diff options
Diffstat (limited to 'board/cr50/dcrypto/sha512.c')
-rw-r--r-- | board/cr50/dcrypto/sha512.c | 249 |
1 files changed, 243 insertions, 6 deletions
diff --git a/board/cr50/dcrypto/sha512.c b/board/cr50/dcrypto/sha512.c index 1446970174..31b0d47c1a 100644 --- a/board/cr50/dcrypto/sha512.c +++ b/board/cr50/dcrypto/sha512.c @@ -4,17 +4,254 @@ */ #include "dcrypto.h" +#include "endian.h" #include "internal.h" -#include "cryptoc/sha512.h" +static void SHA512_transform(struct sha512_ctx *ctx) +{ + static const uint64_t K[80] = { + 0x428A2F98D728AE22ll, 0x7137449123EF65CDll, + 0xB5C0FBCFEC4D3B2Fll, 0xE9B5DBA58189DBBCll, + 0x3956C25BF348B538ll, 0x59F111F1B605D019ll, + 0x923F82A4AF194F9Bll, 0xAB1C5ED5DA6D8118ll, + 0xD807AA98A3030242ll, 0x12835B0145706FBEll, + 0x243185BE4EE4B28Cll, 0x550C7DC3D5FFB4E2ll, + 0x72BE5D74F27B896Fll, 0x80DEB1FE3B1696B1ll, + 0x9BDC06A725C71235ll, 0xC19BF174CF692694ll, + 0xE49B69C19EF14AD2ll, 0xEFBE4786384F25E3ll, + 0x0FC19DC68B8CD5B5ll, 0x240CA1CC77AC9C65ll, + 0x2DE92C6F592B0275ll, 0x4A7484AA6EA6E483ll, + 0x5CB0A9DCBD41FBD4ll, 0x76F988DA831153B5ll, + 0x983E5152EE66DFABll, 0xA831C66D2DB43210ll, + 0xB00327C898FB213Fll, 0xBF597FC7BEEF0EE4ll, + 0xC6E00BF33DA88FC2ll, 0xD5A79147930AA725ll, + 0x06CA6351E003826Fll, 0x142929670A0E6E70ll, + 0x27B70A8546D22FFCll, 0x2E1B21385C26C926ll, + 0x4D2C6DFC5AC42AEDll, 0x53380D139D95B3DFll, + 0x650A73548BAF63DEll, 0x766A0ABB3C77B2A8ll, + 0x81C2C92E47EDAEE6ll, 0x92722C851482353Bll, + 0xA2BFE8A14CF10364ll, 0xA81A664BBC423001ll, + 0xC24B8B70D0F89791ll, 0xC76C51A30654BE30ll, + 0xD192E819D6EF5218ll, 0xD69906245565A910ll, + 0xF40E35855771202All, 0x106AA07032BBD1B8ll, + 0x19A4C116B8D2D0C8ll, 0x1E376C085141AB53ll, + 0x2748774CDF8EEB99ll, 0x34B0BCB5E19B48A8ll, + 0x391C0CB3C5C95A63ll, 0x4ED8AA4AE3418ACBll, + 0x5B9CCA4F7763E373ll, 0x682E6FF3D6B2B8A3ll, + 0x748F82EE5DEFB2FCll, 0x78A5636F43172F60ll, + 0x84C87814A1F0AB72ll, 0x8CC702081A6439ECll, + 0x90BEFFFA23631E28ll, 0xA4506CEBDE82BDE9ll, + 0xBEF9A3F7B2C67915ll, 0xC67178F2E372532Bll, + 0xCA273ECEEA26619Cll, 0xD186B8C721C0C207ll, + 0xEADA7DD6CDE0EB1Ell, 0xF57D4F7FEE6ED178ll, + 0x06F067AA72176FBAll, 0x0A637DC5A2C898A6ll, + 0x113F9804BEF90DAEll, 0x1B710B35131C471Bll, + 0x28DB77F523047D84ll, 0x32CAAB7B40C72493ll, + 0x3C9EBE0A15C9BEBCll, 0x431D67C49C100D4Cll, + 0x4CC5D4BECB3E42B6ll, 0x597F299CFC657E2All, + 0x5FCB6FAB3AD6FAECll, 0x6C44198C4A475817ll + }; + uint64_t W[80]; + uint64_t A, B, C, D, E, F, G, H; + size_t t; + + for (t = 0; t < 16; t++) + W[t] = be64toh(ctx->b64[t]); + + for (; t < 80; t++) { + uint64_t Wt2 = W[t - 2]; + uint64_t Wt7 = W[t - 7]; + uint64_t Wt15 = W[t - 15]; + uint64_t Wt16 = W[t - 16]; + uint64_t s0 = ror64(Wt15, 1) ^ ror64(Wt15, 8) ^ (Wt15 >> 7); + uint64_t s1 = ror64(Wt2, 19) ^ ror64(Wt2, 61) ^ (Wt2 >> 6); + + W[t] = s1 + Wt7 + s0 + Wt16; + } + A = ctx->state[0]; + B = ctx->state[1]; + C = ctx->state[2]; + D = ctx->state[3]; + E = ctx->state[4]; + F = ctx->state[5]; + G = ctx->state[6]; + H = ctx->state[7]; + for (t = 0; t < 80; t++) { + uint64_t s0 = ror64(A, 28) ^ ror64(A, 34) ^ ror64(A, 39); + uint64_t maj = (A & B) ^ (A & C) ^ (B & C); + uint64_t t2 = s0 + maj; + uint64_t s1 = ror64(E, 14) ^ ror64(E, 18) ^ ror64(E, 41); + uint64_t ch = (E & F) ^ ((~E) & G); + uint64_t t1 = H + s1 + ch + W[t] + K[t]; + + H = G; + G = F; + F = E; + E = D + t1; + D = C; + C = B; + B = A; + A = t1 + t2; + } + ctx->state[0] += A; + ctx->state[1] += B; + ctx->state[2] += C; + ctx->state[3] += D; + ctx->state[4] += E; + ctx->state[5] += F; + ctx->state[6] += G; + ctx->state[7] += H; +} + +/** + * Define aliases taking union type as parameter. This is safe + * as union type has header in same place and is not less than original type. + * Equal to: + * void SHA512_init_as_hash(HASH_CTX *const ctx) {SHA512_init(&ctx.sha512);} + * but save some space for embedded uses. + */ +BUILD_ASSERT(sizeof(union hash_ctx) >= sizeof(struct sha512_ctx)); +BUILD_ASSERT(sizeof(union hash_ctx) >= sizeof(struct sha384_ctx)); + +static void SHA512_init_as_hash(union hash_ctx *const ctx) + __alias(SHA512_sw_init); +static void SHA512_update_as_hash(union hash_ctx *const ctx, const void *data, + size_t len) __alias(SHA512_sw_update); +static const union sha_digests *SHA512_final_as_hash(union hash_ctx *const ctx) + __alias(SHA512_sw_final); +static void SHA384_init_as_hash(union hash_ctx *const ctx) + __alias(SHA384_sw_init); + +void SHA512_sw_init(struct sha512_ctx *const ctx) +{ + static const struct hash_vtable sha512_vtable = { + SHA512_init_as_hash, SHA512_update_as_hash, + SHA512_final_as_hash, HMAC_sw_final, + SHA512_DIGEST_SIZE, SHA512_BLOCK_SIZE, + sizeof(struct sha512_ctx) + }; + static const uint64_t sha512_init[SHA512_DIGEST_DWORDS] = { + 0x6a09e667f3bcc908ll, 0xbb67ae8584caa73bll, + 0x3c6ef372fe94f82bll, 0xa54ff53a5f1d36f1ll, + 0x510e527fade682d1ll, 0x9b05688c2b3e6c1fll, + 0x1f83d9abfb41bd6bll, 0x5be0cd19137e2179ll + }; + + memcpy(ctx->state, sha512_init, sizeof(ctx->state)); + ctx->f = &sha512_vtable; + ctx->count = 0; +} + +/* SHA2-384 and SHA2-512 use same internal context. */ +BUILD_ASSERT(sizeof(struct sha384_ctx) == sizeof(struct sha512_ctx)); + +void SHA384_sw_update(struct sha384_ctx *const ctx, const void *data, + size_t len) __alias(SHA512_sw_update); + +void SHA512_sw_update(struct sha512_ctx *const ctx, const void *data, + size_t len) +{ + size_t i = ctx->count & (SHA512_BLOCK_SIZE - 1); + const uint8_t *p = (const uint8_t *)data; -void DCRYPTO_SHA512_init(LITE_SHA512_CTX *ctx) + ctx->count += len; + while (len--) { + ctx->b8[i++] = *p++; + if (i == SHA512_BLOCK_SIZE) { + SHA512_transform(ctx); + i = 0; + } + } +} + +const struct sha384_digest *SHA384_sw_final(struct sha384_ctx *const ctx) + __alias(SHA512_sw_final); + +const struct sha512_digest *SHA512_sw_final(struct