mirror of
https://github.com/oopuuu/zTC1.git
synced 2025-12-15 06:28:14 +08:00
698 lines
26 KiB
C
698 lines
26 KiB
C
/**
|
|
******************************************************************************
|
|
* @file SHAUtils.c
|
|
* @author William Xu
|
|
* @version V1.0.0
|
|
* @date 05-May-2014
|
|
* @brief SHA Utilities, Port of libtom's SHA-1, SHA-256, and SHA-512 code.
|
|
* Port of floodyberry's SHA-3 code.
|
|
******************************************************************************
|
|
*
|
|
* The MIT License
|
|
* Copyright (c) 2014 MXCHIP Inc.
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is furnished
|
|
* to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in
|
|
* all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
|
|
* IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
******************************************************************************
|
|
*/
|
|
|
|
#include "SHAUtils.h"
|
|
|
|
#include "common.h"
|
|
#include "Debug.h"
|
|
|
|
#include "StringUtils.h"
|
|
|
|
//===========================================================================================================================
|
|
// SHA-1 internals
|
|
//===========================================================================================================================
|
|
|
|
#define SHA1_BLOCK_SIZE 64
|
|
|
|
static void _SHA1_Compress( SHA_CTX_compat *ctx, const uint8_t *inPtr );
|
|
|
|
//===========================================================================================================================
|
|
// SHA1_Init_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA1_Init_compat( SHA_CTX_compat *ctx )
|
|
{
|
|
ctx->length = 0;
|
|
ctx->state[ 0 ] = UINT32_C( 0x67452301 );
|
|
ctx->state[ 1 ] = UINT32_C( 0xefcdab89 );
|
|
ctx->state[ 2 ] = UINT32_C( 0x98badcfe );
|
|
ctx->state[ 3 ] = UINT32_C( 0x10325476 );
|
|
ctx->state[ 4 ] = UINT32_C( 0xc3d2e1f0 );
|
|
ctx->curlen = 0;
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA1_Update_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA1_Update_compat( SHA_CTX_compat *ctx, const void *inData, size_t inLen )
|
|
{
|
|
const uint8_t * src = (const uint8_t *) inData;
|
|
size_t n;
|
|
|
|
while( inLen > 0 )
|
|
{
|
|
if( ( ctx->curlen == 0 ) && ( inLen >= SHA1_BLOCK_SIZE ) )
|
|
{
|
|
_SHA1_Compress( ctx, src );
|
|
ctx->length += ( SHA1_BLOCK_SIZE * 8 );
|
|
src += SHA1_BLOCK_SIZE;
|
|
inLen -= SHA1_BLOCK_SIZE;
|
|
}
|
|
else
|
|
{
|
|
n = Min( inLen, SHA1_BLOCK_SIZE - ctx->curlen );
|
|
memcpy( ctx->buf + ctx->curlen, src, n );
|
|
ctx->curlen += n;
|
|
src += n;
|
|
inLen -= n;
|
|
if( ctx->curlen == SHA1_BLOCK_SIZE )
|
|
{
|
|
_SHA1_Compress( ctx, ctx->buf );
|
|
ctx->length += ( SHA1_BLOCK_SIZE * 8 );
|
|
ctx->curlen = 0;
|
|
}
|
|
}
|
|
}
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA1_Final_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA1_Final_compat( unsigned char *outDigest, SHA_CTX_compat *ctx )
|
|
{
|
|
int i;
|
|
|
|
ctx->length += ctx->curlen * 8;
|
|
ctx->buf[ ctx->curlen++ ] = 0x80;
|
|
|
|
// If length > 56 bytes, append zeros then compress. Then fall back to padding zeros and length encoding like normal.
|
|
if( ctx->curlen > 56 )
|
|
{
|
|
while( ctx->curlen < 64 ) ctx->buf[ ctx->curlen++ ] = 0;
|
|
_SHA1_Compress( ctx, ctx->buf );
|
|
ctx->curlen = 0;
|
|
}
|
|
|
|
// Pad up to 56 bytes of zeros.
|
|
while( ctx->curlen < 56 ) ctx->buf[ ctx->curlen++ ] = 0;
|
|
|
|
// Store length.
|
|
WriteBig64( ctx->buf + 56, ctx->length );
|
|
_SHA1_Compress( ctx, ctx->buf );
|
|
|
|
// Copy output.
|
|
for( i = 0; i < 5; ++i )
|
|
{
|
|
WriteBig32( outDigest + ( 4 * i ), ctx->state[ i ] );
|
|
}
|
|
memset( ctx, 0, sizeof( *ctx ) ); // Zero sensitive info.
