[catacomb] / symm / sha512.c

/* -*-c-*-
 *
 * Implementation of the SHA-512 hash function
 *
 * (c) 2000 Straylight/Edgeware
 */

/*----- Licensing notice --------------------------------------------------*
 *
 * This file is part of Catacomb.
 *
 * Catacomb is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * Catacomb is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Library General Public License for more details.
 *
 * You should have received a copy of the GNU Library General Public
 * License along with Catacomb; if not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

/*----- Header files ------------------------------------------------------*/

#include <mLib/bits.h>

#include "ghash.h"
#include "ghash-def.h"
#include "hash.h"
#include "sha512.h"

/*----- Main code ---------------------------------------------------------*/

/* --- @sha512_compress@, etc. --- *
 *
 * Arguments:	@sha512_ctx *ctx@ = pointer to context block
 *		@const void *sbuf@ = pointer to buffer of appropriate size
 *
 * Returns:	---
 *
 * Use:		SHA-512 compression function.
 */

void sha512_compress(sha512_ctx *ctx, const void *sbuf)
{
  kludge64 a, b, c, d, e, f, g, h;
  kludge64 m[16];
  const kludge64 *k;
  const octet *p;
  int i;

  static const kludge64 K[80] = {
    X64(428a2f98, d728ae22), X64(71374491, 23ef65cd),
    X64(b5c0fbcf, ec4d3b2f), X64(e9b5dba5, 8189dbbc),
    X64(3956c25b, f348b538), X64(59f111f1, b605d019),
    X64(923f82a4, af194f9b), X64(ab1c5ed5, da6d8118),
    X64(d807aa98, a3030242), X64(12835b01, 45706fbe),
    X64(243185be, 4ee4b28c), X64(550c7dc3, d5ffb4e2),
    X64(72be5d74, f27b896f), X64(80deb1fe, 3b1696b1),
    X64(9bdc06a7, 25c71235), X64(c19bf174, cf692694),
    X64(e49b69c1, 9ef14ad2), X64(efbe4786, 384f25e3),
    X64(0fc19dc6, 8b8cd5b5), X64(240ca1cc, 77ac9c65),
    X64(2de92c6f, 592b0275), X64(4a7484aa, 6ea6e483),
    X64(5cb0a9dc, bd41fbd4), X64(76f988da, 831153b5),
    X64(983e5152, ee66dfab), X64(a831c66d, 2db43210),
    X64(b00327c8, 98fb213f), X64(bf597fc7, beef0ee4),
    X64(c6e00bf3, 3da88fc2), X64(d5a79147, 930aa725),
    X64(06ca6351, e003826f), X64(14292967, 0a0e6e70),
    X64(27b70a85, 46d22ffc), X64(2e1b2138, 5c26c926),
    X64(4d2c6dfc, 5ac42aed), X64(53380d13, 9d95b3df),
    X64(650a7354, 8baf63de), X64(766a0abb, 3c77b2a8),
    X64(81c2c92e, 47edaee6), X64(92722c85, 1482353b),
    X64(a2bfe8a1, 4cf10364), X64(a81a664b, bc423001),
    X64(c24b8b70, d0f89791), X64(c76c51a3, 0654be30),
    X64(d192e819, d6ef5218), X64(d6990624, 5565a910),
    X64(f40e3585, 5771202a), X64(106aa070, 32bbd1b8),
    X64(19a4c116, b8d2d0c8), X64(1e376c08, 5141ab53),
    X64(2748774c, df8eeb99), X64(34b0bcb5, e19b48a8),
    X64(391c0cb3, c5c95a63), X64(4ed8aa4a, e3418acb),
    X64(5b9cca4f, 7763e373), X64(682e6ff3, d6b2b8a3),
    X64(748f82ee, 5defb2fc), X64(78a5636f, 43172f60),
    X64(84c87814, a1f0ab72), X64(8cc70208, 1a6439ec),
    X64(90befffa, 23631e28), X64(a4506ceb, de82bde9),
    X64(bef9a3f7, b2c67915), X64(c67178f2, e372532b),
    X64(ca273ece, ea26619c), X64(d186b8c7, 21c0c207),
    X64(eada7dd6, cde0eb1e), X64(f57d4f7f, ee6ed178),
    X64(06f067aa, 72176fba), X64(0a637dc5, a2c898a6),
    X64(113f9804, bef90dae), X64(1b710b35, 131c471b),
    X64(28db77f5, 23047d84), X64(32caab7b, 40c72493),
    X64(3c9ebe0a, 15c9bebc), X64(431d67c4, 9c100d4c),
    X64(4cc5d4be, cb3e42b6), X64(597f299c, fc657e2a),
    X64(5fcb6fab, 3ad6faec), X64(6c44198c, 4a475817)
  };

  a  = ctx->a; b  = ctx->b; c  = ctx->c; d  = ctx->d;
  e  = ctx->e; f  = ctx->f; g  = ctx->g; h  = ctx->h;
  for (p = sbuf, i = 0; i < 16; i++, p += 8) LOAD64_(m[i], p);

  /* --- Definitions for round functions --- */

#define CH(d, x, y, z) do {						\
  kludge64 _x; AND64((d), (x), (y)); CPL64(_x, (x));			\
  AND64(_x, _x, (z)); OR64((d), (d), _x);				\
} while (0)

