/* gchecksum.h - data hashing functions

 *

 * Copyright (C) 2007  Emmanuele Bassi  <ebassi@gnome.org>

 *

 * SPDX-License-Identifier: LGPL-2.1-or-later

 *

 * This library is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2.1 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this library; if not, see <http://www.gnu.org/licenses/>.

 */

#include "config.h"

#include <string.h>

#include "gchecksum.h"

#include "gslice.h"

#include "gmem.h"

#include "gstrfuncs.h"

#include "gtestutils.h"

#include "gtypes.h"

#include "glibintl.h"

/**

 * GChecksum:

 *

 * GLib provides a generic API for computing checksums (or ‘digests’)

 * for a sequence of arbitrary bytes, using various hashing algorithms

 * like MD5, SHA-1 and SHA-256. Checksums are commonly used in various

 * environments and specifications.

 *

 * To create a new `GChecksum`, use [ctor@GLib.Checksum.new]. To free

 * a `GChecksum`, use [method@GLib.Checksum.free].

 *

 * GLib supports incremental checksums using the `GChecksum` data

 * structure, by calling [method@GLib.Checksum.update] as long as there’s data

 * available and then using [method@GLib.Checksum.get_string] or

 * [method@GLib.Checksum.get_digest] to compute the checksum and return it

 * either as a string in hexadecimal form, or as a raw sequence of bytes. To

 * compute the checksum for binary blobs and nul-terminated strings in

 * one go, use the convenience functions [func@GLib.compute_checksum_for_data]

 * and [func@GLib.compute_checksum_for_string], respectively.

 *

 * Since: 2.16

 **/

#define IS_VALID_TYPE(type)     ((type) >= G_CHECKSUM_MD5 && (type) <= G_CHECKSUM_SHA384)

/* The fact that these are lower case characters is part of the ABI */

static const gchar hex_digits[] = "0123456789abcdef";

#define MD5_DATASIZE    64

#define MD5_DIGEST_LEN  16

typedef struct

{

  guint32 buf[4];

  guint32 bits[2];

  union {

    guchar data[MD5_DATASIZE];

    guint32 data32[MD5_DATASIZE / 4];

  } u;

  guchar digest[MD5_DIGEST_LEN];

} Md5sum;

#define SHA1_DATASIZE   64

#define SHA1_DIGEST_LEN 20

typedef struct

{

  guint32 buf[5];

  guint32 bits[2];

  /* we pack 64 unsigned chars into 16 32-bit unsigned integers */

  guint32 data[16];

  guchar digest[SHA1_DIGEST_LEN];

} Sha1sum;

#define SHA256_DATASIZE         64

#define SHA256_DIGEST_LEN       32

typedef struct

{

  guint32 buf[8];

  guint32 bits[2];

  guint8 data[SHA256_DATASIZE];

  guchar digest[SHA256_DIGEST_LEN];

} Sha256sum;

/* SHA2 is common thing for SHA-384, SHA-512, SHA-512/224 and SHA-512/256 */

#define SHA2_BLOCK_LEN         128 /* 1024 bits message block */

#define SHA384_DIGEST_LEN       48

#define SHA512_DIGEST_LEN       64

typedef struct

{

  guint64 H[8];

  guint8 block[SHA2_BLOCK_LEN];

  guint8 block_len;

  guint64 data_len[2];

  guchar digest[SHA512_DIGEST_LEN];

} Sha512sum;

struct _GChecksum

{

  GChecksumType type;

  gchar *digest_str;

  union {

    Md5sum md5;

    Sha1sum sha1;

    Sha256sum sha256;

    Sha512sum sha512;

  } sum;

};

/* we need different byte swapping functions because MD5 expects buffers

 * to be little-endian, while SHA1 and SHA256 expect them in big-endian

 * form.