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA1_compat
|
|
//===========================================================================================================================
|
|
|
|
unsigned char * SHA1_compat( const void *inData, size_t inLen, unsigned char *outDigest )
|
|
{
|
|
SHA_CTX_compat ctx;
|
|
|
|
SHA1_Init_compat( &ctx );
|
|
SHA1_Update_compat( &ctx, inData, inLen );
|
|
SHA1_Final_compat( outDigest, &ctx );
|
|
return( outDigest );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// _SHA1_Compress
|
|
//===========================================================================================================================
|
|
|
|
#define SHA1_F0( x, y, z ) (z ^ ( x & ( y ^ z ) ) )
|
|
#define SHA1_F1( x, y, z ) (x ^ y ^ z )
|
|
#define SHA1_F2( x, y, z ) ( ( x & y ) | ( z & ( x | y ) ) )
|
|
#define SHA1_F3( x, y, z ) (x ^ y ^ z )
|
|
#define SHA1_FF0( a, b, c, d, e, i ) e = ( ROTL32( a, 5 ) + SHA1_F0( b, c, d ) + e + W[ i ] + UINT32_C( 0x5a827999 ) ); b = ROTL32( b, 30);
|
|
#define SHA1_FF1( a, b, c, d, e, i ) e = ( ROTL32( a, 5 ) + SHA1_F1( b, c, d ) + e + W[ i ] + UINT32_C( 0x6ed9eba1 ) ); b = ROTL32( b, 30);
|
|
#define SHA1_FF2( a, b, c, d, e, i ) e = ( ROTL32( a, 5 ) + SHA1_F2( b, c, d ) + e + W[ i ] + UINT32_C( 0x8f1bbcdc ) ); b = ROTL32( b, 30);
|
|
#define SHA1_FF3( a, b, c, d, e, i ) e = ( ROTL32( a, 5 ) + SHA1_F3( b, c, d ) + e + W[ i ] + UINT32_C( 0xca62c1d6 ) ); b = ROTL32( b, 30);
|
|
|
|
static void _SHA1_Compress( SHA_CTX_compat *ctx, const uint8_t *inPtr )
|
|
{
|
|
uint32_t a, b, c, d, e, W[ 80 ], i, tmp;
|
|
|
|
// Copy the state into 512-bits into W[0..15].
|
|
for( i = 0; i < 16; ++i )
|
|
{
|
|
W[ i ] = ReadBig32( inPtr );
|
|
inPtr += 4;
|
|
}
|
|
|
|
// Copy state
|
|
a = ctx->state[ 0 ];
|
|
b = ctx->state[ 1 ];
|
|
c = ctx->state[ 2 ];
|
|
d = ctx->state[ 3 ];
|
|
e = ctx->state[ 4 ];
|
|
|
|
// Expand it
|
|
for( i = 16; i < 80; ++i )
|
|
{
|
|
tmp = W[ i-3 ] ^ W[ i-8 ] ^ W[ i-14 ] ^ W[ i-16 ];
|
|
W[ i ] = ROTL32( tmp, 1 );
|
|
}
|
|
|
|
// Compress
|
|
// Round 1
|
|
for( i = 0; i < 20; )
|
|
{
|
|
SHA1_FF0( a, b, c, d, e, i++ );
|
|
SHA1_FF0( e, a, b, c, d, i++ );
|
|
SHA1_FF0( d, e, a, b, c, i++ );
|
|
SHA1_FF0( c, d, e, a, b, i++ );
|
|
SHA1_FF0( b, c, d, e, a, i++ );
|
|
}
|
|
|
|
// Round 2
|
|
for( ; i < 40; )
|
|
{
|
|
SHA1_FF1( a, b, c, d, e, i++ );
|
|
SHA1_FF1( e, a, b, c, d, i++ );
|
|
SHA1_FF1( d, e, a, b, c, i++ );
|
|
SHA1_FF1( c, d, e, a, b, i++ );
|
|
SHA1_FF1( b, c, d, e, a, i++ );
|
|
}
|
|
|
|
// Round 3
|
|
for( ; i < 60; )
|
|
{
|
|
SHA1_FF2( a, b, c, d, e, i++ );
|
|
SHA1_FF2( e, a, b, c, d, i++ );
|
|
SHA1_FF2( d, e, a, b, c, i++ );
|
|
SHA1_FF2( c, d, e, a, b, i++ );
|
|
SHA1_FF2( b, c, d, e, a, i++ );
|
|
}
|
|
|
|
// Round 4
|
|
for( ; i < 80; )
|
|
{
|
|
SHA1_FF3( a, b, c, d, e, i++ );