#define MAJ(d, x, y, z) do {						\
  kludge64 _x; AND64((d), (x), (y)); AND64(_x, (x), (z));		\
  OR64((d), (d), _x); AND64(_x, (y), (z)); OR64((d), (d), _x);		\
} while (0)

#define SIGMA(d, x, i, j, k, last, what) do {				\
  kludge64 _x; ROR64_((d), (x), (i)); ROR64_(_x, (x), (j));		\
  XOR64((d), (d), _x); last##64_(_x, (x), (k)); XOR64((d), (d), _x);	\
} while (0)

#define S0(d, x) SIGMA(d, x, 28, 34, 39, ROR, S0);
#define S1(d, x) SIGMA(d, x, 14, 18, 41, ROR, S1);
#define s0(d, x) SIGMA(d, x,  1,  8,  7, LSR, s0);
#define s1(d, x) SIGMA(d, x, 19, 61,  6, LSR, s1);

#define T(a, b, c, d, e, f, g, h, i) do {				\
  kludge64 t1, t2, x;							\
  ADD64(t1, m[i], k[i]); ADD64(t1, t1, h);				\
  S1(x, e); ADD64(t1, t1, x); CH(x, e, f, g); ADD64(t1, t1, x);		\
  S0(t2, a); MAJ(x, a, b, c); ADD64(t2, t2, x);				\
  ADD64(d, d, t1); ADD64(h, t1, t2);					\
} while (0)

#define M(i, i2, i7, i15) do {						\
  kludge64 t;								\
  ADD64(m[i], m[i], m[i7]);						\
  s1(t, m[i2]); ADD64(m[i], m[i], t);					\
  s0(t, m[i15]); ADD64(m[i], m[i], t);					\
} while (0)

  /* --- The main compression function --- */

  for (i = 0, k = K; i < 64; i += 16, k += 16) {
    T(a, b, c, d, e, f, g, h,  0);	M( 0, 14,  9,  1);
    T(h, a, b, c, d, e, f, g,  1);	M( 1, 15, 10,  2);
    T(g, h, a, b, c, d, e, f,  2);	M( 2,  0, 11,  3);
    T(f, g, h, a, b, c, d, e,  3);	M( 3,  1, 12,  4);
    T(e, f, g, h, a, b, c, d,  4);	M( 4,  2, 13,  5);
    T(d, e, f, g, h, a, b, c,  5);	M( 5,  3, 14,  6);
    T(c, d, e, f, g, h, a, b,  6);	M( 6,  4, 15,  7);
    T(b, c, d, e, f, g, h, a,  7);	M( 7,  5,  0,  8);
    T(a, b, c, d, e, f, g, h,  8);	M( 8,  6,  1,  9);
    T(h, a, b, c, d, e, f, g,  9);	M( 9,  7,  2, 10);
    T(g, h, a, b, c, d, e, f, 10);	M(10,  8,  3, 11);
    T(f, g, h, a, b, c, d, e, 11);	M(11,  9,  4, 12);
    T(e, f, g, h, a, b, c, d, 12);	M(12, 10,  5, 13);
    T(d, e, f, g, h, a, b, c, 13);	M(13, 11,  6, 14);
    T(c, d, e, f, g, h, a, b, 14);	M(14, 12,  7, 15);
    T(b, c, d, e, f, g, h, a, 15);	M(15, 13,  8,  0);
  }

  T(a, b, c, d, e, f, g, h,  0);
  T(h, a, b, c, d, e, f, g,  1);
  T(g, h, a, b, c, d, e, f,  2);
  T(f, g, h, a, b, c, d, e,  3);
  T(e, f, g, h, a, b, c, d,  4);
  T(d, e, f, g, h, a, b, c,  5);
  T(c, d, e, f, g, h, a, b,  6);
  T(b, c, d, e, f, g, h, a,  7);
  T(a, b, c, d, e, f, g, h,  8);
  T(h, a, b, c, d, e, f, g,  9);
  T(g, h, a, b, c, d, e, f, 10);
  T(f, g, h, a, b, c, d, e, 11);
  T(e, f, g, h, a, b, c, d, 12);
  T(d, e, f, g, h, a, b, c, 13);
  T(c, d, e, f, g, h, a, b, 14);
  T(b, c, d, e, f, g, h, a, 15);

  /* --- Update the chaining variables --- */

  ADD64(ctx->a, ctx->a, a); ADD64(ctx->b, ctx->b, b);
  ADD64(ctx->c, ctx->c, c); ADD64(ctx->d, ctx->d, d);
  ADD64(ctx->e, ctx->e, e); ADD64(ctx->f, ctx->f, f);
  ADD64(ctx->g, ctx->g, g); ADD64(ctx->h, ctx->h, h);
}

