Crypto++ 7.0 Free C++ class library of cryptographic schemes

sha.cpp
1 // sha.cpp - modified by Wei Dai from Steve Reid's public domain sha1.c
2
3 // Steve Reid implemented SHA-1. Wei Dai implemented SHA-2. Jeffrey Walton
4 // implemented Intel SHA extensions based on Intel articles and code by
5 // Sean Gulley. Jeffrey Walton implemented ARM SHA based on ARM code and
6 // code from Johannes Schneiders, Skip Hovsmith and Barry O'Rourke.
7 // All code is in the public domain.
8
9 // In August 2017 JW reworked the internals to align all the implementations.
10 // Formerly all hashes were software based, IterHashBase handled endian conversions,
11 // and IterHashBase dispatched a single to block SHA{N}::Transform. SHA{N}::Transform
12 // then performed the single block hashing. It was repeated for multiple blocks.
13 //
14 // The rework added SHA{N}::HashMultipleBlocks (class) and SHA{N}_HashMultipleBlocks
15 // (free standing). There are also hardware accelerated variations. Callers enter
16 // SHA{N}::HashMultipleBlocks (class), and the function calls SHA{N}_HashMultipleBlocks
17 // (free standing) or SHA{N}_HashBlock (free standing) as a fallback.
18 //
19 // An added wrinkle is hardware is little endian, C++ is big endian, and callers use
20 // big endian, so SHA{N}_HashMultipleBlock accepts a ByteOrder for the incoming data
21 // arrangement. Hardware based SHA{N}_HashMultipleBlock can often perform the endian
22 // swap much easier by setting an EPI mask. Endian swap incurs no penalty on Intel SHA,
23 // and 4-instruction penalty on ARM SHA. Under C++ the full software based swap penalty
24 // is incurred due to use of ReverseBytes().
25 //
26 // The rework also removed the hacked-in pointers to implementations.
27
28 // use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM sha.cpp" to generate MASM code
29
30 #include "pch.h"
31 #include "config.h"
32
33 #if CRYPTOPP_MSC_VERSION
34 # pragma warning(disable: 4100 4731)
35 #endif
36
37 #ifndef CRYPTOPP_IMPORTS
38 #ifndef CRYPTOPP_GENERATE_X64_MASM
39
40 #include "secblock.h"
41 #include "sha.h"
42 #include "misc.h"
43 #include "cpu.h"
44
45 #if defined(CRYPTOPP_DISABLE_SHA_ASM)
46 # undef CRYPTOPP_X86_ASM_AVAILABLE
47 # undef CRYPTOPP_X32_ASM_AVAILABLE
48 # undef CRYPTOPP_X64_ASM_AVAILABLE
49 # undef CRYPTOPP_SSE2_ASM_AVAILABLE
50 #endif
51
52 NAMESPACE_BEGIN(CryptoPP)
53
54 #if CRYPTOPP_SHANI_AVAILABLE
55 extern void SHA1_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order);
56 extern void SHA256_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order);
57 #endif
58
59 #if CRYPTOPP_ARM_SHA1_AVAILABLE
60 extern void SHA1_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
61 #endif
62
63 #if CRYPTOPP_ARM_SHA2_AVAILABLE
64 extern void SHA256_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
65 #endif
66
67 #if CRYPTOPP_ARM_SHA512_AVAILABLE
68 extern void SHA512_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
69 #endif
70
71 #if CRYPTOPP_POWER8_SHA_AVAILABLE
72 extern void SHA256_HashMultipleBlocks_POWER8(word32 *state, const word32 *data, size_t length, ByteOrder order);
73 extern void SHA512_HashMultipleBlocks_POWER8(word64 *state, const word64 *data, size_t length, ByteOrder order);
74 #endif
75
76 // We add extern to export table to sha_simd.cpp, but it
77 // cleared http://github.com/weidai11/cryptopp/issues/502
78 extern const word32 SHA256_K[64];
79 extern const word64 SHA512_K[80];
80
81 CRYPTOPP_ALIGN_DATA(16)
82 const word64 SHA512_K[80] = {
83 W64LIT(0x428a2f98d728ae22), W64LIT(0x7137449123ef65cd),
84 W64LIT(0xb5c0fbcfec4d3b2f), W64LIT(0xe9b5dba58189dbbc),
85 W64LIT(0x3956c25bf348b538), W64LIT(0x59f111f1b605d019),
86 W64LIT(0x923f82a4af194f9b), W64LIT(0xab1c5ed5da6d8118),
87 W64LIT(0xd807aa98a3030242), W64LIT(0x12835b0145706fbe),
88 W64LIT(0x243185be4ee4b28c), W64LIT(0x550c7dc3d5ffb4e2),
89 W64LIT(0x72be5d74f27b896f), W64LIT(0x80deb1fe3b1696b1),
90 W64LIT(0x9bdc06a725c71235), W64LIT(0xc19bf174cf692694),
91 W64LIT(0xe49b69c19ef14ad2), W64LIT(0xefbe4786384f25e3),
92 W64LIT(0x0fc19dc68b8cd5b5), W64LIT(0x240ca1cc77ac9c65),
93 W64LIT(0x2de92c6f592b0275), W64LIT(0x4a7484aa6ea6e483),
94 W64LIT(0x5cb0a9dcbd41fbd4), W64LIT(0x76f988da831153b5),
95 W64LIT(0x983e5152ee66dfab), W64LIT(0xa831c66d2db43210),
96 W64LIT(0xb00327c898fb213f), W64LIT(0xbf597fc7beef0ee4),
97 W64LIT(0xc6e00bf33da88fc2), W64LIT(0xd5a79147930aa725),
98 W64LIT(0x06ca6351e003826f), W64LIT(0x142929670a0e6e70),
99 W64LIT(0x27b70a8546d22ffc), W64LIT(0x2e1b21385c26c926),
100 W64LIT(0x4d2c6dfc5ac42aed), W64LIT(0x53380d139d95b3df),
101 W64LIT(0x650a73548baf63de), W64LIT(0x766a0abb3c77b2a8),
102 W64LIT(0x81c2c92e47edaee6), W64LIT(0x92722c851482353b),
103 W64LIT(0xa2bfe8a14cf10364), W64LIT(0xa81a664bbc423001),
104 W64LIT(0xc24b8b70d0f89791), W64LIT(0xc76c51a30654be30),
105 W64LIT(0xd192e819d6ef5218), W64LIT(0xd69906245565a910),
106 W64LIT(0xf40e35855771202a), W64LIT(0x106aa07032bbd1b8),