|
|
SHA1_FF3( e, a, b, c, d, i++ );
|
|
SHA1_FF3( d, e, a, b, c, i++ );
|
|
SHA1_FF3( c, d, e, a, b, i++ );
|
|
SHA1_FF3( b, c, d, e, a, i++ );
|
|
}
|
|
|
|
// Store
|
|
ctx->state[ 0 ] = ctx->state[ 0 ] + a;
|
|
ctx->state[ 1 ] = ctx->state[ 1 ] + b;
|
|
ctx->state[ 2 ] = ctx->state[ 2 ] + c;
|
|
ctx->state[ 3 ] = ctx->state[ 3 ] + d;
|
|
ctx->state[ 4 ] = ctx->state[ 4 ] + e;
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA-512 internals
|
|
//===========================================================================================================================
|
|
|
|
#define SHA512_BLOCK_SIZE 128
|
|
|
|
static const uint64_t K[ 80 ] =
|
|
{
|
|
UINT64_C( 0x428a2f98d728ae22 ), UINT64_C( 0x7137449123ef65cd ), UINT64_C( 0xb5c0fbcfec4d3b2f ), UINT64_C( 0xe9b5dba58189dbbc ),
|
|
UINT64_C( 0x3956c25bf348b538 ), UINT64_C( 0x59f111f1b605d019 ), UINT64_C( 0x923f82a4af194f9b ), UINT64_C( 0xab1c5ed5da6d8118 ),
|
|
UINT64_C( 0xd807aa98a3030242 ), UINT64_C( 0x12835b0145706fbe ), UINT64_C( 0x243185be4ee4b28c ), UINT64_C( 0x550c7dc3d5ffb4e2 ),
|
|
UINT64_C( 0x72be5d74f27b896f ), UINT64_C( 0x80deb1fe3b1696b1 ), UINT64_C( 0x9bdc06a725c71235 ), UINT64_C( 0xc19bf174cf692694 ),
|
|
UINT64_C( 0xe49b69c19ef14ad2 ), UINT64_C( 0xefbe4786384f25e3 ), UINT64_C( 0x0fc19dc68b8cd5b5 ), UINT64_C( 0x240ca1cc77ac9c65 ),
|
|
UINT64_C( 0x2de92c6f592b0275 ), UINT64_C( 0x4a7484aa6ea6e483 ), UINT64_C( 0x5cb0a9dcbd41fbd4 ), UINT64_C( 0x76f988da831153b5 ),
|
|
UINT64_C( 0x983e5152ee66dfab ), UINT64_C( 0xa831c66d2db43210 ), UINT64_C( 0xb00327c898fb213f ), UINT64_C( 0xbf597fc7beef0ee4 ),
|
|
UINT64_C( 0xc6e00bf33da88fc2 ), UINT64_C( 0xd5a79147930aa725 ), UINT64_C( 0x06ca6351e003826f ), UINT64_C( 0x142929670a0e6e70 ),
|
|
UINT64_C( 0x27b70a8546d22ffc ), UINT64_C( 0x2e1b21385c26c926 ), UINT64_C( 0x4d2c6dfc5ac42aed ), UINT64_C( 0x53380d139d95b3df ),
|
|
UINT64_C( 0x650a73548baf63de ), UINT64_C( 0x766a0abb3c77b2a8 ), UINT64_C( 0x81c2c92e47edaee6 ), UINT64_C( 0x92722c851482353b ),
|
|
UINT64_C( 0xa2bfe8a14cf10364 ), UINT64_C( 0xa81a664bbc423001 ), UINT64_C( 0xc24b8b70d0f89791 ), UINT64_C( 0xc76c51a30654be30 ),
|
|
UINT64_C( 0xd192e819d6ef5218 ), UINT64_C( 0xd69906245565a910 ), UINT64_C( 0xf40e35855771202a ), UINT64_C( 0x106aa07032bbd1b8 ),
|
|
UINT64_C( 0x19a4c116b8d2d0c8 ), UINT64_C( 0x1e376c085141ab53 ), UINT64_C( 0x2748774cdf8eeb99 ), UINT64_C( 0x34b0bcb5e19b48a8 ),
|
|
UINT64_C( 0x391c0cb3c5c95a63 ), UINT64_C( 0x4ed8aa4ae3418acb ), UINT64_C( 0x5b9cca4f7763e373 ), UINT64_C( 0x682e6ff3d6b2b8a3 ),
|
|
UINT64_C( 0x748f82ee5defb2fc ), UINT64_C( 0x78a5636f43172f60 ), UINT64_C( 0x84c87814a1f0ab72 ), UINT64_C( 0x8cc702081a6439ec ),
|
|
UINT64_C( 0x90befffa23631e28 ), UINT64_C( 0xa4506cebde82bde9 ), UINT64_C( 0xbef9a3f7b2c67915 ), UINT64_C( 0xc67178f2e372532b ),
|
|
