1 /* SHA-256 and SHA-512 implementation based on code by Oliver Gay 2 * <olivier.gay (at) a3.epfl.ch> under a BSD-style license. See below. 3 */ 4 5 /* 6 * FIPS 180-2 SHA-224/256/384/512 implementation 7 * Last update: 02/02/2007 8 * Issue date: 04/30/2005 9 * 10 * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay (at) a3.epfl.ch> 11 * All rights reserved. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. Neither the name of the project nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 #include "avb_sha.h" 39 40 #define SHFR(x, n) (x >> n) 41 #define ROTR(x, n) ((x >> n) | (x << ((sizeof(x) << 3) - n))) 42 #define ROTL(x, n) ((x << n) | (x >> ((sizeof(x) << 3) - n))) 43 #define CH(x, y, z) ((x & y) ^ (~x & z)) 44 #define MAJ(x, y, z) ((x & y) ^ (x & z) ^ (y & z)) 45 46 #define SHA256_F1(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22)) 47 #define SHA256_F2(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25)) 48 #define SHA256_F3(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHFR(x, 3)) 49 #define SHA256_F4(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHFR(x, 10)) 50 51 #define UNPACK32(x, str) \ 52 { \ 53 *((str) + 3) = (uint8_t)((x)); \ 54 *((str) + 2) = (uint8_t)((x) >> 8); \ 55 *((str) + 1) = (uint8_t)((x) >> 16); \ 56 *((str) + 0) = (uint8_t)((x) >> 24); \ 57 } 58 59 #define PACK32(str, x) \ 60 { \ 61 *(x) = ((uint32_t) * ((str) + 3)) | ((uint32_t) * ((str) + 2) << 8) | \ 62 ((uint32_t) * ((str) + 1) << 16) | \ 63 ((uint32_t) * ((str) + 0) << 24); \ 64 } 65 66 /* Macros used for loops unrolling */ 67 68 #define SHA256_SCR(i) \ 69 { w[i] = SHA256_F4(w[i - 2]) + w[i - 7] + SHA256_F3(w[i - 15]) + w[i - 16]; } 70 71 #define SHA256_EXP(a, b, c, d, e, f, g, h, j) \ 72 { \ 73 t1 = wv[h] + SHA256_F2(wv[e]) + CH(wv[e], wv[f], wv[g]) + sha256_k[j] + \ 74 w[j]; \ 75 t2 = SHA256_F1(wv[a]) + MAJ(wv[a], wv[b], wv[c]); \ 76 wv[d] += t1; \ 77 wv[h] = t1 + t2; \ 78 } 79 80 static const uint32_t sha256_h0[8] = {0x6a09e667, 81 0xbb67ae85, 82 0x3c6ef372, 83 0xa54ff53a, 84 0x510e527f, 85 0x9b05688c, 86 0x1f83d9ab, 87 0x5be0cd19}; 88 89 static const uint32_t sha256_k[64] = { 90 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 91 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 92 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 93 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 94 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 95 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 96 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 97 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 98 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 99 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 100 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2}; 101 102 /* SHA-256 implementation */ 103 void avb_sha256_init(AvbSHA256Ctx* ctx) { 104 #ifndef UNROLL_LOOPS 105 int i; 106 for (i = 0; i < 8; i++) { 107 ctx->h[i] = sha256_h0[i]; 108 } 109 #else 110 ctx->h[0] = sha256_h0[0]; 111 ctx->h[1] = sha256_h0[1]; 112 ctx->h[2] = sha256_h0[2]; 113 ctx->h[3] = sha256_h0[3]; 114 ctx->h[4] = sha256_h0[4]; 115 ctx->h[5] = sha256_h0[5]; 116 ctx->h[6] = sha256_h0[6]; 117 ctx->h[7] = sha256_h0[7]; 118 #endif /* !UNROLL_LOOPS */ 119 120 ctx->len = 0; 121 ctx->tot_len = 0; 122 } 123 124 static void SHA256_transform(AvbSHA256Ctx* ctx, 125 const uint8_t* message, 126 unsigned int block_nb) { 127 uint32_t w[64]; 128 uint32_t wv[8]; 129 uint32_t t1, t2; 130 const unsigned char* sub_block; 131 int i; 132 133 #ifndef UNROLL_LOOPS 134 int j; 135 #endif 136 137 for (i = 0; i < (int)block_nb; i++) { 138 sub_block = message + (i << 6); 139 140 #ifndef UNROLL_LOOPS 141 for (j = 0; j < 16; j++) { 142 PACK32(&sub_block[j << 2], &w[j]); 143 } 144 145 for (j = 16; j < 64; j++) { 146 SHA256_SCR(j); 147 } 148 149 for (j = 0; j < 8; j++) { 150 wv[j] = ctx->h[j]; 151 } 152 153 for (j = 0; j < 64; j++) { 154 t1 = wv[7] + SHA256_F2(wv[4]) + CH(wv[4], wv[5], wv[6]) + sha256_k[j] + 155 w[j]; 156 t2 = SHA256_F1(wv[0]) + MAJ(wv[0], wv[1], wv[2]); 157 wv[7] = wv[6]; 