1276541Sdes/* 2276541Sdes * FILE: sha2.c 3276541Sdes * AUTHOR: Aaron D. Gifford - http://www.aarongifford.com/ 4276541Sdes * 5276541Sdes * Copyright (c) 2000-2001, Aaron D. Gifford 6276541Sdes * All rights reserved. 7276541Sdes * 8276541Sdes * Modified by Jelte Jansen to fit in ldns, and not clash with any 9276541Sdes * system-defined SHA code. 10276541Sdes * Changes: 11276541Sdes * - Renamed (external) functions and constants to fit ldns style 12276541Sdes * - Removed _End and _Data functions 13276541Sdes * - Added ldns_shaX(data, len, digest) convenience functions 14276541Sdes * - Removed prototypes of _Transform functions and made those static 15276541Sdes * Modified by Wouter, and trimmed, to provide SHA512 for getentropy_fallback. 16276541Sdes * 17276541Sdes * Redistribution and use in source and binary forms, with or without 18276541Sdes * modification, are permitted provided that the following conditions 19276541Sdes * are met: 20276541Sdes * 1. Redistributions of source code must retain the above copyright 21276541Sdes * notice, this list of conditions and the following disclaimer. 22276541Sdes * 2. Redistributions in binary form must reproduce the above copyright 23276541Sdes * notice, this list of conditions and the following disclaimer in the 24276541Sdes * documentation and/or other materials provided with the distribution. 25276541Sdes * 3. Neither the name of the copyright holder nor the names of contributors 26276541Sdes * may be used to endorse or promote products derived from this software 27276541Sdes * without specific prior written permission. 28276541Sdes * 29276541Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND 30276541Sdes * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 31276541Sdes * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 32276541Sdes * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTOR(S) BE LIABLE 33276541Sdes * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 34276541Sdes * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 35276541Sdes * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 36276541Sdes * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 37276541Sdes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 38276541Sdes * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 39276541Sdes * SUCH DAMAGE. 40276541Sdes * 41276541Sdes * $Id: sha2.c,v 1.1 2001/11/08 00:01:51 adg Exp adg $ 42276541Sdes */ 43276541Sdes#include "config.h" 44276541Sdes 45276541Sdes#include <string.h> /* memcpy()/memset() or bcopy()/bzero() */ 46276541Sdes#include <assert.h> /* assert() */ 47276541Sdes 48276541Sdes/* do we have sha512 header defs */ 49276541Sdes#ifndef SHA512_DIGEST_LENGTH 50276541Sdes#define SHA512_BLOCK_LENGTH 128 51276541Sdes#define SHA512_DIGEST_LENGTH 64 52276541Sdes#define SHA512_DIGEST_STRING_LENGTH (SHA512_DIGEST_LENGTH * 2 + 1) 53276541Sdestypedef struct _SHA512_CTX { 54276541Sdes uint64_t state[8]; 55276541Sdes uint64_t bitcount[2]; 56276541Sdes uint8_t buffer[SHA512_BLOCK_LENGTH]; 57276541Sdes} SHA512_CTX; 58276541Sdes#endif /* do we have sha512 header defs */ 59276541Sdes 60276541Sdesvoid SHA512_Init(SHA512_CTX*); 61276541Sdesvoid SHA512_Update(SHA512_CTX*, void*, size_t); 62276541Sdesvoid SHA512_Final(uint8_t[SHA512_DIGEST_LENGTH], SHA512_CTX*); 63276541Sdesunsigned char *SHA512(void *data, unsigned int data_len, unsigned char *digest); 64276541Sdes 65276541Sdes 66276541Sdes/*** SHA-256/384/512 Machine Architecture Definitions *****************/ 67276541Sdes/* 68276541Sdes * BYTE_ORDER NOTE: 69276541Sdes * 70276541Sdes * Please make sure that your system defines BYTE_ORDER. If your 71276541Sdes * architecture is little-endian, make sure it also defines 72276541Sdes * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are 73292206Sdes * equivalent. 