avb_sha256.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363
  1. // SPDX-License-Identifier: BSD-3-Clause
  2. /*
  3. * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay@a3.epfl.ch>
  4. * All rights reserved.
  5. *
  6. * FIPS 180-2 SHA-224/256/384/512 implementation
  7. * Last update: 02/02/2007
  8. * Issue date: 04/30/2005
  9. */
  10. #include "avb_sha.h"
  11. #define SHFR(x, n) (x >> n)
  12. #define ROTR(x, n) ((x >> n) | (x << ((sizeof(x) << 3) - n)))
  13. #define ROTL(x, n) ((x << n) | (x >> ((sizeof(x) << 3) - n)))
  14. #define CH(x, y, z) ((x & y) ^ (~x & z))
  15. #define MAJ(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
  16. #define SHA256_F1(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
  17. #define SHA256_F2(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
  18. #define SHA256_F3(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHFR(x, 3))
  19. #define SHA256_F4(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHFR(x, 10))
  20. #define UNPACK32(x, str) \
  21. { \
  22. *((str) + 3) = (uint8_t)((x)); \
  23. *((str) + 2) = (uint8_t)((x) >> 8); \
  24. *((str) + 1) = (uint8_t)((x) >> 16); \
  25. *((str) + 0) = (uint8_t)((x) >> 24); \
  26. }
  27. #define PACK32(str, x) \
  28. { \
  29. *(x) = ((uint32_t) * ((str) + 3)) | ((uint32_t) * ((str) + 2) << 8) | \
  30. ((uint32_t) * ((str) + 1) << 16) | \
  31. ((uint32_t) * ((str) + 0) << 24); \
  32. }
  33. /* Macros used for loops unrolling */
  34. #define SHA256_SCR(i) \
  35. { w[i] = SHA256_F4(w[i - 2]) + w[i - 7] + SHA256_F3(w[i - 15]) + w[i - 16]; }
  36. #define SHA256_EXP(a, b, c, d, e, f, g, h, j) \
  37. { \
  38. t1 = wv[h] + SHA256_F2(wv[e]) + CH(wv[e], wv[f], wv[g]) + sha256_k[j] + \
  39. w[j]; \
  40. t2 = SHA256_F1(wv[a]) + MAJ(wv[a], wv[b], wv[c]); \
  41. wv[d] += t1; \
  42. wv[h] = t1 + t2; \
  43. }
  44. static const uint32_t sha256_h0[8] = {0x6a09e667,
  45. 0xbb67ae85,
  46. 0x3c6ef372,
  47. 0xa54ff53a,
  48. 0x510e527f,
  49. 0x9b05688c,
  50. 0x1f83d9ab,
  51. 0x5be0cd19};
  52. static const uint32_t sha256_k[64] = {
  53. 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
  54. 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
  55. 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
  56. 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
  57. 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
  58. 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
  59. 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
  60. 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
  61. 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
  62. 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
  63. 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2};
  64. /* SHA-256 implementation */
  65. void avb_sha256_init(AvbSHA256Ctx* ctx) {
  66. #ifndef UNROLL_LOOPS
  67. int i;
  68. for (i = 0; i < 8; i++) {
  69. ctx->h[i] = sha256_h0[i];
  70. }
  71. #else
  72. ctx->h[0] = sha256_h0[0];
  73. ctx->h[1] = sha256_h0[1];
  74. ctx->h[2] = sha256_h0[2];
  75. ctx->h[3] = sha256_h0[3];
  76. ctx->h[4] = sha256_h0[4];
  77. ctx->h[5] = sha256_h0[5];
  78. ctx->h[6] = sha256_h0[6];
  79. ctx->h[7] = sha256_h0[7];
  80. #endif /* !UNROLL_LOOPS */
  81. ctx->len = 0;
  82. ctx->tot_len = 0;
  83. }
  84. static void SHA256_transform(AvbSHA256Ctx* ctx,
  85. const uint8_t* message,
  86. unsigned int block_nb) {
  87. uint32_t w[64];
  88. uint32_t wv[8];
  89. uint32_t t1, t2;
  90. const unsigned char* sub_block;
  91. int i;
  92. #ifndef UNROLL_LOOPS
  93. int j;
  94. #endif
  95. for (i = 0; i < (int)block_nb; i++) {
  96. sub_block = message + (i << 6);
  97. #ifndef UNROLL_LOOPS
  98. for (j = 0; j < 16; j++) {
  99. PACK32(&sub_block[j << 2], &w[j]);
  100. }
  101. for (j = 16; j < 64; j++) {
  102. SHA256_SCR(j);
  103. }
  104. for (j = 0; j < 8; j++) {
  105. wv[j] = ctx->h[j];
  106. }
  107. for (j = 0; j < 64; j++) {
  108. t1 = wv[7] + SHA256_F2(wv[4]) + CH(wv[4], wv[5], wv[6]) + sha256_k[j] +
  109. w[j];
  110. t2 = SHA256_F1(wv[0]) + MAJ(wv[0], wv[1], wv[2]);
  111. wv[7] = wv[6];
  112. wv[6] = wv[5];
  113. wv[5] = wv[4];
  114. wv[4] = wv[3] + t1;
  115. wv[3] = wv[2];
  116. wv[2] = wv[1];