158 wv[6] = wv[5]; 159 wv[5] = wv[4]; 160 wv[4] = wv[3] + t1; 161 wv[3] = wv[2]; 162 wv[2] = wv[1]; 163 wv[1] = wv[0]; 164 wv[0] = t1 + t2; 165 } 166 167 for (j = 0; j < 8; j++) { 168 ctx->h[j] += wv[j]; 169 } 170 #else 171 PACK32(&sub_block[0], &w[0]); 172 PACK32(&sub_block[4], &w[1]); 173 PACK32(&sub_block[8], &w[2]); 174 PACK32(&sub_block[12], &w[3]); 175 PACK32(&sub_block[16], &w[4]); 176 PACK32(&sub_block[20], &w[5]); 177 PACK32(&sub_block[24], &w[6]); 178 PACK32(&sub_block[28], &w[7]); 179 PACK32(&sub_block[32], &w[8]); 180 PACK32(&sub_block[36], &w[9]); 181 PACK32(&sub_block[40], &w[10]); 182 PACK32(&sub_block[44], &w[11]); 183 PACK32(&sub_block[48], &w[12]); 184 PACK32(&sub_block[52], &w[13]); 185 PACK32(&sub_block[56], &w[14]); 186 PACK32(&sub_block[60], &w[15]); 187 188 SHA256_SCR(16); 189 SHA256_SCR(17); 190 SHA256_SCR(18); 191 SHA256_SCR(19); 192 SHA256_SCR(20); 193 SHA256_SCR(21); 194 SHA256_SCR(22); 195 SHA256_SCR(23); 196 SHA256_SCR(24); 197 SHA256_SCR(25); 198 SHA256_SCR(26); 199 SHA256_SCR(27); 200 SHA256_SCR(28); 201 SHA256_SCR(29); 202 SHA256_SCR(30); 203 SHA256_SCR(31); 204 SHA256_SCR(32); 205 SHA256_SCR(33); 206 SHA256_SCR(34); 207 SHA256_SCR(35); 208 SHA256_SCR(36); 209 SHA256_SCR(37); 210 SHA256_SCR(38); 211 SHA256_SCR(39); 212 SHA256_SCR(40); 213 SHA256_SCR(41); 214 SHA256_SCR(42); 215 SHA256_SCR(43); 216 SHA256_SCR(44); 217 SHA256_SCR(45); 218 SHA256_SCR(46); 219 SHA256_SCR(47); 220 SHA256_SCR(48); 221 SHA256_SCR(49); 222 SHA256_SCR(50); 223 SHA256_SCR(51); 224 SHA256_SCR(52); 225 SHA256_SCR(53); 226 SHA256_SCR(54); 227 SHA256_SCR(55); 228 SHA256_SCR(56); 229 SHA256_SCR(57); 230 SHA256_SCR(58); 231 SHA256_SCR(59); 232 SHA256_SCR(60); 233 SHA256_SCR(61); 234 SHA256_SCR(62); 235 SHA256_SCR(63); 236 237 wv[0] = ctx->h[0]; 238 wv[1] = ctx->h[1]; 239 wv[2] = ctx->h[2]; 240 wv[3] = ctx->h[3]; 241 wv[4] = ctx->h[4]; 242 wv[5] = ctx->h[5]; 243 wv[6] = ctx->h[6]; 244 wv[7] = ctx->h[7]; 245 246 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 0); 247 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 1); 248 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 2); 249 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 3); 250 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 4); 251 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 5); 252 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 6); 253 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 7); 254 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 8); 255 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 9); 256 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 10); 257 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 11); 258 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 12); 259 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 13); 260 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 14); 261 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 15); 262 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 16); 263 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 17); 264 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 18); 265 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 19); 266 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 20); 267 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 21); 268 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 22); 269 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 23); 270 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 24); 271 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 25); 272 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 26); 273 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 27); 274 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 28); 275 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 29); 276 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 30); 277 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 31); 278 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 32); 279 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 