1 /*
2 * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6 #pragma ident "@(#)sha2.c 1.7 07/04/10 SMI"
7
8
9 /*
10 * The basic framework for this code came from the reference
11 * implementation for MD5. That implementation is Copyright (C)
12 * 1991-2, RSA Data Security, Inc. Created 1991. All rights reserved.
13 *
14 * License to copy and use this software is granted provided that it
15 * is identified as the "RSA Data Security, Inc. MD5 Message-Digest
16 * Algorithm" in all material mentioning or referencing this software
17 * or this function.
18 *
19 * License is also granted to make and use derivative works provided
20 * that such works are identified as "derived from the RSA Data
21 * Security, Inc. MD5 Message-Digest Algorithm" in all material
22 * mentioning or referencing the derived work.
23 *
24 * RSA Data Security, Inc. makes no representations concerning either
25 * the merchantability of this software or the suitability of this
26 * software for any particular purpose. It is provided "as is"
27 * without express or implied warranty of any kind.
28 *
29 * These notices must be retained in any copies of any part of this
30 * documentation and/or software.
31 *
32 * NOTE: Cleaned-up and optimized, version of SHA2, based on the FIPS 180-2
33 * standard, available at http://www.itl.nist.gov/div897/pubs/fip180-2.htm
34 * Not as fast as one would like -- further optimizations are encouraged
35 * and appreciated.
36 */
37
38 #include <sys/types.h>
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/sysmacros.h>
42 #define _SHA2_IMPL
43 #include <sys/sha2.h>
44 #include <sys/sha2_consts.h>
45
46 #ifndef _KERNEL
47
48 #include <strings.h>
49 #include <stdlib.h>
50 #include <errno.h>
51
52 #pragma weak SHA256Update = SHA2Update
53 #pragma weak SHA384Update = SHA2Update
54 #pragma weak SHA512Update = SHA2Update
55
56 #pragma weak SHA256Final = SHA2Final
57 #pragma weak SHA384Final = SHA2Final
58 #pragma weak SHA512Final = SHA2Final
59
60 #endif /* !_KERNEL */
61
62 #ifdef _KERNEL
63 #include <sys/cmn_err.h>
64 #endif /* _KERNEL */
65
66 static void Encode(uint8_t *, uint32_t *, size_t);
67 static void Encode64(uint8_t *, uint64_t *, size_t);
68 static void SHA256Transform(SHA2_CTX *, const uint8_t *);
69 static void SHA512Transform(SHA2_CTX *, const uint8_t *);
70
71 static uint8_t PADDING[128] = { 0x80, /* all zeros */ };
72
73 /* Ch and Maj are the basic SHA2 functions. */
74 #define Ch(b, c, d) (((b) & (c)) ^ ((~b) & (d)))
75 #define Maj(b, c, d) (((b) & (c)) ^ ((b) & (d)) ^ ((c) & (d)))
76
77 /* Rotates x right n bits. */
78 #define ROTR(x, n) \
79 (((x) >> (n)) | ((x) << ((sizeof (x) * NBBY)-(n))))
80
81 /* Shift x right n bits */
82 #define SHR(x, n) ((x) >> (n))
83
84 /* SHA256 Functions */
85 #define BIGSIGMA0_256(x) (ROTR((x), 2) ^ ROTR((x), 13) ^ ROTR((x), 22))
86 #define BIGSIGMA1_256(x) (ROTR((x), 6) ^ ROTR((x), 11) ^ ROTR((x), 25))
87 #define SIGMA0_256(x) (ROTR((x), 7) ^ ROTR((x), 18) ^ SHR((x), 3))
88 #define SIGMA1_256(x) (ROTR((x), 17) ^ ROTR((x), 19) ^ SHR((x), 10))
89
118 #define LOAD_BIG_32(addr) (*(uint32_t *)(addr))
119
120 #else /* little endian -- will work on big endian, but slowly */
121