UINT64_C( 0xca273eceea26619c ), UINT64_C( 0xd186b8c721c0c207 ), UINT64_C( 0xeada7dd6cde0eb1e ), UINT64_C( 0xf57d4f7fee6ed178 ),
|
|
UINT64_C( 0x06f067aa72176fba ), UINT64_C( 0x0a637dc5a2c898a6 ), UINT64_C( 0x113f9804bef90dae ), UINT64_C( 0x1b710b35131c471b ),
|
|
UINT64_C( 0x28db77f523047d84 ), UINT64_C( 0x32caab7b40c72493 ), UINT64_C( 0x3c9ebe0a15c9bebc ), UINT64_C( 0x431d67c49c100d4c ),
|
|
UINT64_C( 0x4cc5d4becb3e42b6 ), UINT64_C( 0x597f299cfc657e2a ), UINT64_C( 0x5fcb6fab3ad6faec ), UINT64_C( 0x6c44198c4a475817 )
|
|
};
|
|
|
|
static void _SHA512_Compress( SHA512_CTX_compat *ctx, const uint8_t *inPtr );
|
|
|
|
//===========================================================================================================================
|
|
// SHA512_Init_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA512_Init_compat( SHA512_CTX_compat *ctx )
|
|
{
|
|
ctx->length = 0;
|
|
ctx->state[ 0 ] = UINT64_C( 0x6a09e667f3bcc908 );
|
|
ctx->state[ 1 ] = UINT64_C( 0xbb67ae8584caa73b );
|
|
ctx->state[ 2 ] = UINT64_C( 0x3c6ef372fe94f82b );
|
|
ctx->state[ 3 ] = UINT64_C( 0xa54ff53a5f1d36f1 );
|
|
ctx->state[ 4 ] = UINT64_C( 0x510e527fade682d1 );
|
|
ctx->state[ 5 ] = UINT64_C( 0x9b05688c2b3e6c1f );
|
|
ctx->state[ 6 ] = UINT64_C( 0x1f83d9abfb41bd6b );
|
|
ctx->state[ 7 ] = UINT64_C( 0x5be0cd19137e2179 );
|
|
ctx->curlen = 0;
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA512_Update_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA512_Update_compat( SHA512_CTX_compat *ctx, const void *inData, size_t inLen )
|
|
{
|
|
const uint8_t * src = (const uint8_t *) inData;
|
|
size_t n;
|
|
|
|
while( inLen > 0 )
|
|
{
|
|
if( ( ctx->curlen == 0 ) && ( inLen >= SHA512_BLOCK_SIZE ) )
|
|
{
|
|
_SHA512_Compress( ctx, src );
|
|
ctx->length += ( SHA512_BLOCK_SIZE * 8 );
|
|
src += SHA512_BLOCK_SIZE;
|
|
inLen -= SHA512_BLOCK_SIZE;
|
|
}
|
|
else
|
|
{
|
|
n = Min( inLen, SHA512_BLOCK_SIZE - ctx->curlen );
|
|
memcpy( ctx->buf + ctx->curlen, src, n );
|
|
ctx->curlen += n;
|
|
src += n;
|
|
inLen -= n;
|
|
if( ctx->curlen == SHA512_BLOCK_SIZE )
|
|
{
|
|
_SHA512_Compress( ctx, ctx->buf );
|
|
ctx->length += ( SHA512_BLOCK_SIZE * 8 );
|
|
ctx->curlen = 0;
|
|
}
|
|
}
|
|
}
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA512_Final_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA512_Final_compat( unsigned char *outDigest, SHA512_CTX_compat *ctx )
|
|
{
|
|
int i;
|
|
|
|
ctx->length += ( ctx->curlen * UINT64_C( 8 ) );
|
|
ctx->buf[ ctx->curlen++ ] = 0x80;
|
|
|
|
// If length > 112 bytes, append zeros then compress. Then fall back to padding zeros and length encoding like normal.
|
|
if( ctx->curlen > 112 )
|
|
{
|
|
while( ctx->curlen < 128 ) ctx->buf[ ctx->curlen++ ] = 0;
|
|
_SHA512_Compress( ctx, ctx->buf );
|
|
ctx->curlen = 0;
|
|
}
|
|
|
|
// Pad up to 120 bytes of zeroes.
