sha256.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*
    2  * Cryptographic API.
    3  *
    4  * SHA-256, as specified in
    5  * http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf
    6  *
    7  * SHA-256 code by Jean-Luc Cooke <jlcooke@certainkey.com>.
    8  *
    9  * Copyright (c) Jean-Luc Cooke <jlcooke@certainkey.com>
   10  * Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk>
   11  * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
   12  *
   13  * This program is free software; you can redistribute it and/or modify it
   14  * under the terms of the GNU General Public License as published by the Free
   15  * Software Foundation; either version 2 of the License, or (at your option) 
   16  * any later version.
   17  *
   18  */
   19 #include <linux/init.h>
   20 #include <linux/module.h>
   21 #include <linux/mm.h>
   22 #include <linux/crypto.h>
   23 #include <asm/scatterlist.h>
   24 #include <asm/byteorder.h>
   25 
   26 #define SHA256_DIGEST_SIZE      32
   27 #define SHA256_HMAC_BLOCK_SIZE  64
   28 
   29 struct sha256_ctx {
   30         u32 count[2];
   31         u32 state[8];
   32         u8 buf[128];
   33 };
   34 
   35 static inline u32 Ch(u32 x, u32 y, u32 z)
   36 {
   37         return ((x & y) ^ (~x & z));
   38 }
   39 
   40 static inline u32 Maj(u32 x, u32 y, u32 z)
   41 {
   42         return ((x & y) ^ (x & z) ^ (y & z));
   43 }
   44 
   45 static inline u32 RORu32(u32 x, u32 y)
   46 {
   47         return (x >> y) | (x << (32 - y));
   48 }
   49 
   50 #define e0(x)       (RORu32(x, 2) ^ RORu32(x,13) ^ RORu32(x,22))
   51 #define e1(x)       (RORu32(x, 6) ^ RORu32(x,11) ^ RORu32(x,25))
   52 #define s0(x)       (RORu32(x, 7) ^ RORu32(x,18) ^ (x >> 3))
   53 #define s1(x)       (RORu32(x,17) ^ RORu32(x,19) ^ (x >> 10))
   54 
   55 #define H0         0x6a09e667
   56 #define H1         0xbb67ae85
   57 #define H2         0x3c6ef372
   58 #define H3         0xa54ff53a
   59 #define H4         0x510e527f
   60 #define H5         0x9b05688c
   61 #define H6         0x1f83d9ab
   62 #define H7         0x5be0cd19
   63 
   64 static inline void LOAD_OP(int I, u32 *W, const u8 *input)
   65 {
   66         u32 t1 = input[(4 * I)] & 0xff;
   67 
   68         t1 <<= 8;
   69         t1 |= input[(4 * I) + 1] & 0xff;
   70         t1 <<= 8;
   71         t1 |= input[(4 * I) + 2] & 0xff;
   72         t1 <<= 8;
   73         t1 |= input[(4 * I) + 3] & 0xff;
   74         W[I] = t1;
   75 }
   76 
   77 static inline void BLEND_OP(int I, u32 *W)
   78 {
   79         W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
   80 }
   81 
   82 static void sha256_transform(u32 *state, const u8 *input)
   83 {
   84         u32 a, b, c, d, e, f, g, h, t1, t2;
   85         u32 W[64];
   86         int i;
   87 
   88         /* load the input */
   89         for (i = 0; i < 16; i++)
   90                 LOAD_OP(i, W, input);
   91 
   92         /* now blend */
   93         for (i = 16; i < 64; i++)
   94                 BLEND_OP(i, W);
   95     
   96         /* load the state into our registers */
   97         a=state[0];  b=state[1];  c=state[2];  d=state[3];
   98         e=state[4];  f=state[5];  g=state[6];  h=state[7];
   99 
  100         /* now iterate */
  101         t1 = h + e1(e) + Ch(e,f,g) + 0x428a2f98 + W[ 0];
  102         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  103         t1 = g + e1(d) + Ch(d,e,f) + 0x71374491 + W[ 1];
  104         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  105         t1 = f + e1(c) + Ch(c,d,e) + 0xb5c0fbcf + W[ 2];
  106         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  107         t1 = e + e1(b) + Ch(b,c,d) + 0xe9b5dba5 + W[ 3];
  108         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  109         t1 = d + e1(a) + Ch(a,b,c) + 0x3956c25b + W[ 4];
  110         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  111         t1 = c + e1(h) + Ch(h,a,b) + 0x59f111f1 + W[ 5];
  112         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  113         t1 = b + e1(g) + Ch(g,h,a) + 0x923f82a4 + W[ 6];
