1 /*
2 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6 #pragma ident "@(#)sha2.c 1.8 08/03/20 SMI"
7
8 /*
9 * The basic framework for this code came from the reference
10 * implementation for MD5. That implementation is Copyright (C)
11 * 1991-2, RSA Data Security, Inc. Created 1991. All rights reserved.
12 *
13 * License to copy and use this software is granted provided that it
14 * is identified as the "RSA Data Security, Inc. MD5 Message-Digest
15 * Algorithm" in all material mentioning or referencing this software
16 * or this function.
17 *
18 * License is also granted to make and use derivative works provided
19 * that such works are identified as "derived from the RSA Data
20 * Security, Inc. MD5 Message-Digest Algorithm" in all material
21 * mentioning or referencing the derived work.
22 *
23 * RSA Data Security, Inc. makes no representations concerning either
24 * the merchantability of this software or the suitability of this
25 * software for any particular purpose. It is provided "as is"
26 * without express or implied warranty of any kind.
27 *
28 * These notices must be retained in any copies of any part of this
29 * documentation and/or software.
30 *
31 * NOTE: Cleaned-up and optimized, version of SHA2, based on the FIPS 180-2
32 * standard, available at http://www.itl.nist.gov/div897/pubs/fip180-2.htm
33 * Not as fast as one would like -- further optimizations are encouraged
34 * and appreciated.
35 */
36
37 #include <sys/types.h>
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/sysmacros.h>
41 #define _SHA2_IMPL
42 #include <sys/sha2.h>
43 #include <sys/sha2_consts.h>
44
45 #ifdef _KERNEL
46 #include <sys/cmn_err.h>
47
48 #else
49 #include <strings.h>
50 #include <stdlib.h>
51 #include <errno.h>
52
53 #pragma weak SHA256Update = SHA2Update
54 #pragma weak SHA384Update = SHA2Update
55 #pragma weak SHA512Update = SHA2Update
56
57 #pragma weak SHA256Final = SHA2Final
58 #pragma weak SHA384Final = SHA2Final
59 #pragma weak SHA512Final = SHA2Final
60
61 #endif /* _KERNEL */
62
63 static void Encode(uint8_t *, uint32_t *, size_t);
64 static void Encode64(uint8_t *, uint64_t *, size_t);
65
66 #if defined(__amd64)
67 #define SHA512Transform(ctx, in) SHA512TransformBlocks((ctx), (in), 1)
68 #define SHA256Transform(ctx, in) SHA256TransformBlocks((ctx), (in), 1)
69
70 void SHA512TransformBlocks(SHA2_CTX *ctx, const void *in, size_t num);
71 void SHA256TransformBlocks(SHA2_CTX *ctx, const void *in, size_t num);
72
73 #else
74 static void SHA256Transform(SHA2_CTX *, const uint8_t *);
75 static void SHA512Transform(SHA2_CTX *, const uint8_t *);
76 #endif /* __amd64 */
77
78 static uint8_t PADDING[128] = { 0x80, /* all zeros */ };
79
80 /* Ch and Maj are the basic SHA2 functions. */
81 #define Ch(b, c, d) (((b) & (c)) ^ ((~b) & (d)))
82 #define Maj(b, c, d) (((b) & (c)) ^ ((b) & (d)) ^ ((c) & (d)))
83
84 /* Rotates x right n bits. */
85 #define ROTR(x, n) \
86 (((x) >> (n)) | ((x) << ((sizeof (x) * NBBY)-(n))))
87
88 /* Shift x right n bits */
89 #define SHR(x, n) ((x) >> (n))
90
91 /* SHA256 Functions */
92 #define BIGSIGMA0_256(x) (ROTR((x), 2) ^ ROTR((x), 13) ^ ROTR((x), 22))
93 #define BIGSIGMA1_256(x) (ROTR((x), 6) ^ ROTR((x), 11) ^ ROTR((x), 25))
94 #define SIGMA0_256(x) (ROTR((x), 7) ^ ROTR((x), 18) ^ SHR((x), 3))
95 #define SIGMA1_256(x) (ROTR((x), 17) ^ ROTR((x), 19) ^ SHR((x), 10))
96
97 #define SHA256ROUND(a, b, c, d, e, f, g, h, i, w) \
98 T1 = h + BIGSIGMA1_256(e) + Ch(e, f, g) + SHA256_CONST(i) + w; \
99 d += T1; \
100 T2 = BIGSIGMA0_256(a) + Maj(a, b, c); \
101 h = T1 + T2
102
103 /* SHA384/512 Functions */
104 #define BIGSIGMA0(x) (ROTR((x), 28) ^ ROTR((x), 34) ^ ROTR((x), 39))
105 #define BIGSIGMA1(x) (ROTR((x), 14) ^ ROTR((x), 18) ^ ROTR((x), 41))
106 #define SIGMA0(x) (ROTR((x), 1) ^ ROTR((x), 8) ^ SHR((x), 7))
107 #define SIGMA1(x) (ROTR((x), 19) ^ ROTR((x), 61) ^ SHR((x), 6))
108 #define SHA512ROUND(a, b, c, d, e, f, g, h, i, w) \
109 T1 = h + BIGSIGMA1(e) + Ch(e, f, g) + SHA512_CONST(i) + w; \
110 d += T1; \
111 T2 = BIGSIGMA0(a) + Maj(a, b, c); \
112 h = T1 + T2
113
114 /*
115 * sparc optimization:
116 *
117 * on the sparc, we can load big endian 32-bit data easily. note that
118 * special care must be taken to ensure the address is 32-bit aligned.
119 * in the interest of speed, we don't check to make sure, since
120 * careful programming can guarantee this for us.
