HH(c, d, a, b, x_7, MD5_SHIFT_33, MD5_CONST_e(38)); /* 39 */
597 HH(b, c, d, a, x_10, MD5_SHIFT_34, MD5_CONST_o(39)); /* 40 */
598 HH(a, b, c, d, x_13, MD5_SHIFT_31, MD5_CONST_e(40)); /* 41 */
599 HH(d, a, b, c, x_0, MD5_SHIFT_32, MD5_CONST_o(41)); /* 42 */
600 HH(c, d, a, b, x_3, MD5_SHIFT_33, MD5_CONST_e(42)); /* 43 */
601 HH(b, c, d, a, x_6, MD5_SHIFT_34, MD5_CONST_o(43)); /* 44 */
602 HH(a, b, c, d, x_9, MD5_SHIFT_31, MD5_CONST_e(44)); /* 45 */
603 HH(d, a, b, c, x_12, MD5_SHIFT_32, MD5_CONST_o(45)); /* 46 */
604 HH(c, d, a, b, x_15, MD5_SHIFT_33, MD5_CONST_e(46)); /* 47 */
605 HH(b, c, d, a, x_2, MD5_SHIFT_34, MD5_CONST_o(47)); /* 48 */
606
607 /* round 4 */
608 II(a, b, c, d, x_0, MD5_SHIFT_41, MD5_CONST_e(48)); /* 49 */
609 II(d, a, b, c, x_7, MD5_SHIFT_42, MD5_CONST_o(49)); /* 50 */
610 II(c, d, a, b, x_14, MD5_SHIFT_43, MD5_CONST_e(50)); /* 51 */
611 II(b, c, d, a, x_5, MD5_SHIFT_44, MD5_CONST_o(51)); /* 52 */
612 II(a, b, c, d, x_12, MD5_SHIFT_41, MD5_CONST_e(52)); /* 53 */
613 II(d, a, b, c, x_3, MD5_SHIFT_42, MD5_CONST_o(53)); /* 54 */
614 II(c, d, a, b, x_10, MD5_SHIFT_43, MD5_CONST_e(54)); /* 55 */
615 II(b, c, d, a, x_1, MD5_SHIFT_44, MD5_CONST_o(55)); /* 56 */
616 II(a, b, c, d, x_8, MD5_SHIFT_41, MD5_CONST_e(56)); /* 57 */
617 II(d, a, b, c, x_15, MD5_SHIFT_42, MD5_CONST_o(57)); /* 58 */
618 II(c, d, a, b, x_6, MD5_SHIFT_43, MD5_CONST_e(58)); /* 59 */
619 II(b, c, d, a, x_13, MD5_SHIFT_44, MD5_CONST_o(59)); /* 60 */
620 II(a, b, c, d, x_4, MD5_SHIFT_41, MD5_CONST_e(60)); /* 61 */
621 II(d, a, b, c, x_11, MD5_SHIFT_42, MD5_CONST_o(61)); /* 62 */
622 II(c, d, a, b, x_2, MD5_SHIFT_43, MD5_CONST_e(62)); /* 63 */
623 II(b, c, d, a, x_9, MD5_SHIFT_44, MD5_CONST_o(63)); /* 64 */
624
625 ctx->state[0] += a;
626 ctx->state[1] += b;
627 ctx->state[2] += c;
628 ctx->state[3] += d;
629
630 /*
631 * zeroize sensitive information -- compiler will optimize
632 * this out if everything is kept in registers
633 */
634
635 x_0 = x_1 = x_2 = x_3 = x_4 = x_5 = x_6 = x_7 = x_8 = 0;
636 x_9 = x_10 = x_11 = x_12 = x_13 = x_14 = x_15 = 0;
637 }
638
639 /*
640 * Encode()
641 *
642 * purpose: to convert a list of numbers from big endian to little endian
643 * input: uint8_t * : place to store the converted little endian numbers
644 * uint32_t * : place to get numbers to convert from
645 * size_t : the length of the input in bytes
646 * output: void
647 */
648
649 static void
650 Encode(uint8_t *_RESTRICT_KYWD output, const uint32_t *_RESTRICT_KYWD input,
651 size_t input_len)
652 {
653 size_t i, j;
654
655 for (i = 0, j = 0; j < input_len; i++, j += sizeof (uint32_t)) {
656
657 #ifdef _LITTLE_ENDIAN
658
659 #ifdef _MD5_CHECK_ALIGNMENT
660 if ((uintptr_t)output & 0x3) /* Not 4-byte aligned */
661 bcopy(input + i, output + j, 4);
662 else *(uint32_t *)(output + j) = input[i];
663 #else
664 /*LINTED E_BAD_PTR_CAST_ALIGN*/
665 *(uint32_t *)(output + j) = input[i];
666 #endif /* _MD5_CHECK_ALIGNMENT */
667
668 #else /* big endian -- will work on little endian, but slowly */
669
670 output[j] = input[i] & 0xff;
671 output[j + 1] = (input[i] >> 8) & 0xff;
672 output[j + 2] = (input[i] >> 16) & 0xff;
673 output[j + 3] = (input[i] >> 24) & 0xff;
674 #endif
675 }
676 }