  114         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  115         t1 = a + e1(f) + Ch(f,g,h) + 0xab1c5ed5 + W[ 7];
  116         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  117 
  118         t1 = h + e1(e) + Ch(e,f,g) + 0xd807aa98 + W[ 8];
  119         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  120         t1 = g + e1(d) + Ch(d,e,f) + 0x12835b01 + W[ 9];
  121         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  122         t1 = f + e1(c) + Ch(c,d,e) + 0x243185be + W[10];
  123         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  124         t1 = e + e1(b) + Ch(b,c,d) + 0x550c7dc3 + W[11];
  125         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  126         t1 = d + e1(a) + Ch(a,b,c) + 0x72be5d74 + W[12];
  127         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  128         t1 = c + e1(h) + Ch(h,a,b) + 0x80deb1fe + W[13];
  129         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  130         t1 = b + e1(g) + Ch(g,h,a) + 0x9bdc06a7 + W[14];
  131         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  132         t1 = a + e1(f) + Ch(f,g,h) + 0xc19bf174 + W[15];
  133         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  134 
  135         t1 = h + e1(e) + Ch(e,f,g) + 0xe49b69c1 + W[16];
  136         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  137         t1 = g + e1(d) + Ch(d,e,f) + 0xefbe4786 + W[17];
  138         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  139         t1 = f + e1(c) + Ch(c,d,e) + 0x0fc19dc6 + W[18];
  140         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  141         t1 = e + e1(b) + Ch(b,c,d) + 0x240ca1cc + W[19];
  142         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  143         t1 = d + e1(a) + Ch(a,b,c) + 0x2de92c6f + W[20];
  144         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  145         t1 = c + e1(h) + Ch(h,a,b) + 0x4a7484aa + W[21];
  146         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  147         t1 = b + e1(g) + Ch(g,h,a) + 0x5cb0a9dc + W[22];
  148         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  149         t1 = a + e1(f) + Ch(f,g,h) + 0x76f988da + W[23];
  150         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  151 
  152         t1 = h + e1(e) + Ch(e,f,g) + 0x983e5152 + W[24];
  153         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  154         t1 = g + e1(d) + Ch(d,e,f) + 0xa831c66d + W[25];
  155         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  156         t1 = f + e1(c) + Ch(c,d,e) + 0xb00327c8 + W[26];
  157         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  158         t1 = e + e1(b) + Ch(b,c,d) + 0xbf597fc7 + W[27];
  159         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  160         t1 = d + e1(a) + Ch(a,b,c) + 0xc6e00bf3 + W[28];
  161         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  162         t1 = c + e1(h) + Ch(h,a,b) + 0xd5a79147 + W[29];
  163         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  164         t1 = b + e1(g) + Ch(g,h,a) + 0x06ca6351 + W[30];
  165         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  166         t1 = a + e1(f) + Ch(f,g,h) + 0x14292967 + W[31];
  167         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  168 
  169         t1 = h + e1(e) + Ch(e,f,g) + 0x27b70a85 + W[32];
  170         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  171         t1 = g + e1(d) + Ch(d,e,f) + 0x2e1b2138 + W[33];
  172         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  173         t1 = f + e1(c) + Ch(c,d,e) + 0x4d2c6dfc + W[34];
  174         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  175         t1 = e + e1(b) + Ch(b,c,d) + 0x53380d13 + W[35];
  176         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  177         t1 = d + e1(a) + Ch(a,b,c) + 0x650a7354 + W[36];
  178         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  179         t1 = c + e1(h) + Ch(h,a,b) + 0x766a0abb + W[37];
