15  *
  16  * License is also granted to make and use derivative works provided
  17  * that such works are identified as "derived from the RSA Data
  18  * Security, Inc. MD5 Message-Digest Algorithm" in all material
  19  * mentioning or referencing the derived work.
  20  *
  21  * RSA Data Security, Inc. makes no representations concerning either
  22  * the merchantability of this software or the suitability of this
  23  * software for any particular purpose. It is provided "as is"
  24  * without express or implied warranty of any kind.
  25  *
  26  * These notices must be retained in any copies of any part of this
  27  * documentation and/or software.
  28  *
  29  * NOTE: Cleaned-up and optimized, version of SHA1, based on the FIPS 180-1
  30  * standard, available at http://www.itl.nist.gov/fipspubs/fip180-1.htm
  31  * Not as fast as one would like -- further optimizations are encouraged
  32  * and appreciated.
  33  */
  34 




  35 #if !defined(_KERNEL) && !defined(_BOOT)
  36 #include <stdint.h>
  37 #include <strings.h>
  38 #include <stdlib.h>
  39 #include <errno.h>
  40 #include <sys/systeminfo.h>
  41 #endif  /* !_KERNEL && !_BOOT */

  42 
  43 #include <sys/types.h>
  44 #include <sys/param.h>
  45 #include <sys/systm.h>
  46 #include <sys/sysmacros.h>
  47 #include <sys/sha1.h>
  48 #include <sys/sha1_consts.h>
  49 









  50 #ifdef _LITTLE_ENDIAN
  51 #include <sys/byteorder.h>
  52 #define HAVE_HTONL
  53 #endif

  54 
  55 #ifdef  _BOOT
  56 #define bcopy(_s, _d, _l)       ((void) memcpy((_d), (_s), (_l)))
  57 #define bzero(_m, _l)           ((void) memset((_m), 0, (_l)))
  58 #endif
  59 
  60 static void Encode(uint8_t *, const uint32_t *, size_t);
  61 
  62 #if     defined(__sparc)
  63 
  64 #define SHA1_TRANSFORM(ctx, in) \
  65         SHA1Transform((ctx)->state[0], (ctx)->state[1], (ctx)->state[2], \
  66                 (ctx)->state[3], (ctx)->state[4], (ctx), (in))
  67 
  68 static void SHA1Transform(uint32_t, uint32_t, uint32_t, uint32_t, uint32_t,
  69     SHA1_CTX *, const uint8_t *);
  70 
  71 #elif   defined(__amd64)
  72 
  73 #define SHA1_TRANSFORM(ctx, in) sha1_block_data_order((ctx), (in), 1)
  74 #define SHA1_TRANSFORM_BLOCKS(ctx, in, num) sha1_block_data_order((ctx), \
  75                 (in), (num))
  76 
  77 void sha1_block_data_order(SHA1_CTX *ctx, const void *inpp, size_t num_blocks);
  78 
  79 #else
  80 
  81 #define SHA1_TRANSFORM(ctx, in) SHA1Transform((ctx), (in))
  82 
  83 static void SHA1Transform(SHA1_CTX *, const uint8_t *);
  84 
  85 #endif
  86 
  87 
  88 static uint8_t PADDING[64] = { 0x80, /* all zeros */ };
  89 
  90 /*
  91  * F, G, and H are the basic SHA1 functions.