121 */
122
123 #if defined(_BIG_ENDIAN)
124
125 #define LOAD_BIG_32(addr) (*(uint32_t *)(addr))
126
127 #else /* little endian -- will work on big endian, but slowly */
128
129 #define LOAD_BIG_32(addr) \
130 (((addr)[0] << 24) | ((addr)[1] << 16) | ((addr)[2] << 8) | (addr)[3])
131 #endif
132
133
134 #if defined(_BIG_ENDIAN)
135
136 #define LOAD_BIG_64(addr) (*(uint64_t *)(addr))
137
138 #else /* little endian -- will work on big endian, but slowly */
139
140 #define LOAD_BIG_64(addr) \
141 (((uint64_t)(addr)[0] << 56) | ((uint64_t)(addr)[1] << 48) | \
142 ((uint64_t)(addr)[2] << 40) | ((uint64_t)(addr)[3] << 32) | \
143 ((uint64_t)(addr)[4] << 24) | ((uint64_t)(addr)[5] << 16) | \
144 ((uint64_t)(addr)[6] << 8) | (uint64_t)(addr)[7])
145 #endif
146
147
148 #if !defined(__amd64)
149 /* SHA256 Transform */
150
151 static void
152 SHA256Transform(SHA2_CTX *ctx, const uint8_t *blk)
153 {
154 uint32_t a = ctx->state.s32[0];
155 uint32_t b = ctx->state.s32[1];
156 uint32_t c = ctx->state.s32[2];
157 uint32_t d = ctx->state.s32[3];
158 uint32_t e = ctx->state.s32[4];
159 uint32_t f = ctx->state.s32[5];
160 uint32_t g = ctx->state.s32[6];
161 uint32_t h = ctx->state.s32[7];
162
163 uint32_t w0, w1, w2, w3, w4, w5, w6, w7;
164 uint32_t w8, w9, w10, w11, w12, w13, w14, w15;
165 uint32_t T1, T2;
166
167 #if defined(__sparc)
168 static const uint32_t sha256_consts[] = {
169 SHA256_CONST_0, SHA256_CONST_1, SHA256_CONST_2,
170 SHA256_CONST_3, SHA256_CONST_4, SHA256_CONST_5,
171 SHA256_CONST_6, SHA256_CONST_7, SHA256_CONST_8,
172 SHA256_CONST_9, SHA256_CONST_10, SHA256_CONST_11,
173 SHA256_CONST_12, SHA256_CONST_13, SHA256_CONST_14,
174 SHA256_CONST_15, SHA256_CONST_16, SHA256_CONST_17,
175 SHA256_CONST_18, SHA256_CONST_19, SHA256_CONST_20,
176 SHA256_CONST_21, SHA256_CONST_22, SHA256_CONST_23,
177 SHA256_CONST_24, SHA256_CONST_25, SHA256_CONST_26,
178 SHA256_CONST_27, SHA256_CONST_28, SHA256_CONST_29,
179 SHA256_CONST_30, SHA256_CONST_31, SHA256_CONST_32,
180 SHA256_CONST_33, SHA256_CONST_34, SHA256_CONST_35,
181 SHA256_CONST_36, SHA256_CONST_37, SHA256_CONST_38,
182 SHA256_CONST_39, SHA256_CONST_40, SHA256_CONST_41,
183 SHA256_CONST_42, SHA256_CONST_43, SHA256_CONST_44,
184 SHA256_CONST_45, SHA256_CONST_46, SHA256_CONST_47,
185 SHA256_CONST_48, SHA256_CONST_49, SHA256_CONST_50,
186 SHA256_CONST_51, SHA256_CONST_52, SHA256_CONST_53,
187 SHA256_CONST_54, SHA256_CONST_55, SHA256_CONST_56,
188 SHA256_CONST_57, SHA256_CONST_58, SHA256_CONST_59,
189 SHA256_CONST_60, SHA256_CONST_61, SHA256_CONST_62,
190 SHA256_CONST_63
191 };
192 #endif /* __sparc */
193
194 if ((uintptr_t)blk & 0x3) { /* not 4-byte aligned? */
195 bcopy(blk, ctx->buf_un.buf32, sizeof (ctx->buf_un.buf32));
196 blk = (uint8_t *)ctx->buf_un.buf32;
197 }
198
199 /* LINTED E_BAD_PTR_CAST_ALIGN */
200 w0 = LOAD_BIG_32(blk + 4 * 0);
201 SHA256ROUND(a, b, c, d, e, f, g, h, 0, w0);
202 /* LINTED E_BAD_PTR_CAST_ALIGN */
203 w1 = LOAD_BIG_32(blk + 4 * 1);
204 SHA256ROUND(h, a, b, c, d, e, f, g, 1, w1);
205 /* LINTED E_BAD_PTR_CAST_ALIGN */
206 w2 = LOAD_BIG_32(blk + 4 * 2);
207 SHA256ROUND(g, h, a, b, c, d, e, f, 2, w2);
208 /* LINTED E_BAD_PTR_CAST_ALIGN */
209 w3 = LOAD_BIG_32(blk + 4 * 3);
210 SHA256ROUND(f, g, h, a, b, c, d, e, 3, w3);
211 /* LINTED E_BAD_PTR_CAST_ALIGN */
212 w4 = LOAD_BIG_32(blk + 4 * 4);
213 SHA256ROUND(e, f, g, h, a, b, c, d, 4, w4);
214 /* LINTED E_BAD_PTR_CAST_ALIGN */
215 w5 = LOAD_BIG_32(blk + 4 * 5);
216 SHA256ROUND(d, e, f, g, h, a, b, c, 5, w5);
217 /* LINTED E_BAD_PTR_CAST_ALIGN */
218 w6 = LOAD_BIG_32(blk + 4 * 6);
219 SHA256ROUND(c, d, e, f, g, h, a, b, 6, w6);
220 /* LINTED E_BAD_PTR_CAST_ALIGN */
221 w7 = LOAD_BIG_32(blk + 4 * 7);
222 SHA256ROUND(b, c, d, e, f, g, h, a, 7, w7);
223 /* LINTED E_BAD_PTR_CAST_ALIGN */
224 w8 = LOAD_BIG_32(blk + 4 * 8);
225 SHA256ROUND(a, b, c, d, e, f, g, h, 8, w8);
226 /* LINTED E_BAD_PTR_CAST_ALIGN */
227 w9 = LOAD_BIG_32(blk + 4 * 9);
228 SHA256ROUND(h, a, b, c, d, e, f, g, 9, w9);
229 /* LINTED E_BAD_PTR_CAST_ALIGN */
230 w10 = LOAD_BIG_32(blk + 4 * 10);
231 SHA256ROUND(g, h, a, b, c, d, e, f, 10, w10);
232 /* LINTED E_BAD_PTR_CAST_ALIGN */
