Crypto++ 8.0 Free C++ class library of cryptographic schemes

sha.cpp
1 // sha.cpp - modified by Wei Dai from Steve Reid's public domain sha1.c
2
3 // Steve Reid implemented SHA-1. Wei Dai implemented SHA-2. Jeffrey Walton
4 // implemented Intel SHA extensions based on Intel articles and code by
5 // Sean Gulley. Jeffrey Walton implemented ARM SHA based on ARM code and
6 // code from Johannes Schneiders, Skip Hovsmith and Barry O'Rourke.
7 // All code is in the public domain.
8
9 // In August 2017 JW reworked the internals to align all the implementations.
10 // Formerly all hashes were software based, IterHashBase handled endian conversions,
11 // and IterHashBase dispatched a single to block SHA{N}::Transform. SHA{N}::Transform
12 // then performed the single block hashing. It was repeated for multiple blocks.
13 //
14 // The rework added SHA{N}::HashMultipleBlocks (class) and SHA{N}_HashMultipleBlocks
15 // (free standing). There are also hardware accelerated variations. Callers enter
16 // SHA{N}::HashMultipleBlocks (class), and the function calls SHA{N}_HashMultipleBlocks
17 // (free standing) or SHA{N}_HashBlock (free standing) as a fallback.
18 //
19 // An added wrinkle is hardware is little endian, C++ is big endian, and callers use
20 // big endian, so SHA{N}_HashMultipleBlock accepts a ByteOrder for the incoming data
21 // arrangement. Hardware based SHA{N}_HashMultipleBlock can often perform the endian
22 // swap much easier by setting an EPI mask. Endian swap incurs no penalty on Intel SHA,
23 // and 4-instruction penalty on ARM SHA. Under C++ the full software based swap penalty
24 // is incurred due to use of ReverseBytes().
25 //
26 // The rework also removed the hacked-in pointers to implementations.
27
28 // use "cl /EP /P /DCRYPTOPP_GENERATE_X64_MASM sha.cpp" to generate MASM code
29
30 #include "pch.h"
31 #include "config.h"
32
33 #if CRYPTOPP_MSC_VERSION
34 # pragma warning(disable: 4100 4731)
35 #endif
36
37 #ifndef CRYPTOPP_IMPORTS
38 #ifndef CRYPTOPP_GENERATE_X64_MASM
39
40 #include "secblock.h"
41 #include "sha.h"
42 #include "misc.h"
43 #include "cpu.h"
44
45 #if defined(CRYPTOPP_DISABLE_SHA_ASM)
46 # undef CRYPTOPP_X86_ASM_AVAILABLE
47 # undef CRYPTOPP_X32_ASM_AVAILABLE
48 # undef CRYPTOPP_X64_ASM_AVAILABLE
49 # undef CRYPTOPP_SSE2_ASM_AVAILABLE
50 #endif
51
52 NAMESPACE_BEGIN(CryptoPP)
53
54 #if CRYPTOPP_SHANI_AVAILABLE
55 extern void SHA1_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order);
56 extern void SHA256_HashMultipleBlocks_SHANI(word32 *state, const word32 *data, size_t length, ByteOrder order);
57 #endif
58
59 #if CRYPTOPP_ARM_SHA1_AVAILABLE
60 extern void SHA1_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
61 #endif
62
63 #if CRYPTOPP_ARM_SHA2_AVAILABLE
64 extern void SHA256_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
65 #endif
66
67 #if CRYPTOPP_ARM_SHA512_AVAILABLE
68 extern void SHA512_HashMultipleBlocks_ARMV8(word32 *state, const word32 *data, size_t length, ByteOrder order);
69 #endif
70
71 #if CRYPTOPP_POWER8_SHA_AVAILABLE
72 extern void SHA256_HashMultipleBlocks_POWER8(word32 *state, const word32 *data, size_t length, ByteOrder order);
73 extern void SHA512_HashMultipleBlocks_POWER8(word64 *state, const word64 *data, size_t length, ByteOrder order);
74 #endif
75
76 // We add extern to export table to sha_simd.cpp, but it
77 // cleared http://github.com/weidai11/cryptopp/issues/502
78 extern const word32 SHA256_K[64];
79 extern const word64 SHA512_K[80];
80
81 CRYPTOPP_ALIGN_DATA(16)