 */

#if G_BYTE_ORDER == G_LITTLE_ENDIAN

#define md5_byte_reverse(buffer,length)

#else

/* assume that the passed buffer is integer aligned */

static inline void

md5_byte_reverse (guchar *buffer,

                  gulong  length)

{

  guint32 bit;

  do

    {

      bit = (guint32) ((unsigned) buffer[3] << 8 | buffer[2]) << 16 |

                      ((unsigned) buffer[1] << 8 | buffer[0]);

      * (guint32 *) buffer = bit;

      buffer += 4;

    }

  while (--length);

}

#endif /* G_BYTE_ORDER == G_LITTLE_ENDIAN */

#if G_BYTE_ORDER == G_BIG_ENDIAN

#define sha_byte_reverse(buffer,length)

#else

static inline void

sha_byte_reverse (guint32 *buffer,

                  size_t   length)

{

  length /= sizeof (guint32);

  while (length--)

    {

      *buffer = GUINT32_SWAP_LE_BE (*buffer);

      ++buffer;

    }

}

#endif /* G_BYTE_ORDER == G_BIG_ENDIAN */

static gchar *

digest_to_string (guint8 *digest,

                  gsize   digest_len)

{

  gsize i, len = digest_len * 2;

  gchar *retval;

  retval = g_new (gchar, len + 1);

  for (i = 0; i < digest_len; i++)

    {

      guint8 byte = digest[i];

      retval[2 * i] = hex_digits[byte >> 4];

      retval[2 * i + 1] = hex_digits[byte & 0xf];

    }

  retval[len] = 0;

  return retval;

}

/*

 * MD5 Checksum

 */

/* This MD5 digest computation is based on the equivalent code

 * written by Colin Plumb. It came with this notice:

 *

 * This code implements the MD5 message-digest algorithm.

 * The algorithm is due to Ron Rivest.  This code was

 * written by Colin Plumb in 1993, no copyright is claimed.

 * This code is in the public domain; do with it what you wish.

 *

 * Equivalent code is available from RSA Data Security, Inc.

 * This code has been tested against that, and is equivalent,

 * except that you don't need to include two pages of legalese

 * with every copy.

 */

static void

md5_sum_init (Md5sum *md5)

{

  /* arbitrary constants */

  md5->buf[0] = 0x67452301;

  md5->buf[1] = 0xefcdab89;

  md5->buf[2] = 0x98badcfe;

  md5->buf[3] = 0x10325476;

  md5->bits[0] = md5->bits[1] = 0;

}

/*

 * The core of the MD5 algorithm, this alters an existing MD5 hash to

 * reflect the addition of 16 longwords of new data.  md5_sum_update()

 * blocks the data and converts bytes into longwords for this routine.

 */

static void

md5_transform (guint32       buf[4],

               guint32 const in[16])

{

  guint32 a, b, c, d;

/* The four core functions - F1 is optimized somewhat */

#define F1(x, y, z)     (z ^ (x & (y ^ z)))

#define F2(x, y, z)     F1 (z, x, y)

#define F3(x, y, z)     (x ^ y ^ z)

#define F4(x, y, z)     (y ^ (x | ~z))

/* This is the central step in the MD5 algorithm. */

#define md5_step(f, w, x, y, z, data, s) \

        ( w += f (x, y, z) + data,  w = w << s | w >> (32 - s),  w += x )

  a = buf[0];

  b = buf[1];

  c = buf[2];

  d = buf[3];

  md5_step (F1, a, b, c, d, in[0]  + 0xd76aa478,  7);

  md5_step (F1, d, a, b, c, in[1]  + 0xe8c7b756, 12);

  md5_step (F1, c, d, a, b, in[2]  + 0x242070db, 17);

  md5_step (F1, b, c, d, a, in[3]  + 0xc1bdceee, 22);

  md5_step (F1, a, b, c, d, in[4]  + 0xf57c0faf,  7);

  md5_step (F1, d, a, b, c, in[5]  + 0x4787c62a, 12);

  md5_step (F1, c, d, a, b, in[6]  + 0xa8304613, 17);

  md5_step (F1, b, c, d, a, in[7]  + 0xfd469501, 22);

  md5_step (F1, a, b, c, d, in[8]  + 0x698098d8,  7);

  md5_step (F1, d, a, b, c, in[9]  + 0x8b44f7af, 12);

  md5_step (F1, c, d, a, b, in[10] + 0xffff5bb1, 17);

  md5_step (F1, b, c, d, a, in[11] + 0x895cd7be, 22);

  md5_step (F1, a, b, c, d, in[12] + 0x6b901122,  7);

  md5_step (F1, d, a, b, c, in[13] + 0xfd987193, 12);

  md5_step (F1, c, d, a, b, in[14] + 0xa679438e, 17);

  md5_step (F1, b, c, d, a, in[15] + 0x49b40821, 22);

  md5_step (F2, a, b, c, d, in[1]  + 0xf61e2562,  5);

  md5_step (F2, d, a, b, c, in[6]  + 0xc040b340,  9);