107 W64LIT(0x19a4c116b8d2d0c8), W64LIT(0x1e376c085141ab53),
108 W64LIT(0x2748774cdf8eeb99), W64LIT(0x34b0bcb5e19b48a8),
109 W64LIT(0x391c0cb3c5c95a63), W64LIT(0x4ed8aa4ae3418acb),
110 W64LIT(0x5b9cca4f7763e373), W64LIT(0x682e6ff3d6b2b8a3),
111 W64LIT(0x748f82ee5defb2fc), W64LIT(0x78a5636f43172f60),
112 W64LIT(0x84c87814a1f0ab72), W64LIT(0x8cc702081a6439ec),
113 W64LIT(0x90befffa23631e28), W64LIT(0xa4506cebde82bde9),
114 W64LIT(0xbef9a3f7b2c67915), W64LIT(0xc67178f2e372532b),
115 W64LIT(0xca273eceea26619c), W64LIT(0xd186b8c721c0c207),
116 W64LIT(0xeada7dd6cde0eb1e), W64LIT(0xf57d4f7fee6ed178),
117 W64LIT(0x06f067aa72176fba), W64LIT(0x0a637dc5a2c898a6),
118 W64LIT(0x113f9804bef90dae), W64LIT(0x1b710b35131c471b),
119 W64LIT(0x28db77f523047d84), W64LIT(0x32caab7b40c72493),
120 W64LIT(0x3c9ebe0a15c9bebc), W64LIT(0x431d67c49c100d4c),
121 W64LIT(0x4cc5d4becb3e42b6), W64LIT(0x597f299cfc657e2a),
122 W64LIT(0x5fcb6fab3ad6faec), W64LIT(0x6c44198c4a475817)
123 };
124
125 CRYPTOPP_ALIGN_DATA(16)
126 const word32 SHA256_K[64] = {
127
128 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
129 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
130 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
131 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
132 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
133 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
134 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
135 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
136 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
137 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
138 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
139 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
140 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
141 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
142 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
143 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
144 };
145
146 ////////////////////////////////
147 // start of Steve Reid's code //
148 ////////////////////////////////
149
150 ANONYMOUS_NAMESPACE_BEGIN
151
152 #define blk0(i) (W[i] = data[i])
153 #define blk1(i) (W[i&15] = rotlConstant<1>(W[(i+13)&15]^W[(i+8)&15]^W[(i+2)&15]^W[i&15]))
154
155 #define f1(x,y,z) (z^(x&(y^z)))
156 #define f2(x,y,z) (x^y^z)
157 #define f3(x,y,z) ((x&y)|(z&(x|y)))
158 #define f4(x,y,z) (x^y^z)
159
160 /* (R0+R1), R2, R3, R4 are the different operations used in SHA1 */
161 #define R0(v,w,x,y,z,i) z+=f1(w,x,y)+blk0(i)+0x5A827999+rotlConstant<5>(v);w=rotlConstant<30>(w);
162 #define R1(v,w,x,y,z,i) z+=f1(w,x,y)+blk1(i)+0x5A827999+rotlConstant<5>(v);w=rotlConstant<30>(w);
163 #define R2(v,w,x,y,z,i) z+=f2(w,x,y)+blk1(i)+0x6ED9EBA1+rotlConstant<5>(v);w=rotlConstant<30>(w);
164 #define R3(v,w,x,y,z,i) z+=f3(w,x,y)+blk1(i)+0x8F1BBCDC+rotlConstant<5>(v);w=rotlConstant<30>(w);
165 #define R4(v,w,x,y,z,i) z+=f4(w,x,y)+blk1(i)+0xCA62C1D6+rotlConstant<5>(v);w=rotlConstant<30>(w);
166
167 void SHA1_HashBlock_CXX(word32 *state, const word32 *data)
168 {
169 CRYPTOPP_ASSERT(state);
170 CRYPTOPP_ASSERT(data);
171
172 word32 W[16];
173 /* Copy context->state[] to working vars */
174 word32 a = state[0];
175 word32 b = state[1];
176 word32 c = state[2];
177 word32 d = state[3];
178 word32 e = state[4];
179 /* 4 rounds of 20 operations each. Loop unrolled. */
180 R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
181 R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
182 R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
183 R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
184 R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
185 R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
186 R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
187 R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
188 R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
189 R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
190 R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
191 R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
192 R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
193 R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
194 R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
195 R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
196 R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
197 R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
198 R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
199 R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
200 /* Add the working vars back into context.state[] */
201 state[0] += a;
202 state[1] += b;
203 state[2] += c;
204 state[3] += d;
205 state[4] += e;
206 }
207
208 #undef blk0
209 #undef blk1
210 #undef f1
211 #undef f2
212 #undef f3
213 #undef f4
214 #undef R1
215 #undef R2
216 #undef R3
217 #undef R4
218
219 ANONYMOUS_NAMESPACE_END
220
221 //////////////////////////////
222 // end of Steve Reid's code //
