avb_sha256.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375
  1. // SPDX-License-Identifier: BSD-3-Clause
  2. /*
  3. * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay@a3.epfl.ch>
  4. * All rights reserved.
  5. *
  6. * FIPS 180-2 SHA-224/256/384/512 implementation
  7. * Last update: 02/02/2007
  8. * Issue date: 04/30/2005
  9. */
  10. #include "avb_sha.h"
  11. #define SHFR(x, n) (x >> n)
  12. #define ROTR(x, n) ((x >> n) | (x << ((sizeof(x) << 3) - n)))
  13. #define ROTL(x, n) ((x << n) | (x >> ((sizeof(x) << 3) - n)))
  14. #define CH(x, y, z) ((x & y) ^ (~x & z))
  15. #define MAJ(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
  16. #define SHA256_F1(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
  17. #define SHA256_F2(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
  18. #define SHA256_F3(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHFR(x, 3))
  19. #define SHA256_F4(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHFR(x, 10))
  20. #define UNPACK32(x, str) \
  21. { \
  22. *((str) + 3) = (uint8_t)((x)); \
  23. *((str) + 2) = (uint8_t)((x) >> 8); \
  24. *((str) + 1) = (uint8_t)((x) >> 16); \
  25. *((str) + 0) = (uint8_t)((x) >> 24); \
  26. }
  27. #define UNPACK64(x, str) \
  28. { \
  29. *((str) + 7) = (uint8_t)x; \
  30. *((str) + 6) = (uint8_t)((uint64_t)x >> 8); \
  31. *((str) + 5) = (uint8_t)((uint64_t)x >> 16); \
  32. *((str) + 4) = (uint8_t)((uint64_t)x >> 24); \
  33. *((str) + 3) = (uint8_t)((uint64_t)x >> 32); \
  34. *((str) + 2) = (uint8_t)((uint64_t)x >> 40); \
  35. *((str) + 1) = (uint8_t)((uint64_t)x >> 48); \
  36. *((str) + 0) = (uint8_t)((uint64_t)x >> 56); \
  37. }
  38. #define PACK32(str, x) \
  39. { \
  40. *(x) = ((uint32_t) * ((str) + 3)) | ((uint32_t) * ((str) + 2) << 8) | \
  41. ((uint32_t) * ((str) + 1) << 16) | \
  42. ((uint32_t) * ((str) + 0) << 24); \
  43. }
  44. /* Macros used for loops unrolling */
  45. #define SHA256_SCR(i) \
  46. { w[i] = SHA256_F4(w[i - 2]) + w[i - 7] + SHA256_F3(w[i - 15]) + w[i - 16]; }
  47. #define SHA256_EXP(a, b, c, d, e, f, g, h, j) \
  48. { \
  49. t1 = wv[h] + SHA256_F2(wv[e]) + CH(wv[e], wv[f], wv[g]) + sha256_k[j] + \
  50. w[j]; \
  51. t2 = SHA256_F1(wv[a]) + MAJ(wv[a], wv[b], wv[c]); \
  52. wv[d] += t1; \
  53. wv[h] = t1 + t2; \
  54. }
  55. static const uint32_t sha256_h0[8] = {0x6a09e667,
  56. 0xbb67ae85,
  57. 0x3c6ef372,
  58. 0xa54ff53a,
  59. 0x510e527f,
  60. 0x9b05688c,
  61. 0x1f83d9ab,
  62. 0x5be0cd19};
  63. static const uint32_t sha256_k[64] = {
  64. 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
  65. 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
  66. 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
  67. 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
  68. 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
  69. 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
  70. 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
  71. 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
  72. 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
  73. 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
  74. 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2};
  75. /* SHA-256 implementation */
  76. void avb_sha256_init(AvbSHA256Ctx* ctx) {
  77. #ifndef UNROLL_LOOPS
  78. int i;
  79. for (i = 0; i < 8; i++) {
  80. ctx->h[i] = sha256_h0[i];
  81. }
  82. #else
  83. ctx->h[0] = sha256_h0[0];
  84. ctx->h[1] = sha256_h0[1];
  85. ctx->h[2] = sha256_h0[2];
  86. ctx->h[3] = sha256_h0[3];
  87. ctx->h[4] = sha256_h0[4];
  88. ctx->h[5] = sha256_h0[5];
  89. ctx->h[6] = sha256_h0[6];
  90. ctx->h[7] = sha256_h0[7];
  91. #endif /* !UNROLL_LOOPS */
  92. ctx->len = 0;
  93. ctx->tot_len = 0;
  94. }
  95. static void SHA256_transform(AvbSHA256Ctx* ctx,
  96. const uint8_t* message,
  97. size_t block_nb) {
  98. uint32_t w[64];
  99. uint32_t wv[8];
  100. uint32_t t1, t2;
  101. const unsigned char* sub_block;
  102. size_t i;
  103. #ifndef UNROLL_LOOPS
  104. size_t j;
  105. #endif
  106. for (i = 0; i < block_nb; i++) {
  107. sub_block = message + (i << 6);
  108. #ifndef UNROLL_LOOPS
  109. for (j = 0; j < 16; j++) {
  110. PACK32(&sub_block[j << 2], &w[j]);
  111. }
  112. for (j = 16; j < 64; j++) {
  113. SHA256_SCR(j);
  114. }
  115. for (j = 0; j < 8; j++) {