  md5_step (F2, c, d, a, b, in[11] + 0x265e5a51, 14);

  md5_step (F2, b, c, d, a, in[0]  + 0xe9b6c7aa, 20);

  md5_step (F2, a, b, c, d, in[5]  + 0xd62f105d,  5);

  md5_step (F2, d, a, b, c, in[10] + 0x02441453,  9);

  md5_step (F2, c, d, a, b, in[15] + 0xd8a1e681, 14);

  md5_step (F2, b, c, d, a, in[4]  + 0xe7d3fbc8, 20);

  md5_step (F2, a, b, c, d, in[9]  + 0x21e1cde6,  5);

  md5_step (F2, d, a, b, c, in[14] + 0xc33707d6,  9);

  md5_step (F2, c, d, a, b, in[3]  + 0xf4d50d87, 14);

  md5_step (F2, b, c, d, a, in[8]  + 0x455a14ed, 20);

  md5_step (F2, a, b, c, d, in[13] + 0xa9e3e905,  5);

  md5_step (F2, d, a, b, c, in[2]  + 0xfcefa3f8,  9);

  md5_step (F2, c, d, a, b, in[7]  + 0x676f02d9, 14);

  md5_step (F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);

  md5_step (F3, a, b, c, d, in[5]  + 0xfffa3942,  4);

  md5_step (F3, d, a, b, c, in[8]  + 0x8771f681, 11);

  md5_step (F3, c, d, a, b, in[11] + 0x6d9d6122, 16);

  md5_step (F3, b, c, d, a, in[14] + 0xfde5380c, 23);

  md5_step (F3, a, b, c, d, in[1]  + 0xa4beea44,  4);

  md5_step (F3, d, a, b, c, in[4]  + 0x4bdecfa9, 11);

  md5_step (F3, c, d, a, b, in[7]  + 0xf6bb4b60, 16);

  md5_step (F3, b, c, d, a, in[10] + 0xbebfbc70, 23);

  md5_step (F3, a, b, c, d, in[13] + 0x289b7ec6,  4);

  md5_step (F3, d, a, b, c, in[0]  + 0xeaa127fa, 11);

  md5_step (F3, c, d, a, b, in[3]  + 0xd4ef3085, 16);

  md5_step (F3, b, c, d, a, in[6]  + 0x04881d05, 23);

  md5_step (F3, a, b, c, d, in[9]  + 0xd9d4d039,  4);

  md5_step (F3, d, a, b, c, in[12] + 0xe6db99e5, 11);

  md5_step (F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);

  md5_step (F3, b, c, d, a, in[2]  + 0xc4ac5665, 23);

  md5_step (F4, a, b, c, d, in[0]  + 0xf4292244,  6);

  md5_step (F4, d, a, b, c, in[7]  + 0x432aff97, 10);

  md5_step (F4, c, d, a, b, in[14] + 0xab9423a7, 15);

  md5_step (F4, b, c, d, a, in[5]  + 0xfc93a039, 21);

  md5_step (F4, a, b, c, d, in[12] + 0x655b59c3,  6);

  md5_step (F4, d, a, b, c, in[3]  + 0x8f0ccc92, 10);

  md5_step (F4, c, d, a, b, in[10] + 0xffeff47d, 15);

  md5_step (F4, b, c, d, a, in[1]  + 0x85845dd1, 21);

  md5_step (F4, a, b, c, d, in[8]  + 0x6fa87e4f,  6);

  md5_step (F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);

  md5_step (F4, c, d, a, b, in[6]  + 0xa3014314, 15);

  md5_step (F4, b, c, d, a, in[13] + 0x4e0811a1, 21);

  md5_step (F4, a, b, c, d, in[4]  + 0xf7537e82,  6);

  md5_step (F4, d, a, b, c, in[11] + 0xbd3af235, 10);

  md5_step (F4, c, d, a, b, in[2]  + 0x2ad7d2bb, 15);

  md5_step (F4, b, c, d, a, in[9]  + 0xeb86d391, 21);

  buf[0] += a;

  buf[1] += b;

  buf[2] += c;

  buf[3] += d;

#undef F1

#undef F2

#undef F3

#undef F4

#undef md5_step

}

static void

md5_sum_update (Md5sum       *md5,

                const guchar *data,

                gsize         length)

{

  guint32 bit;

  bit = md5->bits[0];

  md5->bits[0] = bit + ((guint32) length << 3);