74276541Sdes * 75276541Sdes * If your system does not define the above, then you can do so by 76276541Sdes * hand like this: 77276541Sdes * 78276541Sdes * #define LITTLE_ENDIAN 1234 79276541Sdes * #define BIG_ENDIAN 4321 80276541Sdes * 81276541Sdes * And for little-endian machines, add: 82276541Sdes * 83276541Sdes * #define BYTE_ORDER LITTLE_ENDIAN 84276541Sdes * 85276541Sdes * Or for big-endian machines: 86276541Sdes * 87276541Sdes * #define BYTE_ORDER BIG_ENDIAN 88276541Sdes * 89276541Sdes * The FreeBSD machine this was written on defines BYTE_ORDER 90276541Sdes * appropriately by including <sys/types.h> (which in turn includes 91276541Sdes * <machine/endian.h> where the appropriate definitions are actually 92276541Sdes * made). 93276541Sdes */ 94276541Sdes#if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN) 95276541Sdes#error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN 96276541Sdes#endif 97276541Sdes 98276541Sdestypedef uint8_t sha2_byte; /* Exactly 1 byte */ 99276541Sdestypedef uint32_t sha2_word32; /* Exactly 4 bytes */ 100276541Sdes#ifdef S_SPLINT_S 101276541Sdestypedef unsigned long long sha2_word64; /* lint 8 bytes */ 102276541Sdes#else 103276541Sdestypedef uint64_t sha2_word64; /* Exactly 8 bytes */ 104276541Sdes#endif 105276541Sdes 106276541Sdes/*** SHA-256/384/512 Various Length Definitions ***********************/ 107276541Sdes#define SHA512_SHORT_BLOCK_LENGTH (SHA512_BLOCK_LENGTH - 16) 108276541Sdes 109276541Sdes 110276541Sdes/*** ENDIAN REVERSAL MACROS *******************************************/ 111276541Sdes#if BYTE_ORDER == LITTLE_ENDIAN 112276541Sdes#define REVERSE32(w,x) { \ 113276541Sdes sha2_word32 tmp = (w); \ 114276541Sdes tmp = (tmp >> 16) | (tmp << 16); \ 115276541Sdes (x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \ 116276541Sdes} 117276541Sdes#ifndef S_SPLINT_S 118276541Sdes#define REVERSE64(w,x) { \ 119276541Sdes sha2_word64 tmp = (w); \ 120276541Sdes tmp = (tmp >> 32) | (tmp << 32); \ 121276541Sdes tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \ 122276541Sdes ((tmp & 0x00ff00ff00ff00ffULL) << 8); \ 123276541Sdes (x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \ 124276541Sdes ((tmp & 0x0000ffff0000ffffULL) << 16); \ 125276541Sdes} 126276541Sdes#else /* splint */ 127276541Sdes#define REVERSE64(w,x) /* splint */ 128276541Sdes#endif /* splint */ 129276541Sdes#endif /* BYTE_ORDER == LITTLE_ENDIAN */ 130276541Sdes 131276541Sdes/* 132276541Sdes * Macro for incrementally adding the unsigned 64-bit integer n to the 133276541Sdes * unsigned 128-bit integer (represented using a two-element array of 134276541Sdes * 64-bit words): 135276541Sdes */ 136276541Sdes#define ADDINC128(w,n) { \ 137276541Sdes (w)[0] += (sha2_word64)(n); \ 138276541Sdes if ((w)[0] < (n)) { \ 139276541Sdes (w)[1]++; \ 140276541Sdes } \ 141276541Sdes} 142276541Sdes#ifdef S_SPLINT_S 143276541Sdes#undef ADDINC128 144276541Sdes#define ADDINC128(w,n) /* splint */ 145276541Sdes#endif 146276541Sdes 147276541Sdes/* 148276541Sdes * Macros for copying blocks of memory and for zeroing out ranges 149276541Sdes * of memory. Using these macros makes it easy to switch from 150276541Sdes * using memset()/memcpy() and using bzero()/bcopy(). 