 317                  * will be an expensive nop.
 318                  */
 319 
 320                 if (input_len == i)
 321                         return;
 322 
 323                 buf_index = 0;
 324         }
 325 
 326         /* buffer remaining input */
 327         bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
 328 }
 329 
 330 #else /* VIS_SHA1 */
 331 
 332 void
 333 SHA1Update(SHA1_CTX *ctx, const void *inptr, size_t input_len)
 334 {
 335         uint32_t i, buf_index, buf_len;
 336         const uint8_t *input = inptr;
 337 #if defined(__amd64)
 338         uint32_t        block_count;
 339 #endif  /* __amd64 */
 340 
 341         /* check for noop */
 342         if (input_len == 0)
 343                 return;
 344 
 345         /* compute number of bytes mod 64 */
 346         buf_index = (ctx->count[1] >> 3) & 0x3F;
 347 
 348         /* update number of bits */
 349         if ((ctx->count[1] += (input_len << 3)) < (input_len << 3))
 350                 ctx->count[0]++;
 351 
 352         ctx->count[0] += (input_len >> 29);
 353 
 354         buf_len = 64 - buf_index;
 355 
 356         /* transform as many times as possible */
 357         i = 0;
 358         if (input_len >= buf_len) {
 359 
 360                 /*
 361                  * general optimization:
 362                  *
 363                  * only do initial bcopy() and SHA1Transform() if
 364                  * buf_index != 0.  if buf_index == 0, we're just
 365                  * wasting our time doing the bcopy() since there
 366                  * wasn't any data left over from a previous call to
 367                  * SHA1Update().
 368                  */
 369 
 370                 if (buf_index) {
 371                         bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
 372                         SHA1_TRANSFORM(ctx, ctx->buf_un.buf8);
 373                         i = buf_len;
 374                 }
 375 
 376 #if !defined(__amd64)
 377                 for (; i + 63 < input_len; i += 64)
 378                         SHA1_TRANSFORM(ctx, &input[i]);
 379 #else
 380                 block_count = (input_len - i) >> 6;
 381                 if (block_count > 0) {
 382                         SHA1_TRANSFORM_BLOCKS(ctx, &input[i], block_count);
 383                         i += block_count << 6;
 384                 }
 385 #endif  /* !__amd64 */
 386 
 387                 /*
 388                  * general optimization:
 389                  *
 390                  * if i and input_len are the same, return now instead
 391                  * of calling bcopy(), since the bcopy() in this case
 392                  * will be an expensive nop.
 393                  */
 394 
 395                 if (input_len == i)
 396                         return;

 422         uint8_t         bitcount_be[sizeof (ctx->count)];
 423         uint32_t        index = (ctx->count[1] >> 3) & 0x3f;
 424 
 425         /* store bit count, big endian */
 426         Encode(bitcount_be, ctx->count, sizeof (bitcount_be));
 427 
 428         /* pad out to 56 mod 64 */
 429         SHA1Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
 430 
 431         /* append length (before padding) */
 432         SHA1Update(ctx, bitcount_be, sizeof (bitcount_be));
 433 
 434         /* store state in digest */
 435         Encode(digest, ctx->state, sizeof (ctx->state));
 436 
 437         /* zeroize sensitive information */
 438         bzero(ctx, sizeof (*ctx));
 439 }
 440 
 441 
 442 #if !defined(__amd64)
 443 
 444 typedef uint32_t sha1word;
 445 
 446 /*
 447  * sparc optimization:
 448  *
 449  * on the sparc, we can load big endian 32-bit data easily.  note that
 450  * special care must be taken to ensure the address is 32-bit aligned.
 451  * in the interest of speed, we don't check to make sure, since
 452  * careful programming can guarantee this for us.
 453  */
 454 
 455 #if     defined(_BIG_ENDIAN)
 456 #define LOAD_BIG_32(addr)       (*(uint32_t *)(addr))
 457 
 458 #elif   defined(HAVE_HTONL)
 459 #define LOAD_BIG_32(addr) htonl(*((uint32_t *)(addr)))
 460 
 461 #else
 462 /* little endian -- will work on big endian, but slowly */