  /* carry from low to high */

  if (md5->bits[0] < bit)

    md5->bits[1] += 1;

  md5->bits[1] += length >> 29;

  /* bytes already in Md5sum->u.data */

  bit = (bit >> 3) & 0x3f;

  /* handle any leading odd-sized chunks */

  if (bit)

    {

      guchar *p = md5->u.data + bit;

      bit = MD5_DATASIZE - bit;

      if (length < bit)

        {

          memcpy (p, data, length);

          return;

        }

      memcpy (p, data, bit);

      md5_byte_reverse (md5->u.data, 16);

      md5_transform (md5->buf, md5->u.data32);

      data += bit;

      length -= bit;

    }

  /* process data in 64-byte chunks */

  while (length >= MD5_DATASIZE)

    {

      memcpy (md5->u.data, data, MD5_DATASIZE);

      md5_byte_reverse (md5->u.data, 16);

      md5_transform (md5->buf, md5->u.data32);

      data += MD5_DATASIZE;

      length -= MD5_DATASIZE;

    }

  /* handle any remaining bytes of data */

  memcpy (md5->u.data, data, length);

}

/* closes a checksum */

static void

md5_sum_close (Md5sum *md5)

{

  guint count;

  guchar *p;

  /* Compute number of bytes mod 64 */

  count = (md5->bits[0] >> 3) & 0x3F;

  /* Set the first char of padding to 0x80.

   * This is safe since there is always at least one byte free

   */

  p = md5->u.data + count;

  *p++ = 0x80;

  /* Bytes of padding needed to make 64 bytes */

  count = MD5_DATASIZE - 1 - count;

  /* Pad out to 56 mod 64 */

  if (count < 8)

    {

      /* Two lots of padding:  Pad the first block to 64 bytes */

      memset (p, 0, count);

      md5_byte_reverse (md5->u.data, 16);

      md5_transform (md5->buf, md5->u.data32);

      /* Now fill the next block with 56 bytes */

      memset (md5->u.data, 0, MD5_DATASIZE - 8);

    }

  else

    {

      /* Pad block to 56 bytes */

      memset (p, 0, count - 8);

    }

  md5_byte_reverse (md5->u.data, 14);

  /* Append length in bits and transform */

  md5->u.data32[14] = md5->bits[0];

  md5->u.data32[15] = md5->bits[1];

  md5_transform (md5->buf, md5->u.data32);

  md5_byte_reverse ((guchar *) md5->buf, 4);

  memcpy (md5->digest, md5->buf, 16);

  /* Reset buffers in case they contain sensitive data */

  memset (md5->buf, 0, sizeof (md5->buf));

  memset (md5->u.data, 0, sizeof (md5->u.data));

}

static gchar *

md5_sum_to_string (Md5sum *md5)

{

  return digest_to_string (md5->digest, MD5_DIGEST_LEN);

}

static void

md5_sum_digest (Md5sum *md5,

                guint8 *digest)

{

  gint i;

  for (i = 0; i < MD5_DIGEST_LEN; i++)

    digest[i] = md5->digest[i];

}

/*

 * SHA-1 Checksum

 */

/* The following implementation comes from D-Bus dbus-sha.c. I've changed

 * it to use GLib types and to work more like the MD5 implementation above.

 * I left the comments to have a history of this code.

 *      -- Emmanuele Bassi, ebassi@gnome.org

 */

/* The following comments have the history of where this code

 * comes from. I actually copied it from GNet in GNOME CVS.

 * - hp@redhat.com

 */

/*

 *  sha.h : Implementation of the Secure Hash Algorithm

 *

 * Part of the Python Cryptography Toolkit, version 1.0.0

 *

 * Copyright (C) 1995, A.M. Kuchling

 *

 * Distribute and use freely; there are no restrictions on further

 * dissemination and usage except those imposed by the laws of your

 * country of residence.

 *

 */

/* SHA: NIST's Secure Hash Algorithm */

/* Based on SHA code originally posted to sci.crypt by Peter Gutmann

   in message <30ajo5$oe8@ccu2.auckland.ac.nz>.

   Modified to test for endianness on creation of SHA objects by AMK.

   Also, the original specification of SHA was found to have a weakness

   by NSA/NIST.  This code implements the fixed version of SHA.