233 w11 = LOAD_BIG_32(blk + 4 * 11);
234 SHA256ROUND(f, g, h, a, b, c, d, e, 11, w11);
235 /* LINTED E_BAD_PTR_CAST_ALIGN */
236 w12 = LOAD_BIG_32(blk + 4 * 12);
237 SHA256ROUND(e, f, g, h, a, b, c, d, 12, w12);
238 /* LINTED E_BAD_PTR_CAST_ALIGN */
239 w13 = LOAD_BIG_32(blk + 4 * 13);
240 SHA256ROUND(d, e, f, g, h, a, b, c, 13, w13);
241 /* LINTED E_BAD_PTR_CAST_ALIGN */
242 w14 = LOAD_BIG_32(blk + 4 * 14);
243 SHA256ROUND(c, d, e, f, g, h, a, b, 14, w14);
244 /* LINTED E_BAD_PTR_CAST_ALIGN */
245 w15 = LOAD_BIG_32(blk + 4 * 15);
246 SHA256ROUND(b, c, d, e, f, g, h, a, 15, w15);
247
248 w0 = SIGMA1_256(w14) + w9 + SIGMA0_256(w1) + w0;
249 SHA256ROUND(a, b, c, d, e, f, g, h, 16, w0);
250 w1 = SIGMA1_256(w15) + w10 + SIGMA0_256(w2) + w1;
251 SHA256ROUND(h, a, b, c, d, e, f, g, 17, w1);
252 w2 = SIGMA1_256(w0) + w11 + SIGMA0_256(w3) + w2;
253 SHA256ROUND(g, h, a, b, c, d, e, f, 18, w2);
254 w3 = SIGMA1_256(w1) + w12 + SIGMA0_256(w4) + w3;
255 SHA256ROUND(f, g, h, a, b, c, d, e, 19, w3);
256 w4 = SIGMA1_256(w2) + w13 + SIGMA0_256(w5) + w4;
257 SHA256ROUND(e, f, g, h, a, b, c, d, 20, w4);
258 w5 = SIGMA1_256(w3) + w14 + SIGMA0_256(w6) + w5;
259 SHA256ROUND(d, e, f, g, h, a, b, c, 21, w5);
260 w6 = SIGMA1_256(w4) + w15 + SIGMA0_256(w7) + w6;
261 SHA256ROUND(c, d, e, f, g, h, a, b, 22, w6);
262 w7 = SIGMA1_256(w5) + w0 + SIGMA0_256(w8) + w7;
263 SHA256ROUND(b, c, d, e, f, g, h, a, 23, w7);
264 w8 = SIGMA1_256(w6) + w1 + SIGMA0_256(w9) + w8;
265 SHA256ROUND(a, b, c, d, e, f, g, h, 24, w8);
266 w9 = SIGMA1_256(w7) + w2 + SIGMA0_256(w10) + w9;
267 SHA256ROUND(h, a, b, c, d, e, f, g, 25, w9);
268 w10 = SIGMA1_256(w8) + w3 + SIGMA0_256(w11) + w10;
269 SHA256ROUND(g, h, a, b, c, d, e, f, 26, w10);
270 w11 = SIGMA1_256(w9) + w4 + SIGMA0_256(w12) + w11;
271 SHA256ROUND(f, g, h, a, b, c, d, e, 27, w11);
272 w12 = SIGMA1_256(w10) + w5 + SIGMA0_256(w13) + w12;
273 SHA256ROUND(e, f, g, h, a, b, c, d, 28, w12);
274 w13 = SIGMA1_256(w11) + w6 + SIGMA0_256(w14) + w13;
275 SHA256ROUND(d, e, f, g, h, a, b, c, 29, w13);
276 w14 = SIGMA1_256(w12) + w7 + SIGMA0_256(w15) + w14;
277 SHA256ROUND(c, d, e, f, g, h, a, b, 30, w14);
278 w15 = SIGMA1_256(w13) + w8 + SIGMA0_256(w0) + w15;
279 SHA256ROUND(b, c, d, e, f, g, h, a, 31, w15);
280
281 w0 = SIGMA1_256(w14) + w9 + SIGMA0_256(w1) + w0;
282 SHA256ROUND(a, b, c, d, e, f, g, h, 32, w0);
283 w1 = SIGMA1_256(w15) + w10 + SIGMA0_256(w2) + w1;
284 SHA256ROUND(h, a, b, c, d, e, f, g, 33, w1);
285 w2 = SIGMA1_256(w0) + w11 + SIGMA0_256(w3) + w2;
286 SHA256ROUND(g, h, a, b, c, d, e, f, 34, w2);
287 w3 = SIGMA1_256(w1) + w12 + SIGMA0_256(w4) + w3;
288 SHA256ROUND(f, g, h, a, b, c, d, e, 35, w3);
289 w4 = SIGMA1_256(w2) + w13 + SIGMA0_256(w5) + w4;
290 SHA256ROUND(e, f, g, h, a, b, c, d, 36, w4);
291 w5 = SIGMA1_256(w3) + w14 + SIGMA0_256(w6) + w5;
292 SHA256ROUND(d, e, f, g, h, a, b, c, 37, w5);
293 w6 = SIGMA1_256(w4) + w15 + SIGMA0_256(w7) + w6;
294 SHA256ROUND(c, d, e, f, g, h, a, b, 38, w6);
295 w7 = SIGMA1_256(w5) + w0 + SIGMA0_256(w8) + w7;
296 SHA256ROUND(b, c, d, e, f, g, h, a, 39, w7);
297 w8 = SIGMA1_256(w6) + w1 + SIGMA0_256(w9) + w8;
298 SHA256ROUND(a, b, c, d, e, f, g, h, 40, w8);
299 w9 = SIGMA1_256(w7) + w2 + SIGMA0_256(w10) + w9;
300 SHA256ROUND(h, a, b, c, d, e, f, g, 41, w9);
301 w10 = SIGMA1_256(w8) + w3 + SIGMA0_256(w11) + w10;
302 SHA256ROUND(g, h, a, b, c, d, e, f, 42, w10);
303 w11 = SIGMA1_256(w9) + w4 + SIGMA0_256(w12) + w11;
304 SHA256ROUND(f, g, h, a, b, c, d, e, 43, w11);
305 w12 = SIGMA1_256(w10) + w5 + SIGMA0_256(w13) + w12;
306 SHA256ROUND(e, f, g, h, a, b, c, d, 44, w12);
307 w13 = SIGMA1_256(w11) + w6 + SIGMA0_256(w14) + w13;
308 SHA256ROUND(d, e, f, g, h, a, b, c, 45, w13);
309 w14 = SIGMA1_256(w12) + w7 + SIGMA0_256(w15) + w14;
310 SHA256ROUND(c, d, e, f, g, h, a, b, 46, w14);
311 w15 = SIGMA1_256(w13) + w8 + SIGMA0_256(w0) + w15;
312 SHA256ROUND(b, c, d, e, f, g, h, a, 47, w15);
313
314 w0 = SIGMA1_256(w14) + w9 + SIGMA0_256(w1) + w0;
315 SHA256ROUND(a, b, c, d, e, f, g, h, 48, w0);
316 w1 = SIGMA1_256(w15) + w10 + SIGMA0_256(w2) + w1;
317 SHA256ROUND(h, a, b, c, d, e, f, g, 49, w1);