82 const word64 SHA512_K[80] = {
83 W64LIT(0x428a2f98d728ae22), W64LIT(0x7137449123ef65cd),
84 W64LIT(0xb5c0fbcfec4d3b2f), W64LIT(0xe9b5dba58189dbbc),
85 W64LIT(0x3956c25bf348b538), W64LIT(0x59f111f1b605d019),
86 W64LIT(0x923f82a4af194f9b), W64LIT(0xab1c5ed5da6d8118),
87 W64LIT(0xd807aa98a3030242), W64LIT(0x12835b0145706fbe),
88 W64LIT(0x243185be4ee4b28c), W64LIT(0x550c7dc3d5ffb4e2),
89 W64LIT(0x72be5d74f27b896f), W64LIT(0x80deb1fe3b1696b1),
90 W64LIT(0x9bdc06a725c71235), W64LIT(0xc19bf174cf692694),
91 W64LIT(0xe49b69c19ef14ad2), W64LIT(0xefbe4786384f25e3),
92 W64LIT(0x0fc19dc68b8cd5b5), W64LIT(0x240ca1cc77ac9c65),
93 W64LIT(0x2de92c6f592b0275), W64LIT(0x4a7484aa6ea6e483),
94 W64LIT(0x5cb0a9dcbd41fbd4), W64LIT(0x76f988da831153b5),
95 W64LIT(0x983e5152ee66dfab), W64LIT(0xa831c66d2db43210),
96 W64LIT(0xb00327c898fb213f), W64LIT(0xbf597fc7beef0ee4),
97 W64LIT(0xc6e00bf33da88fc2), W64LIT(0xd5a79147930aa725),
98 W64LIT(0x06ca6351e003826f), W64LIT(0x142929670a0e6e70),
99 W64LIT(0x27b70a8546d22ffc), W64LIT(0x2e1b21385c26c926),
100 W64LIT(0x4d2c6dfc5ac42aed), W64LIT(0x53380d139d95b3df),
101 W64LIT(0x650a73548baf63de), W64LIT(0x766a0abb3c77b2a8),
102 W64LIT(0x81c2c92e47edaee6), W64LIT(0x92722c851482353b),
103 W64LIT(0xa2bfe8a14cf10364), W64LIT(0xa81a664bbc423001),
104 W64LIT(0xc24b8b70d0f89791), W64LIT(0xc76c51a30654be30),
105 W64LIT(0xd192e819d6ef5218), W64LIT(0xd69906245565a910),
106 W64LIT(0xf40e35855771202a), W64LIT(0x106aa07032bbd1b8),
107 W64LIT(0x19a4c116b8d2d0c8), W64LIT(0x1e376c085141ab53),
108 W64LIT(0x2748774cdf8eeb99), W64LIT(0x34b0bcb5e19b48a8),
109 W64LIT(0x391c0cb3c5c95a63), W64LIT(0x4ed8aa4ae3418acb),
110 W64LIT(0x5b9cca4f7763e373), W64LIT(0x682e6ff3d6b2b8a3),
111 W64LIT(0x748f82ee5defb2fc), W64LIT(0x78a5636f43172f60),
112 W64LIT(0x84c87814a1f0ab72), W64LIT(0x8cc702081a6439ec),
113 W64LIT(0x90befffa23631e28), W64LIT(0xa4506cebde82bde9),
114 W64LIT(0xbef9a3f7b2c67915), W64LIT(0xc67178f2e372532b),
115 W64LIT(0xca273eceea26619c), W64LIT(0xd186b8c721c0c207),
116 W64LIT(0xeada7dd6cde0eb1e), W64LIT(0xf57d4f7fee6ed178),
117 W64LIT(0x06f067aa72176fba), W64LIT(0x0a637dc5a2c898a6),
118 W64LIT(0x113f9804bef90dae), W64LIT(0x1b710b35131c471b),
119 W64LIT(0x28db77f523047d84), W64LIT(0x32caab7b40c72493),
120 W64LIT(0x3c9ebe0a15c9bebc), W64LIT(0x431d67c49c100d4c),
121 W64LIT(0x4cc5d4becb3e42b6), W64LIT(0x597f299cfc657e2a),
122 W64LIT(0x5fcb6fab3ad6faec), W64LIT(0x6c44198c4a475817)
123 };
124
125 CRYPTOPP_ALIGN_DATA(16)
126 const word32 SHA256_K[64] = {
127
128 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
129 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
130 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
131 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
132 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
133 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
134 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
135 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
136 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
137 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
138 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
139 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
140 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
141 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
142 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
143 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
144 };
145
146 ////////////////////////////////
147 // start of Steve Reid's code //