223 //////////////////////////////
224
225 std::string SHA1::AlgorithmProvider() const
226 {
227 #if CRYPTOPP_SHANI_AVAILABLE
228 if (HasSHA())
229 return "SHANI";
230 #endif
231 #if CRYPTOPP_SSE2_ASM_AVAILABLE
232 if (HasSSE2())
233 return "SSE2";
234 #endif
235 #if CRYPTOPP_ARM_SHA1_AVAILABLE
236 if (HasSHA1())
237 return "ARMv8";
238 #endif
239 return "C++";
240 }
241
242 void SHA1::InitState(HashWordType *state)
243 {
244 state[0] = 0x67452301;
245 state[1] = 0xEFCDAB89;
246 state[2] = 0x98BADCFE;
247 state[3] = 0x10325476;
248 state[4] = 0xC3D2E1F0;
249 }
250
251 void SHA1::Transform(word32 *state, const word32 *data)
252 {
253 CRYPTOPP_ASSERT(state);
254 CRYPTOPP_ASSERT(data);
255
256 #if CRYPTOPP_SHANI_AVAILABLE
257 if (HasSHA())
258 {
259 SHA1_HashMultipleBlocks_SHANI(state, data, SHA1::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
260 return;
261 }
262 #endif
263 #if CRYPTOPP_ARM_SHA1_AVAILABLE
264 if (HasSHA1())
265 {
266 SHA1_HashMultipleBlocks_ARMV8(state, data, SHA1::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
267 return;
268 }
269 #endif
270
271 SHA1_HashBlock_CXX(state, data);
272 }
273
274 size_t SHA1::HashMultipleBlocks(const word32 *input, size_t length)
275 {
276 CRYPTOPP_ASSERT(input);
277 CRYPTOPP_ASSERT(length >= SHA1::BLOCKSIZE);
278
279 #if CRYPTOPP_SHANI_AVAILABLE
280 if (HasSHA())
281 {
282 SHA1_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
283 return length & (SHA1::BLOCKSIZE - 1);
284 }
285 #endif
286 #if CRYPTOPP_ARM_SHA1_AVAILABLE
287 if (HasSHA1())
288 {
289 SHA1_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
290 return length & (SHA1::BLOCKSIZE - 1);
291 }
292 #endif
293
294 const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
295 word32 *dataBuf = this->DataBuf();
296 do
297 {
298 if (noReverse)
299 {
300 SHA1_HashBlock_CXX(m_state, input);
301 }
302 else
303 {
304 ByteReverse(dataBuf, input, SHA1::BLOCKSIZE);
305 SHA1_HashBlock_CXX(m_state, dataBuf);
306 }
307
308 input += SHA1::BLOCKSIZE/sizeof(word32);
309 length -= SHA1::BLOCKSIZE;
310 }
311 while (length >= SHA1::BLOCKSIZE);
312 return length;
313 }
314
315 // *************************************************************
316
317 ANONYMOUS_NAMESPACE_BEGIN
318
319 #define a(i) T[(0-i)&7]
320 #define b(i) T[(1-i)&7]
321 #define c(i) T[(2-i)&7]
322 #define d(i) T[(3-i)&7]
323 #define e(i) T[(4-i)&7]
324 #define f(i) T[(5-i)&7]
325 #define g(i) T[(6-i)&7]
326 #define h(i) T[(7-i)&7]
327
328 #define blk0(i) (W[i] = data[i])
329 #define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
330
331 #define Ch(x,y,z) (z^(x&(y^z)))
332 #define Maj(x,y,z) (y^((x^y)&(y^z)))
333
334 #define R(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA256_K[i+j]+(j?blk2(i):blk0(i));\
335 d(i)+=h(i);h(i)+=S0(a(i))+Maj(a(i),b(i),c(i))
336
337 // for SHA256
338 #define s0(x) (rotrConstant<7>(x)^rotrConstant<18>(x)^(x>>3))
339 #define s1(x) (rotrConstant<17>(x)^rotrConstant<19>(x)^(x>>10))
340 #define S0(x) (rotrConstant<2>(x)^rotrConstant<13>(x)^rotrConstant<22>(x))
341 #define S1(x) (rotrConstant<6>(x)^rotrConstant<11>(x)^rotrConstant<25>(x))
342
343 void SHA256_HashBlock_CXX(word32 *state, const word32 *data)
344 {
345 word32 W[16]={0}, T[8];
346 /* Copy context->state[] to working vars */
347 memcpy(T, state, sizeof(T));
348 /* 64 operations, partially loop unrolled */
349 for (unsigned int j=0; j<64; j+=16)
350 {
351 R( 0); R( 1); R( 2); R( 3);
352 R( 4); R( 5); R( 6); R( 7);
353 R( 8); R( 9); R(10); R(11);
354 R(12); R(13); R(14); R(15);
355 }
356 /* Add the working vars back into context.state[] */
357 state[0] += a(0);
358 state[1] += b(0);
359 state[2] += c(0);
360 state[3] += d(0);
361 state[4] += e(0);
362 state[5] += f(0);
363 state[6] += g(0);
364 state[7] += h(0);
365 }
366
367 #undef Ch
368 #undef Maj
369 #undef s0
370 #undef s1
371 #undef S0
372 #undef S1
373 #undef blk0
374 #undef blk1
375 #undef blk2
376 #undef R
377
378 #undef a
379 #undef b
380 #undef c
381 #undef d
382 #undef e
383 #undef f
384 #undef g
385 #undef h
386
387 ANONYMOUS_NAMESPACE_END
388
389 std::string SHA256_AlgorithmProvider()
390 {
391 #if CRYPTOPP_SHANI_AVAILABLE
392 if (HasSHA())
393 return "SHANI";
394 #endif
395 #if CRYPTOPP_SSE2_ASM_AVAILABLE
396 if (HasSSE2())
397 return "SSE2";
398 #endif
399 #if CRYPTOPP_ARM_SHA2_AVAILABLE
400 if (HasSHA2())
401 return "ARMv8";
402 #endif
403 #if (CRYPTOPP_POWER8_SHA_AVAILABLE)
404 if (HasSHA256())
405 return "Power8";
406 #endif
407 return "C++";
408 }
409
410 std::string SHA224::AlgorithmProvider() const
411 {
412 return SHA256_AlgorithmProvider();
413 }
414
415 void SHA224::InitState(HashWordType *state)
416 {
417 static const word32 s[8] = {
418 0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939,
419 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4};
420 memcpy(state, s, sizeof(s));
421 }
422
423 void SHA256::InitState(HashWordType *state)
424 {
425 static const word32 s[8] = {