318 w2 = SIGMA1_256(w0) + w11 + SIGMA0_256(w3) + w2;
319 SHA256ROUND(g, h, a, b, c, d, e, f, 50, w2);
320 w3 = SIGMA1_256(w1) + w12 + SIGMA0_256(w4) + w3;
321 SHA256ROUND(f, g, h, a, b, c, d, e, 51, w3);
322 w4 = SIGMA1_256(w2) + w13 + SIGMA0_256(w5) + w4;
323 SHA256ROUND(e, f, g, h, a, b, c, d, 52, w4);
324 w5 = SIGMA1_256(w3) + w14 + SIGMA0_256(w6) + w5;
325 SHA256ROUND(d, e, f, g, h, a, b, c, 53, w5);
326 w6 = SIGMA1_256(w4) + w15 + SIGMA0_256(w7) + w6;
327 SHA256ROUND(c, d, e, f, g, h, a, b, 54, w6);
328 w7 = SIGMA1_256(w5) + w0 + SIGMA0_256(w8) + w7;
329 SHA256ROUND(b, c, d, e, f, g, h, a, 55, w7);
330 w8 = SIGMA1_256(w6) + w1 + SIGMA0_256(w9) + w8;
331 SHA256ROUND(a, b, c, d, e, f, g, h, 56, w8);
332 w9 = SIGMA1_256(w7) + w2 + SIGMA0_256(w10) + w9;
333 SHA256ROUND(h, a, b, c, d, e, f, g, 57, w9);
334 w10 = SIGMA1_256(w8) + w3 + SIGMA0_256(w11) + w10;
335 SHA256ROUND(g, h, a, b, c, d, e, f, 58, w10);
336 w11 = SIGMA1_256(w9) + w4 + SIGMA0_256(w12) + w11;
337 SHA256ROUND(f, g, h, a, b, c, d, e, 59, w11);
338 w12 = SIGMA1_256(w10) + w5 + SIGMA0_256(w13) + w12;
339 SHA256ROUND(e, f, g, h, a, b, c, d, 60, w12);
340 w13 = SIGMA1_256(w11) + w6 + SIGMA0_256(w14) + w13;
341 SHA256ROUND(d, e, f, g, h, a, b, c, 61, w13);
342 w14 = SIGMA1_256(w12) + w7 + SIGMA0_256(w15) + w14;
343 SHA256ROUND(c, d, e, f, g, h, a, b, 62, w14);
344 w15 = SIGMA1_256(w13) + w8 + SIGMA0_256(w0) + w15;
345 SHA256ROUND(b, c, d, e, f, g, h, a, 63, w15);
346
347 ctx->state.s32[0] += a;
348 ctx->state.s32[1] += b;
349 ctx->state.s32[2] += c;
350 ctx->state.s32[3] += d;
351 ctx->state.s32[4] += e;
352 ctx->state.s32[5] += f;
353 ctx->state.s32[6] += g;
354 ctx->state.s32[7] += h;
355 }
356
357
358 /* SHA384 and SHA512 Transform */
359
360 static void
361 SHA512Transform(SHA2_CTX *ctx, const uint8_t *blk)
362 {
363
364 uint64_t a = ctx->state.s64[0];
365 uint64_t b = ctx->state.s64[1];
366 uint64_t c = ctx->state.s64[2];
367 uint64_t d = ctx->state.s64[3];
368 uint64_t e = ctx->state.s64[4];
369 uint64_t f = ctx->state.s64[5];
370 uint64_t g = ctx->state.s64[6];
371 uint64_t h = ctx->state.s64[7];
372
373 uint64_t w0, w1, w2, w3, w4, w5, w6, w7;
374 uint64_t w8, w9, w10, w11, w12, w13, w14, w15;
375 uint64_t T1, T2;
376
377 #if defined(__sparc)
378 static const uint64_t sha512_consts[] = {
379 SHA512_CONST_0, SHA512_CONST_1, SHA512_CONST_2,
380 SHA512_CONST_3, SHA512_CONST_4, SHA512_CONST_5,
381 SHA512_CONST_6, SHA512_CONST_7, SHA512_CONST_8,
382 SHA512_CONST_9, SHA512_CONST_10, SHA512_CONST_11,
383 SHA512_CONST_12, SHA512_CONST_13, SHA512_CONST_14,
384 SHA512_CONST_15, SHA512_CONST_16, SHA512_CONST_17,
385 SHA512_CONST_18, SHA512_CONST_19, SHA512_CONST_20,
386 SHA512_CONST_21, SHA512_CONST_22, SHA512_CONST_23,
387 SHA512_CONST_24, SHA512_CONST_25, SHA512_CONST_26,
388 SHA512_CONST_27, SHA512_CONST_28, SHA512_CONST_29,
389 SHA512_CONST_30, SHA512_CONST_31, SHA512_CONST_32,
390 SHA512_CONST_33, SHA512_CONST_34, SHA512_CONST_35,
391 SHA512_CONST_36, SHA512_CONST_37, SHA512_CONST_38,
392 SHA512_CONST_39, SHA512_CONST_40, SHA512_CONST_41,
393 SHA512_CONST_42, SHA512_CONST_43, SHA512_CONST_44,
394 SHA512_CONST_45, SHA512_CONST_46, SHA512_CONST_47,
395 SHA512_CONST_48, SHA512_CONST_49, SHA512_CONST_50,
396 SHA512_CONST_51, SHA512_CONST_52, SHA512_CONST_53,
397 SHA512_CONST_54, SHA512_CONST_55, SHA512_CONST_56,
398 SHA512_CONST_57, SHA512_CONST_58, SHA512_CONST_59,
399 SHA512_CONST_60, SHA512_CONST_61, SHA512_CONST_62,
400 SHA512_CONST_63, SHA512_CONST_64, SHA512_CONST_65,
401 SHA512_CONST_66, SHA512_CONST_67, SHA512_CONST_68,
402 SHA512_CONST_69, SHA512_CONST_70, SHA512_CONST_71,
403 SHA512_CONST_72, SHA512_CONST_73, SHA512_CONST_74,
404 SHA512_CONST_75, SHA512_CONST_76, SHA512_CONST_77,
405 SHA512_CONST_78, SHA512_CONST_79
406 };
407 #endif /* __sparc */
408
409
410 if ((uintptr_t)blk & 0x7) { /* not 8-byte aligned? */
411 bcopy(blk, ctx->buf_un.buf64, sizeof (ctx->buf_un.buf64));
412 blk = (uint8_t *)ctx->buf_un.buf64;
413 }
414
415 /* LINTED E_BAD_PTR_CAST_ALIGN */
416 w0 = LOAD_BIG_64(blk + 8 * 0);
417 SHA512ROUND(a, b, c, d, e, f, g, h, 0, w0);
418 /* LINTED E_BAD_PTR_CAST_ALIGN */