151276541Sdes * 152276541Sdes * Please define either SHA2_USE_MEMSET_MEMCPY or define 153276541Sdes * SHA2_USE_BZERO_BCOPY depending on which function set you 154276541Sdes * choose to use: 155276541Sdes */ 156276541Sdes#if !defined(SHA2_USE_MEMSET_MEMCPY) && !defined(SHA2_USE_BZERO_BCOPY) 157276541Sdes/* Default to memset()/memcpy() if no option is specified */ 158276541Sdes#define SHA2_USE_MEMSET_MEMCPY 1 159276541Sdes#endif 160276541Sdes#if defined(SHA2_USE_MEMSET_MEMCPY) && defined(SHA2_USE_BZERO_BCOPY) 161276541Sdes/* Abort with an error if BOTH options are defined */ 162276541Sdes#error Define either SHA2_USE_MEMSET_MEMCPY or SHA2_USE_BZERO_BCOPY, not both! 163276541Sdes#endif 164276541Sdes 165276541Sdes#ifdef SHA2_USE_MEMSET_MEMCPY 166276541Sdes#define MEMSET_BZERO(p,l) memset((p), 0, (l)) 167276541Sdes#define MEMCPY_BCOPY(d,s,l) memcpy((d), (s), (l)) 168276541Sdes#endif 169276541Sdes#ifdef SHA2_USE_BZERO_BCOPY 170276541Sdes#define MEMSET_BZERO(p,l) bzero((p), (l)) 171276541Sdes#define MEMCPY_BCOPY(d,s,l) bcopy((s), (d), (l)) 172276541Sdes#endif 173276541Sdes 174276541Sdes 175276541Sdes/*** THE SIX LOGICAL FUNCTIONS ****************************************/ 176276541Sdes/* 177276541Sdes * Bit shifting and rotation (used by the six SHA-XYZ logical functions: 178276541Sdes * 179276541Sdes * NOTE: The naming of R and S appears backwards here (R is a SHIFT and 180276541Sdes * S is a ROTATION) because the SHA-256/384/512 description document 181276541Sdes * (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this 182276541Sdes * same "backwards" definition. 183276541Sdes */ 184276541Sdes/* Shift-right (used in SHA-256, SHA-384, and SHA-512): */ 185276541Sdes#define R(b,x) ((x) >> (b)) 186276541Sdes/* 64-bit Rotate-right (used in SHA-384 and SHA-512): */ 187276541Sdes#define S64(b,x) (((x) >> (b)) | ((x) << (64 - (b)))) 188276541Sdes 189276541Sdes/* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */ 190276541Sdes#define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z))) 191276541Sdes#define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) 192276541Sdes 193276541Sdes/* Four of six logical functions used in SHA-384 and SHA-512: */ 194276541Sdes#define Sigma0_512(x) (S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x))) 195276541Sdes#define Sigma1_512(x) (S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x))) 196276541Sdes#define sigma0_512(x) (S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7, (x))) 197276541Sdes#define sigma1_512(x) (S64(19, (x)) ^ S64(61, (x)) ^ R( 6, (x))) 198276541Sdes 199276541Sdes/*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/ 200276541Sdes/* Hash constant words K for SHA-384 and SHA-512: */ 201276541Sdesstatic const sha2_word64 K512[80] = { 202276541Sdes 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 203276541Sdes 0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL, 204276541Sdes 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL, 205276541Sdes 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 206276541Sdes 0xd807aa98a3030242ULL, 0x12835b0145706fbeULL, 207276541Sdes 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL, 208276541Sdes 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 209276541Sdes 0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL, 210276541Sdes 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL, 211276541Sdes 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 212276541Sdes 0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL, 213276541Sdes 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL, 214276541Sdes 0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 215276541Sdes 0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL, 216276541Sdes 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL, 217276541Sdes 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 218276541Sdes 0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL, 219276541Sdes 