122 #define LOAD_BIG_32(addr) \
123 (((addr)[0] << 24) | ((addr)[1] << 16) | ((addr)[2] << 8) | (addr)[3])
124 #endif
125
126
127 #if defined(_BIG_ENDIAN)
128
129 #define LOAD_BIG_64(addr) (*(uint64_t *)(addr))
130
131 #else /* little endian -- will work on big endian, but slowly */
132
133 #define LOAD_BIG_64(addr) \
134 (((uint64_t)(addr)[0] << 56) | ((uint64_t)(addr)[1] << 48) | \
135 ((uint64_t)(addr)[2] << 40) | ((uint64_t)(addr)[3] << 32) | \
136 ((uint64_t)(addr)[4] << 24) | ((uint64_t)(addr)[5] << 16) | \
137 ((uint64_t)(addr)[6] << 8) | (uint64_t)(addr)[7])
138
139 #endif
140
141
142 /* SHA256 Transform */
143
144 static void
145 SHA256Transform(SHA2_CTX *ctx, const uint8_t *blk)
146 {
147
148 uint32_t a = ctx->state.s32[0];
149 uint32_t b = ctx->state.s32[1];
150 uint32_t c = ctx->state.s32[2];
151 uint32_t d = ctx->state.s32[3];
152 uint32_t e = ctx->state.s32[4];
153 uint32_t f = ctx->state.s32[5];
154 uint32_t g = ctx->state.s32[6];
155 uint32_t h = ctx->state.s32[7];
156
157 uint32_t w0, w1, w2, w3, w4, w5, w6, w7;
158 uint32_t w8, w9, w10, w11, w12, w13, w14, w15;
159 uint32_t T1, T2;
160
161 #if defined(__sparc)
162 static const uint32_t sha256_consts[] = {
163 SHA256_CONST_0, SHA256_CONST_1, SHA256_CONST_2,
164 SHA256_CONST_3, SHA256_CONST_4, SHA256_CONST_5,
165 SHA256_CONST_6, SHA256_CONST_7, SHA256_CONST_8,
166 SHA256_CONST_9, SHA256_CONST_10, SHA256_CONST_11,
167 SHA256_CONST_12, SHA256_CONST_13, SHA256_CONST_14,
168 SHA256_CONST_15, SHA256_CONST_16, SHA256_CONST_17,
169 SHA256_CONST_18, SHA256_CONST_19, SHA256_CONST_20,
170 SHA256_CONST_21, SHA256_CONST_22, SHA256_CONST_23,
171 SHA256_CONST_24, SHA256_CONST_25, SHA256_CONST_26,
172 SHA256_CONST_27, SHA256_CONST_28, SHA256_CONST_29,
173 SHA256_CONST_30, SHA256_CONST_31, SHA256_CONST_32,
174 SHA256_CONST_33, SHA256_CONST_34, SHA256_CONST_35,
175 SHA256_CONST_36, SHA256_CONST_37, SHA256_CONST_38,
176 SHA256_CONST_39, SHA256_CONST_40, SHA256_CONST_41,
177 SHA256_CONST_42, SHA256_CONST_43, SHA256_CONST_44,
178 SHA256_CONST_45, SHA256_CONST_46, SHA256_CONST_47,
179 SHA256_CONST_48, SHA256_CONST_49, SHA256_CONST_50,
180 SHA256_CONST_51, SHA256_CONST_52, SHA256_CONST_53,
181 SHA256_CONST_54, SHA256_CONST_55, SHA256_CONST_56,
182 SHA256_CONST_57, SHA256_CONST_58, SHA256_CONST_59,
183 SHA256_CONST_60, SHA256_CONST_61, SHA256_CONST_62,
184 SHA256_CONST_63
185 };
186 #endif
187
188 if ((uintptr_t)blk & 0x3) { /* not 4-byte aligned? */
189 bcopy(blk, ctx->buf_un.buf32, sizeof (ctx->buf_un.buf32));
190 blk = (uint8_t *)ctx->buf_un.buf32;
191 }
192
193 /* LINTED E_BAD_PTR_CAST_ALIGN */
194 w0 = LOAD_BIG_32(blk + 4 * 0);
195 SHA256ROUND(a, b, c, d, e, f, g, h, 0, w0);
196 /* LINTED E_BAD_PTR_CAST_ALIGN */
197 w1 = LOAD_BIG_32(blk + 4 * 1);
198 SHA256ROUND(h, a, b, c, d, e, f, g, 1, w1);
199 /* LINTED E_BAD_PTR_CAST_ALIGN */
200 w2 = LOAD_BIG_32(blk + 4 * 2);
201 SHA256ROUND(g, h, a, b, c, d, e, f, 2, w2);
202 /* LINTED E_BAD_PTR_CAST_ALIGN */
203 w3 = LOAD_BIG_32(blk + 4 * 3);
204 SHA256ROUND(f, g, h, a, b, c, d, e, 3, w3);
205 /* LINTED E_BAD_PTR_CAST_ALIGN */
206 w4 = LOAD_BIG_32(blk + 4 * 4);
381 SHA512_CONST_24, SHA512_CONST_25, SHA512_CONST_26,
382 SHA512_CONST_27, SHA512_CONST_28, SHA512_CONST_29,