|
|
// Note: that from 112 to 120 is the 64 MSB of the length. We assume that you won't hash 2^64 bits of data.
|
|
while( ctx->curlen < 120 ) ctx->buf[ ctx->curlen++ ] = 0;
|
|
|
|
// Store length
|
|
WriteBig64( ctx->buf + 120, ctx->length );
|
|
_SHA512_Compress( ctx, ctx->buf );
|
|
|
|
// Copy output
|
|
for( i = 0; i < 8; ++i )
|
|
{
|
|
WriteBig64( outDigest + ( 8 * i ), ctx->state[ i ] );
|
|
}
|
|
memset( ctx, 0, sizeof( *ctx ) ); // Zero sensitive info.
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA512_compat
|
|
//===========================================================================================================================
|
|
|
|
unsigned char * SHA512_compat( const void *inData, size_t inLen, unsigned char *outDigest )
|
|
{
|
|
SHA512_CTX_compat ctx;
|
|
|
|
SHA512_Init_compat( &ctx );
|
|
SHA512_Update_compat( &ctx, inData, inLen );
|
|
SHA512_Final_compat( outDigest, &ctx );
|
|
return( outDigest );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// _SHA512_Compress
|
|
//===========================================================================================================================
|
|
|
|
#define SHA512_Ch(x,y,z) (z ^ (x & (y ^ z)))
|
|
#define SHA512_Maj(x,y,z) (((x | y) & z) | (x & y))
|
|
#define SHA512_S(x, n) ROTR64(x, n)
|
|
#define SHA512_R(x, n) (((x) & UINT64_C(0xFFFFFFFFFFFFFFFF)) >> ((uint64_t) n))
|
|
#define SHA512_Sigma0(x) (SHA512_S(x, 28) ^ SHA512_S(x, 34) ^ SHA512_S(x, 39))
|
|
#define SHA512_Sigma1(x) (SHA512_S(x, 14) ^ SHA512_S(x, 18) ^ SHA512_S(x, 41))
|
|
#define SHA512_Gamma0(x) (SHA512_S(x, 1) ^ SHA512_S(x, 8) ^ SHA512_R(x, 7))
|
|
#define SHA512_Gamma1(x) (SHA512_S(x, 19) ^ SHA512_S(x, 61) ^ SHA512_R(x, 6))
|
|
#define SHA512_RND( a, b, c, d, e, f, g, h, i ) \
|
|
t0 = h + SHA512_Sigma1( e ) + SHA512_Ch( e, f, g ) + K[ i ] + W[ i ]; \
|
|
t1 = SHA512_Sigma0( a ) + SHA512_Maj( a, b, c); \
|
|
d += t0; \
|
|
h = t0 + t1;
|
|
|
|
static void _SHA512_Compress( SHA512_CTX_compat *ctx, const uint8_t *inPtr )
|
|
{
|
|
uint64_t S[ 8] , W[ 80 ], t0, t1;
|
|
int i;
|
|
|
|
// Copy state into S
|
|
for( i = 0; i < 8; ++i )
|
|
{
|
|
S[ i ] = ctx->state[ i ];
|
|
}
|
|
|
|
// Copy the state into 1024-bits into W[0..15]
|
|
for( i = 0; i < 16; ++i )
|
|
{
|
|
W[ i ] = ReadBig64( inPtr );
|
|
inPtr += 8;
|
|
}
|
|
|
|
// Fill W[16..79]
|
|
for( i = 16; i < 80; ++i )
|
|
{
|
|
W[ i ] = SHA512_Gamma1( W[ i-2 ] ) + W[ i-7 ] + SHA512_Gamma0( W[ i-15 ] ) + W[ i-16 ];
|
|
}
|
|
|
|
// Compress
|
|
for( i = 0; i < 80; i += 8 )
|
|
{
|
|
SHA512_RND( S[ 0 ], S[ 1 ], S[ 2 ], S[ 3 ], S[ 4 ], S[ 5 ], S[ 6 ], S[ 7 ], i+0 );
|
|
SHA512_RND( S[ 7 ], S[ 0 ], S[ 1 ], S[ 2 ], S[ 3 ], S[ 4 ], S[ 5 ], S[ 6 ], i+1 );
|
|
SHA512_RND( S[ 6 ], S[ 7 ], S[ 0 ], S[ 1 ], S[ 2 ], S[ 3 ], S[ 4 ], S[ 5 ], i+2 );
|
|
SHA512_RND( S[ 5 ], S[ 6 ], S[ 7 ], S[ 0 ], S[ 1 ], S[ 2 ], S[ 3 ], S[ 4 ], i+3 );
|
|
SHA512_RND( S[ 4 ], S[ 5 ], S[ 6 ], S[ 7 ], S[ 0 ], S[ 1 ], S[ 2 ], S[ 3 ], i+4 );
|
|
SHA512_RND( S[ 3 ], S[ 4 ], S[ 5 ], S[ 6 ], S[ 7 ], S[ 0 ], S[ 1 ], S[ 2 ], i+5 );
|
|
SHA512_RND( S[ 2 ], S[ 3 ], S[ 4 ], S[ 5 ], S[ 6 ], S[ 7 ], S[ 0 ], S[ 1 ], i+6 );
|
|
SHA512_RND( S[ 1 ], S[ 2 ], S[ 3 ], S[ 4 ], S[ 5 ], S[ 6 ], S[ 7 ], S[ 0 ], i+7 );
|
|
}
|
|
|
|
// Feedback
|
|
for( i = 0; i < 8; ++i )
|
|
{
|
|
ctx->state[ i ] += S[ i ];
|
|
}
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA-3 internals
|
|
//
|
|
// Based on code from <https://github.com/floodyberry>.