/* --- @sha512_init@, etc. --- *
 *
 * Arguments:	@sha512_ctx *ctx@ = pointer to context block to initialize
 *
 * Returns:	---
 *
 * Use:		Initializes a context block ready for hashing.
 */

void sha512_init(sha512_ctx *ctx)
{
  SET64(ctx->a,	0x6a09e667, 0xf3bcc908);
  SET64(ctx->b,	0xbb67ae85, 0x84caa73b);
  SET64(ctx->c,	0x3c6ef372, 0xfe94f82b);
  SET64(ctx->d,	0xa54ff53a, 0x5f1d36f1);
  SET64(ctx->e,	0x510e527f, 0xade682d1);
  SET64(ctx->f,	0x9b05688c, 0x2b3e6c1f);
  SET64(ctx->g,	0x1f83d9ab, 0xfb41bd6b);
  SET64(ctx->h,	0x5be0cd19, 0x137e2179);
  ctx->off = 0;
  ctx->nh = ctx->nl = 0;
}

void sha384_init(sha512_ctx *ctx)
{
  SET64(ctx->a,	0xcbbb9d5d, 0xc1059ed8);
  SET64(ctx->b,	0x629a292a, 0x367cd507);
  SET64(ctx->c,	0x9159015a, 0x3070dd17);
  SET64(ctx->d,	0x152fecd8, 0xf70e5939);
  SET64(ctx->e,	0x67332667, 0xffc00b31);
  SET64(ctx->f,	0x8eb44a87, 0x68581511);
  SET64(ctx->g,	0xdb0c2e0d, 0x64f98fa7);
  SET64(ctx->h,	0x47b5481d, 0xbefa4fa4);
  ctx->off = 0;
  ctx->nh = ctx->nl = 0;
}

void sha512_256_init(sha512_ctx *ctx)
{
  SET64(ctx->a,	0x22312194, 0xfc2bf72c);
  SET64(ctx->b,	0x9f555fa3, 0xc84c64c2);
  SET64(ctx->c,	0x2393b86b, 0x6f53b151);
  SET64(ctx->d,	0x96387719, 0x5940eabd);
  SET64(ctx->e,	0x96283ee2, 0xa88effe3);
  SET64(ctx->f,	0xbe5e1e25, 0x53863992);
  SET64(ctx->g,	0x2b0199fc, 0x2c85b8aa);
  SET64(ctx->h,	0x0eb72ddc, 0x81c52ca2);
  ctx->off = 0;
  ctx->nh = ctx->nl = 0;
}

void sha512_224_init(sha512_ctx *ctx)
{
  SET64(ctx->a,	0x8c3d37c8, 0x19544da2);
  SET64(ctx->b,	0x73e19966, 0x89dcd4d6);
  SET64(ctx->c,	0x1dfab7ae, 0x32ff9c82);
  SET64(ctx->d,	0x679dd514, 0x582f9fcf);
  SET64(ctx->e,	0x0f6d2b69, 0x7bd44da8);
  SET64(ctx->f,	0x77e36f73, 0x04c48942);
  SET64(ctx->g,	0x3f9d85a8, 0x6a1d36c8);
  SET64(ctx->h,	0x1112e6ad, 0x91d692a1);
  ctx->off = 0;
  ctx->nh = ctx->nl = 0;
}

/* --- @sha512_set@, etc. --- *
 *
 * Arguments:	@sha512_ctx *ctx@ = pointer to context block
 *		@const void *buf@ = pointer to state buffer
 *		@unsigned long count@ = current count of bytes processed
 *
 * Returns:	---
 *
 * Use:		Initializes a context block from a given state.  This is
 *		useful in cases where the initial hash state is meant to be
 *		secret, e.g., for NMAC and HMAC support.
 */

void sha512_set(sha512_ctx *ctx, const void *buf, unsigned long count)
{
  const octet *p = buf;
  LOAD64_(ctx->a, p +  0);
  LOAD64_(ctx->b, p +  8);
  LOAD64_(ctx->c, p + 16);
  LOAD64_(ctx->d, p + 24);
  LOAD64_(ctx->e, p + 32);
  LOAD64_(ctx->f, p + 40);
  LOAD64_(ctx->g, p + 48);
  LOAD64_(ctx->h, p + 56);
  ctx->off = 0;
  ctx->nl = U32(count);
  ctx->nh = U32(((count & ~(unsigned long)MASK32) >> 16) >> 16);
}

/* --- @sha512_hash@, @sha384_hash@ --- *
 *
 * Arguments:	@sha512_ctx *ctx@ = pointer to context block
 *		@const void *buf@ = buffer of data to hash
 *		@size_t sz@ = size of buffer to hash
 *
 * Returns:	---
 *
 * Use:		Hashes a buffer of data.  The buffer may be of any size and
 *		alignment.
 */

void sha512_hash(sha512_ctx *ctx, const void *buf, size_t sz)
{
  HASH_BUFFER(SHA512, sha512, ctx, buf, sz);
}