426 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
427 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
428 memcpy(state, s, sizeof(s));
429 }
430 #endif // Not CRYPTOPP_GENERATE_X64_MASM
431
432 #if defined(CRYPTOPP_X86_ASM_AVAILABLE)
433
434 ANONYMOUS_NAMESPACE_BEGIN
435
436 void CRYPTOPP_FASTCALL SHA256_HashMultipleBlocks_SSE2(word32 *state, const word32 *data, size_t len)
437 {
438 #define LOCALS_SIZE 8*4 + 16*4 + 4*WORD_SZ
439 #define H(i) [BASE+ASM_MOD(1024+7-(i),8)*4]
440 #define G(i) H(i+1)
441 #define F(i) H(i+2)
442 #define E(i) H(i+3)
443 #define D(i) H(i+4)
444 #define C(i) H(i+5)
445 #define B(i) H(i+6)
446 #define A(i) H(i+7)
447 #define Wt(i) BASE+8*4+ASM_MOD(1024+15-(i),16)*4
448 #define Wt_2(i) Wt((i)-2)
449 #define Wt_15(i) Wt((i)-15)
450 #define Wt_7(i) Wt((i)-7)
451 #define K_END [BASE+8*4+16*4+0*WORD_SZ]
452 #define STATE_SAVE [BASE+8*4+16*4+1*WORD_SZ]
453 #define DATA_SAVE [BASE+8*4+16*4+2*WORD_SZ]
454 #define DATA_END [BASE+8*4+16*4+3*WORD_SZ]
455 #define Kt(i) WORD_REG(si)+(i)*4
456 #if CRYPTOPP_BOOL_X86
457 #define BASE esp+4
458 #elif defined(__GNUC__)
459 #define BASE r8
460 #else
461 #define BASE rsp
462 #endif
463
464 #define RA0(i, edx, edi) \
465 AS2( add edx, [Kt(i)] )\
466 AS2( add edx, [Wt(i)] )\
467 AS2( add edx, H(i) )\
468
469 #define RA1(i, edx, edi)
470
471 #define RB0(i, edx, edi)
472
473 #define RB1(i, edx, edi) \
474 AS2( mov AS_REG_7d, [Wt_2(i)] )\
475 AS2( mov edi, [Wt_15(i)])\
476 AS2( mov ebx, AS_REG_7d )\
477 AS2( shr AS_REG_7d, 10 )\
478 AS2( ror ebx, 17 )\
479 AS2( xor AS_REG_7d, ebx )\
480 AS2( ror ebx, 2 )\
481 AS2( xor ebx, AS_REG_7d )/* s1(W_t-2) */\
482 AS2( add ebx, [Wt_7(i)])\
483 AS2( mov AS_REG_7d, edi )\
484 AS2( shr AS_REG_7d, 3 )\
485 AS2( ror edi, 7 )\
486 AS2( add ebx, [Wt(i)])/* s1(W_t-2) + W_t-7 + W_t-16 */\
487 AS2( xor AS_REG_7d, edi )\
488 AS2( add edx, [Kt(i)])\
489 AS2( ror edi, 11 )\
490 AS2( add edx, H(i) )\
491 AS2( xor AS_REG_7d, edi )/* s0(W_t-15) */\
492 AS2( add AS_REG_7d, ebx )/* W_t = s1(W_t-2) + W_t-7 + s0(W_t-15) W_t-16*/\
493 AS2( mov [Wt(i)], AS_REG_7d)\
494 AS2( add edx, AS_REG_7d )\
495
496 #define ROUND(i, r, eax, ecx, edi, edx)\
497 /* in: edi = E */\
498 /* unused: eax, ecx, temp: ebx, AS_REG_7d, out: edx = T1 */\
499 AS2( mov edx, F(i) )\
500 AS2( xor edx, G(i) )\
501 AS2( and edx, edi )\
502 AS2( xor edx, G(i) )/* Ch(E,F,G) = (G^(E&(F^G))) */\
503 AS2( mov AS_REG_7d, edi )\
504 AS2( ror edi, 6 )\
505 AS2( ror AS_REG_7d, 25 )\
506 RA##r(i, edx, edi )/* H + Wt + Kt + Ch(E,F,G) */\
507 AS2( xor AS_REG_7d, edi )\
508 AS2( ror edi, 5 )\
509 AS2( xor AS_REG_7d, edi )/* S1(E) */\
510 AS2( add edx, AS_REG_7d )/* T1 = S1(E) + Ch(E,F,G) + H + Wt + Kt */\
511 RB##r(i, edx, edi )/* H + Wt + Kt + Ch(E,F,G) */\
512 /* in: ecx = A, eax = B^C, edx = T1 */\
513 /* unused: edx, temp: ebx, AS_REG_7d, out: eax = A, ecx = B^C, edx = E */\
514 AS2( mov ebx, ecx )\
515 AS2( xor ecx, B(i) )/* A^B */\
516 AS2( and eax, ecx )\
517 AS2( xor eax, B(i) )/* Maj(A,B,C) = B^((A^B)&(B^C) */\
518 AS2( mov AS_REG_7d, ebx )\
519 AS2( ror ebx, 2 )\
520 AS2( add eax, edx )/* T1 + Maj(A,B,C) */\
521 AS2( add edx, D(i) )\
522 AS2( mov D(i), edx )\
523 AS2( ror AS_REG_7d, 22 )\
524 AS2( xor AS_REG_7d, ebx )\
525 AS2( ror ebx, 11 )\
526 AS2( xor AS_REG_7d, ebx )\
527 AS2( add eax, AS_REG_7d )/* T1 + S0(A) + Maj(A,B,C) */\
528 AS2( mov H(i), eax )\
529
530 // Unroll the use of CRYPTOPP_BOOL_X64 in assembler math. The GAS assembler on X32 (version 2.25)
531 // complains "Error: invalid operands (*ABS* and *UND* sections) for `*` and `-`"
532 #if CRYPTOPP_BOOL_X64
533 #define SWAP_COPY(i) \
534 AS2( mov WORD_REG(bx), [WORD_REG(dx)+i*WORD_SZ])\
535 AS1( bswap WORD_REG(bx))\
536 AS2( mov [Wt(i*2+1)], WORD_REG(bx))
537 #else // X86 and X32
538 #define SWAP_COPY(i) \
539 AS2( mov WORD_REG(bx), [WORD_REG(dx)+i*WORD_SZ])\
540 AS1( bswap WORD_REG(bx))\
541 AS2( mov [Wt(i)], WORD_REG(bx))
542 #endif
543
544 #if defined(__GNUC__)
545 #if CRYPTOPP_BOOL_X64
546 FixedSizeAlignedSecBlock<byte, LOCALS_SIZE> workspace;
547 #endif
548 __asm__ __volatile__
549 (
550 #if CRYPTOPP_BOOL_X64
551 "lea %4, %%r8;"
552 #endif
553 INTEL_NOPREFIX
554 #elif defined(CRYPTOPP_GENERATE_X64_MASM)
555 ALIGN 8
556 SHA256_HashMultipleBlocks_SSE2 PROC FRAME
557 rex_push_reg rsi
558 push_reg rdi
559 push_reg rbx
560 push_reg rbp
561 alloc_stack(LOCALS_SIZE+8)
562 .endprolog
563 mov rdi, r8
564 lea rsi, [?SHA256_K@CryptoPP@@3QBIB + 48*4]
565 #endif
566
567 #if CRYPTOPP_BOOL_X86
568 #ifndef __GNUC__
569 AS2( mov edi, [len])
570 AS2( lea WORD_REG(si), [SHA256_K+48*4])
571 #endif
572 #if !defined(_MSC_VER) || (_MSC_VER < 1400)
573 AS_PUSH_IF86(bx)
574 #endif
575
576 AS_PUSH_IF86(bp)
577 AS2( mov ebx, esp)
578 AS2( and esp, -16)
579 AS2( sub WORD_REG(sp), LOCALS_SIZE)
580 AS_PUSH_IF86(bx)
581 #endif
582 AS2( mov STATE_SAVE, WORD_REG(cx))
583 AS2( mov DATA_SAVE, WORD_REG(dx))
584 AS2( lea WORD_REG(ax), [WORD_REG(di) + WORD_REG(dx)])