  180         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  181         t1 = b + e1(g) + Ch(g,h,a) + 0x81c2c92e + W[38];
  182         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  183         t1 = a + e1(f) + Ch(f,g,h) + 0x92722c85 + W[39];
  184         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  185 
  186         t1 = h + e1(e) + Ch(e,f,g) + 0xa2bfe8a1 + W[40];
  187         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  188         t1 = g + e1(d) + Ch(d,e,f) + 0xa81a664b + W[41];
  189         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  190         t1 = f + e1(c) + Ch(c,d,e) + 0xc24b8b70 + W[42];
  191         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  192         t1 = e + e1(b) + Ch(b,c,d) + 0xc76c51a3 + W[43];
  193         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  194         t1 = d + e1(a) + Ch(a,b,c) + 0xd192e819 + W[44];
  195         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  196         t1 = c + e1(h) + Ch(h,a,b) + 0xd6990624 + W[45];
  197         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  198         t1 = b + e1(g) + Ch(g,h,a) + 0xf40e3585 + W[46];
  199         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  200         t1 = a + e1(f) + Ch(f,g,h) + 0x106aa070 + W[47];
  201         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  202 
  203         t1 = h + e1(e) + Ch(e,f,g) + 0x19a4c116 + W[48];
  204         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  205         t1 = g + e1(d) + Ch(d,e,f) + 0x1e376c08 + W[49];
  206         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  207         t1 = f + e1(c) + Ch(c,d,e) + 0x2748774c + W[50];
  208         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  209         t1 = e + e1(b) + Ch(b,c,d) + 0x34b0bcb5 + W[51];
  210         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  211         t1 = d + e1(a) + Ch(a,b,c) + 0x391c0cb3 + W[52];
  212         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  213         t1 = c + e1(h) + Ch(h,a,b) + 0x4ed8aa4a + W[53];
  214         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  215         t1 = b + e1(g) + Ch(g,h,a) + 0x5b9cca4f + W[54];
  216         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  217         t1 = a + e1(f) + Ch(f,g,h) + 0x682e6ff3 + W[55];
  218         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  219 
  220         t1 = h + e1(e) + Ch(e,f,g) + 0x748f82ee + W[56];
  221         t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
  222         t1 = g + e1(d) + Ch(d,e,f) + 0x78a5636f + W[57];
  223         t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
  224         t1 = f + e1(c) + Ch(c,d,e) + 0x84c87814 + W[58];
  225         t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
  226         t1 = e + e1(b) + Ch(b,c,d) + 0x8cc70208 + W[59];
  227         t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
  228         t1 = d + e1(a) + Ch(a,b,c) + 0x90befffa + W[60];
  229         t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
  230         t1 = c + e1(h) + Ch(h,a,b) + 0xa4506ceb + W[61];
  231         t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
  232         t1 = b + e1(g) + Ch(g,h,a) + 0xbef9a3f7 + W[62];
  233         t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
  234         t1 = a + e1(f) + Ch(f,g,h) + 0xc67178f2 + W[63];
  235         t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
  236 
  237         state[0] += a; state[1] += b; state[2] += c; state[3] += d;
  238         state[4] += e; state[5] += f; state[6] += g; state[7] += h;
  239 
  240         /* clear any sensitive info... */
  241         a = b = c = d = e = f = g = h = t1 = t2 = 0;
  242         memset(W, 0, 64 * sizeof(u32));
  243 }
  244 
  245 static void sha256_init(void *ctx)
  246 {
  247         struct sha256_ctx *sctx = ctx;
  248         sctx->state[0] = H0;
  249         sctx->state[1] = H1;
  250         sctx->state[2] = H2;
  251         sctx->state[3] = H3;