  116. wv[j] = ctx->h[j];
  117. }
  118. for (j = 0; j < 64; j++) {
  119. t1 = wv[7] + SHA256_F2(wv[4]) + CH(wv[4], wv[5], wv[6]) + sha256_k[j] +
  120. w[j];
  121. t2 = SHA256_F1(wv[0]) + MAJ(wv[0], wv[1], wv[2]);
  122. wv[7] = wv[6];
  123. wv[6] = wv[5];
  124. wv[5] = wv[4];
  125. wv[4] = wv[3] + t1;
  126. wv[3] = wv[2];
  127. wv[2] = wv[1];
  128. wv[1] = wv[0];
  129. wv[0] = t1 + t2;
  130. }
  131. for (j = 0; j < 8; j++) {
  132. ctx->h[j] += wv[j];
  133. }
  134. #else
  135. PACK32(&sub_block[0], &w[0]);
  136. PACK32(&sub_block[4], &w[1]);
  137. PACK32(&sub_block[8], &w[2]);
  138. PACK32(&sub_block[12], &w[3]);
  139. PACK32(&sub_block[16], &w[4]);
  140. PACK32(&sub_block[20], &w[5]);
  141. PACK32(&sub_block[24], &w[6]);
  142. PACK32(&sub_block[28], &w[7]);
  143. PACK32(&sub_block[32], &w[8]);
  144. PACK32(&sub_block[36], &w[9]);
  145. PACK32(&sub_block[40], &w[10]);
  146. PACK32(&sub_block[44], &w[11]);
  147. PACK32(&sub_block[48], &w[12]);
  148. PACK32(&sub_block[52], &w[13]);
  149. PACK32(&sub_block[56], &w[14]);
  150. PACK32(&sub_block[60], &w[15]);
  151. SHA256_SCR(16);
  152. SHA256_SCR(17);
  153. SHA256_SCR(18);
  154. SHA256_SCR(19);
  155. SHA256_SCR(20);
  156. SHA256_SCR(21);
  157. SHA256_SCR(22);
  158. SHA256_SCR(23);
  159. SHA256_SCR(24);
  160. SHA256_SCR(25);
  161. SHA256_SCR(26);
  162. SHA256_SCR(27);
  163. SHA256_SCR(28);
  164. SHA256_SCR(29);
  165. SHA256_SCR(30);
  166. SHA256_SCR(31);
  167. SHA256_SCR(32);
  168. SHA256_SCR(33);
  169. SHA256_SCR(34);
  170. SHA256_SCR(35);
  171. SHA256_SCR(36);
  172. SHA256_SCR(37);
  173. SHA256_SCR(38);
  174. SHA256_SCR(39);
  175. SHA256_SCR(40);
  176. SHA256_SCR(41);
  177. SHA256_SCR(42);
  178. SHA256_SCR(43);
  179. SHA256_SCR(44);
  180. SHA256_SCR(45);
  181. SHA256_SCR(46);
  182. SHA256_SCR(47);
  183. SHA256_SCR(48);
  184. SHA256_SCR(49);
  185. SHA256_SCR(50);
  186. SHA256_SCR(51);
  187. SHA256_SCR(52);
  188. SHA256_SCR(53);
  189. SHA256_SCR(54);
  190. SHA256_SCR(55);
  191. SHA256_SCR(56);
  192. SHA256_SCR(57);
  193. SHA256_SCR(58);
  194. SHA256_SCR(59);
  195. SHA256_SCR(60);
  196. SHA256_SCR(61);
  197. SHA256_SCR(62);
  198. SHA256_SCR(63);
  199. wv[0] = ctx->h[0];
  200. wv[1] = ctx->h[1];
  201. wv[2] = ctx->h[2];
  202. wv[3] = ctx->h[3];
  203. wv[4] = ctx->h[4];
  204. wv[5] = ctx->h[5];
  205. wv[6] = ctx->h[6];
  206. wv[7] = ctx->h[7];
  207. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 0);
  208. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 1);
  209. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 2);
  210. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 3);
  211. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 4);
  212. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 5);
  213. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 6);
  214. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 7);
  215. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 8);
  216. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 9);
  217. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 10);
  218. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 11);
  219. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 12);
  220. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 13);
  221. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 14);
  222. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 15);
  223. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 16);
  224. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 17);
  225. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 18);
  226. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 19);
  227. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 20);
  228. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 21);
  229. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 22);
  230. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 23);
  231. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 24);
  232. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 25);
  233. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 26);
  234. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 27);
  235. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 28);