585 AS2( mov DATA_END, WORD_REG(ax))
586 AS2( mov K_END, WORD_REG(si))
587
588 #if CRYPTOPP_SSE2_ASM_AVAILABLE
589 #if CRYPTOPP_BOOL_X86
590 AS2( test edi, 1)
591 ASJ( jnz, 2, f)
592 AS1( dec DWORD PTR K_END)
593 #endif
594 AS2( movdqu xmm0, XMMWORD_PTR [WORD_REG(cx)+0*16])
595 AS2( movdqu xmm1, XMMWORD_PTR [WORD_REG(cx)+1*16])
596 #endif
597
598 #if CRYPTOPP_BOOL_X86
599 #if CRYPTOPP_SSE2_ASM_AVAILABLE
600 ASJ( jmp, 0, f)
601 #endif
602 ASL(2) // non-SSE2
603 AS2( mov esi, ecx)
604 AS2( lea edi, A(0))
605 AS2( mov ecx, 8)
606 ATT_NOPREFIX
607 AS1( rep movsd)
608 INTEL_NOPREFIX
609 AS2( mov esi, K_END)
610 ASJ( jmp, 3, f)
611 #endif
612
613 #if CRYPTOPP_SSE2_ASM_AVAILABLE
614 ASL(0)
615 AS2( movdqu E(0), xmm1)
616 AS2( movdqu A(0), xmm0)
617 #endif
618 #if CRYPTOPP_BOOL_X86
619 ASL(3)
620 #endif
621 AS2( sub WORD_REG(si), 48*4)
622 SWAP_COPY(0) SWAP_COPY(1) SWAP_COPY(2) SWAP_COPY(3)
623 SWAP_COPY(4) SWAP_COPY(5) SWAP_COPY(6) SWAP_COPY(7)
624 #if CRYPTOPP_BOOL_X86
625 SWAP_COPY(8) SWAP_COPY(9) SWAP_COPY(10) SWAP_COPY(11)
626 SWAP_COPY(12) SWAP_COPY(13) SWAP_COPY(14) SWAP_COPY(15)
627 #endif
628 AS2( mov edi, E(0)) // E
629 AS2( mov eax, B(0)) // B
630 AS2( xor eax, C(0)) // B^C
631 AS2( mov ecx, A(0)) // A
632
633 ROUND(0, 0, eax, ecx, edi, edx)
634 ROUND(1, 0, ecx, eax, edx, edi)
635 ROUND(2, 0, eax, ecx, edi, edx)
636 ROUND(3, 0, ecx, eax, edx, edi)
637 ROUND(4, 0, eax, ecx, edi, edx)
638 ROUND(5, 0, ecx, eax, edx, edi)
639 ROUND(6, 0, eax, ecx, edi, edx)
640 ROUND(7, 0, ecx, eax, edx, edi)
641 ROUND(8, 0, eax, ecx, edi, edx)
642 ROUND(9, 0, ecx, eax, edx, edi)
643 ROUND(10, 0, eax, ecx, edi, edx)
644 ROUND(11, 0, ecx, eax, edx, edi)
645 ROUND(12, 0, eax, ecx, edi, edx)
646 ROUND(13, 0, ecx, eax, edx, edi)
647 ROUND(14, 0, eax, ecx, edi, edx)
648 ROUND(15, 0, ecx, eax, edx, edi)
649
650 ASL(1)
651 AS2(add WORD_REG(si), 4*16)
652 ROUND(0, 1, eax, ecx, edi, edx)
653 ROUND(1, 1, ecx, eax, edx, edi)
654 ROUND(2, 1, eax, ecx, edi, edx)
655 ROUND(3, 1, ecx, eax, edx, edi)
656 ROUND(4, 1, eax, ecx, edi, edx)
657 ROUND(5, 1, ecx, eax, edx, edi)
658 ROUND(6, 1, eax, ecx, edi, edx)
659 ROUND(7, 1, ecx, eax, edx, edi)
660 ROUND(8, 1, eax, ecx, edi, edx)
661 ROUND(9, 1, ecx, eax, edx, edi)
662 ROUND(10, 1, eax, ecx, edi, edx)
663 ROUND(11, 1, ecx, eax, edx, edi)
664 ROUND(12, 1, eax, ecx, edi, edx)
665 ROUND(13, 1, ecx, eax, edx, edi)
666 ROUND(14, 1, eax, ecx, edi, edx)
667 ROUND(15, 1, ecx, eax, edx, edi)
668 AS2( cmp WORD_REG(si), K_END)
669 ATT_NOPREFIX
670 ASJ( jb, 1, b)
671 INTEL_NOPREFIX
672
673 AS2( mov WORD_REG(dx), DATA_SAVE)
674 AS2( add WORD_REG(dx), 64)
675 AS2( mov AS_REG_7, STATE_SAVE)
676 AS2( mov DATA_SAVE, WORD_REG(dx))
677
678 #if CRYPTOPP_SSE2_ASM_AVAILABLE
679 #if CRYPTOPP_BOOL_X86
680 AS2( test DWORD PTR K_END, 1)
681 ASJ( jz, 4, f)
682 #endif
683 AS2( movdqu xmm1, XMMWORD_PTR [AS_REG_7+1*16])
684 AS2( movdqu xmm0, XMMWORD_PTR [AS_REG_7+0*16])
685 AS2( paddd xmm1, E(0))
686 AS2( paddd xmm0, A(0))
687 AS2( movdqu [AS_REG_7+1*16], xmm1)
688 AS2( movdqu [AS_REG_7+0*16], xmm0)
689 AS2( cmp WORD_REG(dx), DATA_END)
690 ATT_NOPREFIX
691 ASJ( jb, 0, b)
692 INTEL_NOPREFIX
693 #endif
694
695 #if CRYPTOPP_BOOL_X86
696 #if CRYPTOPP_SSE2_ASM_AVAILABLE
697 ASJ( jmp, 5, f)
698 ASL(4) // non-SSE2
699 #endif
700 AS2( add [AS_REG_7+0*4], ecx) // A
701 AS2( add [AS_REG_7+4*4], edi) // E
702 AS2( mov eax, B(0))
703 AS2( mov ebx, C(0))
704 AS2( mov ecx, D(0))
705 AS2( add [AS_REG_7+1*4], eax)
706 AS2( add [AS_REG_7+2*4], ebx)
707 AS2( add [AS_REG_7+3*4], ecx)
708 AS2( mov eax, F(0))
709 AS2( mov ebx, G(0))
710 AS2( mov ecx, H(0))
711 AS2( add [AS_REG_7+5*4], eax)
712 AS2( add [AS_REG_7+6*4], ebx)
713 AS2( add [AS_REG_7+7*4], ecx)
714 AS2( mov ecx, AS_REG_7d)
715 AS2( cmp WORD_REG(dx), DATA_END)
716 ASJ( jb, 2, b)
717 #if CRYPTOPP_SSE2_ASM_AVAILABLE
718 ASL(5)
719 #endif
720 #endif
721
722 AS_POP_IF86(sp)
723 AS_POP_IF86(bp)
724 #if !defined(_MSC_VER) || (_MSC_VER < 1400)
725 AS_POP_IF86(bx)
726 #endif
727
728 #ifdef CRYPTOPP_GENERATE_X64_MASM
729 add rsp, LOCALS_SIZE+8
730 pop rbp
731 pop rbx
732 pop rdi
733 pop rsi
734 ret
735 SHA256_HashMultipleBlocks_SSE2 ENDP
736 #endif
737
738 #ifdef __GNUC__
739 ATT_PREFIX
740 :
741 : "c" (state), "d" (data), "S" (SHA256_K+48), "D" (len)
742 #if CRYPTOPP_BOOL_X64
743 , "m" (workspace[0])
744 #endif
745 : "memory", "cc", "%eax"
746 #if CRYPTOPP_BOOL_X64
747 , "%rbx", "%r8", "%r10"
748 #endif
749 );
750 #endif
751 }
752
753 ANONYMOUS_NAMESPACE_END
754
755 #endif // CRYPTOPP_X86_ASM_AVAILABLE
756
757 #ifndef CRYPTOPP_GENERATE_X64_MASM
758
759 #ifdef CRYPTOPP_X64_MASM_AVAILABLE
760 extern "C" {
761 void CRYPTOPP_FASTCALL SHA256_HashMultipleBlocks_SSE2(word32 *state, const word32 *data, size_t len);
762 }
763 #endif
764
765 std::string SHA256::AlgorithmProvider() const
766 {
767 return SHA256_AlgorithmProvider();
768 }
769
770 void SHA256::Transform(word32 *state, const word32 *data)
771 {
772 CRYPTOPP_ASSERT(state);