383 SHA512_CONST_30, SHA512_CONST_31, SHA512_CONST_32,
384 SHA512_CONST_33, SHA512_CONST_34, SHA512_CONST_35,
385 SHA512_CONST_36, SHA512_CONST_37, SHA512_CONST_38,
386 SHA512_CONST_39, SHA512_CONST_40, SHA512_CONST_41,
387 SHA512_CONST_42, SHA512_CONST_43, SHA512_CONST_44,
388 SHA512_CONST_45, SHA512_CONST_46, SHA512_CONST_47,
389 SHA512_CONST_48, SHA512_CONST_49, SHA512_CONST_50,
390 SHA512_CONST_51, SHA512_CONST_52, SHA512_CONST_53,
391 SHA512_CONST_54, SHA512_CONST_55, SHA512_CONST_56,
392 SHA512_CONST_57, SHA512_CONST_58, SHA512_CONST_59,
393 SHA512_CONST_60, SHA512_CONST_61, SHA512_CONST_62,
394 SHA512_CONST_63, SHA512_CONST_64, SHA512_CONST_65,
395 SHA512_CONST_66, SHA512_CONST_67, SHA512_CONST_68,
396 SHA512_CONST_69, SHA512_CONST_70, SHA512_CONST_71,
397 SHA512_CONST_72, SHA512_CONST_73, SHA512_CONST_74,
398 SHA512_CONST_75, SHA512_CONST_76, SHA512_CONST_77,
399 SHA512_CONST_78, SHA512_CONST_79
400 };
401 #endif
402
403
404 if ((uintptr_t)blk & 0x7) { /* not 8-byte aligned? */
405 bcopy(blk, ctx->buf_un.buf64, sizeof (ctx->buf_un.buf64));
406 blk = (uint8_t *)ctx->buf_un.buf64;
407 }
408
409 /* LINTED E_BAD_PTR_CAST_ALIGN */
410 w0 = LOAD_BIG_64(blk + 8 * 0);
411 SHA512ROUND(a, b, c, d, e, f, g, h, 0, w0);
412 /* LINTED E_BAD_PTR_CAST_ALIGN */
413 w1 = LOAD_BIG_64(blk + 8 * 1);
414 SHA512ROUND(h, a, b, c, d, e, f, g, 1, w1);
415 /* LINTED E_BAD_PTR_CAST_ALIGN */
416 w2 = LOAD_BIG_64(blk + 8 * 2);
417 SHA512ROUND(g, h, a, b, c, d, e, f, 2, w2);
418 /* LINTED E_BAD_PTR_CAST_ALIGN */
419 w3 = LOAD_BIG_64(blk + 8 * 3);
420 SHA512ROUND(f, g, h, a, b, c, d, e, 3, w3);
421 /* LINTED E_BAD_PTR_CAST_ALIGN */
580 SHA512ROUND(f, g, h, a, b, c, d, e, 75, w11);
581 w12 = SIGMA1(w10) + w5 + SIGMA0(w13) + w12;
582 SHA512ROUND(e, f, g, h, a, b, c, d, 76, w12);
583 w13 = SIGMA1(w11) + w6 + SIGMA0(w14) + w13;
584 SHA512ROUND(d, e, f, g, h, a, b, c, 77, w13);
585 w14 = SIGMA1(w12) + w7 + SIGMA0(w15) + w14;
586 SHA512ROUND(c, d, e, f, g, h, a, b, 78, w14);
587 w15 = SIGMA1(w13) + w8 + SIGMA0(w0) + w15;
588 SHA512ROUND(b, c, d, e, f, g, h, a, 79, w15);
589
590 ctx->state.s64[0] += a;
591 ctx->state.s64[1] += b;
592 ctx->state.s64[2] += c;
593 ctx->state.s64[3] += d;
594 ctx->state.s64[4] += e;
595 ctx->state.s64[5] += f;
596 ctx->state.s64[6] += g;
597 ctx->state.s64[7] += h;
598
599 }
600
601
602 /*
603 * Encode()
604 *
605 * purpose: to convert a list of numbers from little endian to big endian
606 * input: uint8_t * : place to store the converted big endian numbers
607 * uint32_t * : place to get numbers to convert from
608 * size_t : the length of the input in bytes
609 * output: void
610 */
611
612 static void
613 Encode(uint8_t *_RESTRICT_KYWD output, uint32_t *_RESTRICT_KYWD input,
614 size_t len)
615 {
616 size_t i, j;
617
618 #if defined(__sparc)
619 if (IS_P2ALIGNED(output, sizeof (uint32_t))) {
732 SHA384Init(SHA384_CTX *ctx)
733 {
734 SHA2Init(SHA384, ctx);
735 }
736
737 void
738 SHA512Init(SHA512_CTX *ctx)
739 {
740 SHA2Init(SHA512, ctx);
741 }
742
743 #endif /* _KERNEL */
744
745 /*
746 * SHA2Update()
747 *
748 * purpose: continues an sha2 digest operation, using the message block
749 * to update the context.