  15  *
  16  * License is also granted to make and use derivative works provided
  17  * that such works are identified as "derived from the RSA Data
  18  * Security, Inc. MD5 Message-Digest Algorithm" in all material
  19  * mentioning or referencing the derived work.
  20  *
  21  * RSA Data Security, Inc. makes no representations concerning either
  22  * the merchantability of this software or the suitability of this
  23  * software for any particular purpose. It is provided "as is"
  24  * without express or implied warranty of any kind.
  25  *
  26  * These notices must be retained in any copies of any part of this
  27  * documentation and/or software.
  28  *
  29  * NOTE: Cleaned-up and optimized, version of SHA1, based on the FIPS 180-1
  30  * standard, available at http://www.itl.nist.gov/fipspubs/fip180-1.htm
  31  * Not as fast as one would like -- further optimizations are encouraged
  32  * and appreciated.
  33  */
  34 
  35 #if defined(_STANDALONE)
  36 #include <sys/cdefs.h>
  37 #define _RESTRICT_KYWD  restrict
  38 #else
  39 #if !defined(_KERNEL) && !defined(_BOOT)
  40 #include <stdint.h>
  41 #include <strings.h>
  42 #include <stdlib.h>
  43 #include <errno.h>
  44 #include <sys/systeminfo.h>
  45 #endif  /* !_KERNEL && !_BOOT */
  46 #endif  /* _STANDALONE */
  47 
  48 #include <sys/types.h>
  49 #include <sys/param.h>
  50 #include <sys/systm.h>
  51 #include <sys/sysmacros.h>
  52 #include <sys/sha1.h>
  53 #include <sys/sha1_consts.h>
  54 
  55 #if defined(_STANDALONE)
  56 #include <sys/endian.h>
  57 #define HAVE_HTONL
  58 #if _BYTE_ORDER == _LITTLE_ENDIAN
  59 #undef _BIG_ENDIAN
  60 #else
  61 #undef _LITTLE_ENDIAN
  62 #endif
  63 #else
  64 #ifdef _LITTLE_ENDIAN
  65 #include <sys/byteorder.h>
  66 #define HAVE_HTONL
  67 #endif
  68 #endif
  69 
  70 #ifdef  _BOOT
  71 #define bcopy(_s, _d, _l)       ((void) memcpy((_d), (_s), (_l)))
  72 #define bzero(_m, _l)           ((void) memset((_m), 0, (_l)))
  73 #endif
  74 
  75 static void Encode(uint8_t *, const uint32_t *, size_t);
  76 
  77 #if     defined(__sparc)
  78 
  79 #define SHA1_TRANSFORM(ctx, in) \
  80         SHA1Transform((ctx)->state[0], (ctx)->state[1], (ctx)->state[2], \
  81                 (ctx)->state[3], (ctx)->state[4], (ctx), (in))
  82 
  83 static void SHA1Transform(uint32_t, uint32_t, uint32_t, uint32_t, uint32_t,
  84     SHA1_CTX *, const uint8_t *);
  85 
  86 #elif   defined(__amd64) && !defined(_STANDALONE)
  87 
  88 #define SHA1_TRANSFORM(ctx, in) sha1_block_data_order((ctx), (in), 1)
  89 #define SHA1_TRANSFORM_BLOCKS(ctx, in, num) sha1_block_data_order((ctx), \
  90                 (in), (num))
  91 
  92 void sha1_block_data_order(SHA1_CTX *ctx, const void *inpp, size_t num_blocks);
  93 
  94 #else
  95 
  96 #define SHA1_TRANSFORM(ctx, in) SHA1Transform((ctx), (in))
  97 
  98 static void SHA1Transform(SHA1_CTX *, const uint8_t *);
  99 
 100 #endif
 101 
 102 
 103 static uint8_t PADDING[64] = { 0x80, /* all zeros */ };
 104 
 105 /*
 106  * F, G, and H are the basic SHA1 functions.