773 CRYPTOPP_ASSERT(data);
774
775 #if CRYPTOPP_SHANI_AVAILABLE
776 if (HasSHA())
777 {
778 SHA256_HashMultipleBlocks_SHANI(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
779 return;
780 }
781 #endif
782 #if CRYPTOPP_ARM_SHA2_AVAILABLE
783 if (HasSHA2())
784 {
785 SHA256_HashMultipleBlocks_ARMV8(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
786 return;
787 }
788 #endif
789 #if CRYPTOPP_POWER8_SHA_AVAILABLE
790 if (HasSHA256())
791 {
792 SHA256_HashMultipleBlocks_POWER8(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
793 return;
794 }
795 #endif
796
797 SHA256_HashBlock_CXX(state, data);
798 }
799
800 size_t SHA256::HashMultipleBlocks(const word32 *input, size_t length)
801 {
802 CRYPTOPP_ASSERT(input);
803 CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
804
805 #if CRYPTOPP_SHANI_AVAILABLE
806 if (HasSHA())
807 {
808 SHA256_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
809 return length & (SHA256::BLOCKSIZE - 1);
810 }
811 #endif
812 #if CRYPTOPP_SSE2_ASM_AVAILABLE || CRYPTOPP_X64_MASM_AVAILABLE
813 if (HasSSE2())
814 {
815 const size_t res = length & (SHA256::BLOCKSIZE - 1);
816 SHA256_HashMultipleBlocks_SSE2(m_state, input, length-res);
817 return res;
818 }
819 #endif
820 #if CRYPTOPP_ARM_SHA2_AVAILABLE
821 if (HasSHA2())
822 {
823 SHA256_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
824 return length & (SHA256::BLOCKSIZE - 1);
825 }
826 #endif
827 #if CRYPTOPP_POWER8_SHA_AVAILABLE
828 if (HasSHA256())
829 {
830 SHA256_HashMultipleBlocks_POWER8(m_state, input, length, BIG_ENDIAN_ORDER);
831 return length & (SHA256::BLOCKSIZE - 1);
832 }
833 #endif
834
835 const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
836 word32 *dataBuf = this->DataBuf();
837 do
838 {
839 if (noReverse)
840 {
841 SHA256_HashBlock_CXX(m_state, input);
842 }
843 else
844 {
845 ByteReverse(dataBuf, input, SHA256::BLOCKSIZE);
846 SHA256_HashBlock_CXX(m_state, dataBuf);
847 }
848
849 input += SHA256::BLOCKSIZE/sizeof(word32);
850 length -= SHA256::BLOCKSIZE;
851 }
852 while (length >= SHA256::BLOCKSIZE);
853 return length;
854 }
855
856 size_t SHA224::HashMultipleBlocks(const word32 *input, size_t length)
857 {
858 CRYPTOPP_ASSERT(input);
859 CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
860
861 #if CRYPTOPP_SHANI_AVAILABLE
862 if (HasSHA())
863 {
864 SHA256_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
865 return length & (SHA256::BLOCKSIZE - 1);
866 }
867 #endif
868 #if CRYPTOPP_SSE2_ASM_AVAILABLE || CRYPTOPP_X64_MASM_AVAILABLE
869 if (HasSSE2())
870 {
871 const size_t res = length & (SHA256::BLOCKSIZE - 1);
872 SHA256_HashMultipleBlocks_SSE2(m_state, input, length-res);
873 return res;
874 }
875 #endif
876 #if CRYPTOPP_ARM_SHA2_AVAILABLE
877 if (HasSHA2())
878 {
879 SHA256_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
880 return length & (SHA256::BLOCKSIZE - 1);
881 }
882 #endif
883 #if CRYPTOPP_POWER8_SHA_AVAILABLE
884 if (HasSHA256())
885 {
886 SHA256_HashMultipleBlocks_POWER8(m_state, input, length, BIG_ENDIAN_ORDER);
887 return length & (SHA256::BLOCKSIZE - 1);
888 }
889 #endif
890
891 const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
892 word32 *dataBuf = this->DataBuf();
893 do
894 {
895 if (noReverse)
896 {
897 SHA256_HashBlock_CXX(m_state, input);
898 }
899 else
900 {
901 ByteReverse(dataBuf, input, SHA256::BLOCKSIZE);
902 SHA256_HashBlock_CXX(m_state, dataBuf);
903 }
904
905 input += SHA256::BLOCKSIZE/sizeof(word32);
906 length -= SHA256::BLOCKSIZE;
907 }
908 while (length >= SHA256::BLOCKSIZE);
909 return length;
910 }
911
912 // *************************************************************
913
914 std::string SHA512_AlgorithmProvider()
915 {
916 #if CRYPTOPP_SSE2_ASM_AVAILABLE
917 if (HasSSE2())
918 return "SSE2";
919 #endif
920 #if (CRYPTOPP_POWER8_SHA_AVAILABLE)
921 if (HasSHA512())
922 return "Power8";
923 #endif
924 return "C++";
925 }
926
927 std::string SHA384::AlgorithmProvider() const
928 {
929 return SHA512_AlgorithmProvider();
930 }
931
932 std::string SHA512::AlgorithmProvider() const
933 {
934 return SHA512_AlgorithmProvider();
935 }
936
937 void SHA384::InitState(HashWordType *state)
938 {
939 const word64 s[8] = {
940 W64LIT(0xcbbb9d5dc1059ed8), W64LIT(0x629a292a367cd507),
941 W64LIT(0x9159015a3070dd17), W64LIT(0x152fecd8f70e5939),
942 W64LIT(0x67332667ffc00b31), W64LIT(0x8eb44a8768581511),
943 W64LIT(0xdb0c2e0d64f98fa7), W64LIT(0x47b5481dbefa4fa4)};
944 memcpy(state, s, sizeof(s));
945 }
946
947 void SHA512::InitState(HashWordType *state)
948 {
949 const word64 s[8] = {
950 W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
951 W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
952 W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
953 W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)};
954 memcpy(state, s, sizeof(s));
955 }
956
957 #if CRYPTOPP_SSE2_ASM_AVAILABLE && (CRYPTOPP_BOOL_X86)
958
959 // Anonymous namespace removed due to a new compile error.