419 w1 = LOAD_BIG_64(blk + 8 * 1);
420 SHA512ROUND(h, a, b, c, d, e, f, g, 1, w1);
421 /* LINTED E_BAD_PTR_CAST_ALIGN */
422 w2 = LOAD_BIG_64(blk + 8 * 2);
423 SHA512ROUND(g, h, a, b, c, d, e, f, 2, w2);
424 /* LINTED E_BAD_PTR_CAST_ALIGN */
425 w3 = LOAD_BIG_64(blk + 8 * 3);
426 SHA512ROUND(f, g, h, a, b, c, d, e, 3, w3);
427 /* LINTED E_BAD_PTR_CAST_ALIGN */
428 w4 = LOAD_BIG_64(blk + 8 * 4);
429 SHA512ROUND(e, f, g, h, a, b, c, d, 4, w4);
430 /* LINTED E_BAD_PTR_CAST_ALIGN */
431 w5 = LOAD_BIG_64(blk + 8 * 5);
432 SHA512ROUND(d, e, f, g, h, a, b, c, 5, w5);
433 /* LINTED E_BAD_PTR_CAST_ALIGN */
434 w6 = LOAD_BIG_64(blk + 8 * 6);
435 SHA512ROUND(c, d, e, f, g, h, a, b, 6, w6);
436 /* LINTED E_BAD_PTR_CAST_ALIGN */
437 w7 = LOAD_BIG_64(blk + 8 * 7);
438 SHA512ROUND(b, c, d, e, f, g, h, a, 7, w7);
439 /* LINTED E_BAD_PTR_CAST_ALIGN */
440 w8 = LOAD_BIG_64(blk + 8 * 8);
441 SHA512ROUND(a, b, c, d, e, f, g, h, 8, w8);
442 /* LINTED E_BAD_PTR_CAST_ALIGN */
443 w9 = LOAD_BIG_64(blk + 8 * 9);
444 SHA512ROUND(h, a, b, c, d, e, f, g, 9, w9);
445 /* LINTED E_BAD_PTR_CAST_ALIGN */
446 w10 = LOAD_BIG_64(blk + 8 * 10);
447 SHA512ROUND(g, h, a, b, c, d, e, f, 10, w10);
448 /* LINTED E_BAD_PTR_CAST_ALIGN */
449 w11 = LOAD_BIG_64(blk + 8 * 11);
450 SHA512ROUND(f, g, h, a, b, c, d, e, 11, w11);
451 /* LINTED E_BAD_PTR_CAST_ALIGN */
452 w12 = LOAD_BIG_64(blk + 8 * 12);
453 SHA512ROUND(e, f, g, h, a, b, c, d, 12, w12);
454 /* LINTED E_BAD_PTR_CAST_ALIGN */
455 w13 = LOAD_BIG_64(blk + 8 * 13);
456 SHA512ROUND(d, e, f, g, h, a, b, c, 13, w13);
457 /* LINTED E_BAD_PTR_CAST_ALIGN */
458 w14 = LOAD_BIG_64(blk + 8 * 14);
459 SHA512ROUND(c, d, e, f, g, h, a, b, 14, w14);
460 /* LINTED E_BAD_PTR_CAST_ALIGN */
461 w15 = LOAD_BIG_64(blk + 8 * 15);
462 SHA512ROUND(b, c, d, e, f, g, h, a, 15, w15);
463
464 w0 = SIGMA1(w14) + w9 + SIGMA0(w1) + w0;
465 SHA512ROUND(a, b, c, d, e, f, g, h, 16, w0);
466 w1 = SIGMA1(w15) + w10 + SIGMA0(w2) + w1;
467 SHA512ROUND(h, a, b, c, d, e, f, g, 17, w1);
468 w2 = SIGMA1(w0) + w11 + SIGMA0(w3) + w2;
469 SHA512ROUND(g, h, a, b, c, d, e, f, 18, w2);
470 w3 = SIGMA1(w1) + w12 + SIGMA0(w4) + w3;
471 SHA512ROUND(f, g, h, a, b, c, d, e, 19, w3);
472 w4 = SIGMA1(w2) + w13 + SIGMA0(w5) + w4;
473 SHA512ROUND(e, f, g, h, a, b, c, d, 20, w4);
474 w5 = SIGMA1(w3) + w14 + SIGMA0(w6) + w5;
475 SHA512ROUND(d, e, f, g, h, a, b, c, 21, w5);
476 w6 = SIGMA1(w4) + w15 + SIGMA0(w7) + w6;
477 SHA512ROUND(c, d, e, f, g, h, a, b, 22, w6);
478 w7 = SIGMA1(w5) + w0 + SIGMA0(w8) + w7;
479 SHA512ROUND(b, c, d, e, f, g, h, a, 23, w7);
480 w8 = SIGMA1(w6) + w1 + SIGMA0(w9) + w8;
481 SHA512ROUND(a, b, c, d, e, f, g, h, 24, w8);
482 w9 = SIGMA1(w7) + w2 + SIGMA0(w10) + w9;
483 SHA512ROUND(h, a, b, c, d, e, f, g, 25, w9);
484 w10 = SIGMA1(w8) + w3 + SIGMA0(w11) + w10;
485 SHA512ROUND(g, h, a, b, c, d, e, f, 26, w10);
486 w11 = SIGMA1(w9) + w4 + SIGMA0(w12) + w11;
487 SHA512ROUND(f, g, h, a, b, c, d, e, 27, w11);
488 w12 = SIGMA1(w10) + w5 + SIGMA0(w13) + w12;
489 SHA512ROUND(e, f, g, h, a, b, c, d, 28, w12);
490 w13 = SIGMA1(w11) + w6 + SIGMA0(w14) + w13;
491 SHA512ROUND(d, e, f, g, h, a, b, c, 29, w13);
492 w14 = SIGMA1(w12) + w7 + SIGMA0(w15) + w14;
493 SHA512ROUND(c, d, e, f, g, h, a, b, 30, w14);
494 w15 = SIGMA1(w13) + w8 + SIGMA0(w0) + w15;
495 SHA512ROUND(b, c, d, e, f, g, h, a, 31, w15);
496
497 w0 = SIGMA1(w14) + w9 + SIGMA0(w1) + w0;
498 SHA512ROUND(a, b, c, d, e, f, g, h, 32, w0);
499 w1 = SIGMA1(w15) + w10 + SIGMA0(w2) + w1;
500 SHA512ROUND(h, a, b, c, d, e, f, g, 33, w1);
501 w2 = SIGMA1(w0) + w11 + SIGMA0(w3) + w2;
502 SHA512ROUND(g, h, a, b, c, d, e, f, 34, w2);
503 w3 = SIGMA1(w1) + w12 + SIGMA0(w4) + w3;
504 SHA512ROUND(f, g, h, a, b, c, d, e, 35, w3);
505 w4 = SIGMA1(w2) + w13 + SIGMA0(w5) + w4;
506 SHA512ROUND(e, f, g, h, a, b, c, d, 36, w4);
507 w5 = SIGMA1(w3) + w14 + SIGMA0(w6) + w5;
508 SHA512ROUND(d, e, f, g, h, a, b, c, 37, w5);
509 w6 = SIGMA1(w4) + w15 + SIGMA0(w7) + w6;
510 SHA512ROUND(c, d, e, f, g, h, a, b, 38, w6);
511 w7 = SIGMA1(w5) + w0 + SIGMA0(w8) + w7;
512 SHA512ROUND(b, c, d, e, f, g, h, a, 39, w7);
