/src/xz/src/liblzma/check/sha256.c
Line | Count | Source (jump to first uncovered line) |
1 | | /////////////////////////////////////////////////////////////////////////////// |
2 | | // |
3 | | /// \file sha256.c |
4 | | /// \brief SHA-256 |
5 | | /// |
6 | | /// \todo Crypto++ has x86 ASM optimizations. They use SSE so if they |
7 | | /// are imported to liblzma, SSE instructions need to be used |
8 | | /// conditionally to keep the code working on older boxes. |
9 | | // |
10 | | // This code is based on the code found from 7-Zip, which has a modified |
11 | | // version of the SHA-256 found from Crypto++ <https://www.cryptopp.com/>. |
12 | | // The code was modified a little to fit into liblzma. |
13 | | // |
14 | | // Authors: Kevin Springle |
15 | | // Wei Dai |
16 | | // Igor Pavlov |
17 | | // Lasse Collin |
18 | | // |
19 | | // This file has been put into the public domain. |
20 | | // You can do whatever you want with this file. |
21 | | // |
22 | | /////////////////////////////////////////////////////////////////////////////// |
23 | | |
24 | | #include "check.h" |
25 | | |
26 | | // Rotate a uint32_t. GCC can optimize this to a rotate instruction |
27 | | // at least on x86. |
28 | | static inline uint32_t |
29 | | rotr_32(uint32_t num, unsigned amount) |
30 | 95.5M | { |
31 | 95.5M | return (num >> amount) | (num << (32 - amount)); |
32 | 95.5M | } |
33 | | |
34 | | #define blk0(i) (W[i] = conv32be(data[i])) |
35 | | #define blk2(i) (W[i & 15] += s1(W[(i - 2) & 15]) + W[(i - 7) & 15] \ |
36 | | + s0(W[(i - 15) & 15])) |
37 | | |
38 | 10.6M | #define Ch(x, y, z) (z ^ (x & (y ^ z))) |
39 | 10.6M | #define Maj(x, y, z) ((x & (y ^ z)) + (y & z)) |
40 | | |
41 | 165k | #define a(i) T[(0 - i) & 7] |
42 | 165k | #define b(i) T[(1 - i) & 7] |
43 | 165k | #define c(i) T[(2 - i) & 7] |
44 | 10.7M | #define d(i) T[(3 - i) & 7] |
45 | 165k | #define e(i) T[(4 - i) & 7] |
46 | 165k | #define f(i) T[(5 - i) & 7] |
47 | 165k | #define g(i) T[(6 - i) & 7] |
48 | 32.0M | #define h(i) T[(7 - i) & 7] |
49 | | |
50 | | #define R(i, j, blk) \ |
51 | 10.6M | h(i) += S1(e(i)) + Ch(e(i), f(i), g(i)) + SHA256_K[i + j] + blk; \ |
52 | 10.6M | d(i) += h(i); \ |
53 | 10.6M | h(i) += S0(a(i)) + Maj(a(i), b(i), c(i)) |
54 | 2.65M | #define R0(i) R(i, 0, blk0(i)) |
55 | 7.96M | #define R2(i) R(i, j, blk2(i)) |
56 | | |
57 | 10.6M | #define S0(x) rotr_32(x ^ rotr_32(x ^ rotr_32(x, 9), 11), 2) |
58 | 10.6M | #define S1(x) rotr_32(x ^ rotr_32(x ^ rotr_32(x, 14), 5), 6) |
59 | | #define s0(x) (rotr_32(x ^ rotr_32(x, 11), 7) ^ (x >> 3)) |
60 | | #define s1(x) (rotr_32(x ^ rotr_32(x, 2), 17) ^ (x >> 10)) |
61 | | |
62 | | |
63 | | static const uint32_t SHA256_K[64] = { |
64 | | 0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5, |
65 | | 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5, |
66 | | 0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3, |
67 | | 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174, |
68 | | 0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC, |
69 | | 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA, |
70 | | 0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7, |
71 | | 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967, |
72 | | 0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13, |
73 | | 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85, |
74 | | 0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3, |
75 | | 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070, |
76 | | 0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5, |
77 | | 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3, |
78 | | 0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208, |
79 | | 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2, |
80 | | }; |
81 | | |
82 | | |
83 | | static void |
84 | | transform(uint32_t state[8], const uint32_t data[16]) |