/* --- @sha512_done@, etc. --- *
 *
 * Arguments:	@sha512_ctx *ctx@ = pointer to context block
 *		@void *hash@ = pointer to output buffer
 *
 * Returns:	---
 *
 * Use:		Returns the hash of the data read so far.
 */

static void final(sha512_ctx *ctx)
{
  HASH_PAD(SHA512, sha512, ctx, 0x80, 0, 16);
  memset(ctx->buf + SHA512_BUFSZ - 16, 0, 8);
  STORE32(ctx->buf + SHA512_BUFSZ -  8, (ctx->nl >> 29) | (ctx->nh << 3));
  STORE32(ctx->buf + SHA512_BUFSZ -  4, ctx->nl << 3);
  sha512_compress(ctx, ctx->buf);
}

void sha512_done(sha512_ctx *ctx, void *hash)
{
  octet *p = hash;
  final(ctx);
  STORE64_(p +	0, ctx->a);
  STORE64_(p +	8, ctx->b);
  STORE64_(p + 16, ctx->c);
  STORE64_(p + 24, ctx->d);
  STORE64_(p + 32, ctx->e);
  STORE64_(p + 40, ctx->f);
  STORE64_(p + 48, ctx->g);
  STORE64_(p + 56, ctx->h);
}

void sha384_done(sha512_ctx *ctx, void *hash)
{
  octet *p = hash;
  final(ctx);
  STORE64_(p +	0, ctx->a);
  STORE64_(p +	8, ctx->b);
  STORE64_(p + 16, ctx->c);
  STORE64_(p + 24, ctx->d);
  STORE64_(p + 32, ctx->e);
  STORE64_(p + 40, ctx->f);
}

void sha512_256_done(sha384_ctx *ctx, void *hash)
{
  octet *p = hash;
  final(ctx);
  STORE64_(p +	0, ctx->a);
  STORE64_(p +	8, ctx->b);
  STORE64_(p + 16, ctx->c);
  STORE64_(p + 24, ctx->d);
}

void sha512_224_done(sha384_ctx *ctx, void *hash)
{
  octet *p = hash;
  final(ctx);
  STORE64_(p +	0, ctx->a);
  STORE64_(p +	8, ctx->b);
  STORE64_(p + 16, ctx->c);
  STORE32 (p + 24, HI64(ctx->d));
}

/* --- @sha512_state@, etc. --- *
 *
 * Arguments:	@sha512_ctx *ctx@ = pointer to context
 *		@void *state@ = pointer to buffer for current state
 *
 * Returns:	Number of bytes written to the hash function so far.
 *
 * Use:		Returns the current state of the hash function such that
 *		it can be passed to @sha512_set@.
 */

unsigned long sha512_state(sha512_ctx *ctx, void *state)
{
  octet *p = state;
  STORE64_(p +	0, ctx->a);
  STORE64_(p +	8, ctx->b);
  STORE64_(p + 16, ctx->c);
  STORE64_(p + 24, ctx->d);
  STORE64_(p + 32, ctx->e);
  STORE64_(p + 40, ctx->f);
  STORE64_(p + 48, ctx->g);
  STORE64_(p + 56, ctx->h);
  return (ctx->nl | ((ctx->nh << 16) << 16));
}

/* --- Generic interface --- */

#define HASHES(_)							\
  _(SHA512_224, sha512_224, "sha512/224")				\
  _(SHA512_256, sha512_256, "sha512/256")				\
  _(SHA384, sha384, "sha384")						\
  _(SHA512, sha512, "sha512")

HASHES(GHASH_DEFX)

/*----- Test rig ----------------------------------------------------------*/

#ifdef TEST_RIG

#include <mLib/testrig.h>

HASHES(HASH_VERIFYX)

static const test_chunk defs[] = {
  HASHES(HASH_TESTDEFSX)
  { 0, 0, { 0 } }
};

int main(int argc, char *argv[])
{
  test_run(argc, argv, defs, SRCDIR "/t/sha512");
  return (0);
}