750 * input: SHA2_CTX * : the context to update
751 * void * : the message block
752 * size_t : the length of the message block in bytes
753 * output: void
754 */
755
756 void
757 SHA2Update(SHA2_CTX *ctx, const void *inptr, size_t input_len)
758 {
759 uint32_t i, buf_index, buf_len, buf_limit;
760 const uint8_t *input = inptr;
761
762 /* check for noop */
763 if (input_len == 0)
764 return;
765
766 if (ctx->algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
767 buf_limit = 64;
768
769 /* compute number of bytes mod 64 */
770 buf_index = (ctx->count.c32[1] >> 3) & 0x3F;
771
772 /* update number of bits */
773 if ((ctx->count.c32[1] += (input_len << 3)) < (input_len << 3))
774 ctx->count.c32[0]++;
775
776 ctx->count.c32[0] += (input_len >> 29);
777
778 } else {
779 buf_limit = 128;
780
781 /* compute number of bytes mod 128 */
782 buf_index = (ctx->count.c64[1] >> 3) & 0x7F;
783
784 /* update number of bits */
785 if ((ctx->count.c64[1] += (input_len << 3)) < (input_len << 3))
786 ctx->count.c64[0]++;
788 ctx->count.c64[0] += (input_len >> 29);
789 }
790
791 buf_len = buf_limit - buf_index;
792
793 /* transform as many times as possible */
794 i = 0;
795 if (input_len >= buf_len) {
796
797 /*
798 * general optimization:
799 *
800 * only do initial bcopy() and SHA2Transform() if
801 * buf_index != 0. if buf_index == 0, we're just
802 * wasting our time doing the bcopy() since there
803 * wasn't any data left over from a previous call to
804 * SHA2Update().
805 */
806 if (buf_index) {
807 bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
808 if (ctx->algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE)
809 SHA256Transform(ctx, ctx->buf_un.buf8);
810 else
811 SHA512Transform(ctx, ctx->buf_un.buf8);
812
813 i = buf_len;
814 }
815
816
817 for (; i + buf_limit - 1 < input_len; i += buf_limit) {
818 if (ctx->algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE)
819 SHA256Transform(ctx, &input[i]);
820 else
821 SHA512Transform(ctx, &input[i]);
822 }
823
824 /*
825 * general optimization:
826 *
827 * if i and input_len are the same, return now instead
828 * of calling bcopy(), since the bcopy() in this case
829 * will be an expensive nop.
830 */
831
832 if (input_len == i)
833 return;
834
835 buf_index = 0;
836 }
837
838 /* buffer remaining input */
839 bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
840 }
841
842
843 /*
844 * SHA2Final()
845 *
846 * purpose: ends an sha2 digest operation, finalizing the message digest and
847 * zeroing the context.
848 * input: uchar_t * : a buffer to store the digest in
849 * : The function actually uses void* because many
850 * : callers pass things other than uchar_t here.
851 * SHA2_CTX * : the context to finalize, save, and zero
852 * output: void
853 */
854
855 void
856 SHA2Final(void *digest, SHA2_CTX *ctx)
857 {
858 uint8_t bitcount_be[sizeof (ctx->count.c32)];
859 uint8_t bitcount_be64[sizeof (ctx->count.c64)];
860 uint32_t index;
861
862
863 if (ctx->algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
864 index = (ctx->count.c32[1] >> 3) & 0x3f;
865 Encode(bitcount_be, ctx->count.c32, sizeof (bitcount_be));
866 SHA2Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
867 SHA2Update(ctx, bitcount_be, sizeof (bitcount_be));
868 Encode(digest, ctx->state.s32, sizeof (ctx->state.s32));
869
870 } else {
871 index = (ctx->count.c64[1] >> 3) & 0x7f;
872 Encode64(bitcount_be64, ctx->count.c64,
873 sizeof (bitcount_be64));
874 SHA2Update(ctx, PADDING, ((index < 112) ? 112 : 240) - index);
875 SHA2Update(ctx, bitcount_be64, sizeof (bitcount_be64));
876 if (ctx->algotype <= SHA384_HMAC_GEN_MECH_INFO_TYPE) {
877 ctx->state.s64[6] = ctx->state.s64[7] = 0;
878 Encode64(digest, ctx->state.s64,
879 sizeof (uint64_t) * 6);
880 } else
881 Encode64(digest, ctx->state.s64,
882 sizeof (ctx->state.s64));
883 }
884
885 /* zeroize sensitive information */
886 bzero(ctx, sizeof (*ctx));
887 }
|
1 /*
2 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6 #pragma ident "@(#)sha2.c 1.8 08/03/05 SMI"
7
8 /*
9 * The basic framework for this code came from the reference
10 * implementation for MD5. That implementation is Copyright (C)
11 * 1991-2, RSA Data Security, Inc. Created 1991. All rights reserved.
12 *
13 * License to copy and use this software is granted provided that it
14 * is identified as the "RSA Data Security, Inc. MD5 Message-Digest
15 * Algorithm" in all material mentioning or referencing this software
16 * or this function.
17 *
18 * License is also granted to make and use derivative works provided
19 * that such works are identified as "derived from the RSA Data
20 * Security, Inc. MD5 Message-Digest Algorithm" in all material
21 * mentioning or referencing the derived work.