*/

/* Here's the first paragraph of Peter Gutmann's posting:

The following is my SHA (FIPS 180) code updated to allow use of the "fixed"

SHA, thanks to Jim Gillogly and an anonymous contributor for the information on

what's changed in the new version.  The fix is a simple change which involves

adding a single rotate in the initial expansion function.  It is unknown

whether this is an optimal solution to the problem which was discovered in the

SHA or whether it's simply a bandaid which fixes the problem with a minimum of

effort (for example the reengineering of a great many Capstone chips).

*/

static void

sha1_sum_init (Sha1sum *sha1)

{

  /* initialize constants */

  sha1->buf[0] = 0x67452301L;

  sha1->buf[1] = 0xEFCDAB89L;

  sha1->buf[2] = 0x98BADCFEL;

  sha1->buf[3] = 0x10325476L;

  sha1->buf[4] = 0xC3D2E1F0L;

  /* initialize bits */

  sha1->bits[0] = sha1->bits[1] = 0;

}

/* The SHA f()-functions. */

#define f1(x,y,z)       (z ^ (x & (y ^ z)))             /* Rounds  0-19 */

#define f2(x,y,z)       (x ^ y ^ z)                     /* Rounds 20-39 */

#define f3(x,y,z)       (( x & y) | (z & (x | y)))      /* Rounds 40-59 */

#define f4(x,y,z)       (x ^ y ^ z)                     /* Rounds 60-79 */

/* The SHA Mysterious Constants */

#define K1  0x5A827999L                                 /* Rounds  0-19 */

#define K2  0x6ED9EBA1L                                 /* Rounds 20-39 */

#define K3  0x8F1BBCDCL                                 /* Rounds 40-59 */

#define K4  0xCA62C1D6L                                 /* Rounds 60-79 */

/* 32-bit rotate left - kludged with shifts */

#define ROTL(n,X) (((X) << n ) | ((X) >> (32 - n)))

/* The initial expanding function.  The hash function is defined over an

   80-word expanded input array W, where the first 16 are copies of the input

   data, and the remaining 64 are defined by

        W[ i ] = W[ i - 16 ] ^ W[ i - 14 ] ^ W[ i - 8 ] ^ W[ i - 3 ]

   This implementation generates these values on the fly in a circular

   buffer - thanks to Colin Plumb, colin@nyx10.cs.du.edu for this

   optimization.

   The updated SHA changes the expanding function by adding a rotate of 1

   bit.  Thanks to Jim Gillogly, jim@rand.org, and an anonymous contributor

   for this information */

#define expand(W,i) (W[ i & 15 ] = ROTL (1, (W[ i       & 15] ^ \

                                             W[(i - 14) & 15] ^ \

                                             W[(i -  8) & 15] ^ \

                                             W[(i -  3) & 15])))

/* The prototype SHA sub-round.  The fundamental sub-round is:

        a' = e + ROTL( 5, a ) + f( b, c, d ) + k + data;

        b' = a;

        c' = ROTL( 30, b );

        d' = c;

        e' = d;

   but this is implemented by unrolling the loop 5 times and renaming the

   variables ( e, a, b, c, d ) = ( a', b', c', d', e' ) each iteration.

   This code is then replicated 20 times for each of the 4 functions, using

   the next 20 values from the W[] array each time */

#define subRound(a, b, c, d, e, f, k, data) \

   (e += ROTL (5, a) + f(b, c, d) + k + data, b = ROTL (30, b))

static void

sha1_transform (guint32  buf[5],

                guint32  in[16])

{

  guint32 A, B, C, D, E;

  A = buf[0];

  B = buf[1];

  C = buf[2];

  D = buf[3];

  E = buf[4];

  /* Heavy mangling, in 4 sub-rounds of 20 iterations each. */

  subRound (A, B, C, D, E, f1, K1, in[0]);

  subRound (E, A, B, C, D, f1, K1, in[1]);

  subRound (D, E, A, B, C, f1, K1, in[2]);

  subRound (C, D, E, A, B, f1, K1, in[3]);

  subRound (B, C, D, E, A, f1, K1, in[4]);

  subRound (A, B, C, D, E, f1, K1, in[5]);

  subRound (E, A, B, C, D, f1, K1, in[6]);

  subRound (D, E, A, B, C, f1, K1, in[7]);

  subRound (C, D, E, A, B, f1, K1, in[8]);

  subRound (B, C, D, E, A, f1, K1, in[9]);