#endif

/*----- That's all, folks -------------------------------------------------*/
Commit	Line	Data
eee16120	1	/* --c--
eee16120	2	*
eee16120	3	* Implementation of the SHA-512 hash function
	4	*
	5	* (c) 2000 Straylight/Edgeware
	6	*/
	7
45c0fd36	8	/----- Licensing notice --------------------------------------------------
eee16120	9	*
	10	* This file is part of Catacomb.
	11	*
	12	* Catacomb is free software; you can redistribute it and/or modify
	13	* it under the terms of the GNU Library General Public License as
	14	* published by the Free Software Foundation; either version 2 of the
	15	* License, or (at your option) any later version.
45c0fd36	16	*
eee16120	17	* Catacomb is distributed in the hope that it will be useful,
	18	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	20	* GNU Library General Public License for more details.
45c0fd36	21	*
eee16120	22	* You should have received a copy of the GNU Library General Public
	23	* License along with Catacomb; if not, write to the Free
	24	* Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
	25	* MA 02111-1307, USA.
	26	*/
	27
eee16120	28	/----- Header files ------------------------------------------------------/
	29
	30	#include <mLib/bits.h>
	31
	32	#include "ghash.h"
	33	#include "ghash-def.h"
	34	#include "hash.h"
	35	#include "sha512.h"
	36
	37	/----- Main code ---------------------------------------------------------/
	38
12a5df42	39	/* --- @sha512_compress@, etc. --- *
eee16120	40	*
	41	* Arguments: @sha512_ctx *ctx@ = pointer to context block
	42	* @const void *sbuf@ = pointer to buffer of appropriate size
	43	*
	44	* Returns: ---
	45	*
	46	* Use: SHA-512 compression function.
	47	*/
	48
	49	void sha512_compress(sha512_ctx ctx, const void sbuf)
	50	{
	51	kludge64 a, b, c, d, e, f, g, h;
15dfa998 MW	52	kludge64 m[16];
	53	const kludge64 *k;
	54	const octet *p;
eee16120	55	int i;
	56
	57	static const kludge64 K[80] = {
	58	X64(428a2f98, d728ae22), X64(71374491, 23ef65cd),
	59	X64(b5c0fbcf, ec4d3b2f), X64(e9b5dba5, 8189dbbc),
	60	X64(3956c25b, f348b538), X64(59f111f1, b605d019),
	61	X64(923f82a4, af194f9b), X64(ab1c5ed5, da6d8118),
	62	X64(d807aa98, a3030242), X64(12835b01, 45706fbe),
	63	X64(243185be, 4ee4b28c), X64(550c7dc3, d5ffb4e2),
	64	X64(72be5d74, f27b896f), X64(80deb1fe, 3b1696b1),
	65	X64(9bdc06a7, 25c71235), X64(c19bf174, cf692694),
	66	X64(e49b69c1, 9ef14ad2), X64(efbe4786, 384f25e3),
	67	X64(0fc19dc6, 8b8cd5b5), X64(240ca1cc, 77ac9c65),
	68	X64(2de92c6f, 592b0275), X64(4a7484aa, 6ea6e483),
	69	X64(5cb0a9dc, bd41fbd4), X64(76f988da, 831153b5),
	70	X64(983e5152, ee66dfab), X64(a831c66d, 2db43210),
	71	X64(b00327c8, 98fb213f), X64(bf597fc7, beef0ee4),
	72	X64(c6e00bf3, 3da88fc2), X64(d5a79147, 930aa725),
	73	X64(06ca6351, e003826f), X64(14292967, 0a0e6e70),
	74	X64(27b70a85, 46d22ffc), X64(2e1b2138, 5c26c926),
	75	X64(4d2c6dfc, 5ac42aed), X64(53380d13, 9d95b3df),
	76	X64(650a7354, 8baf63de), X64(766a0abb, 3c77b2a8),
	77	X64(81c2c92e, 47edaee6), X64(92722c85, 1482353b),
	78	X64(a2bfe8a1, 4cf10364), X64(a81a664b, bc423001),
	79	X64(c24b8b70, d0f89791), X64(c76c51a3, 0654be30),
	80	X64(d192e819, d6ef5218), X64(d6990624, 5565a910),
	81	X64(f40e3585, 5771202a), X64(106aa070, 32bbd1b8),
	82	X64(19a4c116, b8d2d0c8), X64(1e376c08, 5141ab53),
	83	X64(2748774c, df8eeb99), X64(34b0bcb5, e19b48a8),
	84	X64(391c0cb3, c5c95a63), X64(4ed8aa4a, e3418acb),
	85	X64(5b9cca4f, 7763e373), X64(682e6ff3, d6b2b8a3),
	86	X64(748f82ee, 5defb2fc), X64(78a5636f, 43172f60),
	87	X64(84c87814, a1f0ab72), X64(8cc70208, 1a6439ec),
	88	X64(90befffa, 23631e28), X64(a4506ceb, de82bde9),
	89	X64(bef9a3f7, b2c67915), X64(c67178f2, e372532b),