22 *
23 * RSA Data Security, Inc. makes no representations concerning either
24 * the merchantability of this software or the suitability of this
25 * software for any particular purpose. It is provided "as is"
26 * without express or implied warranty of any kind.
27 *
28 * These notices must be retained in any copies of any part of this
29 * documentation and/or software.
30 *
31 * NOTE: Cleaned-up and optimized, version of SHA2, based on the FIPS 180-2
32 * standard, available at http://www.itl.nist.gov/div897/pubs/fip180-2.htm
33 * Not as fast as one would like -- further optimizations are encouraged
34 * and appreciated.
35 */
36
37 #include <sys/types.h>
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/sysmacros.h>
41 #define _SHA2_IMPL
42 #include <sys/sha2.h>
43 #include <sys/sha2_consts.h>
44
45 #ifdef _KERNEL
46 #include <sys/cmn_err.h>
47
48 #else
49 #include <strings.h>
50 #include <stdlib.h>
51 #include <errno.h>
52
53 #pragma weak SHA256Update = SHA2Update
54 #pragma weak SHA384Update = SHA2Update
55 #pragma weak SHA512Update = SHA2Update
56
57 #pragma weak SHA256Final = SHA2Final
58 #pragma weak SHA384Final = SHA2Final
59 #pragma weak SHA512Final = SHA2Final
60
61 #endif /* _KERNEL */
62
63 static void Encode(uint8_t *, uint32_t *, size_t);
64 static void Encode64(uint8_t *, uint64_t *, size_t);
65
66 #if defined(__amd64)
67 #define SHA512Transform(ctx, in) SHA512TransformBlocks((ctx), (in), 1)
68 #define SHA256Transform(ctx, in) SHA256TransformBlocks((ctx), (in), 1)
69
70 void SHA512TransformBlocks(SHA2_CTX *ctx, const void *in, size_t num);
71 void SHA256TransformBlocks(SHA2_CTX *ctx, const void *in, size_t num);
72
73 #else
74 static void SHA256Transform(SHA2_CTX *, const uint8_t *);
75 static void SHA512Transform(SHA2_CTX *, const uint8_t *);
76 #endif /* __amd64 */
77
78 static uint8_t PADDING[128] = { 0x80, /* all zeros */ };
79
80 /* Ch and Maj are the basic SHA2 functions. */
81 #define Ch(b, c, d) (((b) & (c)) ^ ((~b) & (d)))
82 #define Maj(b, c, d) (((b) & (c)) ^ ((b) & (d)) ^ ((c) & (d)))
83
84 /* Rotates x right n bits. */
85 #define ROTR(x, n) \
86 (((x) >> (n)) | ((x) << ((sizeof (x) * NBBY)-(n))))
87
88 /* Shift x right n bits */
89 #define SHR(x, n) ((x) >> (n))
90
91 /* SHA256 Functions */
92 #define BIGSIGMA0_256(x) (ROTR((x), 2) ^ ROTR((x), 13) ^ ROTR((x), 22))
93 #define BIGSIGMA1_256(x) (ROTR((x), 6) ^ ROTR((x), 11) ^ ROTR((x), 25))
94 #define SIGMA0_256(x) (ROTR((x), 7) ^ ROTR((x), 18) ^ SHR((x), 3))
95 #define SIGMA1_256(x) (ROTR((x), 17) ^ ROTR((x), 19) ^ SHR((x), 10))
96
125 #define LOAD_BIG_32(addr) (*(uint32_t *)(addr))
126
127 #else /* little endian -- will work on big endian, but slowly */
128
129 #define LOAD_BIG_32(addr) \
130 (((addr)[0] << 24) | ((addr)[1] << 16) | ((addr)[2] << 8) | (addr)[3])
131 #endif
132
133
134 #if defined(_BIG_ENDIAN)
135
136 #define LOAD_BIG_64(addr) (*(uint64_t *)(addr))
137
138 #else /* little endian -- will work on big endian, but slowly */
139
140 #define LOAD_BIG_64(addr) \
141 (((uint64_t)(addr)[0] << 56) | ((uint64_t)(addr)[1] << 48) | \