513 w8 = SIGMA1(w6) + w1 + SIGMA0(w9) + w8;
514 SHA512ROUND(a, b, c, d, e, f, g, h, 40, w8);
515 w9 = SIGMA1(w7) + w2 + SIGMA0(w10) + w9;
516 SHA512ROUND(h, a, b, c, d, e, f, g, 41, w9);
517 w10 = SIGMA1(w8) + w3 + SIGMA0(w11) + w10;
518 SHA512ROUND(g, h, a, b, c, d, e, f, 42, w10);
519 w11 = SIGMA1(w9) + w4 + SIGMA0(w12) + w11;
520 SHA512ROUND(f, g, h, a, b, c, d, e, 43, w11);
521 w12 = SIGMA1(w10) + w5 + SIGMA0(w13) + w12;
522 SHA512ROUND(e, f, g, h, a, b, c, d, 44, w12);
523 w13 = SIGMA1(w11) + w6 + SIGMA0(w14) + w13;
524 SHA512ROUND(d, e, f, g, h, a, b, c, 45, w13);
525 w14 = SIGMA1(w12) + w7 + SIGMA0(w15) + w14;
526 SHA512ROUND(c, d, e, f, g, h, a, b, 46, w14);
527 w15 = SIGMA1(w13) + w8 + SIGMA0(w0) + w15;
528 SHA512ROUND(b, c, d, e, f, g, h, a, 47, w15);
529
530 w0 = SIGMA1(w14) + w9 + SIGMA0(w1) + w0;
531 SHA512ROUND(a, b, c, d, e, f, g, h, 48, w0);
532 w1 = SIGMA1(w15) + w10 + SIGMA0(w2) + w1;
533 SHA512ROUND(h, a, b, c, d, e, f, g, 49, w1);
534 w2 = SIGMA1(w0) + w11 + SIGMA0(w3) + w2;
535 SHA512ROUND(g, h, a, b, c, d, e, f, 50, w2);
536 w3 = SIGMA1(w1) + w12 + SIGMA0(w4) + w3;
537 SHA512ROUND(f, g, h, a, b, c, d, e, 51, w3);
538 w4 = SIGMA1(w2) + w13 + SIGMA0(w5) + w4;
539 SHA512ROUND(e, f, g, h, a, b, c, d, 52, w4);
540 w5 = SIGMA1(w3) + w14 + SIGMA0(w6) + w5;
541 SHA512ROUND(d, e, f, g, h, a, b, c, 53, w5);
542 w6 = SIGMA1(w4) + w15 + SIGMA0(w7) + w6;
543 SHA512ROUND(c, d, e, f, g, h, a, b, 54, w6);
544 w7 = SIGMA1(w5) + w0 + SIGMA0(w8) + w7;
545 SHA512ROUND(b, c, d, e, f, g, h, a, 55, w7);
546 w8 = SIGMA1(w6) + w1 + SIGMA0(w9) + w8;
547 SHA512ROUND(a, b, c, d, e, f, g, h, 56, w8);
548 w9 = SIGMA1(w7) + w2 + SIGMA0(w10) + w9;
549 SHA512ROUND(h, a, b, c, d, e, f, g, 57, w9);
550 w10 = SIGMA1(w8) + w3 + SIGMA0(w11) + w10;
551 SHA512ROUND(g, h, a, b, c, d, e, f, 58, w10);
552 w11 = SIGMA1(w9) + w4 + SIGMA0(w12) + w11;
553 SHA512ROUND(f, g, h, a, b, c, d, e, 59, w11);
554 w12 = SIGMA1(w10) + w5 + SIGMA0(w13) + w12;
555 SHA512ROUND(e, f, g, h, a, b, c, d, 60, w12);
556 w13 = SIGMA1(w11) + w6 + SIGMA0(w14) + w13;
557 SHA512ROUND(d, e, f, g, h, a, b, c, 61, w13);
558 w14 = SIGMA1(w12) + w7 + SIGMA0(w15) + w14;
559 SHA512ROUND(c, d, e, f, g, h, a, b, 62, w14);
560 w15 = SIGMA1(w13) + w8 + SIGMA0(w0) + w15;
561 SHA512ROUND(b, c, d, e, f, g, h, a, 63, w15);
562
563 w0 = SIGMA1(w14) + w9 + SIGMA0(w1) + w0;
564 SHA512ROUND(a, b, c, d, e, f, g, h, 64, w0);
565 w1 = SIGMA1(w15) + w10 + SIGMA0(w2) + w1;
566 SHA512ROUND(h, a, b, c, d, e, f, g, 65, w1);
567 w2 = SIGMA1(w0) + w11 + SIGMA0(w3) + w2;
568 SHA512ROUND(g, h, a, b, c, d, e, f, 66, w2);
569 w3 = SIGMA1(w1) + w12 + SIGMA0(w4) + w3;
570 SHA512ROUND(f, g, h, a, b, c, d, e, 67, w3);
571 w4 = SIGMA1(w2) + w13 + SIGMA0(w5) + w4;
572 SHA512ROUND(e, f, g, h, a, b, c, d, 68, w4);
573 w5 = SIGMA1(w3) + w14 + SIGMA0(w6) + w5;
574 SHA512ROUND(d, e, f, g, h, a, b, c, 69, w5);
575 w6 = SIGMA1(w4) + w15 + SIGMA0(w7) + w6;
576 SHA512ROUND(c, d, e, f, g, h, a, b, 70, w6);
577 w7 = SIGMA1(w5) + w0 + SIGMA0(w8) + w7;
578 SHA512ROUND(b, c, d, e, f, g, h, a, 71, w7);
579 w8 = SIGMA1(w6) + w1 + SIGMA0(w9) + w8;
580 SHA512ROUND(a, b, c, d, e, f, g, h, 72, w8);
581 w9 = SIGMA1(w7) + w2 + SIGMA0(w10) + w9;
582 SHA512ROUND(h, a, b, c, d, e, f, g, 73, w9);
583 w10 = SIGMA1(w8) + w3 + SIGMA0(w11) + w10;
584 SHA512ROUND(g, h, a, b, c, d, e, f, 74, w10);
585 w11 = SIGMA1(w9) + w4 + SIGMA0(w12) + w11;
586 SHA512ROUND(f, g, h, a, b, c, d, e, 75, w11);
587 w12 = SIGMA1(w10) + w5 + SIGMA0(w13) + w12;
588 SHA512ROUND(e, f, g, h, a, b, c, d, 76, w12);
589 w13 = SIGMA1(w11) + w6 + SIGMA0(w14) + w13;
590 SHA512ROUND(d, e, f, g, h, a, b, c, 77, w13);
591 w14 = SIGMA1(w12) + w7 + SIGMA0(w15) + w14;
592 SHA512ROUND(c, d, e, f, g, h, a, b, 78, w14);
593 w15 = SIGMA1(w13) + w8 + SIGMA0(w0) + w15;
594 SHA512ROUND(b, c, d, e, f, g, h, a, 79, w15);
595
596 ctx->state.s64[0] += a;
597 ctx->state.s64[1] += b;
598 ctx->state.s64[2] += c;
599 ctx->state.s64[3] += d;
600 ctx->state.s64[4] += e;
601 ctx->state.s64[5] += f;
602 ctx->state.s64[6] += g;
603 ctx->state.s64[7] += h;
604
605 }
606 #endif /* !__amd64 */
607
608
609 /*
610 * Encode()
611 *