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL, 220276541Sdes 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 221276541Sdes 0x81c2c92e47edaee6ULL, 0x92722c851482353bULL, 222276541Sdes 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL, 223276541Sdes 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 224276541Sdes 0xd192e819d6ef5218ULL, 0xd69906245565a910ULL, 225276541Sdes 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL, 226276541Sdes 0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 227276541Sdes 0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL, 228276541Sdes 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL, 229276541Sdes 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 230276541Sdes 0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL, 231276541Sdes 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL, 232276541Sdes 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 233276541Sdes 0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL, 234276541Sdes 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL, 235276541Sdes 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 236276541Sdes 0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL, 237276541Sdes 0x113f9804bef90daeULL, 0x1b710b35131c471bULL, 238276541Sdes 0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 239276541Sdes 0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL, 240276541Sdes 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL, 241276541Sdes 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL 242276541Sdes}; 243276541Sdes 244276541Sdes/* initial hash value H for SHA-512 */ 245276541Sdesstatic const sha2_word64 sha512_initial_hash_value[8] = { 246276541Sdes 0x6a09e667f3bcc908ULL, 247276541Sdes 0xbb67ae8584caa73bULL, 248276541Sdes 0x3c6ef372fe94f82bULL, 249276541Sdes 0xa54ff53a5f1d36f1ULL, 250276541Sdes 0x510e527fade682d1ULL, 251276541Sdes 0x9b05688c2b3e6c1fULL, 252276541Sdes 0x1f83d9abfb41bd6bULL, 253276541Sdes 0x5be0cd19137e2179ULL 254276541Sdes}; 255276541Sdes 256276541Sdestypedef union _ldns_sha2_buffer_union { 257276541Sdes uint8_t* theChars; 258276541Sdes uint64_t* theLongs; 259276541Sdes} ldns_sha2_buffer_union; 260276541Sdes 261276541Sdes/*** SHA-512: *********************************************************/ 262276541Sdesvoid SHA512_Init(SHA512_CTX* context) { 263276541Sdes if (context == (SHA512_CTX*)0) { 264276541Sdes return; 265276541Sdes } 266276541Sdes MEMCPY_BCOPY(context->state, sha512_initial_hash_value, SHA512_DIGEST_LENGTH); 267276541Sdes MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH); 268276541Sdes context->bitcount[0] = context->bitcount[1] = 0; 269276541Sdes} 270276541Sdes 271276541Sdesstatic void SHA512_Transform(SHA512_CTX* context, 272276541Sdes const sha2_word64* data) { 273276541Sdes sha2_word64 a, b, c, d, e, f, g, h, s0, s1; 274276541Sdes sha2_word64 T1, T2, *W512 = (sha2_word64*)context->buffer; 275276541Sdes int j; 276276541Sdes 277276541Sdes /* initialize registers with the prev. intermediate value */ 278276541Sdes a = context->state[0]; 279276541Sdes b = context->state[1]; 280276541Sdes c = context->state[2]; 281276541Sdes d = context->state[3]; 282276541Sdes e = context->state[4]; 283276541Sdes f = context->state[5]; 284276541Sdes g = context->state[6]; 285276541Sdes h = context->state[7]; 286276541Sdes 287276541Sdes j = 0; 288276541Sdes do { 289276541Sdes#if BYTE_ORDER == LITTLE_ENDIAN 290276541Sdes /* Convert TO host byte order */ 291276541Sdes REVERSE64(*data++, W512[j]); 292276541Sdes /* Apply the SHA-512 compression function to update a..h */ 293276541Sdes T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j]; 