142 ((uint64_t)(addr)[2] << 40) | ((uint64_t)(addr)[3] << 32) | \
143 ((uint64_t)(addr)[4] << 24) | ((uint64_t)(addr)[5] << 16) | \
144 ((uint64_t)(addr)[6] << 8) | (uint64_t)(addr)[7])
145 #endif
146
147
148 #if !defined(__amd64)
149 /* SHA256 Transform */
150
151 static void
152 SHA256Transform(SHA2_CTX *ctx, const uint8_t *blk)
153 {
154 uint32_t a = ctx->state.s32[0];
155 uint32_t b = ctx->state.s32[1];
156 uint32_t c = ctx->state.s32[2];
157 uint32_t d = ctx->state.s32[3];
158 uint32_t e = ctx->state.s32[4];
159 uint32_t f = ctx->state.s32[5];
160 uint32_t g = ctx->state.s32[6];
161 uint32_t h = ctx->state.s32[7];
162
163 uint32_t w0, w1, w2, w3, w4, w5, w6, w7;
164 uint32_t w8, w9, w10, w11, w12, w13, w14, w15;
165 uint32_t T1, T2;
166
167 #if defined(__sparc)
168 static const uint32_t sha256_consts[] = {
169 SHA256_CONST_0, SHA256_CONST_1, SHA256_CONST_2,
170 SHA256_CONST_3, SHA256_CONST_4, SHA256_CONST_5,
171 SHA256_CONST_6, SHA256_CONST_7, SHA256_CONST_8,
172 SHA256_CONST_9, SHA256_CONST_10, SHA256_CONST_11,
173 SHA256_CONST_12, SHA256_CONST_13, SHA256_CONST_14,
174 SHA256_CONST_15, SHA256_CONST_16, SHA256_CONST_17,
175 SHA256_CONST_18, SHA256_CONST_19, SHA256_CONST_20,
176 SHA256_CONST_21, SHA256_CONST_22, SHA256_CONST_23,
177 SHA256_CONST_24, SHA256_CONST_25, SHA256_CONST_26,
178 SHA256_CONST_27, SHA256_CONST_28, SHA256_CONST_29,
179 SHA256_CONST_30, SHA256_CONST_31, SHA256_CONST_32,
180 SHA256_CONST_33, SHA256_CONST_34, SHA256_CONST_35,
181 SHA256_CONST_36, SHA256_CONST_37, SHA256_CONST_38,
182 SHA256_CONST_39, SHA256_CONST_40, SHA256_CONST_41,
183 SHA256_CONST_42, SHA256_CONST_43, SHA256_CONST_44,
184 SHA256_CONST_45, SHA256_CONST_46, SHA256_CONST_47,
185 SHA256_CONST_48, SHA256_CONST_49, SHA256_CONST_50,
186 SHA256_CONST_51, SHA256_CONST_52, SHA256_CONST_53,
187 SHA256_CONST_54, SHA256_CONST_55, SHA256_CONST_56,
188 SHA256_CONST_57, SHA256_CONST_58, SHA256_CONST_59,
189 SHA256_CONST_60, SHA256_CONST_61, SHA256_CONST_62,
190 SHA256_CONST_63
191 };
192 #endif /* __sparc */
193
194 if ((uintptr_t)blk & 0x3) { /* not 4-byte aligned? */
195 bcopy(blk, ctx->buf_un.buf32, sizeof (ctx->buf_un.buf32));
196 blk = (uint8_t *)ctx->buf_un.buf32;
197 }
198
199 /* LINTED E_BAD_PTR_CAST_ALIGN */
200 w0 = LOAD_BIG_32(blk + 4 * 0);
201 SHA256ROUND(a, b, c, d, e, f, g, h, 0, w0);
202 /* LINTED E_BAD_PTR_CAST_ALIGN */
203 w1 = LOAD_BIG_32(blk + 4 * 1);
204 SHA256ROUND(h, a, b, c, d, e, f, g, 1, w1);
205 /* LINTED E_BAD_PTR_CAST_ALIGN */
206 w2 = LOAD_BIG_32(blk + 4 * 2);
207 SHA256ROUND(g, h, a, b, c, d, e, f, 2, w2);
208 /* LINTED E_BAD_PTR_CAST_ALIGN */
209 w3 = LOAD_BIG_32(blk + 4 * 3);
210 SHA256ROUND(f, g, h, a, b, c, d, e, 3, w3);
211 /* LINTED E_BAD_PTR_CAST_ALIGN */
212 w4 = LOAD_BIG_32(blk + 4 * 4);
387 SHA512_CONST_24, SHA512_CONST_25, SHA512_CONST_26,
388 SHA512_CONST_27, SHA512_CONST_28, SHA512_CONST_29,
389 SHA512_CONST_30, SHA512_CONST_31, SHA512_CONST_32,
390 SHA512_CONST_33, SHA512_CONST_34, SHA512_CONST_35,
391 SHA512_CONST_36, SHA512_CONST_37, SHA512_CONST_38,
