Back to home page

LXR

 
 

    


0001 /*
0002  * Cryptographic API.
0003  *
0004  * SHA-256, as specified in
0005  * http://csrc.nist.gov/groups/STM/cavp/documents/shs/sha256-384-512.pdf
0006  *
0007  * SHA-256 code by Jean-Luc Cooke <jlcooke@certainkey.com>.
0008  *
0009  * Copyright (c) Jean-Luc Cooke <jlcooke@certainkey.com>
0010  * Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk>
0011  * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
0012  * SHA224 Support Copyright 2007 Intel Corporation <jonathan.lynch@intel.com>
0013  *
0014  * This program is free software; you can redistribute it and/or modify it
0015  * under the terms of the GNU General Public License as published by the Free
0016  * Software Foundation; either version 2 of the License, or (at your option) 
0017  * any later version.
0018  *
0019  */
0020 #include <crypto/internal/hash.h>
0021 #include <linux/init.h>
0022 #include <linux/module.h>
0023 #include <linux/mm.h>
0024 #include <linux/types.h>
0025 #include <crypto/sha.h>
0026 #include <crypto/sha256_base.h>
0027 #include <asm/byteorder.h>
0028 #include <asm/unaligned.h>
0029 
0030 const u8 sha224_zero_message_hash[SHA224_DIGEST_SIZE] = {
0031     0xd1, 0x4a, 0x02, 0x8c, 0x2a, 0x3a, 0x2b, 0xc9, 0x47,
0032     0x61, 0x02, 0xbb, 0x28, 0x82, 0x34, 0xc4, 0x15, 0xa2,
0033     0xb0, 0x1f, 0x82, 0x8e, 0xa6, 0x2a, 0xc5, 0xb3, 0xe4,
0034     0x2f
0035 };
0036 EXPORT_SYMBOL_GPL(sha224_zero_message_hash);
0037 
0038 const u8 sha256_zero_message_hash[SHA256_DIGEST_SIZE] = {
0039     0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14,
0040     0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24,
0041     0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
0042     0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55
0043 };
0044 EXPORT_SYMBOL_GPL(sha256_zero_message_hash);
0045 
0046 static inline u32 Ch(u32 x, u32 y, u32 z)
0047 {
0048     return z ^ (x & (y ^ z));
0049 }
0050 
0051 static inline u32 Maj(u32 x, u32 y, u32 z)
0052 {
0053     return (x & y) | (z & (x | y));
0054 }
0055 
0056 #define e0(x)       (ror32(x, 2) ^ ror32(x,13) ^ ror32(x,22))
0057 #define e1(x)       (ror32(x, 6) ^ ror32(x,11) ^ ror32(x,25))
0058 #define s0(x)       (ror32(x, 7) ^ ror32(x,18) ^ (x >> 3))
0059 #define s1(x)       (ror32(x,17) ^ ror32(x,19) ^ (x >> 10))
0060 
0061 static inline void LOAD_OP(int I, u32 *W, const u8 *input)
0062 {
0063     W[I] = get_unaligned_be32((__u32 *)input + I);
0064 }
0065 
0066 static inline void BLEND_OP(int I, u32 *W)
0067 {
0068     W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
0069 }
0070 
0071 static void sha256_transform(u32 *state, const u8 *input)
0072 {
0073     u32 a, b, c, d, e, f, g, h, t1, t2;
0074     u32 W[64];
0075     int i;
0076 
0077     /* load the input */
0078     for (i = 0; i < 16; i++)
0079         LOAD_OP(i, W, input);
0080 
0081     /* now blend */
0082     for (i = 16; i < 64; i++)
0083         BLEND_OP(i, W);
0084 
0085     /* load the state into our registers */
0086     a=state[0];  b=state[1];  c=state[2];  d=state[3];
0087     e=state[4];  f=state[5];  g=state[6];  h=state[7];
0088 
0089     /* now iterate */
0090     t1 = h + e1(e) + Ch(e,f,g) + 0x428a2f98 + W[ 0];
0091     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0092     t1 = g + e1(d) + Ch(d,e,f) + 0x71374491 + W[ 1];
0093     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0094     t1 = f + e1(c) + Ch(c,d,e) + 0xb5c0fbcf + W[ 2];
0095     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0096     t1 = e + e1(b) + Ch(b,c,d) + 0xe9b5dba5 + W[ 3];
0097     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0098     t1 = d + e1(a) + Ch(a,b,c) + 0x3956c25b + W[ 4];
0099     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0100     t1 = c + e1(h) + Ch(h,a,b) + 0x59f111f1 + W[ 5];
0101     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0102     t1 = b + e1(g) + Ch(g,h,a) + 0x923f82a4 + W[ 6];
0103     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0104     t1 = a + e1(f) + Ch(f,g,h) + 0xab1c5ed5 + W[ 7];
0105     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0106 
0107     t1 = h + e1(e) + Ch(e,f,g) + 0xd807aa98 + W[ 8];
0108     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0109     t1 = g + e1(d) + Ch(d,e,f) + 0x12835b01 + W[ 9];
0110     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0111     t1 = f + e1(c) + Ch(c,d,e) + 0x243185be + W[10];
0112     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0113     t1 = e + e1(b) + Ch(b,c,d) + 0x550c7dc3 + W[11];
0114     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0115     t1 = d + e1(a) + Ch(a,b,c) + 0x72be5d74 + W[12];