sha512_ctx *const ctx) { - SHA512_init(ctx); + uint64_t cnt = (uint64_t)ctx->count * CHAR_BIT; + size_t i = ctx->count & (SHA512_BLOCK_SIZE - 1); + + /** + * Append the bit '1' to the message which would be 0x80 if message + * length is a multiple of 8 bits. + */ + ctx->b8[i++] = 0x80; + /** + * Append 0 ≤ k < 1024 bits '0', such that the resulting message + * length in bits is congruent to −64 ≡ 896 (mod 1024). + */ + if (i > (SHA512_BLOCK_SIZE - 2 * sizeof(cnt))) { + /* Current block won't fit length, so move to next. */ + while (i < SHA512_BLOCK_SIZE) + ctx->b8[i++] = 0; + SHA512_transform(ctx); + i = 0; + } + /* pad rest of zeros, including 8 bytes of 128-bit counter */ + while (i < (SHA512_BLOCK_SIZE - sizeof(cnt))) + ctx->b8[i++] = 0; + /* place big-endian 64-bit bit counter at the end of block */ + ctx->b64[SHA512_BLOCK_DWORDS - 1] = htobe64(cnt); + SHA512_transform(ctx); + for (i = 0; i < 8; i++) + ctx->b64[i] = htobe64(ctx->state[i]); + return &ctx->digest; } -const uint8_t *DCRYPTO_SHA512_hash(const void *data, uint32_t n, - uint8_t *digest) +const struct sha512_digest *SHA512_sw_hash(const void *data, size_t len, + struct sha512_digest *digest) { - return SHA512_hash(data, n, digest); + struct sha512_ctx ctx; + + SHA512_sw_init(&ctx); + SHA512_sw_update(&ctx, data, len); + memcpy(digest->b8, SHA512_sw_final(&ctx)->b8, SHA512_DIGEST_SIZE); + return digest; +} + +void SHA384_sw_init(struct sha384_ctx *ctx) +{ + /* SHA2-384 differs from SHA2-512 only in initialization. */ + static const struct hash_vtable sha384_vtable = { + SHA384_init_as_hash, SHA512_update_as_hash, + SHA512_final_as_hash, HMAC_sw_final, + SHA384_DIGEST_SIZE, SHA384_BLOCK_SIZE, + sizeof(struct sha384_ctx) + }; + static const uint64_t sha384_init[SHA512_DIGEST_DWORDS] = { + 0xcbbb9d5dc1059ed8ll, 0x629a292a367cd507ll, + 0x9159015a3070dd17ll, 0x152fecd8f70e5939ll, + 0x67332667ffc00b31ll, 0x8eb44a8768581511ll, + 0xdb0c2e0d64f98fa7ll, 0x47b5481dbefa4fa4ll + }; + + memcpy(ctx->state, sha384_init, sizeof(ctx->state)); + ctx->count = 0; + ctx->f = &sha384_vtable; } + +const struct sha384_digest *SHA384_sw_hash(const void *data, size_t len, + struct sha384_digest *digest) +{ + struct sha384_ctx ctx; + + SHA384_sw_init(&ctx); + SHA384_sw_update(&ctx, data, len); + memcpy(digest->b8, SHA384_sw_final(&ctx)->b8, SHA384_DIGEST_SIZE); + return digest; +} + +/** + * We don't support HW-accelerated SHA384/SHA512 yet, so alias it to software. + */ +const struct sha512_digest *SHA512_hw_hash(const void *data, size_t len, + struct sha512_digest *digest) + __alias(SHA512_sw_hash); + +const struct sha384_digest *SHA384_hw_hash(const void *data, size_t len, + struct sha384_digest *digest) + __alias(SHA384_sw_hash); + +void SHA512_hw_init(struct sha512_ctx *const ctx) __alias(SHA512_sw_init); +void SHA384_hw_init(struct sha384_ctx *const ctx) __alias(SHA384_sw_init); |