|
|
//===========================================================================================================================
|
|
|
|
static const uint64_t kSHA3RoundConstants[24] =
|
|
{
|
|
UINT64_C( 0x0000000000000001 ), UINT64_C( 0x0000000000008082 ),
|
|
UINT64_C( 0x800000000000808a ), UINT64_C( 0x8000000080008000 ),
|
|
UINT64_C( 0x000000000000808b ), UINT64_C( 0x0000000080000001 ),
|
|
UINT64_C( 0x8000000080008081 ), UINT64_C( 0x8000000000008009 ),
|
|
UINT64_C( 0x000000000000008a ), UINT64_C( 0x0000000000000088 ),
|
|
UINT64_C( 0x0000000080008009 ), UINT64_C( 0x000000008000000a ),
|
|
UINT64_C( 0x000000008000808b ), UINT64_C( 0x800000000000008b ),
|
|
UINT64_C( 0x8000000000008089 ), UINT64_C( 0x8000000000008003 ),
|
|
UINT64_C( 0x8000000000008002 ), UINT64_C( 0x8000000000000080 ),
|
|
UINT64_C( 0x000000000000800a ), UINT64_C( 0x800000008000000a ),
|
|
UINT64_C( 0x8000000080008081 ), UINT64_C( 0x8000000000008080 ),
|
|
UINT64_C( 0x0000000080000001 ), UINT64_C( 0x8000000080008008 )
|
|
};
|
|
|
|
static void _SHA3_Block( SHA3_CTX_compat *ctx, const uint8_t *in );
|
|
|
|
//===========================================================================================================================
|
|
// SHA3_Init_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA3_Init_compat( SHA3_CTX_compat *ctx )
|
|
{
|
|
memset( ctx, 0, sizeof( *ctx ) );
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA3_Update_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA3_Update_compat( SHA3_CTX_compat *ctx, const void *inData, size_t inLen )
|
|
{
|
|
const uint8_t * in = (const uint8_t *) inData;
|
|
size_t want;
|
|
|
|
// Handle the previous data.
|
|
if( ctx->leftover > 0 )
|
|
{
|
|
want = SHA3_BLOCK_SIZE - ctx->leftover;
|
|
want = ( want < inLen ) ? want : inLen;
|
|
memcpy( ctx->buffer + ctx->leftover, in, want );
|
|
ctx->leftover += want;
|
|
if( ctx->leftover < SHA3_BLOCK_SIZE ) goto exit;
|
|
in += want;
|
|
inLen -= want;
|
|
_SHA3_Block( ctx, ctx->buffer );
|
|
}
|
|
|
|
// Handle the current data.
|
|
while( inLen >= SHA3_BLOCK_SIZE )
|
|
{
|
|
_SHA3_Block( ctx, in );
|
|
in += SHA3_BLOCK_SIZE;
|
|
inLen -= SHA3_BLOCK_SIZE;
|
|
}
|
|
|
|
// Handle leftover data.