392 SHA512_CONST_39, SHA512_CONST_40, SHA512_CONST_41,
393 SHA512_CONST_42, SHA512_CONST_43, SHA512_CONST_44,
394 SHA512_CONST_45, SHA512_CONST_46, SHA512_CONST_47,
395 SHA512_CONST_48, SHA512_CONST_49, SHA512_CONST_50,
396 SHA512_CONST_51, SHA512_CONST_52, SHA512_CONST_53,
397 SHA512_CONST_54, SHA512_CONST_55, SHA512_CONST_56,
398 SHA512_CONST_57, SHA512_CONST_58, SHA512_CONST_59,
399 SHA512_CONST_60, SHA512_CONST_61, SHA512_CONST_62,
400 SHA512_CONST_63, SHA512_CONST_64, SHA512_CONST_65,
401 SHA512_CONST_66, SHA512_CONST_67, SHA512_CONST_68,
402 SHA512_CONST_69, SHA512_CONST_70, SHA512_CONST_71,
403 SHA512_CONST_72, SHA512_CONST_73, SHA512_CONST_74,
404 SHA512_CONST_75, SHA512_CONST_76, SHA512_CONST_77,
405 SHA512_CONST_78, SHA512_CONST_79
406 };
407 #endif /* __sparc */
408
409
410 if ((uintptr_t)blk & 0x7) { /* not 8-byte aligned? */
411 bcopy(blk, ctx->buf_un.buf64, sizeof (ctx->buf_un.buf64));
412 blk = (uint8_t *)ctx->buf_un.buf64;
413 }
414
415 /* LINTED E_BAD_PTR_CAST_ALIGN */
416 w0 = LOAD_BIG_64(blk + 8 * 0);
417 SHA512ROUND(a, b, c, d, e, f, g, h, 0, w0);
418 /* LINTED E_BAD_PTR_CAST_ALIGN */
419 w1 = LOAD_BIG_64(blk + 8 * 1);
420 SHA512ROUND(h, a, b, c, d, e, f, g, 1, w1);
421 /* LINTED E_BAD_PTR_CAST_ALIGN */
422 w2 = LOAD_BIG_64(blk + 8 * 2);
423 SHA512ROUND(g, h, a, b, c, d, e, f, 2, w2);
424 /* LINTED E_BAD_PTR_CAST_ALIGN */
425 w3 = LOAD_BIG_64(blk + 8 * 3);
426 SHA512ROUND(f, g, h, a, b, c, d, e, 3, w3);
427 /* LINTED E_BAD_PTR_CAST_ALIGN */
586 SHA512ROUND(f, g, h, a, b, c, d, e, 75, w11);
587 w12 = SIGMA1(w10) + w5 + SIGMA0(w13) + w12;
588 SHA512ROUND(e, f, g, h, a, b, c, d, 76, w12);
589 w13 = SIGMA1(w11) + w6 + SIGMA0(w14) + w13;
590 SHA512ROUND(d, e, f, g, h, a, b, c, 77, w13);
591 w14 = SIGMA1(w12) + w7 + SIGMA0(w15) + w14;
592 SHA512ROUND(c, d, e, f, g, h, a, b, 78, w14);
593 w15 = SIGMA1(w13) + w8 + SIGMA0(w0) + w15;
594 SHA512ROUND(b, c, d, e, f, g, h, a, 79, w15);
595
596 ctx->state.s64[0] += a;
597 ctx->state.s64[1] += b;
598 ctx->state.s64[2] += c;
599 ctx->state.s64[3] += d;
600 ctx->state.s64[4] += e;
601 ctx->state.s64[5] += f;
602 ctx->state.s64[6] += g;
603 ctx->state.s64[7] += h;
604
605 }
606 #endif /* !__amd64 */
607
608
609 /*
610 * Encode()
611 *
612 * purpose: to convert a list of numbers from little endian to big endian
613 * input: uint8_t * : place to store the converted big endian numbers
614 * uint32_t * : place to get numbers to convert from
615 * size_t : the length of the input in bytes
616 * output: void
617 */
618
619 static void
620 Encode(uint8_t *_RESTRICT_KYWD output, uint32_t *_RESTRICT_KYWD input,
621 size_t len)
622 {
623 size_t i, j;
624
625 #if defined(__sparc)
626 if (IS_P2ALIGNED(output, sizeof (uint32_t))) {
739 SHA384Init(SHA384_CTX *ctx)
740 {
741 SHA2Init(SHA384, ctx);
742 }
743
744 void
745 SHA512Init(SHA512_CTX *ctx)
746 {
747 SHA2Init(SHA512, ctx);
748 }
749
750 #endif /* _KERNEL */
751
752 /*
753 * SHA2Update()
754 *
755 * purpose: continues an sha2 digest operation, using the message block
756 * to update the context.