0116     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0117     t1 = c + e1(h) + Ch(h,a,b) + 0x80deb1fe + W[13];
0118     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0119     t1 = b + e1(g) + Ch(g,h,a) + 0x9bdc06a7 + W[14];
0120     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0121     t1 = a + e1(f) + Ch(f,g,h) + 0xc19bf174 + W[15];
0122     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0123 
0124     t1 = h + e1(e) + Ch(e,f,g) + 0xe49b69c1 + W[16];
0125     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0126     t1 = g + e1(d) + Ch(d,e,f) + 0xefbe4786 + W[17];
0127     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0128     t1 = f + e1(c) + Ch(c,d,e) + 0x0fc19dc6 + W[18];
0129     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0130     t1 = e + e1(b) + Ch(b,c,d) + 0x240ca1cc + W[19];
0131     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0132     t1 = d + e1(a) + Ch(a,b,c) + 0x2de92c6f + W[20];
0133     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0134     t1 = c + e1(h) + Ch(h,a,b) + 0x4a7484aa + W[21];
0135     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0136     t1 = b + e1(g) + Ch(g,h,a) + 0x5cb0a9dc + W[22];
0137     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0138     t1 = a + e1(f) + Ch(f,g,h) + 0x76f988da + W[23];
0139     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0140 
0141     t1 = h + e1(e) + Ch(e,f,g) + 0x983e5152 + W[24];
0142     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0143     t1 = g + e1(d) + Ch(d,e,f) + 0xa831c66d + W[25];
0144     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0145     t1 = f + e1(c) + Ch(c,d,e) + 0xb00327c8 + W[26];
0146     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0147     t1 = e + e1(b) + Ch(b,c,d) + 0xbf597fc7 + W[27];
0148     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0149     t1 = d + e1(a) + Ch(a,b,c) + 0xc6e00bf3 + W[28];
0150     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0151     t1 = c + e1(h) + Ch(h,a,b) + 0xd5a79147 + W[29];
0152     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0153     t1 = b + e1(g) + Ch(g,h,a) + 0x06ca6351 + W[30];
0154     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0155     t1 = a + e1(f) + Ch(f,g,h) + 0x14292967 + W[31];
0156     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0157 
0158     t1 = h + e1(e) + Ch(e,f,g) + 0x27b70a85 + W[32];
0159     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0160     t1 = g + e1(d) + Ch(d,e,f) + 0x2e1b2138 + W[33];
0161     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0162     t1 = f + e1(c) + Ch(c,d,e) + 0x4d2c6dfc + W[34];
0163     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0164     t1 = e + e1(b) + Ch(b,c,d) + 0x53380d13 + W[35];
0165     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0166     t1 = d + e1(a) + Ch(a,b,c) + 0x650a7354 + W[36];
0167     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0168     t1 = c + e1(h) + Ch(h,a,b) + 0x766a0abb + W[37];
0169     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0170     t1 = b + e1(g) + Ch(g,h,a) + 0x81c2c92e + W[38];
0171     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0172     t1 = a + e1(f) + Ch(f,g,h) + 0x92722c85 + W[39];
0173     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0174 
0175     t1 = h + e1(e) + Ch(e,f,g) + 0xa2bfe8a1 + W[40];
0176     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0177     t1 = g + e1(d) + Ch(d,e,f) + 0xa81a664b + W[41];
0178     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0179     t1 = f + e1(c) + Ch(c,d,e) + 0xc24b8b70 + W[42];
0180     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0181     t1 = e + e1(b) + Ch(b,c,d) + 0xc76c51a3 + W[43];
0182     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0183     t1 = d + e1(a) + Ch(a,b,c) + 0xd192e819 + W[44];
0184     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0185     t1 = c + e1(h) + Ch(h,a,b) + 0xd6990624 + W[45];
0186     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0187     t1 = b + e1(g) + Ch(g,h,a) + 0xf40e3585 + W[46];
0188     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0189     t1 = a + e1(f) + Ch(f,g,h) + 0x106aa070 + W[47];
0190     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0191 
0192     t1 = h + e1(e) + Ch(e,f,g) + 0x19a4c116 + W[48];
0193     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0194     t1 = g + e1(d) + Ch(d,e,f) + 0x1e376c08 + W[49];
0195     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0196     t1 = f + e1(c) + Ch(c,d,e) + 0x2748774c + W[50];
0197     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0198     t1 = e + e1(b) + Ch(b,c,d) + 0x34b0bcb5 + W[51];