|
|
ctx->leftover = inLen;
|
|
if( inLen > 0 ) memcpy( ctx->buffer, in, inLen );
|
|
|
|
exit:
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA3_Update_compat
|
|
//===========================================================================================================================
|
|
|
|
int SHA3_Final_compat( uint8_t *outDigest, SHA3_CTX_compat *ctx )
|
|
{
|
|
size_t i;
|
|
|
|
ctx->buffer[ctx->leftover] = 0x01;
|
|
memset( ctx->buffer + ( ctx->leftover + 1 ), 0, SHA3_BLOCK_SIZE - ( ctx->leftover + 1 ) );
|
|
ctx->buffer[SHA3_BLOCK_SIZE - 1] |= 0x80;
|
|
_SHA3_Block( ctx, ctx->buffer );
|
|
|
|
for( i = 0; i < SHA3_DIGEST_LENGTH; i += 8 )
|
|
{
|
|
WriteLittle64( &outDigest[i], ctx->state[i / 8] );
|
|
}
|
|
return( 0 );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// SHA3_Update_compat
|
|
//===========================================================================================================================
|
|
|
|
uint8_t * SHA3_compat( const void *inData, size_t inLen, uint8_t outDigest[64] )
|
|
{
|
|
SHA3_CTX_compat ctx;
|
|
|
|
SHA3_Init_compat( &ctx );
|
|
SHA3_Update_compat( &ctx, inData, inLen );
|
|
SHA3_Final_compat( outDigest, &ctx );
|
|
return( outDigest );
|
|
}
|
|
|
|
//===========================================================================================================================
|
|
// _SHA3_Block
|
|
//===========================================================================================================================
|
|
|
|
static void _SHA3_Block( SHA3_CTX_compat *ctx, const uint8_t *in )
|
|
{
|
|
uint64_t s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10;
|
|
uint64_t s11, s12, s13, s14, s15, s16, s17, s18, s19, s20;
|
|
uint64_t s21, s22, s23, s24;
|
|
uint64_t t0, t1, t2, t3, t4, u0, u1, u2, u3, u4, v, w;
|
|
size_t i;
|
|
|
|
s0 = ctx->state[ 0] ^ ReadLittle64( &in[0] );
|
|
s1 = ctx->state[ 1] ^ ReadLittle64( &in[8] );
|
|
s2 = ctx->state[ 2] ^ ReadLittle64( &in[16] );
|
|
s3 = ctx->state[ 3] ^ ReadLittle64( &in[24] );
|
|
s4 = ctx->state[ 4] ^ ReadLittle64( &in[32] );
|
|
s5 = ctx->state[ 5] ^ ReadLittle64( &in[40] );
|
|
s6 = ctx->state[ 6] ^ ReadLittle64( &in[48] );
|
|
s7 = ctx->state[ 7] ^ ReadLittle64( &in[56] );
|
|
s8 = ctx->state[ 8] ^ ReadLittle64( &in[64] );
|
|
s9 = ctx->state[ 9];
|
|
s10 = ctx->state[10];
|
|
s11 = ctx->state[11];
|
|
s12 = ctx->state[12];
|
|
s13 = ctx->state[13];
|
|
s14 = ctx->state[14];
|
|
s15 = ctx->state[15];
|
|
s16 = ctx->state[16];
|
|
s17 = ctx->state[17];
|
|
s18 = ctx->state[18];
|
|
s19 = ctx->state[19];
|
|
s20 = ctx->state[20];
|
|
s21 = ctx->state[21];
|
|
s22 = ctx->state[22];
|
|
s23 = ctx->state[23];
|
|
s24 = ctx->state[24];
|
|
|
|
for( i = 0; i < 24; ++i )
|
|
{
|
|
// theta: c = a[0,i] ^ a[1,i] ^ .. a[4,i]
|
|
t0 = s0 ^ s5 ^ s10 ^ s15 ^ s20;
|
|
t1 = s1 ^ s6 ^ s11 ^ s16 ^ s21;
|
|
t2 = s2 ^ s7 ^ s12 ^ s17 ^ s22;
|
|
t3 = s3 ^ s8 ^ s13 ^ s18 ^ s23;
|
|
t4 = s4 ^ s9 ^ s14 ^ s19 ^ s24;
|
|
|
|
// theta: d[i] = c[i+4] ^ rotl(c[i+1],1)
|
|
u0 = t4 ^ ROTL64(t1, 1);
|
|
u1 = t0 ^ ROTL64(t2, 1);
|
|
u2 = t1 ^ ROTL64(t3, 1);
|
|
u3 = t2 ^ ROTL64(t4, 1);
|
|
u4 = t3 ^ ROTL64(t0, 1);
|
|
|
|
// theta: a[0,i], a[1,i], .. a[4,i] ^= d[i]
|
|
s0 ^= u0; s5 ^= u0; s10 ^= u0; s15 ^= u0; s20 ^= u0;
|
|
s1 ^= u1; s6 ^= u1; s11 ^= u1; s16 ^= u1; s21 ^= u1;
|
|
s2 ^= u2; s7 ^= u2; s12 ^= u2; s17 ^= u2; s22 ^= u2;
|
|
s3 ^= u3; s8 ^= u3; s13 ^= u3; s18 ^= u3; s23 ^= u3;
|
|
s4 ^= u4; s9 ^= u4; s14 ^= u4; s19 ^= u4; s24 ^= u4;
|
|
|
|
// rho pi: b[..] = rotl(a[..], ..)
