/*
-------------------------------------------------------------------------
Copyright (c) 2001, Dr Brian Gladman <brg@gladman.me.uk>, Worcester, UK.
All rights reserved.
TERMS
Redistribution and use in source and binary forms, with or without
modification, are permitted subject to the following conditions:
1. Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. The copyright holder's name must not be used to endorse or promote
any products derived from this software without his specific prior
written permission.
This software is provided 'as is' with no express or implied warranties
of correctness or fitness for purpose.
-------------------------------------------------------------------------
This is a byte oriented version of SHA256 that operates on arrays of bytes
stored in memory. The operation uses a type 'sha256_ctx' to hold details of
the current hash state and uses the following three calls:
void sha256_begin(sha256_ctx ctx[])
void sha256_hash(const unsigned char data[], unsigned long len, sha256_ctx ctx[])
void sha256_end(unsigned char hval[], sha256_ctx ctx[])
The first subroutine initialises a hash computation by setting up the
context in the sha256_ctx context.
The second subroutine hashes 8-bit bytes from array data[] into the hash
state withinh sha256_ctx context, the number of bytes to be hashed being
given by the the unsigned long integer len.
The third subroutine completes the hash calculation and places the
resulting digest value in the array of 8-bit bytes hval[]
This implementation of SHA256 also supports SHA384 and SHA512 but these
hash functions depend on the use of 64-bit long integers and are not very
efficient on 32-bit machines. This code is NOT recommended for these hash
functions.
My thanks to Erik Andersen <andersen@codepoet-consulting.com> for testing
this code on big-endian systems and for his assistance with corrections
*/
/* define the hash functions that you need */
//#define SHA_2
#define SHA_256
//#define SHA_384
//#define SHA_512
#include <string.h> /* for memcpy() etc. */
#include <stdlib.h> /* for _lrotr with VC++ */
/* 1. PLATFORM SPECIFIC INCLUDES */
#if defined(__GNU_LIBRARY__)
# include <endian.h>
# include <byteswap.h>
#elif defined(__CRYPTLIB__)
# if defined( INC_ALL )
# include "crypt.h"
# elif defined( INC_CHILD )
# include "../crypt.h"
# else
# include "crypt.h"
# endif
# if defined(DATA_LITTLEENDIAN)
# define PLATFORM_BYTE_ORDER SHA_LITTLE_ENDIAN
# else
# define PLATFORM_BYTE_ORDER SHA_BIG_ENDIAN
# endif
#elif defined(_MSC_VER)
# include <stdlib.h>
#elif !defined(WIN32)
# include <stdlib.h>
# if !defined (_ENDIAN_H)
# include <sys/param.h>
# else
# include _ENDIAN_H
# endif
#endif
/* 2. BYTE ORDER IN 32-BIT WORDS
To obtain the highest speed on processors with 32-bit words, this code
needs to determine the order in which bytes are packed into such words.
The following block of code is an attempt to capture the most obvious
ways in which various environemnts specify their endian definitions.
It may well fail, in which case the definitions will need to be set by
editing at the points marked **** EDIT HERE IF NECESSARY **** below.