612 * purpose: to convert a list of numbers from little endian to big endian
613 * input: uint8_t * : place to store the converted big endian numbers
614 * uint32_t * : place to get numbers to convert from
615 * size_t : the length of the input in bytes
616 * output: void
617 */
618
619 static void
620 Encode(uint8_t *_RESTRICT_KYWD output, uint32_t *_RESTRICT_KYWD input,
621 size_t len)
622 {
623 size_t i, j;
624
625 #if defined(__sparc)
626 if (IS_P2ALIGNED(output, sizeof (uint32_t))) {
627 for (i = 0, j = 0; j < len; i++, j += 4) {
628 /* LINTED: pointer alignment */
629 *((uint32_t *)(output + j)) = input[i];
630 }
631 } else {
632 #endif /* little endian -- will work on big endian, but slowly */
633 for (i = 0, j = 0; j < len; i++, j += 4) {
634 output[j] = (input[i] >> 24) & 0xff;
635 output[j + 1] = (input[i] >> 16) & 0xff;
636 output[j + 2] = (input[i] >> 8) & 0xff;
637 output[j + 3] = input[i] & 0xff;
638 }
639 #if defined(__sparc)
640 }
641 #endif
642 }
643
644 static void
645 Encode64(uint8_t *_RESTRICT_KYWD output, uint64_t *_RESTRICT_KYWD input,
646 size_t len)
647 {
648 size_t i, j;
649
650 #if defined(__sparc)
651 if (IS_P2ALIGNED(output, sizeof (uint64_t))) {
652 for (i = 0, j = 0; j < len; i++, j += 8) {
653 /* LINTED: pointer alignment */
654 *((uint64_t *)(output + j)) = input[i];
655 }
656 } else {
657 #endif /* little endian -- will work on big endian, but slowly */
658 for (i = 0, j = 0; j < len; i++, j += 8) {
659
660 output[j] = (input[i] >> 56) & 0xff;
661 output[j + 1] = (input[i] >> 48) & 0xff;
662 output[j + 2] = (input[i] >> 40) & 0xff;
663 output[j + 3] = (input[i] >> 32) & 0xff;
664 output[j + 4] = (input[i] >> 24) & 0xff;
665 output[j + 5] = (input[i] >> 16) & 0xff;
666 output[j + 6] = (input[i] >> 8) & 0xff;
667 output[j + 7] = input[i] & 0xff;
668 }
669 #if defined(__sparc)
670 }
671 #endif
672 }
673
674
675 void
676 SHA2Init(uint64_t mech, SHA2_CTX *ctx)
677 {
678
679 switch (mech) {
680 case SHA256_MECH_INFO_TYPE:
681 case SHA256_HMAC_MECH_INFO_TYPE:
682 case SHA256_HMAC_GEN_MECH_INFO_TYPE:
683 ctx->state.s32[0] = 0x6a09e667U;
684 ctx->state.s32[1] = 0xbb67ae85U;
685 ctx->state.s32[2] = 0x3c6ef372U;
686 ctx->state.s32[3] = 0xa54ff53aU;
687 ctx->state.s32[4] = 0x510e527fU;
688 ctx->state.s32[5] = 0x9b05688cU;
689 ctx->state.s32[6] = 0x1f83d9abU;
690 ctx->state.s32[7] = 0x5be0cd19U;
691 break;
692 case SHA384_MECH_INFO_TYPE:
693 case SHA384_HMAC_MECH_INFO_TYPE:
694 case SHA384_HMAC_GEN_MECH_INFO_TYPE:
695 ctx->state.s64[0] = 0xcbbb9d5dc1059ed8ULL;
696 ctx->state.s64[1] = 0x629a292a367cd507ULL;
697 ctx->state.s64[2] = 0x9159015a3070dd17ULL;
698 ctx->state.s64[3] = 0x152fecd8f70e5939ULL;
699 ctx->state.s64[4] = 0x67332667ffc00b31ULL;
700 ctx->state.s64[5] = 0x8eb44a8768581511ULL;
701 ctx->state.s64[6] = 0xdb0c2e0d64f98fa7ULL;
702 ctx->state.s64[7] = 0x47b5481dbefa4fa4ULL;
703 break;
704 case SHA512_MECH_INFO_TYPE:
705 case SHA512_HMAC_MECH_INFO_TYPE:
706 case SHA512_HMAC_GEN_MECH_INFO_TYPE:
707 ctx->state.s64[0] = 0x6a09e667f3bcc908ULL;
708 ctx->state.s64[1] = 0xbb67ae8584caa73bULL;
709 ctx->state.s64[2] = 0x3c6ef372fe94f82bULL;
710 ctx->state.s64[3] = 0xa54ff53a5f1d36f1ULL;
711 ctx->state.s64[4] = 0x510e527fade682d1ULL;
712 ctx->state.s64[5] = 0x9b05688c2b3e6c1fULL;
713 ctx->state.s64[6] = 0x1f83d9abfb41bd6bULL;
714 ctx->state.s64[7] = 0x5be0cd19137e2179ULL;
715 break;
716 #ifdef _KERNEL
717 default:
718 cmn_err(CE_PANIC, "sha2_init: "
719 "failed to find a supported algorithm: 0x%x",
720 (uint32_t)mech);
721
722 #endif /* _KERNEL */
723 }
724
725 ctx->algotype = mech;
726 ctx->count.c64[0] = ctx->count.c64[1] = 0;
727 }
728
729 #ifndef _KERNEL
730
731 #pragma inline(SHA256Init, SHA384Init, SHA512Init)
732 void
733 SHA256Init(SHA256_CTX *ctx)
734 {
735 SHA2Init(SHA256, ctx);
736 }
737
738 void
739 SHA384Init(SHA384_CTX *ctx)
740 {
741 SHA2Init(SHA384, ctx);
742 }
743
744 void
745 SHA512Init(SHA512_CTX *ctx)
746 {
747 SHA2Init(SHA512, ctx);
748 }
749
750 #endif /* _KERNEL */
751
752 /*
753 * SHA2Update()
754 *
755 * purpose: continues an sha2 digest operation, using the message block
756 * to update the context.