0199     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0200     t1 = d + e1(a) + Ch(a,b,c) + 0x391c0cb3 + W[52];
0201     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0202     t1 = c + e1(h) + Ch(h,a,b) + 0x4ed8aa4a + W[53];
0203     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0204     t1 = b + e1(g) + Ch(g,h,a) + 0x5b9cca4f + W[54];
0205     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0206     t1 = a + e1(f) + Ch(f,g,h) + 0x682e6ff3 + W[55];
0207     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0208 
0209     t1 = h + e1(e) + Ch(e,f,g) + 0x748f82ee + W[56];
0210     t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
0211     t1 = g + e1(d) + Ch(d,e,f) + 0x78a5636f + W[57];
0212     t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
0213     t1 = f + e1(c) + Ch(c,d,e) + 0x84c87814 + W[58];
0214     t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
0215     t1 = e + e1(b) + Ch(b,c,d) + 0x8cc70208 + W[59];
0216     t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
0217     t1 = d + e1(a) + Ch(a,b,c) + 0x90befffa + W[60];
0218     t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
0219     t1 = c + e1(h) + Ch(h,a,b) + 0xa4506ceb + W[61];
0220     t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
0221     t1 = b + e1(g) + Ch(g,h,a) + 0xbef9a3f7 + W[62];
0222     t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
0223     t1 = a + e1(f) + Ch(f,g,h) + 0xc67178f2 + W[63];
0224     t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
0225 
0226     state[0] += a; state[1] += b; state[2] += c; state[3] += d;
0227     state[4] += e; state[5] += f; state[6] += g; state[7] += h;
0228 
0229     /* clear any sensitive info... */
0230     a = b = c = d = e = f = g = h = t1 = t2 = 0;
0231     memzero_explicit(W, 64 * sizeof(u32));
0232 }
0233 
0234 static void sha256_generic_block_fn(struct sha256_state *sst, u8 const *src,
0235                     int blocks)
0236 {
0237     while (blocks--) {
0238         sha256_transform(sst->state, src);
0239         src += SHA256_BLOCK_SIZE;
0240     }
0241 }
0242 
0243 int crypto_sha256_update(struct shash_desc *desc, const u8 *data,
0244               unsigned int len)
0245 {
0246     return sha256_base_do_update(desc, data, len, sha256_generic_block_fn);
0247 }
0248 EXPORT_SYMBOL(crypto_sha256_update);
0249 
0250 static int sha256_final(struct shash_desc *desc, u8 *out)
0251 {
0252     sha256_base_do_finalize(desc, sha256_generic_block_fn);
0253     return sha256_base_finish(desc, out);
0254 }
0255 
0256 int crypto_sha256_finup(struct shash_desc *desc, const u8 *data,
0257             unsigned int len, u8 *hash)
0258 {
0259     sha256_base_do_update(desc, data, len, sha256_generic_block_fn);
0260     return sha256_final(desc, hash);
0261 }
0262 EXPORT_SYMBOL(crypto_sha256_finup);
0263 
0264 static struct shash_alg sha256_algs[2] = { {
0265     .digestsize =   SHA256_DIGEST_SIZE,
0266     .init       =   sha256_base_init,
0267     .update     =   crypto_sha256_update,
0268     .final      =   sha256_final,
0269     .finup      =   crypto_sha256_finup,
0270     .descsize   =   sizeof(struct sha256_state),
0271     .base       =   {
0272         .cra_name   =   "sha256",
0273         .cra_driver_name=   "sha256-generic",
0274         .cra_flags  =   CRYPTO_ALG_TYPE_SHASH,
0275         .cra_blocksize  =   SHA256_BLOCK_SIZE,
0276         .cra_module =   THIS_MODULE,
0277     }
0278 }, {
0279     .digestsize =   SHA224_DIGEST_SIZE,
0280     .init       =   sha224_base_init,
0281     .update     =   crypto_sha256_update,
0282     .final      =   sha256_final,
0283     .finup      =   crypto_sha256_finup,
0284     .descsize   =   sizeof(struct sha256_state),
0285     .base       =   {
0286         .cra_name   =   "sha224",
0287         .cra_driver_name=   "sha224-generic",
0288         .cra_flags  =   CRYPTO_ALG_TYPE_SHASH,
0289         .cra_blocksize  =   SHA224_BLOCK_SIZE,
0290         .cra_module =   THIS_MODULE,
0291     }
0292 } };
0293 
0294 static int __init sha256_generic_mod_init(void)
0295 {
0296     return crypto_register_shashes(sha256_algs, ARRAY_SIZE(sha256_algs));
0297 }
0298 
0299 static void __exit sha256_generic_mod_fini(void)
0300 {
0301     crypto_unregister_shashes(sha256_algs, ARRAY_SIZE(sha256_algs));
0302 }
0303 
0304 module_init(sha256_generic_mod_init);
0305 module_exit(sha256_generic_mod_fini);
0306 
0307 MODULE_LICENSE("GPL");
0308 MODULE_DESCRIPTION("SHA-224 and SHA-256 Secure Hash Algorithm");
0309 
0310 MODULE_ALIAS_CRYPTO("sha224");
0311 MODULE_ALIAS_CRYPTO("sha224-generic");
0312 MODULE_ALIAS_CRYPTO("sha256");
0313 MODULE_ALIAS_CRYPTO("sha256-generic");