	90	X64(ca273ece, ea26619c), X64(d186b8c7, 21c0c207),
	91	X64(eada7dd6, cde0eb1e), X64(f57d4f7f, ee6ed178),
	92	X64(06f067aa, 72176fba), X64(0a637dc5, a2c898a6),
	93	X64(113f9804, bef90dae), X64(1b710b35, 131c471b),
	94	X64(28db77f5, 23047d84), X64(32caab7b, 40c72493),
	95	X64(3c9ebe0a, 15c9bebc), X64(431d67c4, 9c100d4c),
	96	X64(4cc5d4be, cb3e42b6), X64(597f299c, fc657e2a),
	97	X64(5fcb6fab, 3ad6faec), X64(6c44198c, 4a475817)
	98	};
	99
15dfa998 MW	100	a = ctx->a; b = ctx->b; c = ctx->c; d = ctx->d;
	101	e = ctx->e; f = ctx->f; g = ctx->g; h = ctx->h;
	102	for (p = sbuf, i = 0; i < 16; i++, p += 8) LOAD64_(m[i], p);
eee16120	103
	104	/* --- Definitions for round functions --- */
	105
	106	#define CH(d, x, y, z) do { \
	107	kludge64 _x; AND64((d), (x), (y)); CPL64(_x, (x)); \
	108	AND64(_x, _x, (z)); OR64((d), (d), _x); \
	109	} while (0)
	110
	111	#define MAJ(d, x, y, z) do { \
	112	kludge64 _x; AND64((d), (x), (y)); AND64(_x, (x), (z)); \
	113	OR64((d), (d), _x); AND64(_x, (y), (z)); OR64((d), (d), _x); \
	114	} while (0)
	115
	116	#define SIGMA(d, x, i, j, k, last, what) do { \
	117	kludge64 _x; ROR64_((d), (x), (i)); ROR64_(_x, (x), (j)); \
	118	XOR64((d), (d), _x); last##64_(_x, (x), (k)); XOR64((d), (d), _x); \
	119	} while (0)
	120
	121	#define S0(d, x) SIGMA(d, x, 28, 34, 39, ROR, S0);
	122	#define S1(d, x) SIGMA(d, x, 14, 18, 41, ROR, S1);
	123	#define s0(d, x) SIGMA(d, x, 1, 8, 7, LSR, s0);
	124	#define s1(d, x) SIGMA(d, x, 19, 61, 6, LSR, s1);
	125
	126	#define T(a, b, c, d, e, f, g, h, i) do { \
	127	kludge64 t1, t2, x; \
15dfa998	128	ADD64(t1, m[i], k[i]); ADD64(t1, t1, h); \
eee16120	129	S1(x, e); ADD64(t1, t1, x); CH(x, e, f, g); ADD64(t1, t1, x); \
	130	S0(t2, a); MAJ(x, a, b, c); ADD64(t2, t2, x); \
	131	ADD64(d, d, t1); ADD64(h, t1, t2); \
	132	} while (0)
	133
15dfa998 MW	134	#define M(i, i2, i7, i15) do { \
	135	kludge64 t; \
	136	ADD64(m[i], m[i], m[i7]); \
	137	s1(t, m[i2]); ADD64(m[i], m[i], t); \
	138	s0(t, m[i15]); ADD64(m[i], m[i], t); \
	139	} while (0)
eee16120	140
	141	/* --- The main compression function --- */
	142
15dfa998 MW	143	for (i = 0, k = K; i < 64; i += 16, k += 16) {
	144	T(a, b, c, d, e, f, g, h, 0); M( 0, 14, 9, 1);
	145	T(h, a, b, c, d, e, f, g, 1); M( 1, 15, 10, 2);
	146	T(g, h, a, b, c, d, e, f, 2); M( 2, 0, 11, 3);
	147	T(f, g, h, a, b, c, d, e, 3); M( 3, 1, 12, 4);
	148	T(e, f, g, h, a, b, c, d, 4); M( 4, 2, 13, 5);
	149	T(d, e, f, g, h, a, b, c, 5); M( 5, 3, 14, 6);
	150	T(c, d, e, f, g, h, a, b, 6); M( 6, 4, 15, 7);
	151	T(b, c, d, e, f, g, h, a, 7); M( 7, 5, 0, 8);
	152	T(a, b, c, d, e, f, g, h, 8); M( 8, 6, 1, 9);
	153	T(h, a, b, c, d, e, f, g, 9); M( 9, 7, 2, 10);
	154	T(g, h, a, b, c, d, e, f, 10); M(10, 8, 3, 11);
	155	T(f, g, h, a, b, c, d, e, 11); M(11, 9, 4, 12);
	156	T(e, f, g, h, a, b, c, d, 12); M(12, 10, 5, 13);
	157	T(d, e, f, g, h, a, b, c, 13); M(13, 11, 6, 14);
	158	T(c, d, e, f, g, h, a, b, 14); M(14, 12, 7, 15);
	159	T(b, c, d, e, f, g, h, a, 15); M(15, 13, 8, 0);
eee16120	160	}
eee16120	161
15dfa998 MW	162	T(a, b, c, d, e, f, g, h, 0);
	163	T(h, a, b, c, d, e, f, g, 1);
	164	T(g, h, a, b, c, d, e, f, 2);
	165	T(f, g, h, a, b, c, d, e, 3);
	166	T(e, f, g, h, a, b, c, d, 4);
	167	T(d, e, f, g, h, a, b, c, 5);
	168	T(c, d, e, f, g, h, a, b, 6);
	169	T(b, c, d, e, f, g, h, a, 7);
	170	T(a, b, c, d, e, f, g, h, 8);
	171	T(h, a, b, c, d, e, f, g, 9);
	172	T(g, h, a, b, c, d, e, f, 10);
	173	T(f, g, h, a, b, c, d, e, 11);
	174	T(e, f, g, h, a, b, c, d, 12);
	175	T(d, e, f, g, h, a, b, c, 13);
	176	T(c, d, e, f, g, h, a, b, 14);
	177	T(b, c, d, e, f, g, h, a, 15);
	178
eee16120	179	/* --- Update the chaining variables --- */