  subRound (A, B, C, D, E, f1, K1, in[10]);

  subRound (E, A, B, C, D, f1, K1, in[11]);

  subRound (D, E, A, B, C, f1, K1, in[12]);

  subRound (C, D, E, A, B, f1, K1, in[13]);

  subRound (B, C, D, E, A, f1, K1, in[14]);

  subRound (A, B, C, D, E, f1, K1, in[15]);

  subRound (E, A, B, C, D, f1, K1, expand (in, 16));

  subRound (D, E, A, B, C, f1, K1, expand (in, 17));

  subRound (C, D, E, A, B, f1, K1, expand (in, 18));

  subRound (B, C, D, E, A, f1, K1, expand (in, 19));

  subRound (A, B, C, D, E, f2, K2, expand (in, 20));

  subRound (E, A, B, C, D, f2, K2, expand (in, 21));

  subRound (D, E, A, B, C, f2, K2, expand (in, 22));

  subRound (C, D, E, A, B, f2, K2, expand (in, 23));

  subRound (B, C, D, E, A, f2, K2, expand (in, 24));

  subRound (A, B, C, D, E, f2, K2, expand (in, 25));

  subRound (E, A, B, C, D, f2, K2, expand (in, 26));

  subRound (D, E, A, B, C, f2, K2, expand (in, 27));

  subRound (C, D, E, A, B, f2, K2, expand (in, 28));

  subRound (B, C, D, E, A, f2, K2, expand (in, 29));

  subRound (A, B, C, D, E, f2, K2, expand (in, 30));

  subRound (E, A, B, C, D, f2, K2, expand (in, 31));

  subRound (D, E, A, B, C, f2, K2, expand (in, 32));

  subRound (C, D, E, A, B, f2, K2, expand (in, 33));

  subRound (B, C, D, E, A, f2, K2, expand (in, 34));

  subRound (A, B, C, D, E, f2, K2, expand (in, 35));

  subRound (E, A, B, C, D, f2, K2, expand (in, 36));

  subRound (D, E, A, B, C, f2, K2, expand (in, 37));

  subRound (C, D, E, A, B, f2, K2, expand (in, 38));

  subRound (B, C, D, E, A, f2, K2, expand (in, 39));

  subRound (A, B, C, D, E, f3, K3, expand (in, 40));

  subRound (E, A, B, C, D, f3, K3, expand (in, 41));

  subRound (D, E, A, B, C, f3, K3, expand (in, 42));

  subRound (C, D, E, A, B, f3, K3, expand (in, 43));

  subRound (B, C, D, E, A, f3, K3, expand (in, 44));

  subRound (A, B, C, D, E, f3, K3, expand (in, 45));

  subRound (E, A, B, C, D, f3, K3, expand (in, 46));

  subRound (D, E, A, B, C, f3, K3, expand (in, 47));

  subRound (C, D, E, A, B, f3, K3, expand (in, 48));

  subRound (B, C, D, E, A, f3, K3, expand (in, 49));

  subRound (A, B, C, D, E, f3, K3, expand (in, 50));

  subRound (E, A, B, C, D, f3, K3, expand (in, 51));

  subRound (D, E, A, B, C, f3, K3, expand (in, 52));

  subRound (C, D, E, A, B, f3, K3, expand (in, 53));

  subRound (B, C, D, E, A, f3, K3, expand (in, 54));

  subRound (A, B, C, D, E, f3, K3, expand (in, 55));

  subRound (E, A, B, C, D, f3, K3, expand (in, 56));

  subRound (D, E, A, B, C, f3, K3, expand (in, 57));

  subRound (C, D, E, A, B, f3, K3, expand (in, 58));

  subRound (B, C, D, E, A, f3, K3, expand (in, 59));

  subRound (A, B, C, D, E, f4, K4, expand (in, 60));

  subRound (E, A, B, C, D, f4, K4, expand (in, 61));

  subRound (D, E, A, B, C, f4, K4, expand (in, 62));

  subRound (C, D, E, A, B, f4, K4, expand (in, 63));

  subRound (B, C, D, E, A, f4, K4, expand (in, 64));

  subRound (A, B, C, D, E, f4, K4, expand (in, 65));

  subRound (E, A, B, C, D, f4, K4, expand (in, 66));

  subRound (D, E, A, B, C, f4, K4, expand (in, 67));

  subRound (C, D, E, A, B, f4, K4, expand (in, 68));

