sha512-sw.c 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169
  1. /*
  2. * Software implementation of SHA-512.
  3. */
  4. #include "ssh.h"
  5. #include "sha512.h"
  6. static bool sha512_sw_available(void)
  7. {
  8. /* Software SHA-512 is always available */
  9. return true;
  10. }
  11. static inline uint64_t ror(uint64_t x, unsigned y)
  12. {
  13. return (x << (63 & -y)) | (x >> (63 & y));
  14. }
  15. static inline uint64_t Ch(uint64_t ctrl, uint64_t if1, uint64_t if0)
  16. {
  17. return if0 ^ (ctrl & (if1 ^ if0));
  18. }
  19. static inline uint64_t Maj(uint64_t x, uint64_t y, uint64_t z)
  20. {
  21. return (x & y) | (z & (x | y));
  22. }
  23. static inline uint64_t Sigma_0(uint64_t x)
  24. {
  25. return ror(x,28) ^ ror(x,34) ^ ror(x,39);
  26. }
  27. static inline uint64_t Sigma_1(uint64_t x)
  28. {
  29. return ror(x,14) ^ ror(x,18) ^ ror(x,41);
  30. }
  31. static inline uint64_t sigma_0(uint64_t x)
  32. {
  33. return ror(x,1) ^ ror(x,8) ^ (x >> 7);
  34. }
  35. static inline uint64_t sigma_1(uint64_t x)
  36. {
  37. return ror(x,19) ^ ror(x,61) ^ (x >> 6);
  38. }
  39. static inline void sha512_sw_round(
  40. unsigned round_index, const uint64_t *schedule,
  41. uint64_t *a, uint64_t *b, uint64_t *c, uint64_t *d,
  42. uint64_t *e, uint64_t *f, uint64_t *g, uint64_t *h)
  43. {
  44. uint64_t t1 = *h + Sigma_1(*e) + Ch(*e,*f,*g) +
  45. sha512_round_constants[round_index] + schedule[round_index];
  46. uint64_t t2 = Sigma_0(*a) + Maj(*a,*b,*c);
  47. *d += t1;
  48. *h = t1 + t2;
  49. }
  50. static void sha512_sw_block(uint64_t *core, const uint8_t *block)
  51. {
  52. uint64_t w[SHA512_ROUNDS];
  53. uint64_t a,b,c,d,e,f,g,h;
  54. int t;
  55. for (t = 0; t < 16; t++)
  56. w[t] = GET_64BIT_MSB_FIRST(block + 8*t);
  57. for (t = 16; t < SHA512_ROUNDS; t++)
  58. w[t] = w[t-16] + w[t-7] + sigma_0(w[t-15]) + sigma_1(w[t-2]);
  59. a = core[0]; b = core[1]; c = core[2]; d = core[3];
  60. e = core[4]; f = core[5]; g = core[6]; h = core[7];
  61. for (t = 0; t < SHA512_ROUNDS; t+=8) {
  62. sha512_sw_round(t+0, w, &a,&b,&c,&d,&e,&f,&g,&h);
  63. sha512_sw_round(t+1, w, &h,&a,&b,&c,&d,&e,&f,&g);
  64. sha512_sw_round(t+2, w, &g,&h,&a,&b,&c,&d,&e,&f);
  65. sha512_sw_round(t+3, w, &f,&g,&h,&a,&b,&c,&d,&e);
  66. sha512_sw_round(t+4, w, &e,&f,&g,&h,&a,&b,&c,&d);
  67. sha512_sw_round(t+5, w, &d,&e,&f,&g,&h,&a,&b,&c);
  68. sha512_sw_round(t+6, w, &c,&d,&e,&f,&g,&h,&a,&b);
  69. sha512_sw_round(t+7, w, &b,&c,&d,&e,&f,&g,&h,&a);
  70. }
  71. core[0] += a; core[1] += b; core[2] += c; core[3] += d;
  72. core[4] += e; core[5] += f; core[6] += g; core[7] += h;
  73. smemclr(w, sizeof(w));
  74. }
  75. typedef struct sha512_sw {
  76. uint64_t core[8];
  77. sha512_block blk;
  78. BinarySink_IMPLEMENTATION;
  79. ssh_hash hash;
  80. } sha512_sw;
  81. static void sha512_sw_write(BinarySink *bs, const void *vp, size_t len);
  82. static ssh_hash *sha512_sw_new(const ssh_hashalg *alg)
  83. {
  84. sha512_sw *s = snew(sha512_sw);
  85. s->hash.vt = alg;
  86. BinarySink_INIT(s, sha512_sw_write);
  87. BinarySink_DELEGATE_INIT(&s->hash, s);
  88. return &s->hash;
  89. }
  90. static void sha512_sw_reset(ssh_hash *hash)
  91. {
  92. sha512_sw *s = container_of(hash, sha512_sw, hash);
  93. const struct sha512_extra *extra =
  94. (const struct sha512_extra *)hash->vt->extra;
  95. memcpy(s->core, extra->initial_state, sizeof(s->core));
  96. sha512_block_setup(&s->blk);
  97. }
  98. static void sha512_sw_copyfrom(ssh_hash *hcopy, ssh_hash *horig)
  99. {
  100. sha512_sw *copy = container_of(hcopy, sha512_sw, hash);
  101. sha512_sw *orig = container_of(horig, sha512_sw, hash);
  102. memcpy(copy, orig, sizeof(*copy));
  103. BinarySink_COPIED(copy);
  104. BinarySink_DELEGATE_INIT(&copy->hash, copy);
  105. }
  106. static void sha512_sw_free(ssh_hash *hash)
  107. {
  108. sha512_sw *s = container_of(hash, sha512_sw, hash);
  109. smemclr(s, sizeof(*s));
  110. sfree(s);
  111. }
  112. static void sha512_sw_write(BinarySink *bs, const void *vp, size_t len)
  113. {
  114. sha512_sw *s = BinarySink_DOWNCAST(bs, sha512_sw);
  115. while (len > 0)
  116. if (sha512_block_write(&s->blk, &vp, &len))
  117. sha512_sw_block(s->core, s->blk.block);
  118. }
  119. static void sha512_sw_digest(ssh_hash *hash, uint8_t *digest)
  120. {
  121. sha512_sw *s = container_of(hash, sha512_sw, hash);
  122. sha512_block_pad(&s->blk, BinarySink_UPCAST(s));
  123. for (size_t i = 0; i < hash->vt->hlen / 8; i++)
  124. PUT_64BIT_MSB_FIRST(digest + 8*i, s->core[i]);
  125. }
  126. /*
  127. * This implementation doesn't need separate digest methods for
  128. * SHA-384 and SHA-512, because the above implementation reads the
  129. * hash length out of the vtable.
  130. */
  131. #define sha384_sw_digest sha512_sw_digest
  132. SHA512_VTABLES(sw, "unaccelerated");