*/
#define SHA_LITTLE_ENDIAN 1234 /* byte 0 is least significant (i386) */
//#define SHA_BIG_ENDIAN 4321 /* byte 0 is most significant (mc68k) */
#if !defined(PLATFORM_BYTE_ORDER)
#if defined(LITTLE_ENDIAN) || defined(BIG_ENDIAN)
# if defined(LITTLE_ENDIAN) && defined(BIG_ENDIAN)
# if defined(BYTE_ORDER)
# if (BYTE_ORDER == LITTLE_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_LITTLE_ENDIAN
# elif (BYTE_ORDER == BIG_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_BIG_ENDIAN
# endif
# endif
# elif defined(LITTLE_ENDIAN) && !defined(BIG_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_LITTLE_ENDIAN
# elif !defined(LITTLE_ENDIAN) && defined(BIG_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_BIG_ENDIAN
# endif
#elif defined(_LITTLE_ENDIAN) || defined(_BIG_ENDIAN)
# if defined(_LITTLE_ENDIAN) && defined(_BIG_ENDIAN)
# if defined(_BYTE_ORDER)
# if (_BYTE_ORDER == _LITTLE_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_LITTLE_ENDIAN
# elif (_BYTE_ORDER == _BIG_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_BIG_ENDIAN
# endif
# endif
# elif defined(_LITTLE_ENDIAN) && !defined(_BIG_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_LITTLE_ENDIAN
# elif !defined(_LITTLE_ENDIAN) && defined(_BIG_ENDIAN)
# define PLATFORM_BYTE_ORDER SHA_BIG_ENDIAN
# endif
#elif 0 /* **** EDIT HERE IF NECESSARY **** */
#define PLATFORM_BYTE_ORDER SHA_LITTLE_ENDIAN
#elif 0 /* **** EDIT HERE IF NECESSARY **** */
#define PLATFORM_BYTE_ORDER SHA_BIG_ENDIAN
#elif (('1234' >> 24) == '1')
# define PLATFORM_BYTE_ORDER SHA_LITTLE_ENDIAN
#elif (('4321' >> 24) == '1')
# define PLATFORM_BYTE_ORDER SHA_BIG_ENDIAN
#endif
#endif
#if !defined(PLATFORM_BYTE_ORDER)
# error Please set undetermined byte order (lines 134 or 136 of sha2.c).
#endif
/* this Microsft VC++ intrinsic rotate makes a big difference to the speed of this code */
#if defined(_MSC_VER)
#define rotr32(x,n) _lrotr(x,n)
#else
#define rotr32(x,n) (((x) >> n) | ((x) << (32 - n)))
#endif
#define rotr64(x,n) (((x) >> n) | ((x) << (64 - n)))
/* reverse byte order in 32-bit words */
#if !defined(bswap_32)
#define bswap_32(x) (rotr32((x), 24) & 0x00ff00ff | rotr32((x), 8) & 0xff00ff00)
#endif
#if !defined(bswap_64)
#define bswap_64(x) (((uint64_t)(bswap_32((uint32_t)(x)))) << 32 | bswap_32((uint32_t)((x) >> 32)))
#endif
#include "sha2.h"
/* Defining FAST_COPY will generally improve speed but it assumes that
arrays of 32-bit words can be addressed as arrays of bytes by
casting the array base address. Defining WORD_COPY avoids this problem
by assembling bytes into a word variable before copying to memory. If
neither is defined a slow but safe byte oriented version is used.
*/
#if 1
#define FAST_COPY
#elif 0
#define WORD_COPY
#endif
#if defined(FAST_COPY) && (PLATFORM_BYTE_ORDER == SHA_LITTLE_ENDIAN)
#define SWAP_BYTES
#else
#undef SWAP_BYTES
#endif
#if defined(SHA_2) || defined(SHA_256)
/* SHA256 mixing function definitions */
#define ch(x,y,z) (((x) & (y)) ^ (~(x) & (z)))
#define maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
#define s256_0(x) (rotr32((x), 2) ^ rotr32((x), 13) ^ rotr32((x), 22))
#define s256_1(x) (rotr32((x), 6) ^ rotr32((x), 11) ^ rotr32((x), 25))
#define g256_0(x) (rotr32((x), 7) ^ rotr32((x), 18) ^ ((x) >> 3))
#define g256_1(x) (rotr32((x), 17) ^ rotr32((x), 19) ^ ((x) >> 10))
/* rotated SHA256 round definition. Rather than swapping variables as in */
/* FIPS-180, different variables are 'rotated' on each round, returning */
/* to their starting positions every eight rounds */
#define h2(i) ctx->wdat[i & 15] += \
g256_1(ctx->wdat[(i + 14) & 15]) + ctx->wdat[(i + 9) & 15] + g256_0(ctx->wdat[(i + 1) & 15])
#define h2_cycle(i,j) \
v[(7 - i) & 7] += (j ? h2(i) : ctx->wdat[i & 15]) + k256[i + j] \
+ s256_1(v[(4 - i) & 7]) + ch(v[(4 - i) & 7], v[(5 - i) & 7], v[(6 - i) & 7]); \
v[(3 - i) & 7] += v[(7 - i) & 7]; \
v[(7 - i) & 7] += s256_0(v[(0 - i) & 7]) + maj(v[(0 - i) & 7], v[(1 - i) & 7], v[(2 - i) & 7])
/* SHA256 mixing data */
const ui