  subRound (B, C, D, E, A, f4, K4, expand (in, 69));

  subRound (A, B, C, D, E, f4, K4, expand (in, 70));

  subRound (E, A, B, C, D, f4, K4, expand (in, 71));

  subRound (D, E, A, B, C, f4, K4, expand (in, 72));

  subRound (C, D, E, A, B, f4, K4, expand (in, 73));

  subRound (B, C, D, E, A, f4, K4, expand (in, 74));

  subRound (A, B, C, D, E, f4, K4, expand (in, 75));

  subRound (E, A, B, C, D, f4, K4, expand (in, 76));

  subRound (D, E, A, B, C, f4, K4, expand (in, 77));

  subRound (C, D, E, A, B, f4, K4, expand (in, 78));

  subRound (B, C, D, E, A, f4, K4, expand (in, 79));

  /* Build message digest */

  buf[0] += A;

  buf[1] += B;

  buf[2] += C;

  buf[3] += D;

  buf[4] += E;

}

#undef K1

#undef K2

#undef K3

#undef K4

#undef f1

#undef f2

#undef f3

#undef f4

#undef ROTL

#undef expand

#undef subRound

static void

sha1_sum_update (Sha1sum      *sha1,

                 const guchar *buffer,

                 gsize         count)

{

  guint32 tmp;

  guint dataCount;

  /* Update bitcount */

  tmp = sha1->bits[0];

  if ((sha1->bits[0] = tmp + ((guint32) count << 3) ) < tmp)

    sha1->bits[1] += 1;             /* Carry from low to high */

  sha1->bits[1] += count >> 29;

  /* Get count of bytes already in data */

  dataCount = (guint) (tmp >> 3) & 0x3F;

  /* Handle any leading odd-sized chunks */

  if (dataCount)

    {

      guchar *p = (guchar *) sha1->data + dataCount;

      dataCount = SHA1_DATASIZE - dataCount;

      if (count < dataCount)

        {

          memcpy (p, buffer, count);

          return;

        }

      memcpy (p, buffer, dataCount);

      sha_byte_reverse (sha1->data, SHA1_DATASIZE);

      sha1_transform (sha1->buf, sha1->data);

      buffer += dataCount;

      count -= dataCount;

    }

  /* Process data in SHA1_DATASIZE chunks */

  while (count >= SHA1_DATASIZE)

    {

      memcpy (sha1->data, buffer, SHA1_DATASIZE);

      sha_byte_reverse (sha1->data, SHA1_DATASIZE);

      sha1_transform (sha1->buf, sha1->data);

      buffer += SHA1_DATASIZE;

      count -= SHA1_DATASIZE;

    }

  /* Handle any remaining bytes of data. */

  memcpy (sha1->data, buffer, count);

}

/* Final wrapup - pad to SHA_DATASIZE-byte boundary with the bit pattern

   1 0* (64-bit count of bits processed, MSB-first) */

static void

sha1_sum_close (Sha1sum *sha1)

{

  size_t count;

  guchar *data_p;

  /* Compute number of bytes mod 64 */

  count = (sha1->bits[0] >> 3) & 0x3f;

  /* Set the first char of padding to 0x80.  This is safe since there is

     always at least one byte free */

  data_p = (guchar *) sha1->data + count;

  *data_p++ = 0x80;

  /* Bytes of padding needed to make 64 bytes */

  count = SHA1_DATASIZE - 1 - count;

  /* Pad out to 56 mod 64 */

  if (count < 8)

    {

      /* Two lots of padding:  Pad the first block to 64 bytes */

      memset (data_p, 0, count);

      sha_byte_reverse (sha1->data, SHA1_DATASIZE);

      sha1_transform (sha1->buf, sha1->data);

      /* Now fill the next block with 56 bytes */

      memset (sha1->data, 0, SHA1_DATASIZE - 8);

    }

  else

    {

      /* Pad block to 56 bytes */

      memset (data_p, 0, count - 8);

    }

  /* Append length in bits and transform */

  sha1->data[14] = sha1->bits[1];

  sha1->data[15] = sha1->bits[0];

  sha_byte_reverse (sha1->data, SHA1_DATASIZE - 8);

  sha1_transform (sha1->buf, sha1->data);

  sha_byte_reverse (sha1->buf, SHA1_DIGEST_LEN);

  memcpy (sha1->digest, sha1->buf, SHA1_DIGEST_LEN);