 332                  * will be an expensive nop.
 333                  */
 334 
 335                 if (input_len == i)
 336                         return;
 337 
 338                 buf_index = 0;
 339         }
 340 
 341         /* buffer remaining input */
 342         bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
 343 }
 344 
 345 #else /* VIS_SHA1 */
 346 
 347 void
 348 SHA1Update(SHA1_CTX *ctx, const void *inptr, size_t input_len)
 349 {
 350         uint32_t i, buf_index, buf_len;
 351         const uint8_t *input = inptr;
 352 #if defined(__amd64) && !defined(_STANDALONE)
 353         uint32_t        block_count;
 354 #endif  /* __amd64 */
 355 
 356         /* check for noop */
 357         if (input_len == 0)
 358                 return;
 359 
 360         /* compute number of bytes mod 64 */
 361         buf_index = (ctx->count[1] >> 3) & 0x3F;
 362 
 363         /* update number of bits */
 364         if ((ctx->count[1] += (input_len << 3)) < (input_len << 3))
 365                 ctx->count[0]++;
 366 
 367         ctx->count[0] += (input_len >> 29);
 368 
 369         buf_len = 64 - buf_index;
 370 
 371         /* transform as many times as possible */
 372         i = 0;
 373         if (input_len >= buf_len) {
 374 
 375                 /*
 376                  * general optimization:
 377                  *
 378                  * only do initial bcopy() and SHA1Transform() if
 379                  * buf_index != 0.  if buf_index == 0, we're just
 380                  * wasting our time doing the bcopy() since there
 381                  * wasn't any data left over from a previous call to
 382                  * SHA1Update().
 383                  */
 384 
 385                 if (buf_index) {
 386                         bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
 387                         SHA1_TRANSFORM(ctx, ctx->buf_un.buf8);
 388                         i = buf_len;
 389                 }
 390 
 391 #if !defined(__amd64) || defined(_STANDALONE)
 392                 for (; i + 63 < input_len; i += 64)
 393                         SHA1_TRANSFORM(ctx, &input[i]);
 394 #else
 395                 block_count = (input_len - i) >> 6;
 396                 if (block_count > 0) {
 397                         SHA1_TRANSFORM_BLOCKS(ctx, &input[i], block_count);
 398                         i += block_count << 6;
 399                 }
 400 #endif  /* !__amd64 */
 401 
 402                 /*
 403                  * general optimization:
 404                  *
 405                  * if i and input_len are the same, return now instead
 406                  * of calling bcopy(), since the bcopy() in this case
 407                  * will be an expensive nop.
 408                  */
 409 
 410                 if (input_len == i)
 411                         return;

 437         uint8_t         bitcount_be[sizeof (ctx->count)];
 438         uint32_t        index = (ctx->count[1] >> 3) & 0x3f;
 439 
 440         /* store bit count, big endian */
 441         Encode(bitcount_be, ctx->count, sizeof (bitcount_be));
 442 
 443         /* pad out to 56 mod 64 */
 444         SHA1Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
 445 
 446         /* append length (before padding) */
 447         SHA1Update(ctx, bitcount_be, sizeof (bitcount_be));
 448 
 449         /* store state in digest */
 450         Encode(digest, ctx->state, sizeof (ctx->state));
 451 
 452         /* zeroize sensitive information */
 453         bzero(ctx, sizeof (*ctx));
 454 }
 455 
 456 
 457 #if !defined(__amd64) || defined(_STANDALONE)
 458 
 459 typedef uint32_t sha1word;
 460 
 461 /*
 462  * sparc optimization:
 463  *
 464  * on the sparc, we can load big endian 32-bit data easily.  note that
 465  * special care must be taken to ensure the address is 32-bit aligned.
 466  * in the interest of speed, we don't check to make sure, since
 467  * careful programming can guarantee this for us.
 468  */
 469 
 470 #if     defined(_BIG_ENDIAN)
 471 #define LOAD_BIG_32(addr)       (*(uint32_t *)(addr))
 472 
 473 #elif   defined(HAVE_HTONL)
 474 #define LOAD_BIG_32(addr) htonl(*((uint32_t *)(addr)))
 475 
 476 #else
 477 /* little endian -- will work on big endian, but slowly */