85 | 165k | { |
86 | 165k | uint32_t W[16]; |
87 | 165k | uint32_t T[8]; |
88 | | |
89 | | // Copy state[] to working vars. |
90 | 165k | memcpy(T, state, sizeof(T)); |
91 | | |
92 | | // The first 16 operations unrolled |
93 | 165k | R0( 0); R0( 1); R0( 2); R0( 3); |
94 | 165k | R0( 4); R0( 5); R0( 6); R0( 7); |
95 | 165k | R0( 8); R0( 9); R0(10); R0(11); |
96 | 165k | R0(12); R0(13); R0(14); R0(15); |
97 | | |
98 | | // The remaining 48 operations partially unrolled |
99 | 663k | for (unsigned int j = 16; j < 64; j += 16) { |
100 | 497k | R2( 0); R2( 1); R2( 2); R2( 3); |
101 | 497k | R2( 4); R2( 5); R2( 6); R2( 7); |
102 | 497k | R2( 8); R2( 9); R2(10); R2(11); |
103 | 497k | R2(12); R2(13); R2(14); R2(15); |
104 | 497k | } |
105 | | |
106 | | // Add the working vars back into state[]. |
107 | 165k | state[0] += a(0); |
108 | 165k | state[1] += b(0); |
109 | 165k | state[2] += c(0); |
110 | 165k | state[3] += d(0); |
111 | 165k | state[4] += e(0); |
112 | 165k | state[5] += f(0); |
113 | 165k | state[6] += g(0); |
114 | 165k | state[7] += h(0); |
115 | 165k | } |
116 | | |
117 | | |
118 | | static void |
119 | | process(lzma_check_state *check) |
120 | 165k | { |
121 | 165k | transform(check->state.sha256.state, check->buffer.u32); |
122 | 165k | return; |
123 | 165k | } |
124 | | |
125 | | |
126 | | extern void |
127 | | lzma_sha256_init(lzma_check_state *check) |
128 | 118k | { |
129 | 118k | static const uint32_t s[8] = { |
130 | 118k | 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, |
131 | 118k | 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19, |
132 | 118k | }; |
133 | | |
134 | 118k | memcpy(check->state.sha256.state, s, sizeof(s)); |
135 | 118k | check->state.sha256.size = 0; |
136 | | |
137 | 118k | return; |
138 | 118k | } |
139 | | |
140 | | |
141 | | extern void |
142 | | lzma_sha256_update(const uint8_t *buf, size_t size, lzma_check_state *check) |
143 | 273k | { |
144 | | // Copy the input data into a properly aligned temporary buffer. |
145 | | // This way we can be called with arbitrarily sized buffers |
146 | | // (no need to be multiple of 64 bytes), and the code works also |
147 | | // on architectures that don't allow unaligned memory access. |
148 | 546k | while (size > 0) { |
149 | 273k | const size_t copy_start = check->state.sha256.size & 0x3F; |
150 | 273k | size_t copy_size = 64 - copy_start; |
151 | 273k | if (copy_size > size) |
152 | 205k | copy_size = size; |
153 | | |
154 | 273k | memcpy(check->buffer.u8 + copy_start, buf, copy_size); |
155 | | |
156 | 273k | buf += copy_size; |
157 | 273k | size -= copy_size; |
158 | 273k | check->state.sha256.size += copy_size; |
159 | | |
160 | 273k | if ((check->state.sha256.size & 0x3F) == 0) |
161 | 67.7k | process(check); |
162 | 273k | } |
163 | | |
164 | 273k | return; |
165 | 273k | } |
166 | | |
167 | | |
168 | | extern void |
169 | | lzma_sha256_finish(lzma_check_state *check) |
170 | 98.1k | { |
171 | | // Add padding as described in RFC 3174 (it describes SHA-1 but |
172 | | // the same padding style is used for SHA-256 too). |
173 | 98.1k | size_t pos = check->state.sha256.size & 0x3F; |
174 | 98.1k | check->buffer.u8[pos++] = 0x80; |
175 | | |
176 | 5.47M | while (pos != 64 - 8) { |
177 | 5.38M | if (pos == 64) { |
178 | 0 | process(check); |
179 | 0 | pos = 0; |
180 | 0 | } |
181 | | |
182 | 5.38M | check->buffer.u8[pos++] = 0x00; |
183 | 5.38M | } |
184 | | |
185 | | // Convert the message size from bytes to bits. |
186 | 98.1k | check->state.sha256.size *= 8; |
187 | | |
188 | 98.1k | check->buffer.u64[(64 - 8) / 8] = conv64be(check->state.sha256.size); |
189 | | |
190 | 98.1k | process(check); |
191 | | |
192 | 883k | for (size_t i = 0; i < 8; ++i) |
193 | 784k | check->buffer.u32[i] = conv32be(check->state.sha256.state[i]); |
194 | | |
195 | 98.1k | return; |
196 | 98.1k | } |