eee16120	180
15dfa998 MW	181	ADD64(ctx->a, ctx->a, a); ADD64(ctx->b, ctx->b, b);
	182	ADD64(ctx->c, ctx->c, c); ADD64(ctx->d, ctx->d, d);
	183	ADD64(ctx->e, ctx->e, e); ADD64(ctx->f, ctx->f, f);
	184	ADD64(ctx->g, ctx->g, g); ADD64(ctx->h, ctx->h, h);
eee16120	185	}
eee16120	186
12a5df42	187	/* --- @sha512_init@, etc. --- *
eee16120	188	*
	189	* Arguments: @sha512_ctx *ctx@ = pointer to context block to initialize
	190	*
	191	* Returns: ---
	192	*
	193	* Use: Initializes a context block ready for hashing.
	194	*/
	195
	196	void sha512_init(sha512_ctx *ctx)
	197	{
	198	SET64(ctx->a, 0x6a09e667, 0xf3bcc908);
	199	SET64(ctx->b, 0xbb67ae85, 0x84caa73b);
	200	SET64(ctx->c, 0x3c6ef372, 0xfe94f82b);
	201	SET64(ctx->d, 0xa54ff53a, 0x5f1d36f1);
	202	SET64(ctx->e, 0x510e527f, 0xade682d1);
	203	SET64(ctx->f, 0x9b05688c, 0x2b3e6c1f);
	204	SET64(ctx->g, 0x1f83d9ab, 0xfb41bd6b);
	205	SET64(ctx->h, 0x5be0cd19, 0x137e2179);
	206	ctx->off = 0;
	207	ctx->nh = ctx->nl = 0;
	208	}
	209
	210	void sha384_init(sha512_ctx *ctx)
	211	{
	212	SET64(ctx->a, 0xcbbb9d5d, 0xc1059ed8);
	213	SET64(ctx->b, 0x629a292a, 0x367cd507);
	214	SET64(ctx->c, 0x9159015a, 0x3070dd17);
	215	SET64(ctx->d, 0x152fecd8, 0xf70e5939);
	216	SET64(ctx->e, 0x67332667, 0xffc00b31);
	217	SET64(ctx->f, 0x8eb44a87, 0x68581511);
	218	SET64(ctx->g, 0xdb0c2e0d, 0x64f98fa7);
	219	SET64(ctx->h, 0x47b5481d, 0xbefa4fa4);
	220	ctx->off = 0;
	221	ctx->nh = ctx->nl = 0;
	222	}
	223
12a5df42 MW	224	void sha512_256_init(sha512_ctx *ctx)
	225	{
	226	SET64(ctx->a, 0x22312194, 0xfc2bf72c);
	227	SET64(ctx->b, 0x9f555fa3, 0xc84c64c2);
	228	SET64(ctx->c, 0x2393b86b, 0x6f53b151);
	229	SET64(ctx->d, 0x96387719, 0x5940eabd);
	230	SET64(ctx->e, 0x96283ee2, 0xa88effe3);
	231	SET64(ctx->f, 0xbe5e1e25, 0x53863992);
	232	SET64(ctx->g, 0x2b0199fc, 0x2c85b8aa);
	233	SET64(ctx->h, 0x0eb72ddc, 0x81c52ca2);
	234	ctx->off = 0;
	235	ctx->nh = ctx->nl = 0;
	236	}
	237
	238	void sha512_224_init(sha512_ctx *ctx)
	239	{
	240	SET64(ctx->a, 0x8c3d37c8, 0x19544da2);
	241	SET64(ctx->b, 0x73e19966, 0x89dcd4d6);
	242	SET64(ctx->c, 0x1dfab7ae, 0x32ff9c82);
	243	SET64(ctx->d, 0x679dd514, 0x582f9fcf);
	244	SET64(ctx->e, 0x0f6d2b69, 0x7bd44da8);
	245	SET64(ctx->f, 0x77e36f73, 0x04c48942);
	246	SET64(ctx->g, 0x3f9d85a8, 0x6a1d36c8);
	247	SET64(ctx->h, 0x1112e6ad, 0x91d692a1);
	248	ctx->off = 0;
	249	ctx->nh = ctx->nl = 0;
	250	}
	251
	252	/* --- @sha512_set@, etc. --- *
eee16120	253	*
	254	* Arguments: @sha512_ctx *ctx@ = pointer to context block
	255	* @const void *buf@ = pointer to state buffer
	256	* @unsigned long count@ = current count of bytes processed
	257	*
	258	* Returns: ---
	259	*
	260	* Use: Initializes a context block from a given state. This is
	261	* useful in cases where the initial hash state is meant to be
	262	* secret, e.g., for NMAC and HMAC support.
	263	*/
	264
	265	void sha512_set(sha512_ctx ctx, const void buf, unsigned long count)
	266	{
	267	const octet *p = buf;
	268	LOAD64_(ctx->a, p + 0);
	269	LOAD64_(ctx->b, p + 8);
	270	LOAD64_(ctx->c, p + 16);
	271	LOAD64_(ctx->d, p + 24);
	272	LOAD64_(ctx->e, p + 32);
	273	LOAD64_(ctx->f, p + 40);
	274	LOAD64_(ctx->g, p + 48);
	275	LOAD64_(ctx->h, p + 56);
	276	ctx->off = 0;
	277	ctx->nl = U32(count);
e91d142c	278	ctx->nh = U32(((count & ~(unsigned long)MASK32) >> 16) >> 16);
eee16120	279	}
	280
	281	/* --- @sha512_hash@, @sha384_hash@ --- *
	282	*
	283	* Arguments: @sha512_ctx *ctx@ = pointer to context block
	284	* @const void *buf@ = buffer of data to hash
	285	* @size_t sz@ = size of buffer to hash
	286	*
	287	* Returns: ---
	288	*
	289	* Use: Hashes a buffer of data. The buffer may be of any size and