  236. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 29);
  237. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 30);
  238. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 31);
  239. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 32);
  240. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 33);
  241. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 34);
  242. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 35);
  243. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 36);
  244. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 37);
  245. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 38);
  246. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 39);
  247. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 40);
  248. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 41);
  249. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 42);
  250. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 43);
  251. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 44);
  252. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 45);
  253. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 46);
  254. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 47);
  255. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 48);
  256. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 49);
  257. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 50);
  258. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 51);
  259. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 52);
  260. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 53);
  261. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 54);
  262. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 55);
  263. SHA256_EXP(0, 1, 2, 3, 4, 5, 6, 7, 56);
  264. SHA256_EXP(7, 0, 1, 2, 3, 4, 5, 6, 57);
  265. SHA256_EXP(6, 7, 0, 1, 2, 3, 4, 5, 58);
  266. SHA256_EXP(5, 6, 7, 0, 1, 2, 3, 4, 59);
  267. SHA256_EXP(4, 5, 6, 7, 0, 1, 2, 3, 60);
  268. SHA256_EXP(3, 4, 5, 6, 7, 0, 1, 2, 61);
  269. SHA256_EXP(2, 3, 4, 5, 6, 7, 0, 1, 62);
  270. SHA256_EXP(1, 2, 3, 4, 5, 6, 7, 0, 63);
  271. ctx->h[0] += wv[0];
  272. ctx->h[1] += wv[1];
  273. ctx->h[2] += wv[2];
  274. ctx->h[3] += wv[3];
  275. ctx->h[4] += wv[4];
  276. ctx->h[5] += wv[5];
  277. ctx->h[6] += wv[6];
  278. ctx->h[7] += wv[7];
  279. #endif /* !UNROLL_LOOPS */
  280. }
  281. }
  282. void avb_sha256_update(AvbSHA256Ctx* ctx, const uint8_t* data, size_t len) {
  283. size_t block_nb;
  284. size_t new_len, rem_len, tmp_len;
  285. const uint8_t* shifted_data;
  286. tmp_len = AVB_SHA256_BLOCK_SIZE - ctx->len;
  287. rem_len = len < tmp_len ? len : tmp_len;
  288. avb_memcpy(&ctx->block[ctx->len], data, rem_len);
  289. if (ctx->len + len < AVB_SHA256_BLOCK_SIZE) {
  290. ctx->len += len;
  291. return;
  292. }
  293. new_len = len - rem_len;
  294. block_nb = new_len / AVB_SHA256_BLOCK_SIZE;
  295. shifted_data = data + rem_len;
  296. SHA256_transform(ctx, ctx->block, 1);
  297. SHA256_transform(ctx, shifted_data, block_nb);
  298. rem_len = new_len % AVB_SHA256_BLOCK_SIZE;
  299. avb_memcpy(ctx->block, &shifted_data[block_nb << 6], rem_len);
  300. ctx->len = rem_len;
  301. ctx->tot_len += (block_nb + 1) << 6;
  302. }
  303. uint8_t* avb_sha256_final(AvbSHA256Ctx* ctx) {
  304. size_t block_nb;
  305. size_t pm_len;
  306. uint64_t len_b;
  307. #ifndef UNROLL_LOOPS
  308. size_t i;
  309. #endif
  310. block_nb =
  311. (1 + ((AVB_SHA256_BLOCK_SIZE - 9) < (ctx->len % AVB_SHA256_BLOCK_SIZE)));
  312. len_b = (ctx->tot_len + ctx->len) << 3;
  313. pm_len = block_nb << 6;
  314. avb_memset(ctx->block + ctx->len, 0, pm_len - ctx->len);
  315. ctx->block[ctx->len] = 0x80;
  316. UNPACK64(len_b, ctx->block + pm_len - 8);
  317. SHA256_transform(ctx, ctx->block, block_nb);
  318. #ifndef UNROLL_LOOPS
  319. for (i = 0; i < 8; i++) {
  320. UNPACK32(ctx->h[i], &ctx->buf[i << 2]);
  321. }
  322. #else
  323. UNPACK32(ctx->h[0], &ctx->buf[0]);
  324. UNPACK32(ctx->h[1], &ctx->buf[4]);
  325. UNPACK32(ctx->h[2], &ctx->buf[8]);
  326. UNPACK32(ctx->h[3], &ctx->buf[12]);
  327. UNPACK32(ctx->h[4], &ctx->buf[16]);
  328. UNPACK32(ctx->h[5], &ctx->buf[20]);
  329. UNPACK32(ctx->h[6], &ctx->buf[24]);
  330. UNPACK32(ctx->h[7], &ctx->buf[28]);
  331. #endif /* !UNROLL_LOOPS */
  332. return ctx->buf;
  333. }