  117. wv[1] = wv[0];
  118. wv[0] = t1 + t2;
  119. }
  120. for (j = 0; j < 8; j++) {
  121. ctx->h[j] += wv[j];
  122. }
  123. #else
  124. PACK32(&sub_block[0], &w[0]);
  125. PACK32(&sub_block[4], &w[1]);
  126. PACK32(&sub_block[8], &w[2]);
  127. PACK32(&sub_block[12], &w[3]);
  128. PACK32(&sub_block[16], &w[4]);
  129. PACK32(&sub_block[20], &w[5]);
  130. PACK32(&sub_block[24], &w[6]);
  131. PACK32(&sub_block[28], &w[7]);
  132. PACK32(&sub_block[32], &w[8]);
  133. PACK32(&sub_block[36], &w[9]);
  134. PACK32(&sub_block[40], &w[10]);
  135. PACK32(&sub_block[44], &w[11]);
  136. PACK32(&sub_block[48], &w[12]);
  137. PACK32(&sub_block[52], &w[13]);
  138. PACK32(&sub_block[56], &w[14]);
  139. PACK32(&sub_block[60], &w[15]);
  140. SHA256_SCR(16);
  141. SHA256_SCR(17);
  142. SHA256_SCR(18);
  143. SHA256_SCR(19);
  144. SHA256_SCR(20);
  145. SHA256_SCR(21);
  146. SHA256_SCR(22);
  147. SHA256_SCR(23);
  148. SHA256_SCR(24);
  149. SHA256_SCR(25);
  150. SHA256_SCR(26);
  151. SHA256_SCR(27);
  152. SHA256_SCR(28);
  153. SHA256_SCR(29);
  154. SHA256_SCR(30);
  155. SHA256_SCR(31);
  156. SHA256_SCR(32);
  157. SHA256_SCR(33);
  158. SHA256_SCR(34);
  159. SHA256_SCR(35);
  160. SHA256_SCR(36);
  161. SHA256_SCR(37);
  162. SHA256_SCR(38);
  163. SHA256_SCR(39);
  164. SHA256_SCR(40);
  165. SHA256_SCR(41);
  166. SHA256_SCR(42);
  167. SHA256_SCR(43);
  168. SHA256_SCR(44);
  169. SHA256_SCR(45);
  170. SHA256_SCR(46);
  171. SHA256_SCR(47);
  172. SHA256_SCR(48);
  173. SHA256_SCR(49);
  174. SHA256_SCR(50);
  175. SHA256_SCR(51);
  176. SHA256_SCR(52);
  177. SHA256_SCR(53);
  178. SHA256_SCR(54);
  179. SHA256_SCR(55);
  180. SHA256_SCR(56);
  181. SHA256_SCR(57);
  182. SHA256_SCR(58);
  183. SHA256_SCR(59);
  184. SHA256_SCR(60);
  185. SHA256_SCR(61);
  186. SHA256_SCR(62);
  187. SHA256_SCR(63);
  188. wv[0] = ctx->h[0];
  189. wv[1] = ctx->h[1];
  190. wv[2] = ctx->h[2];
  191. wv[3] = ctx->h[3];
  192. wv[4] = ctx->h[4];
  193. wv[5] = ctx->h[5];
  194. wv[6] = ctx->h[6];
  195. wv[7] = ctx->h[7];
  196. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 0);
  197. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 1);
  198. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 2);
  199. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 3);
  200. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 4);
  201. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 5);
  202. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 6);
  203. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 7);
  204. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 8);
  205. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 9);
  206. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 10);
  207. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 11);
  208. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 12);
  209. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 13);
  210. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 14);
  211. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 15);
  212. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 16);
  213. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 17);
  214. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 18);
  215. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 19);
  216. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 20);
  217. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 21);
  218. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 22);
  219. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 23);
  220. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 24);
  221. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 25);
  222. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 26);
  223. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 27);
  224. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 28);
  225. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 29);
  226. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 30);
  227. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 31);
  228. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 32);
  229. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 33);