  /* Reset buffers in case they contain sensitive data */

  memset (sha1->buf, 0, sizeof (sha1->buf));

  memset (sha1->data, 0, sizeof (sha1->data));

}

static gchar *

sha1_sum_to_string (Sha1sum *sha1)

{

  return digest_to_string (sha1->digest, SHA1_DIGEST_LEN);

}

static void

sha1_sum_digest (Sha1sum *sha1,

                 guint8  *digest)

{

  size_t i;

  for (i = 0; i < SHA1_DIGEST_LEN; i++)

    digest[i] = sha1->digest[i];

}

/*

 * SHA-256 Checksum

 */

/* adapted from the SHA256 implementation in gsk/src/hash/gskhash.c.

 *

 * Copyright (C) 2006 Dave Benson

 * Released under the terms of the GNU Lesser General Public License

 */

static void

sha256_sum_init (Sha256sum *sha256)

{

  sha256->buf[0] = 0x6a09e667;

  sha256->buf[1] = 0xbb67ae85;

  sha256->buf[2] = 0x3c6ef372;

  sha256->buf[3] = 0xa54ff53a;

  sha256->buf[4] = 0x510e527f;

  sha256->buf[5] = 0x9b05688c;

  sha256->buf[6] = 0x1f83d9ab;

  sha256->buf[7] = 0x5be0cd19;

  sha256->bits[0] = sha256->bits[1] = 0;

}

#define GET_UINT32(n,b,i)               G_STMT_START{   \

    (n) = ((guint32) (b)[(i)    ] << 24)                \

        | ((guint32) (b)[(i) + 1] << 16)                \

        | ((guint32) (b)[(i) + 2] <<  8)                \

        | ((guint32) (b)[(i) + 3]      ); } G_STMT_END

#define PUT_UINT32(n,b,i)               G_STMT_START{   \

    (b)[(i)    ] = (guint8) ((n) >> 24);                \

    (b)[(i) + 1] = (guint8) ((n) >> 16);                \

    (b)[(i) + 2] = (guint8) ((n) >>  8);                \

    (b)[(i) + 3] = (guint8) ((n)      ); } G_STMT_END

static void

sha256_transform (guint32      buf[8],

                  guint8 const data[64])

{

  guint32 temp1, temp2, W[64];

  guint32 A, B, C, D, E, F, G, H;

  GET_UINT32 (W[0],  data,  0);

  GET_UINT32 (W[1],  data,  4);

  GET_UINT32 (W[2],  data,  8);

  GET_UINT32 (W[3],  data, 12);

  GET_UINT32 (W[4],  data, 16);

  GET_UINT32 (W[5],  data, 20);

  GET_UINT32 (W[6],  data, 24);

  GET_UINT32 (W[7],  data, 28);

  GET_UINT32 (W[8],  data, 32);

  GET_UINT32 (W[9],  data, 36);

  GET_UINT32 (W[10], data, 40);

  GET_UINT32 (W[11], data, 44);

  GET_UINT32 (W[12], data, 48);

  GET_UINT32 (W[13], data, 52);

  GET_UINT32 (W[14], data, 56);

  GET_UINT32 (W[15], data, 60);

#define SHR(x,n)        ((x & 0xFFFFFFFF) >> n)

#define ROTR(x,n)       (SHR (x,n) | (x << (32 - n)))

#define S0(x) (ROTR (x, 7) ^ ROTR (x,18) ^  SHR (x, 3))

#define S1(x) (ROTR (x,17) ^ ROTR (x,19) ^  SHR (x,10))

#define S2(x) (ROTR (x, 2) ^ ROTR (x,13) ^ ROTR (x,22))

#define S3(x) (ROTR (x, 6) ^ ROTR (x,11) ^ ROTR (x,25))

#define F0(x,y,z) ((x & y) | (z & (x | y)))

#define F1(x,y,z) (z ^ (x & (y ^ z)))

#define R(t)    (W[t] = S1(W[t -  2]) + W[t -  7] + \

                        S0(W[t - 15]) + W[t - 16])

#define P(a,b,c,d,e,f,g,h,x,K)          G_STMT_START {  \

        temp1 = h + S3(e) + F1(e,f,g) + K + x;          \

        temp2 = S2(a) + F0(a,b,c);                      \

        d += temp1; h = temp1 + temp2; } G_STMT_END

  A = buf[0];

  B = buf[1];

  C = buf[2];