960 // g++ -DNDEBUG -g2 -O3 -pthread -pipe -c sha.cpp
961 // sha.cpp: Assembler messages:
962 // sha.cpp:1155: Error: symbol `SHA512_Round' is already defined
963 // sha.cpp:1155: Error: symbol `SHA512_Round' is already defined
964
965 // ANONYMOUS_NAMESPACE_BEGIN
966
967 CRYPTOPP_NAKED void CRYPTOPP_FASTCALL SHA512_HashBlock_SSE2(word64 *state, const word64 *data)
968 {
969 #ifdef __GNUC__
970 __asm__ __volatile__
971 (
972 INTEL_NOPREFIX
973 AS_PUSH_IF86( bx)
974 AS2( mov ebx, eax)
975 #else
976 AS1( push ebx)
977 AS1( push esi)
978 AS1( push edi)
979 AS2( lea ebx, SHA512_K)
980 #endif
981
982 AS2( mov eax, esp)
983 AS2( and esp, 0xfffffff0)
984 AS2( sub esp, 27*16) // 17*16 for expanded data, 20*8 for state
985 AS_PUSH_IF86( ax)
986 AS2( xor eax, eax)
987
988 AS2( lea edi, [esp+4+8*8]) // start at middle of state buffer. will decrement pointer each round to avoid copying
989 AS2( lea esi, [esp+4+20*8+8]) // 16-byte alignment, then add 8
990
991 AS2( movdqu xmm0, [ecx+0*16])
992 AS2( movdq2q mm4, xmm0)
993 AS2( movdqu [edi+0*16], xmm0)
994 AS2( movdqu xmm0, [ecx+1*16])
995 AS2( movdqu [edi+1*16], xmm0)
996 AS2( movdqu xmm0, [ecx+2*16])
997 AS2( movdq2q mm5, xmm0)
998 AS2( movdqu [edi+2*16], xmm0)
999 AS2( movdqu xmm0, [ecx+3*16])
1000 AS2( movdqu [edi+3*16], xmm0)
1001 ASJ( jmp, 0, f)
1002
1003 #define SSE2_S0_S1(r, a, b, c) \
1004 AS2( movq mm6, r)\
1005 AS2( psrlq r, a)\
1006 AS2( movq mm7, r)\
1007 AS2( psllq mm6, 64-c)\
1008 AS2( pxor mm7, mm6)\
1009 AS2( psrlq r, b-a)\
1010 AS2( pxor mm7, r)\
1011 AS2( psllq mm6, c-b)\
1012 AS2( pxor mm7, mm6)\
1013 AS2( psrlq r, c-b)\
1014 AS2( pxor r, mm7)\
1015 AS2( psllq mm6, b-a)\
1016 AS2( pxor r, mm6)
1017
1018 #define SSE2_s0(r, a, b, c) \
1019 AS2( movdqu xmm6, r)\
1020 AS2( psrlq r, a)\
1021 AS2( movdqu xmm7, r)\
1022 AS2( psllq xmm6, 64-c)\
1023 AS2( pxor xmm7, xmm6)\
1024 AS2( psrlq r, b-a)\
1025 AS2( pxor xmm7, r)\
1026 AS2( psrlq r, c-b)\
1027 AS2( pxor r, xmm7)\
1028 AS2( psllq xmm6, c-a)\
1029 AS2( pxor r, xmm6)
1030
1031 #define SSE2_s1(r, a, b, c) \
1032 AS2( movdqu xmm6, r)\
1033 AS2( psrlq r, a)\
1034 AS2( movdqu xmm7, r)\
1035 AS2( psllq xmm6, 64-c)\
1036 AS2( pxor xmm7, xmm6)\
1037 AS2( psrlq r, b-a)\
1038 AS2( pxor xmm7, r)\
1039 AS2( psllq xmm6, c-b)\
1040 AS2( pxor xmm7, xmm6)\
1041 AS2( psrlq r, c-b)\
1042 AS2( pxor r, xmm7)
1043 ASL(SHA512_Round)
1044
1045 // k + w is in mm0, a is in mm4, e is in mm5
1046 AS2( paddq mm0, [edi+7*8]) // h
1047 AS2( movq mm2, [edi+5*8]) // f
1048 AS2( movq mm3, [edi+6*8]) // g
1049 AS2( pxor mm2, mm3)
1050 AS2( pand mm2, mm5)
1051 SSE2_S0_S1(mm5,14,18,41)
1052 AS2( pxor mm2, mm3)
1053 AS2( paddq mm0, mm2) // h += Ch(e,f,g)
1054 AS2( paddq mm5, mm0) // h += S1(e)
1055 AS2( movq mm2, [edi+1*8]) // b
1056 AS2( movq mm1, mm2)
1057 AS2( por mm2, mm4)
1058 AS2( pand mm2, [edi+2*8]) // c
1059 AS2( pand mm1, mm4)
1060 AS2( por mm1, mm2)
1061 AS2( paddq mm1, mm5) // temp = h + Maj(a,b,c)
1062 AS2( paddq mm5, [edi+3*8]) // e = d + h
1063 AS2( movq [edi+3*8], mm5)
1064 AS2( movq [edi+11*8], mm5)
1065 SSE2_S0_S1(mm4,28,34,39) // S0(a)
1066 AS2( paddq mm4, mm1) // a = temp + S0(a)
1067 AS2( movq [edi-8], mm4)
1068 AS2( movq [edi+7*8], mm4)
1069 AS1( ret)
1070
1071 // first 16 rounds
1072 ASL(0)
1073 AS2( movq mm0, [edx+eax*8])
1074 AS2( movq [esi+eax*8], mm0)
1075 AS2( movq [esi+eax*8+16*8], mm0)
1076 AS2( paddq mm0, [ebx+eax*8])
1077 ASC( call, SHA512_Round)
1078
1079 AS1( inc eax)
1080 AS2( sub edi, 8)
1081 AS2( test eax, 7)
1082 ASJ( jnz, 0, b)
1083 AS2( add edi, 8*8)
1084 AS2( cmp eax, 16)
1085 ASJ( jne, 0, b)
1086
1087 // rest of the rounds
1088 AS2( movdqu xmm0, [esi+(16-2)*8])
1089 ASL(1)
1090 // data expansion, W[i-2] already in xmm0
1091 AS2( movdqu xmm3, [esi])
1092 AS2( paddq xmm3, [esi+(16-7)*8])
1093 AS2( movdqu xmm2, [esi+(16-15)*8])
1094 SSE2_s1(xmm0, 6, 19, 61)
1095 AS2( paddq xmm0, xmm3)
1096 SSE2_s0(xmm2, 1, 7, 8)
1097 AS2( paddq xmm0, xmm2)
1098 AS2( movdq2q mm0, xmm0)
1099 AS2( movhlps xmm1, xmm0)
1100 AS2( paddq mm0, [ebx+eax*8])
1101 AS2( movlps [esi], xmm0)
1102 AS2( movlps [esi+8], xmm1)
1103 AS2( movlps [esi+8*16], xmm0)
1104 AS2( movlps [esi+8*17], xmm1)
1105 // 2 rounds
1106 ASC( call, SHA512_Round)
1107 AS2( sub edi, 8)
1108 AS2( movdq2q mm0, xmm1)
1109 AS2( paddq mm0, [ebx+eax*8+8])
1110 ASC( call, SHA512_Round)
1111 // update indices and loop
1112 AS2( add esi, 16)
1113 AS2( add eax, 2)
1114 AS2( sub edi, 8)
1115 AS2( test eax, 7)
1116 ASJ( jnz, 1, b)
1117 // do housekeeping every 8 rounds
1118 AS2( mov esi, 0xf)
1119 AS2( and esi, eax)
1120 AS2( lea esi, [esp+4+20*8+8+esi*8])
1121 AS2( add edi, 8*8)
1122 AS2( cmp eax, 80)
1123 ASJ( jne, 1, b)
1124
1125 #define SSE2_CombineState(i) \
1126 AS2( movdqu xmm0, [edi+i*16])\
1127 AS2( paddq xmm0, [ecx+i*16])\
1128 AS2( movdqu [ecx+i*16], xmm0)
1129
1130 SSE2_CombineState(0)
1131 SSE2_CombineState(1)
1132 SSE2_CombineState(2)
1133 SSE2_CombineState(3)
1134
1135 AS_POP_IF86( sp)
1136 AS1( emms)
1137
1138 #if defined(__GNUC__)
1139 AS_POP_IF86( bx)
1140 ATT_PREFIX
1141 :
1142 : "a" (SHA512_K), "c" (state), "d" (data)
1143 : "%esi", "%edi", "memory", "cc"
1144 );
1145 #else
1146 AS1( pop edi)
1147 AS1( pop esi)
1148 AS1( pop ebx)
1149 AS1( ret)
1150 #endif
1151 }
1152
1153 // ANONYMOUS_NAMESPACE_END
1154
1155 #endif // CRYPTOPP_SSE2_ASM_AVAILABLE
1156