  230. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 34);
  231. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 35);
  232. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 36);
  233. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 37);
  234. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 38);
  235. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 39);
  236. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 40);
  237. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 41);
  238. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 42);
  239. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 43);
  240. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 44);
  241. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 45);
  242. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 46);
  243. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 47);
  244. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 48);
  245. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 49);
  246. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 50);
  247. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 51);
  248. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 52);
  249. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 53);
  250. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 54);
  251. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 55);
  252. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 56);
  253. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 57);
  254. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 58);
  255. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 59);
  256. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 60);
  257. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 61);
  258. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 62);
  259. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 63);
  260. ctx->h[0] += wv[0];
  261. ctx->h[1] += wv[1];
  262. ctx->h[2] += wv[2];
  263. ctx->h[3] += wv[3];
  264. ctx->h[4] += wv[4];
  265. ctx->h[5] += wv[5];
  266. ctx->h[6] += wv[6];
  267. ctx->h[7] += wv[7];
  268. #endif /* !UNROLL_LOOPS */
  269. }
  270. }
  271. void avb_sha256_update(AvbSHA256Ctx* ctx, const uint8_t* data, uint32_t len) {
  272. unsigned int block_nb;
  273. unsigned int new_len, rem_len, tmp_len;
  274. const uint8_t* shifted_data;
  275. tmp_len = AVB_SHA256_BLOCK_SIZE - ctx->len;
  276. rem_len = len < tmp_len ? len : tmp_len;
  277. avb_memcpy(&ctx->block[ctx->len], data, rem_len);
  278. if (ctx->len + len < AVB_SHA256_BLOCK_SIZE) {
  279. ctx->len += len;
  280. return;
  281. }
  282. new_len = len - rem_len;
  283. block_nb = new_len / AVB_SHA256_BLOCK_SIZE;
  284. shifted_data = data + rem_len;
  285. SHA256_transform(ctx, ctx->block, 1);
  286. SHA256_transform(ctx, shifted_data, block_nb);
  287. rem_len = new_len % AVB_SHA256_BLOCK_SIZE;
  288. avb_memcpy(ctx->block, &shifted_data[block_nb << 6], rem_len);
  289. ctx->len = rem_len;
  290. ctx->tot_len += (block_nb + 1) << 6;
  291. }
  292. uint8_t* avb_sha256_final(AvbSHA256Ctx* ctx) {
  293. unsigned int block_nb;
  294. unsigned int pm_len;
  295. unsigned int len_b;
  296. #ifndef UNROLL_LOOPS
  297. int i;
  298. #endif
  299. block_nb =
  300. (1 + ((AVB_SHA256_BLOCK_SIZE - 9) < (ctx->len % AVB_SHA256_BLOCK_SIZE)));
  301. len_b = (ctx->tot_len + ctx->len) << 3;
  302. pm_len = block_nb << 6;
  303. avb_memset(ctx->block + ctx->len, 0, pm_len - ctx->len);
  304. ctx->block[ctx->len] = 0x80;
  305. UNPACK32(len_b, ctx->block + pm_len - 4);
  306. SHA256_transform(ctx, ctx->block, block_nb);
  307. #ifndef UNROLL_LOOPS
  308. for (i = 0; i < 8; i++) {
  309. UNPACK32(ctx->h[i], &ctx->buf[i << 2]);
  310. }
  311. #else
  312. UNPACK32(ctx->h[0], &ctx->buf[0]);
  313. UNPACK32(ctx->h[1], &ctx->buf[4]);
  314. UNPACK32(ctx->h[2], &ctx->buf[8]);
  315. UNPACK32(ctx->h[3], &ctx->buf[12]);
  316. UNPACK32(ctx->h[4], &ctx->buf[16]);
  317. UNPACK32(ctx->h[5], &ctx->buf[20]);
  318. UNPACK32(ctx->h[6], &ctx->buf[24]);
  319. UNPACK32(ctx->h[7], &ctx->buf[28]);
  320. #endif /* !UNROLL_LOOPS */
  321. return ctx->buf;
  322. }