1 | /* Copyright (c) (2010,2011,2015-2019,2021,2022) Apple Inc. All rights reserved. |
2 | * |
3 | * corecrypto is licensed under Apple Inc.’s Internal Use License Agreement (which |
4 | * is contained in the License.txt file distributed with corecrypto) and only to |
5 | * people who accept that license. IMPORTANT: Any license rights granted to you by |
6 | * Apple Inc. (if any) are limited to internal use within your organization only on |
7 | * devices and computers you own or control, for the sole purpose of verifying the |
8 | * security characteristics and correct functioning of the Apple Software. You may |
9 | * not, directly or indirectly, redistribute the Apple Software or any portions thereof. |
10 | * |
11 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
12 | * |
13 | * This file contains Original Code and/or Modifications of Original Code |
14 | * as defined in and that are subject to the Apple Public Source License |
15 | * Version 2.0 (the 'License'). You may not use this file except in |
16 | * compliance with the License. The rights granted to you under the License |
17 | * may not be used to create, or enable the creation or redistribution of, |
18 | * unlawful or unlicensed copies of an Apple operating system, or to |
19 | * circumvent, violate, or enable the circumvention or violation of, any |
20 | * terms of an Apple operating system software license agreement. |
21 | * |
22 | * Please obtain a copy of the License at |
23 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
24 | * |
25 | * The Original Code and all software distributed under the License are |
26 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
27 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
28 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
29 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
30 | * Please see the License for the specific language governing rights and |
31 | * limitations under the License. |
32 | * |
33 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
34 | */ |
35 | |
36 | /* |
37 | * Parts of this code adapted from LibTomCrypt |
38 | * |
39 | * LibTomCrypt, modular cryptographic library -- Tom St Denis |
40 | * |
41 | * LibTomCrypt is a library that provides various cryptographic |
42 | * algorithms in a highly modular and flexible manner. |
43 | * |
44 | * The library is free for all purposes without any express |
45 | * guarantee it works. |
46 | * |
47 | * Tom St Denis, tomstdenis@gmail.com, http://libtom.org |
48 | */ |
49 | |
50 | #include <corecrypto/ccsha2.h> |
51 | #include "cc_internal.h" |
52 | #include "ccsha2_internal.h" |
53 | |
54 | #if !CC_KERNEL || !CC_USE_ASM |
55 | |
56 | #if CCSHA2_SHA256_USE_SHA512_K |
57 | #define K(i) ((uint32_t)(ccsha512_K[i] >> 32)) |
58 | #else |
59 | #define K(i) ccsha256_K[i] |
60 | #endif |
61 | |
62 | // Various logical functions |
63 | #define Ch(x, y, z) (z ^ (x & (y ^ z))) |
64 | #define Maj(x, y, z) (((x | y) & z) | (x & y)) |
65 | #define S(x, n) CC_RORc(x, n) |
66 | #define R(x, n) ((x) >> (n)) |
67 | #define Sigma0(x) (S(x, 2) ^ S(x, 13) ^ S(x, 22)) |
68 | #define Sigma1(x) (S(x, 6) ^ S(x, 11) ^ S(x, 25)) |
69 | #define Gamma0(x) (S(x, 7) ^ S(x, 18) ^ R(x, 3)) |
70 | #define Gamma1(x) (S(x, 17) ^ S(x, 19) ^ R(x, 10)) |
71 | |
72 | #define set_W(i) (W[i] = cc_load32_be(buf + (4 * (i)))) |
73 | |
74 | // the round function |
75 | #define RND(a, b, c, d, e, f, g, h, i) \ |
76 | t0 = h + Sigma1(e) + Ch(e, f, g) + K(i) + W[i]; \ |
77 | t1 = Sigma0(a) + Maj(a, b, c); \ |
78 | d += t0; \ |
79 | h = t0 + t1; |
80 | |
81 | // compress 512-bits |
82 | void |
83 | ccsha256_ltc_compress(ccdigest_state_t state, size_t nblocks, const void *in) |
84 | { |
85 | uint32_t W[64], t0, t1; |
86 | uint32_t S[8]; |
87 | int i; |
88 | uint32_t *s = ccdigest_u32(state); |
89 | const unsigned char *buf = in; |
90 | |
91 | while (nblocks--) { |
92 | // schedule W 0..15 |
93 | for (i = 0; i < 16; i += 1) { |
94 | set_W(i); |
95 | } |
96 | |
97 | // schedule W 16..63 |
98 | for (; i < 64; i++) { |
99 | W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16]; |
100 | } |
101 | |
102 | // copy state into S |
103 | S[0] = s[0]; |
104 | S[1] = s[1]; |
105 | S[2] = s[2]; |
106 | S[3] = s[3]; |
107 | S[4] = s[4]; |
108 | S[5] = s[5]; |
109 | S[6] = s[6]; |
110 | S[7] = s[7]; |
111 | |
112 | // Compress |
113 | #if CC_SMALL_CODE |
114 | for (i = 0; i < 64; i += 1) { |
115 | t0 = S[7] + Sigma1(S[4]) + Ch(S[4], S[5], S[6]) + K(i) + W[i]; |
116 | t1 = Sigma0(S[0]) + Maj(S[0], S[1], S[2]); |
117 | S[7] = S[6]; |
118 | S[6] = S[5]; |
119 | S[5] = S[4]; |
120 | S[4] = S[3] + t0; |
121 | S[3] = S[2]; |
122 | S[2] = S[1]; |
123 | S[1] = S[0]; |
124 | S[0] = t0 + t1; |
125 | } |
126 | #else |
127 | for (i = 0; i < 64; i += 8) { |
128 | RND(S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i + 0); |
129 | RND(S[7], S[0], S[1], S[2], S[3], S[4], S[5], S[6], i + 1); |
130 | RND(S[6], S[7], S[0], S[1], S[2], S[3], S[4], S[5], i + 2); |
131 | RND(S[5], S[6], S[7], S[0], S[1], S[2], S[3], S[4], i + 3); |
132 | RND(S[4], S[5], S[6], S[7], S[0], S[1], S[2], S[3], i + 4); |
133 | RND(S[3], S[4], S[5], S[6], S[7], S[0], S[1], S[2], i + 5); |
134 | RND(S[2], S[3], S[4], S[5], S[6], S[7], S[0], S[1], i + 6); |
135 | RND(S[1], S[2], S[3], S[4], S[5], S[6], S[7], S[0], i + 7); |
136 | } |
137 | #endif |
138 | |
139 | // feedback |
140 | s[0] += S[0]; |
141 | s[1] += S[1]; |
142 | s[2] += S[2]; |
143 | s[3] += S[3]; |
144 | s[4] += S[4]; |
145 | s[5] += S[5]; |
146 | s[6] += S[6]; |
147 | s[7] += S[7]; |
148 | |
149 | buf += CCSHA256_BLOCK_SIZE / sizeof(buf[0]); |
150 | } |
151 | } |
152 | |
153 | #endif |
154 | |