  252         sctx->state[4] = H4;
  253         sctx->state[5] = H5;
  254         sctx->state[6] = H6;
  255         sctx->state[7] = H7;
  256         sctx->count[0] = sctx->count[1] = 0;
  257         memset(sctx->buf, 0, sizeof(sctx->buf));
  258 }
  259 
  260 static void sha256_update(void *ctx, const u8 *data, unsigned int len)
  261 {
  262         struct sha256_ctx *sctx = ctx;
  263         unsigned int i, index, part_len;
  264 
  265         /* Compute number of bytes mod 128 */
  266         index = (unsigned int)((sctx->count[0] >> 3) & 0x3f);
  267 
  268         /* Update number of bits */
  269         if ((sctx->count[0] += (len << 3)) < (len << 3)) {
  270                 sctx->count[1]++;
  271                 sctx->count[1] += (len >> 29);
  272         }
  273 
  274         part_len = 64 - index;
  275 
  276         /* Transform as many times as possible. */
  277         if (len >= part_len) {
  278                 memcpy(&sctx->buf[index], data, part_len);
  279                 sha256_transform(sctx->state, sctx->buf);
  280 
  281                 for (i = part_len; i + 63 < len; i += 64)
  282                         sha256_transform(sctx->state, &data[i]);
  283                 index = 0;
  284         } else {
  285                 i = 0;
  286         }
  287         
  288         /* Buffer remaining input */
  289         memcpy(&sctx->buf[index], &data[i], len-i);
  290 }
  291 
  292 static void sha256_final(void* ctx, u8 *out)
  293 {
  294         struct sha256_ctx *sctx = ctx;
  295         u8 bits[8];
  296         unsigned int index, pad_len, t;
  297         int i, j;
  298         const u8 padding[64] = { 0x80, };
  299 
  300         /* Save number of bits */
  301         t = sctx->count[0];
  302         bits[7] = t; t >>= 8;
  303         bits[6] = t; t >>= 8;
  304         bits[5] = t; t >>= 8;
  305         bits[4] = t;
  306         t = sctx->count[1];
  307         bits[3] = t; t >>= 8;
  308         bits[2] = t; t >>= 8;
  309         bits[1] = t; t >>= 8;
  310         bits[0] = t;
  311 
  312         /* Pad out to 56 mod 64. */
  313         index = (sctx->count[0] >> 3) & 0x3f;
  314         pad_len = (index < 56) ? (56 - index) : ((64+56) - index);
  315         sha256_update(sctx, padding, pad_len);
  316 
  317         /* Append length (before padding) */
  318         sha256_update(sctx, bits, 8);
  319 
  320         /* Store state in digest */
  321         for (i = j = 0; i < 8; i++, j += 4) {
  322                 t = sctx->state[i];
  323                 out[j+3] = t; t >>= 8;
  324                 out[j+2] = t; t >>= 8;
  325                 out[j+1] = t; t >>= 8;
  326                 out[j  ] = t;
  327         }
  328 
  329         /* Zeroize sensitive information. */
  330         memset(sctx, 0, sizeof(*sctx));
  331 }
  332 
  333 
  334 static struct crypto_alg alg = {
  335         .cra_name       =       "sha256",
  336         .cra_flags      =       CRYPTO_ALG_TYPE_DIGEST,
  337         .cra_blocksize  =       SHA256_HMAC_BLOCK_SIZE,
  338         .cra_ctxsize    =       sizeof(struct sha256_ctx),
  339         .cra_module     =       THIS_MODULE,
  340         .cra_list       =       LIST_HEAD_INIT(alg.cra_list),
  341         .cra_u          =       { .digest = {
  342         .dia_digestsize =       SHA256_DIGEST_SIZE,
  343         .dia_init       =       sha256_init,
  344         .dia_update     =       sha256_update,
  345         .dia_final      =       sha256_final } }
  346 };
  347 
  348 static int __init init(void)
  349 {
  350         return crypto_register_alg(&alg);
  351 }
  352 
  353 static void __exit fini(void)
  354 {
  355         crypto_unregister_alg(&alg);
  356 }
  357 
  358 module_init(init);
  359 module_exit(fini);
  360 
  361 MODULE_LICENSE("GPL");
  362 MODULE_DESCRIPTION("SHA256 Secure Hash Algorithm");
Cache object: 5271036cca51b4544e957c673c21ab65
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/crypto/sha256.c

FreeBSD/Linux Kernel Cross Reference
sys/crypto/sha256.c