33); 280 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 34); 281 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 35); 282 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 36); 283 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 37); 284 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 38); 285 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 39); 286 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 40); 287 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 41); 288 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 42); 289 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 43); 290 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 44); 291 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 45); 292 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 46); 293 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 47); 294 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 48); 295 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 49); 296 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 50); 297 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 51); 298 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 52); 299 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 53); 300 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 54); 301 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 55); 302 SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 56); 303 SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 57); 304 SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 58); 305 SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 59); 306 SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 60); 307 SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 61); 308 SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 62); 309 SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 63); 310 311 ctx->h[0] += wv[0]; 312 ctx->h[1] += wv[1]; 313 ctx->h[2] += wv[2]; 314 ctx->h[3] += wv[3]; 315 ctx->h[4] += wv[4]; 316 ctx->h[5] += wv[5]; 317 ctx->h[6] += wv[6]; 318 ctx->h[7] += wv[7]; 319 #endif /* !UNROLL_LOOPS */ 320 } 321 } 322 323 void avb_sha256_update(AvbSHA256Ctx* ctx, const uint8_t* data, uint32_t len) { 324 unsigned int block_nb; 325 unsigned int new_len, rem_len, tmp_len; 326 const uint8_t* shifted_data; 327 328 tmp_len = AVB_SHA256_BLOCK_SIZE - ctx->len; 329 rem_len = len < tmp_len ? len : tmp_len; 330 331 avb_memcpy(&ctx->block[ctx->len], data, rem_len); 332 333 if (ctx->len + len < AVB_SHA256_BLOCK_SIZE) { 334 ctx->len += len; 335 return; 336 } 337 338 new_len = len - rem_len; 339 block_nb = new_len / AVB_SHA256_BLOCK_SIZE; 340 341 shifted_data = data + rem_len; 342 343 SHA256_transform(ctx, ctx->block, 1); 344 SHA256_transform(ctx, shifted_data, block_nb); 345 346 rem_len = new_len % AVB_SHA256_BLOCK_SIZE; 347 348 avb_memcpy(ctx->block, &shifted_data[block_nb << 6], rem_len); 349 350 ctx->len = rem_len; 351 ctx->tot_len += (block_nb + 1) << 6; 352 } 353 354 uint8_t* avb_sha256_final(AvbSHA256Ctx* ctx) { 355 unsigned int block_nb; 356 unsigned int pm_len; 357 unsigned int len_b; 358 #ifndef UNROLL_LOOPS 359 int i; 360 #endif 361 362 block_nb = 363 (1 + ((AVB_SHA256_BLOCK_SIZE - 9) < (ctx->len % AVB_SHA256_BLOCK_SIZE))); 364 365 len_b = (ctx->tot_len + ctx->len) << 3; 366 pm_len = block_nb << 6; 367 368 avb_memset(ctx->block + ctx->len, 0, pm_len - ctx->len); 369 ctx->block[ctx->len] = 0x80; 370 UNPACK32(len_b, ctx->block + pm_len - 4); 371 372 SHA256_transform(ctx, ctx->block, block_nb); 373 374 #ifndef UNROLL_LOOPS 375 for (i = 0; i < 8; i++) { 376 UNPACK32(ctx->h[i], &ctx->buf[i << 2]); 377 } 378 #else 379 UNPACK32(ctx->h[0], &ctx->buf[0]); 380 UNPACK32(ctx->h[1], &ctx->buf[4]); 381 UNPACK32(ctx->h[2], &ctx->buf[8]); 382 UNPACK32(ctx->h[3], &ctx->buf[12]); 383 UNPACK32(ctx->h[4], &ctx->buf[16]); 384 UNPACK32(ctx->h[5], &ctx->buf[20]); 385 UNPACK32(ctx->h[6], &ctx->buf[24]); 386 UNPACK32(ctx->h[7], &ctx->buf[28]); 387 #endif /* !UNROLL_LOOPS */ 388 389 return ctx->buf; 390 } 391