148 ////////////////////////////////
149
150 ANONYMOUS_NAMESPACE_BEGIN
151
152 #define blk0(i) (W[i] = data[i])
153 #define blk1(i) (W[i&15] = rotlConstant<1>(W[(i+13)&15]^W[(i+8)&15]^W[(i+2)&15]^W[i&15]))
154
155 #define f1(x,y,z) (z^(x&(y^z)))
156 #define f2(x,y,z) (x^y^z)
157 #define f3(x,y,z) ((x&y)|(z&(x|y)))
158 #define f4(x,y,z) (x^y^z)
159
160 /* (R0+R1), R2, R3, R4 are the different operations used in SHA1 */
161 #define R0(v,w,x,y,z,i) z+=f1(w,x,y)+blk0(i)+0x5A827999+rotlConstant<5>(v);w=rotlConstant<30>(w);
162 #define R1(v,w,x,y,z,i) z+=f1(w,x,y)+blk1(i)+0x5A827999+rotlConstant<5>(v);w=rotlConstant<30>(w);
163 #define R2(v,w,x,y,z,i) z+=f2(w,x,y)+blk1(i)+0x6ED9EBA1+rotlConstant<5>(v);w=rotlConstant<30>(w);
164 #define R3(v,w,x,y,z,i) z+=f3(w,x,y)+blk1(i)+0x8F1BBCDC+rotlConstant<5>(v);w=rotlConstant<30>(w);
165 #define R4(v,w,x,y,z,i) z+=f4(w,x,y)+blk1(i)+0xCA62C1D6+rotlConstant<5>(v);w=rotlConstant<30>(w);
166
167 void SHA1_HashBlock_CXX(word32 *state, const word32 *data)
168 {
169 CRYPTOPP_ASSERT(state);
170 CRYPTOPP_ASSERT(data);
171
172 word32 W[16];
173 /* Copy context->state[] to working vars */
174 word32 a = state[0];
175 word32 b = state[1];
176 word32 c = state[2];
177 word32 d = state[3];
178 word32 e = state[4];
179 /* 4 rounds of 20 operations each. Loop unrolled. */
180 R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
181 R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
182 R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
183 R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
184 R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
185 R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
186 R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
187 R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
188 R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
189 R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
190 R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
191 R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
192 R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
193 R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
194 R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
195 R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
196 R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
197 R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
198 R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
199 R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
200 /* Add the working vars back into context.state[] */
201 state[0] += a;
202 state[1] += b;
203 state[2] += c;
204 state[3] += d;
205 state[4] += e;
206 }
207
208 #undef blk0
209 #undef blk1
210 #undef f1
211 #undef f2
212 #undef f3
213 #undef f4
214 #undef R1
215 #undef R2
216 #undef R3
217 #undef R4
218
219 ANONYMOUS_NAMESPACE_END
220
221 //////////////////////////////
222 // end of Steve Reid's code //
223 //////////////////////////////
224
225 std::string SHA1::AlgorithmProvider() const
226 {
227 #if CRYPTOPP_SHANI_AVAILABLE
228 if (HasSHA())
229 return "SHANI";
230 #endif
231 #if CRYPTOPP_SSE2_ASM_AVAILABLE
232 if (HasSSE2())
233 return "SSE2";
234 #endif
235 #if CRYPTOPP_ARM_SHA1_AVAILABLE
236 if (HasSHA1())
237 return "ARMv8";
238 #endif
239 return "C++";
240 }
241
242 void SHA1::InitState(HashWordType *state)
243 {
244 state[0] = 0x67452301;
245 state[1] = 0xEFCDAB89;
246 state[2] = 0x98BADCFE;
247 state[3] = 0x10325476;
248 state[4] = 0xC3D2E1F0;
249 }
250
251 void SHA1::Transform(word32 *state, const word32 *data)