|
|
v = s1;
|
|
s1 = ROTL64(s6, 44);
|
|
s6 = ROTL64(s9, 20);
|
|
s9 = ROTL64(s22, 61);
|
|
s22 = ROTL64(s14, 39);
|
|
s14 = ROTL64(s20, 18);
|
|
s20 = ROTL64(s2, 62);
|
|
s2 = ROTL64(s12, 43);
|
|
s12 = ROTL64(s13, 25);
|
|
s13 = ROTL64(s19, 8);
|
|
s19 = ROTL64(s23, 56);
|
|
s23 = ROTL64(s15, 41);
|
|
s15 = ROTL64(s4, 27);
|
|
s4 = ROTL64(s24, 14);
|
|
s24 = ROTL64(s21, 2);
|
|
s21 = ROTL64(s8, 55);
|
|
s8 = ROTL64(s16, 45);
|
|
s16 = ROTL64(s5, 36);
|
|
s5 = ROTL64(s3, 28);
|
|
s3 = ROTL64(s18, 21);
|
|
s18 = ROTL64(s17, 15);
|
|
s17 = ROTL64(s11, 10);
|
|
s11 = ROTL64(s7, 6);
|
|
s7 = ROTL64(s10, 3);
|
|
s10 = ROTL64(v, 1);
|
|
|
|
// chi: a[i,j] ^= ~b[i,j+1] & b[i,j+2]
|
|
v = s0;
|
|
w = s1;
|
|
s0 ^= (~w) & s2;
|
|
s1 ^= (~s2) & s3;
|
|
s2 ^= (~s3) & s4;
|
|
s3 ^= (~s4) & v;
|
|
s4 ^= (~v) & w;
|
|
v = s5;
|
|
w = s6;
|
|
s5 ^= (~w) & s7;
|
|
s6 ^= (~s7) & s8;
|
|
s7 ^= (~s8) & s9;
|
|
s8 ^= (~s9) & v;
|
|
s9 ^= (~v) & w;
|
|
v = s10;
|
|
w = s11;
|
|
s10 ^= (~w) & s12;
|
|
s11 ^= (~s12) & s13;
|
|
s12 ^= (~s13) & s14;
|
|
s13 ^= (~s14) & v;
|
|
s14 ^= (~v) & w;
|
|
v = s15;
|
|
w = s16;
|
|
s15 ^= (~w) & s17;
|
|
s16 ^= (~s17) & s18;
|
|
s17 ^= (~s18) & s19;
|
|
s18 ^= (~s19) & v;
|
|
s19 ^= (~v) & w;
|
|
v = s20;
|
|
w = s21;
|
|
s20 ^= (~w) & s22;
|
|
s21 ^= (~s22) & s23;
|
|
s22 ^= (~s23) & s24;
|
|
s23 ^= (~s24) & v;
|
|
s24 ^= (~v) & w;
|
|
|
|
// iota: a[0,0] ^= round constant
|
|
s0 ^= kSHA3RoundConstants[i];
|
|
}
|
|
|
|
ctx->state[ 0] = s0;
|
|
ctx->state[ 1] = s1;
|
|
ctx->state[ 2] = s2;
|
|
ctx->state[ 3] = s3;
|
|
ctx->state[ 4] = s4;
|
|
ctx->state[ 5] = s5;
|
|
ctx->state[ 6] = s6;
|
|
ctx->state[ 7] = s7;
|
|
ctx->state[ 8] = s8;
|
|
ctx->state[ 9] = s9;
|
|
ctx->state[10] = s10;
|
|
ctx->state[11] = s11;
|
|
ctx->state[12] = s12;
|
|
ctx->state[13] = s13;
|
|
ctx->state[14] = s14;
|
|
ctx->state[15] = s15;
|
|
ctx->state[16] = s16;
|
|
ctx->state[17] = s17;
|
|
ctx->state[18] = s18;
|
|
ctx->state[19] = s19;
|
|
ctx->state[20] = s20;
|
|
ctx->state[21] = s21;
|
|
ctx->state[22] = s22;
|
|
ctx->state[23] = s23;
|
|
ctx->state[24] = s24;
|
|
}
|
|
|
|
|