1157 ANONYMOUS_NAMESPACE_BEGIN
1158
1159 #define a(i) T[(0-i)&7]
1160 #define b(i) T[(1-i)&7]
1161 #define c(i) T[(2-i)&7]
1162 #define d(i) T[(3-i)&7]
1163 #define e(i) T[(4-i)&7]
1164 #define f(i) T[(5-i)&7]
1165 #define g(i) T[(6-i)&7]
1166 #define h(i) T[(7-i)&7]
1167
1168 #define blk0(i) (W[i]=data[i])
1169 #define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
1170
1171 #define Ch(x,y,z) (z^(x&(y^z)))
1172 #define Maj(x,y,z) (y^((x^y)&(y^z)))
1173
1174 #define s0(x) (rotrConstant<1>(x)^rotrConstant<8>(x)^(x>>7))
1175 #define s1(x) (rotrConstant<19>(x)^rotrConstant<61>(x)^(x>>6))
1176 #define S0(x) (rotrConstant<28>(x)^rotrConstant<34>(x)^rotrConstant<39>(x))
1177 #define S1(x) (rotrConstant<14>(x)^rotrConstant<18>(x)^rotrConstant<41>(x))
1178
1179 #define R(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA512_K[i+j]+\
1180 (j?blk2(i):blk0(i));d(i)+=h(i);h(i)+=S0(a(i))+Maj(a(i),b(i),c(i));
1181
1182 void SHA512_HashBlock_CXX(word64 *state, const word64 *data)
1183 {
1184 CRYPTOPP_ASSERT(state);
1185 CRYPTOPP_ASSERT(data);
1186
1187 word64 W[16]={0}, T[8];
1188
1189 /* Copy context->state[] to working vars */
1190 std::memcpy(T, state, sizeof(T));
1191
1192 /* 80 operations, partially loop unrolled */
1193 for (unsigned int j=0; j<80; j+=16)
1194 {
1195 R( 0); R( 1); R( 2); R( 3);
1196 R( 4); R( 5); R( 6); R( 7);
1197 R( 8); R( 9); R(10); R(11);
1198 R(12); R(13); R(14); R(15);
1199 }
1200
1201 state[0] += a(0);
1202 state[1] += b(0);
1203 state[2] += c(0);
1204 state[3] += d(0);
1205 state[4] += e(0);
1206 state[5] += f(0);
1207 state[6] += g(0);
1208 state[7] += h(0);
1209 }
1210
1211 ANONYMOUS_NAMESPACE_END
1212
1213 void SHA512::Transform(word64 *state, const word64 *data)
1214 {
1215 CRYPTOPP_ASSERT(state);
1216 CRYPTOPP_ASSERT(data);
1217
1218 #if CRYPTOPP_SSE2_ASM_AVAILABLE && (CRYPTOPP_BOOL_X86)
1219 if (HasSSE2())
1220 {
1221 SHA512_HashBlock_SSE2(state, data);
1222 return;
1223 }
1224 #endif
1225 #if CRYPTOPP_POWER8_SHA_AVAILABLE
1226 if (HasSHA512())
1227 {
1228 SHA512_HashMultipleBlocks_POWER8(state, data, SHA512::BLOCKSIZE, BIG_ENDIAN_ORDER);
1229 return;
1230 }
1231 #endif
1232
1233 SHA512_HashBlock_CXX(state, data);
1234 }
1235
1236 #undef Ch
1237 #undef Maj
1238
1239 #undef s0
1240 #undef s1
1241 #undef S0
1242 #undef S1
1243
1244 #undef blk0
1245 #undef blk1
1246 #undef blk2
1247
1248 #undef R
1249
1250 #undef a
1251 #undef b
1252 #undef c
1253 #undef d
1254 #undef e
1255 #undef f
1256 #undef g
1257 #undef h
1258
1259 NAMESPACE_END
1260
1261 #endif // Not CRYPTOPP_GENERATE_X64_MASM
1262 #endif // Not CRYPTOPP_IMPORTS
HasSHA
bool HasSHA()
Determines SHA availability.
Definition: cpu.h:189
NativeByteOrderIs
bool NativeByteOrderIs(ByteOrder order)
Determines whether order follows native byte ordering.
Definition: misc.h:1130
misc.h
Utility functions for the Crypto++ library.
SHA1::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:225
ByteOrder
ByteOrder
Provides the byte ordering.
Definition: cryptlib.h:143
SHA384::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:937
SHA256::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:765
config.h
Library configuration file.
SHA384::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:927
SHA1::Transform
static void Transform(HashWordType *digest, const HashWordType *data)
Operate the hash.
Definition: sha.cpp:251
LITTLE_ENDIAN_ORDER
byte order is little-endian
Definition: cryptlib.h:145
SHA224::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:410
secblock.h
Classes and functions for secure memory allocations.
SHA224::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:415
HasSHA256
bool HasSHA256()
Determine if a PowerPC processor has SHA256 available.
Definition: cpu.h:695
IteratedHash< word32, BigEndian, T_BlockSize >::GetByteOrder
ByteOrder GetByteOrder() const
Provides the byte order of the hash.
Definition: iterhash.h:144
SHA1::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:242
pch.h
Precompiled header file.
HasSHA1
bool HasSHA1()
Determine if an ARM processor has SHA1 available.
Definition: cpu.h:469
FixedSizeAlignedSecBlock
Fixed size stack-based SecBlock with 16-byte alignment.
Definition: secblock.h:1083
HasSHA512
bool HasSHA512()
Determine if an ARM processor has SHA512 available.
Definition: cpu.h:509
BIG_ENDIAN_ORDER
byte order is big-endian
Definition: cryptlib.h:147
CRYPTOPP_ASSERT
#define CRYPTOPP_ASSERT(exp)
Debugging and diagnostic assertion.
Definition: trap.h:60
cpu.h
Functions for CPU features and intrinsics.
sha.h
Classes for SHA-1 and SHA-2 family of message digests.
SHA512::Transform
static void Transform(HashWordType *digest, const HashWordType *data)
Operate the hash.
Definition: sha.cpp:1213
HasSSE2
bool HasSSE2()
Determines SSE2 availability.
Definition: cpu.h:116
HasSHA2
bool HasSHA2()
Determine if an ARM processor has SHA256 available.
Definition: cpu.h:489
SHA512::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:947
SHA256::Transform
static void Transform(HashWordType *digest, const HashWordType *data)
Operate the hash.
Definition: sha.cpp:770
CryptoPP
Crypto++ library namespace.
SHA256::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:423
ByteReverse
byte ByteReverse(byte value)
Reverses bytes in a 8-bit value.
Definition: misc.h:1906
SHA512::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:932