294276541Sdes#else /* BYTE_ORDER == LITTLE_ENDIAN */ 295276541Sdes /* Apply the SHA-512 compression function to update a..h with copy */ 296276541Sdes T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + (W512[j] = *data++); 297276541Sdes#endif /* BYTE_ORDER == LITTLE_ENDIAN */ 298276541Sdes T2 = Sigma0_512(a) + Maj(a, b, c); 299276541Sdes h = g; 300276541Sdes g = f; 301276541Sdes f = e; 302276541Sdes e = d + T1; 303276541Sdes d = c; 304276541Sdes c = b; 305276541Sdes b = a; 306276541Sdes a = T1 + T2; 307276541Sdes 308276541Sdes j++; 309276541Sdes } while (j < 16); 310276541Sdes 311276541Sdes do { 312276541Sdes /* Part of the message block expansion: */ 313276541Sdes s0 = W512[(j+1)&0x0f]; 314276541Sdes s0 = sigma0_512(s0); 315276541Sdes s1 = W512[(j+14)&0x0f]; 316276541Sdes s1 = sigma1_512(s1); 317276541Sdes 318276541Sdes /* Apply the SHA-512 compression function to update a..h */ 319276541Sdes T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + 320276541Sdes (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); 321276541Sdes T2 = Sigma0_512(a) + Maj(a, b, c); 322276541Sdes h = g; 323276541Sdes g = f; 324276541Sdes f = e; 325276541Sdes e = d + T1; 326276541Sdes d = c; 327276541Sdes c = b; 328276541Sdes b = a; 329276541Sdes a = T1 + T2; 330276541Sdes 331276541Sdes j++; 332276541Sdes } while (j < 80); 333276541Sdes 334276541Sdes /* Compute the current intermediate hash value */ 335276541Sdes context->state[0] += a; 336276541Sdes context->state[1] += b; 337276541Sdes context->state[2] += c; 338276541Sdes context->state[3] += d; 339276541Sdes context->state[4] += e; 340276541Sdes context->state[5] += f; 341276541Sdes context->state[6] += g; 342276541Sdes context->state[7] += h; 343276541Sdes 344276541Sdes /* Clean up */ 345276541Sdes a = b = c = d = e = f = g = h = T1 = T2 = 0; 346276541Sdes} 347276541Sdes 348276541Sdesvoid SHA512_Update(SHA512_CTX* context, void *datain, size_t len) { 349276541Sdes size_t freespace, usedspace; 350276541Sdes const sha2_byte* data = (const sha2_byte*)datain; 351276541Sdes 352276541Sdes if (len == 0) { 353276541Sdes /* Calling with no data is valid - we do nothing */ 354276541Sdes return; 355276541Sdes } 356276541Sdes 357276541Sdes /* Sanity check: */ 358276541Sdes assert(context != (SHA512_CTX*)0 && data != (sha2_byte*)0); 359276541Sdes 360276541Sdes usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH; 361276541Sdes if (usedspace > 0) { 362276541Sdes /* Calculate how much free space is available in the buffer */ 363276541Sdes freespace = SHA512_BLOCK_LENGTH - usedspace; 364276541Sdes 365276541Sdes if (len >= freespace) { 366276541Sdes /* Fill the buffer completely and process it */ 367276541Sdes MEMCPY_BCOPY(&context->buffer[usedspace], data, freespace); 368276541Sdes ADDINC128(context->bitcount, freespace << 3); 369276541Sdes len -= freespace; 370276541Sdes data += freespace; 371276541Sdes SHA512_Transform(context, (sha2_word64*)context->buffer); 372276541Sdes } else { 373276541Sdes /* The buffer is not yet full */ 374276541Sdes MEMCPY_BCOPY(&context->buffer[usedspace], data, len); 375276541Sdes ADDINC128(context->bitcount, len << 3); 376276541Sdes /* Clean up: */ 377276541Sdes usedspace = freespace = 0; 378276541Sdes return; 379276541Sdes } 380276541Sdes } 381276541Sdes while (len >= SHA512_BLOCK_LENGTH) { 382276541Sdes /* Process as many complete blocks as we can */ 383276541Sdes SHA512_Transform(context, (sha2_word64*)data); 384276541Sdes ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3); 385276541Sdes len -= SHA512_BLOCK_LENGTH; 386276541Sdes data += SHA512_BLOCK_LENGTH; 387276541Sdes } 388276541Sdes if (len > 0) { 389276541Sdes /* There's left-overs, so save 'em */ 390276541Sdes MEMCPY_BCOPY(context->buffer, data, len); 391276541Sdes ADDINC128(context->bitcount, len << 3); 392276541Sdes } 393276541Sdes /* Clean up: */ 394276541Sdes usedspace = freespace = 0; 395276541Sdes} 396276541Sdes 397276541Sdesstatic void SHA512_Last(SHA512_CTX* context) { 398276541Sdes size_t usedspace; 399276541Sdes ldns_sha2_buffer_union cast_var; 400276541Sdes 401276541Sdes usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH; 402276541Sdes#if BYTE_ORDER == LITTLE_ENDIAN 403276541Sdes /* Convert FROM host byte order */ 404276541Sdes REVERSE64(context->bitcount[0],context->bitcount[0]); 405276541Sdes REVERSE64(context->bitcount[1],context->bitcount[1]); 406276541Sdes#endif 407276541Sdes if (usedspace > 0) { 408276541Sdes /* Begin padding with a 1 bit: */ 409276541Sdes context->buffer[usedspace++] = 0x80; 410276541Sdes 411276541Sdes if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) { 412276541Sdes /* Set-up for the last transform: */ 413276541Sdes MEMSET_BZERO(&context->buffer[usedspace], SHA512_SHORT_BLOCK_LENGTH - usedspace); 414276541Sdes } else { 415276541Sdes if (usedspace < SHA512_BLOCK_LENGTH) { 416276541Sdes MEMSET_BZERO(&context->buffer[usedspace], SHA512_BLOCK_LENGTH - usedspace); 417276541Sdes } 418276541Sdes /* Do second-to-last transform: */ 419276541Sdes SHA512_Transform(context, (sha2_word64*)context->buffer); 420276541Sdes 421276541Sdes /* And set-up for the last transform: */ 422276541Sdes MEMSET_BZERO(context->buffer, SHA512_BLOCK_LENGTH - 2); 423276541Sdes } 424276541Sdes } else { 425276541Sdes /* Prepare for final transform: */ 426276541Sdes MEMSET_BZERO(context->buffer, SHA512_SHORT_BLOCK_LENGTH); 427276541Sdes 428276541Sdes /* Begin padding with a 1 bit: */ 429276541Sdes *context->buffer = 0x80; 430276541Sdes } 431276541Sdes /* Store the length of input data (in bits): */ 432276541Sdes cast_var.theChars = context->buffer; 433276541Sdes cast_var.theLongs[SHA512_SHORT_BLOCK_LENGTH / 8] = context->bitcount[1]; 434276541Sdes cast_var.theLongs[SHA512_SHORT_BLOCK_LENGTH / 8 + 1] = context->bitcount[0]; 435276541Sdes 436276541Sdes /* final transform: */ 437276541Sdes SHA512_Transform(context, (sha2_word64*)context->buffer); 438276541Sdes} 439276541Sdes 440276541Sdesvoid SHA512_Final(sha2_byte digest[], SHA512_CTX* context) { 441276541Sdes sha2_word64 *d = (sha2_word64*)digest; 442276541Sdes 443276541Sdes /* Sanity check: */ 444276541Sdes assert(context != (SHA512_CTX*)0); 445276541Sdes 446276541Sdes /* If no digest buffer is passed, we don't bother doing this: */ 447276541Sdes if (digest != (sha2_byte*)0) { 448276541Sdes SHA512_Last(context); 449276541Sdes 450276541Sdes /* Save the hash data for output: */ 451276541Sdes#if BYTE_ORDER == LITTLE_ENDIAN 452276541Sdes { 453276541Sdes /* Convert TO host byte order */ 454276541Sdes int j; 455276541Sdes for (j = 0; j < 8; j++) { 456276541Sdes REVERSE64(context->state[j],context->state[j]); 457276541Sdes *d++ = context->state[j]; 458276541Sdes } 459276541Sdes } 460276541Sdes#else 461276541Sdes MEMCPY_BCOPY(d, context->state, SHA512_DIGEST_LENGTH); 462276541Sdes#endif 463276541Sdes } 464276541Sdes 465276541Sdes /* Zero out state data */ 466276541Sdes MEMSET_BZERO(context, sizeof(SHA512_CTX)); 467276541Sdes} 468276541Sdes 469276541Sdesunsigned char * 470276541SdesSHA512(void *data, unsigned int data_len, unsigned char *digest) 471276541Sdes{ 472276541Sdes SHA512_CTX ctx; 473276541Sdes SHA512_Init(&ctx); 474276541Sdes SHA512_Update(&ctx, data, data_len); 475276541Sdes SHA512_Final(digest, &ctx); 476276541Sdes return digest; 477276541Sdes} 478