757 * input: SHA2_CTX * : the context to update
758 * void * : the message block
759 * size_t : the length of the message block, in bytes
760 * output: void
761 */
762
763 void
764 SHA2Update(SHA2_CTX *ctx, const void *inptr, size_t input_len)
765 {
766 uint32_t i, buf_index, buf_len, buf_limit;
767 const uint8_t *input = inptr;
768 uint32_t algotype = ctx->algotype;
769 #if defined(__amd64)
770 uint32_t block_count;
771 #endif /* !__amd64 */
772
773
774 /* check for noop */
775 if (input_len == 0)
776 return;
777
778 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
779 buf_limit = 64;
780
781 /* compute number of bytes mod 64 */
782 buf_index = (ctx->count.c32[1] >> 3) & 0x3F;
783
784 /* update number of bits */
785 if ((ctx->count.c32[1] += (input_len << 3)) < (input_len << 3))
786 ctx->count.c32[0]++;
787
788 ctx->count.c32[0] += (input_len >> 29);
789
790 } else {
791 buf_limit = 128;
792
793 /* compute number of bytes mod 128 */
794 buf_index = (ctx->count.c64[1] >> 3) & 0x7F;
795
796 /* update number of bits */
797 if ((ctx->count.c64[1] += (input_len << 3)) < (input_len << 3))
798 ctx->count.c64[0]++;
800 ctx->count.c64[0] += (input_len >> 29);
801 }
802
803 buf_len = buf_limit - buf_index;
804
805 /* transform as many times as possible */
806 i = 0;
807 if (input_len >= buf_len) {
808
809 /*
810 * general optimization:
811 *
812 * only do initial bcopy() and SHA2Transform() if
813 * buf_index != 0. if buf_index == 0, we're just
814 * wasting our time doing the bcopy() since there
815 * wasn't any data left over from a previous call to
816 * SHA2Update().
817 */
818 if (buf_index) {
819 bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
820 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE)
821 SHA256Transform(ctx, ctx->buf_un.buf8);
822 else
823 SHA512Transform(ctx, ctx->buf_un.buf8);
824
825 i = buf_len;
826 }
827
828 #if !defined(__amd64)
829 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
830 for (; i + buf_limit - 1 < input_len; i += buf_limit) {
831 SHA256Transform(ctx, &input[i]);
832 }
833 } else {
834 for (; i + buf_limit - 1 < input_len; i += buf_limit) {
835 SHA512Transform(ctx, &input[i]);
836 }
837 }
838
839 #else
840 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
841 block_count = (input_len - i) >> 6;
842 if (block_count > 0) {
843 SHA256TransformBlocks(ctx, &input[i],
844 block_count);
845 i += block_count << 6;
846 }
847 } else {
848 block_count = (input_len - i) >> 7;
849 if (block_count > 0) {
850 SHA512TransformBlocks(ctx, &input[i],
851 block_count);
852 i += block_count << 7;
853 }
854 }
855 #endif /* !__amd64 */
856
857 /*
858 * general optimization:
859 *
860 * if i and input_len are the same, return now instead
861 * of calling bcopy(), since the bcopy() in this case
862 * will be an expensive noop.
863 */
864
865 if (input_len == i)
866 return;
867
868 buf_index = 0;
869 }
870
871 /* buffer remaining input */
872 bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
873 }
874
875
876 /*
877 * SHA2Final()
878 *
879 * purpose: ends an sha2 digest operation, finalizing the message digest and
880 * zeroing the context.
881 * input: uchar_t * : a buffer to store the digest
882 * : The function actually uses void* because many
883 * : callers pass things other than uchar_t here.
884 * SHA2_CTX * : the context to finalize, save, and zero
885 * output: void
886 */
887
888 void
889 SHA2Final(void *digest, SHA2_CTX *ctx)
890 {
891 uint8_t bitcount_be[sizeof (ctx->count.c32)];
892 uint8_t bitcount_be64[sizeof (ctx->count.c64)];
893 uint32_t index;
894 uint32_t algotype = ctx->algotype;
895
896 if (algotype <= SHA256_HMAC_GEN_MECH_INFO_TYPE) {
897 index = (ctx->count.c32[1] >> 3) & 0x3f;
898 Encode(bitcount_be, ctx->count.c32, sizeof (bitcount_be));
899 SHA2Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
900 SHA2Update(ctx, bitcount_be, sizeof (bitcount_be));
901 Encode(digest, ctx->state.s32, sizeof (ctx->state.s32));
902
903 } else {
904 index = (ctx->count.c64[1] >> 3) & 0x7f;
905 Encode64(bitcount_be64, ctx->count.c64,
906 sizeof (bitcount_be64));
907 SHA2Update(ctx, PADDING, ((index < 112) ? 112 : 240) - index);
908 SHA2Update(ctx, bitcount_be64, sizeof (bitcount_be64));
909 if (algotype <= SHA384_HMAC_GEN_MECH_INFO_TYPE) {
910 ctx->state.s64[6] = ctx->state.s64[7] = 0;
911 Encode64(digest, ctx->state.s64,
912 sizeof (uint64_t) * 6);
913 } else
914 Encode64(digest, ctx->state.s64,
915 sizeof (ctx->state.s64));
916 }
917
918 /* zeroize sensitive information */
919 bzero(ctx, sizeof (*ctx));
920 }
|