757 * input: SHA2_CTX * : the context to update
758 * void * : the message block
759 * size_t : the length of the message block, in bytes
760 * output: void
761 */
762
763 void
764 SHA2Update(SHA2_CTX *ctx, const void *inptr, size_t input_len)
765 {
766 uint32_t i, buf_index, buf_len, buf_limit;
767 const uint8_t *input = inptr;
768 uint32_t algotype = ctx->algotype;
769 #if defined(__amd64)
770 uint32_t block_count;
771 #endif /* !__amd64 */
772
773
774 /* check for noop */
775 if (input_len == 0)
776 return;
777
778 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
779 buf_limit = 64;
780
781 /* compute number of bytes mod 64 */
782 buf_index = (ctx->count.c32[1] >> 3) & 0x3F;
783
784 /* update number of bits */
785 if ((ctx->count.c32[1] += (input_len << 3)) < (input_len << 3))
786 ctx->count.c32[0]++;
787
788 ctx->count.c32[0] += (input_len >> 29);
789
790 } else {
791 buf_limit = 128;
792
793 /* compute number of bytes mod 128 */
794 buf_index = (ctx->count.c64[1] >> 3) & 0x7F;
795
796 /* update number of bits */
797 if ((ctx->count.c64[1] += (input_len << 3)) < (input_len << 3))
798 ctx->count.c64[0]++;
799
800 ctx->count.c64[0] += (input_len >> 29);
801 }
802
803 buf_len = buf_limit - buf_index;
804
805 /* transform as many times as possible */
806 i = 0;
807 if (input_len >= buf_len) {
808
809 /*
810 * general optimization:
811 *
812 * only do initial bcopy() and SHA2Transform() if
813 * buf_index != 0. if buf_index == 0, we're just
814 * wasting our time doing the bcopy() since there
815 * wasn't any data left over from a previous call to
816 * SHA2Update().
817 */
818 if (buf_index) {
819 bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
820 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE)
821 SHA256Transform(ctx, ctx->buf_un.buf8);
822 else
823 SHA512Transform(ctx, ctx->buf_un.buf8);
824
825 i = buf_len;
826 }
827
828 #if !defined(__amd64)
829 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
830 for (; i + buf_limit - 1 < input_len; i += buf_limit) {
831 SHA256Transform(ctx, &input[i]);
832 }
833 } else {
834 for (; i + buf_limit - 1 < input_len; i += buf_limit) {
835 SHA512Transform(ctx, &input[i]);
836 }
837 }
838
839 #else
840 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
841 block_count = (input_len - i) >> 6;
842 if (block_count > 0) {
843 SHA256TransformBlocks(ctx, &input[i],
844 block_count);
845 i += block_count << 6;
846 }
847 } else {
848 block_count = (input_len - i) >> 7;
849 if (block_count > 0) {
850 SHA512TransformBlocks(ctx, &input[i],
851 block_count);
852 i += block_count << 7;
853 }
854 }
855 #endif /* !__amd64 */
856
857 /*
858 * general optimization:
859 *
860 * if i and input_len are the same, return now instead
861 * of calling bcopy(), since the bcopy() in this case
862 * will be an expensive noop.
863 */
864
865 if (input_len == i)
866 return;
867
868 buf_index = 0;
869 }
870
871 /* buffer remaining input */
872 bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
873 }
874
875
876 /*
877 * SHA2Final()
878 *
879 * purpose: ends an sha2 digest operation, finalizing the message digest and
880 * zeroing the context.
881 * input: uchar_t * : a buffer to store the digest
882 * : The function actually uses void* because many
883 * : callers pass things other than uchar_t here.
884 * SHA2_CTX * : the context to finalize, save, and zero
885 * output: void
886 */
887
888 void
889 SHA2Final(void *digest, SHA2_CTX *ctx)
890 {
891 uint8_t bitcount_be[sizeof (ctx->count.c32)];
892 uint8_t bitcount_be64[sizeof (ctx->count.c64)];
893 uint32_t index;
894 uint32_t algotype = ctx->algotype;
895
896 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
897 index = (ctx->count.c32[1] >> 3) & 0x3f;
898 Encode(bitcount_be, ctx->count.c32, sizeof (bitcount_be));
899 SHA2Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
900 SHA2Update(ctx, bitcount_be, sizeof (bitcount_be));
901 Encode(digest, ctx->state.s32, sizeof (ctx->state.s32));
902
903 } else {
904 index = (ctx->count.c64[1] >> 3) & 0x7f;
905 Encode64(bitcount_be64, ctx->count.c64,
906 sizeof (bitcount_be64));
907 SHA2Update(ctx, PADDING, ((index < 112) ? 112 : 240) - index);
908 SHA2Update(ctx, bitcount_be64, sizeof (bitcount_be64));
909 if (algotype <= SHA384_HMAC_GEN_MECH_INFO_TYPE) {
910 ctx->state.s64[6] = ctx->state.s64[7] = 0;
911 Encode64(digest, ctx->state.s64,
912 sizeof (uint64_t) * 6);
913 } else
914 Encode64(digest, ctx->state.s64,
915 sizeof (ctx->state.s64));
916 }
917
918 /* zeroize sensitive information */
919 bzero(ctx, sizeof (*ctx));
920 }