	290	* alignment.
	291	*/
	292
	293	void sha512_hash(sha512_ctx ctx, const void buf, size_t sz)
	294	{
	295	HASH_BUFFER(SHA512, sha512, ctx, buf, sz);
	296	}
	297
12a5df42	298	/* --- @sha512_done@, etc. --- *
eee16120	299	*
	300	* Arguments: @sha512_ctx *ctx@ = pointer to context block
	301	* @void *hash@ = pointer to output buffer
	302	*
	303	* Returns: ---
	304	*
	305	* Use: Returns the hash of the data read so far.
	306	*/
	307
	308	static void final(sha512_ctx *ctx)
	309	{
	310	HASH_PAD(SHA512, sha512, ctx, 0x80, 0, 16);
	311	memset(ctx->buf + SHA512_BUFSZ - 16, 0, 8);
	312	STORE32(ctx->buf + SHA512_BUFSZ - 8, (ctx->nl >> 29) \| (ctx->nh << 3));
	313	STORE32(ctx->buf + SHA512_BUFSZ - 4, ctx->nl << 3);
	314	sha512_compress(ctx, ctx->buf);
	315	}
	316
	317	void sha512_done(sha512_ctx ctx, void hash)
	318	{
	319	octet *p = hash;
	320	final(ctx);
45c0fd36 MW	321	STORE64_(p + 0, ctx->a);
45c0fd36 MW	322	STORE64_(p + 8, ctx->b);
eee16120	323	STORE64_(p + 16, ctx->c);
	324	STORE64_(p + 24, ctx->d);
	325	STORE64_(p + 32, ctx->e);
	326	STORE64_(p + 40, ctx->f);
	327	STORE64_(p + 48, ctx->g);
	328	STORE64_(p + 56, ctx->h);
	329	}
	330
12a5df42	331	void sha384_done(sha512_ctx ctx, void hash)
eee16120	332	{
	333	octet *p = hash;
	334	final(ctx);
45c0fd36 MW	335	STORE64_(p + 0, ctx->a);
45c0fd36 MW	336	STORE64_(p + 8, ctx->b);
eee16120	337	STORE64_(p + 16, ctx->c);
	338	STORE64_(p + 24, ctx->d);
	339	STORE64_(p + 32, ctx->e);
	340	STORE64_(p + 40, ctx->f);
	341	}
	342
12a5df42 MW	343	void sha512_256_done(sha384_ctx ctx, void hash)
	344	{
	345	octet *p = hash;
	346	final(ctx);
	347	STORE64_(p + 0, ctx->a);
	348	STORE64_(p + 8, ctx->b);
	349	STORE64_(p + 16, ctx->c);
	350	STORE64_(p + 24, ctx->d);
	351	}
	352
	353	void sha512_224_done(sha384_ctx ctx, void hash)
	354	{
	355	octet *p = hash;
	356	final(ctx);
	357	STORE64_(p + 0, ctx->a);
	358	STORE64_(p + 8, ctx->b);
	359	STORE64_(p + 16, ctx->c);
	360	STORE32 (p + 24, HI64(ctx->d));
	361	}
	362
	363	/* --- @sha512_state@, etc. --- *
eee16120	364	*
	365	* Arguments: @sha512_ctx *ctx@ = pointer to context
	366	* @void *state@ = pointer to buffer for current state
	367	*
	368	* Returns: Number of bytes written to the hash function so far.
	369	*
	370	* Use: Returns the current state of the hash function such that
	371	* it can be passed to @sha512_set@.
	372	*/
	373
	374	unsigned long sha512_state(sha512_ctx ctx, void state)
	375	{
	376	octet *p = state;
45c0fd36 MW	377	STORE64_(p + 0, ctx->a);
45c0fd36 MW	378	STORE64_(p + 8, ctx->b);
eee16120	379	STORE64_(p + 16, ctx->c);
	380	STORE64_(p + 24, ctx->d);
	381	STORE64_(p + 32, ctx->e);
	382	STORE64_(p + 40, ctx->f);
	383	STORE64_(p + 48, ctx->g);
	384	STORE64_(p + 56, ctx->h);
	385	return (ctx->nl \| ((ctx->nh << 16) << 16));
	386	}
	387
	388	/* --- Generic interface --- */
	389
84924d42	390	#define HASHES(_) \
12a5df42 MW	391	_(SHA512_224, sha512_224, "sha512/224") \
12a5df42 MW	392	_(SHA512_256, sha512_256, "sha512/256") \
84924d42 MW	393	_(SHA384, sha384, "sha384") \
84924d42 MW	394	_(SHA512, sha512, "sha512")
eee16120	395
84924d42	396	HASHES(GHASH_DEFX)
eee16120	397
84924d42 MW	398	/----- Test rig ----------------------------------------------------------/
	399
	400	#ifdef TEST_RIG
	401
	402	#include <mLib/testrig.h>
	403
	404	HASHES(HASH_VERIFYX)
	405
	406	static const test_chunk defs[] = {
	407	HASHES(HASH_TESTDEFSX)
	408	{ 0, 0, { 0 } }
	409	};
	410
	411	int main(int argc, char *argv[])
	412	{
	413	test_run(argc, argv, defs, SRCDIR "/t/sha512");
	414	return (0);
	415	}
	416
	417	#endif
eee16120	418
eee16120	419	/----- That's all, folks -------------------------------------------------/