252 {
253 CRYPTOPP_ASSERT(state);
254 CRYPTOPP_ASSERT(data);
255
256 #if CRYPTOPP_SHANI_AVAILABLE
257 if (HasSHA())
258 {
259 SHA1_HashMultipleBlocks_SHANI(state, data, SHA1::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
260 return;
261 }
262 #endif
263 #if CRYPTOPP_ARM_SHA1_AVAILABLE
264 if (HasSHA1())
265 {
266 SHA1_HashMultipleBlocks_ARMV8(state, data, SHA1::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
267 return;
268 }
269 #endif
270
271 SHA1_HashBlock_CXX(state, data);
272 }
273
274 size_t SHA1::HashMultipleBlocks(const word32 *input, size_t length)
275 {
276 CRYPTOPP_ASSERT(input);
277 CRYPTOPP_ASSERT(length >= SHA1::BLOCKSIZE);
278
279 #if CRYPTOPP_SHANI_AVAILABLE
280 if (HasSHA())
281 {
282 SHA1_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
283 return length & (SHA1::BLOCKSIZE - 1);
284 }
285 #endif
286 #if CRYPTOPP_ARM_SHA1_AVAILABLE
287 if (HasSHA1())
288 {
289 SHA1_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
290 return length & (SHA1::BLOCKSIZE - 1);
291 }
292 #endif
293
294 const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
295 word32 *dataBuf = this->DataBuf();
296 do
297 {
298 if (noReverse)
299 {
300 SHA1_HashBlock_CXX(m_state, input);
301 }
302 else
303 {
304 ByteReverse(dataBuf, input, SHA1::BLOCKSIZE);
305 SHA1_HashBlock_CXX(m_state, dataBuf);
306 }
307
308 input += SHA1::BLOCKSIZE/sizeof(word32);
309 length -= SHA1::BLOCKSIZE;
310 }
311 while (length >= SHA1::BLOCKSIZE);
312 return length;
313 }
314
315 // *************************************************************
316
317 ANONYMOUS_NAMESPACE_BEGIN
318
319 #define a(i) T[(0-i)&7]
320 #define b(i) T[(1-i)&7]
321 #define c(i) T[(2-i)&7]
322 #define d(i) T[(3-i)&7]
323 #define e(i) T[(4-i)&7]
324 #define f(i) T[(5-i)&7]
325 #define g(i) T[(6-i)&7]
326 #define h(i) T[(7-i)&7]
327
328 #define blk0(i) (W[i] = data[i])
329 #define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
330
331 #define Ch(x,y,z) (z^(x&(y^z)))
332 #define Maj(x,y,z) (y^((x^y)&(y^z)))
333
334 #define R(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA256_K[i+j]+(j?blk2(i):blk0(i));\
335 d(i)+=h(i);h(i)+=S0(a(i))+Maj(a(i),b(i),c(i))
336
337 // for SHA256
338 #define s0(x) (rotrConstant<7>(x)^rotrConstant<18>(x)^(x>>3))
339 #define s1(x) (rotrConstant<17>(x)^rotrConstant<19>(x)^(x>>10))
340 #define S0(x) (rotrConstant<2>(x)^rotrConstant<13>(x)^rotrConstant<22>(x))
341 #define S1(x) (rotrConstant<6>(x)^rotrConstant<11>(x)^rotrConstant<25>(x))
342
343 void SHA256_HashBlock_CXX(word32 *state, const word32 *data)
344 {
345 word32 W[16]={0}, T[8];
346 /* Copy context->state[] to working vars */
347 memcpy(T, state, sizeof(T));
348 /* 64 operations, partially loop unrolled */
349 for (unsigned int j=0; j<64; j+=16)
350 {
351 R( 0); R( 1); R( 2); R( 3);
352 R( 4); R( 5); R( 6); R( 7);
353 R( 8); R( 9); R(10); R(11);
354 R(12); R(13); R(14); R(15);
355 }
356 /* Add the working vars back into context.state[] */
357 state[0] += a(0);
358 state[1] += b(0);
359 state[2] += c(0);
360 state[3] += d(0);
361 state[4] += e(0);
362 state[5] += f(0);
363 state[6] += g(0);
364 state[7] += h(0);
365 }
366
367 #undef Ch
368 #undef Maj
369 #undef s0
370 #undef s1
371 #undef S0
372 #undef S1
373 #undef blk0
374 #undef blk1
375 #undef blk2
376 #undef R
377
378 #undef a
379 #undef b
380 #undef c
381 #undef d
382 #undef e
383 #undef f
384 #undef g
385 #undef h
386
387 ANONYMOUS_NAMESPACE_END
388
389 std::string SHA256_AlgorithmProvider()
390 {
391 #if CRYPTOPP_SHANI_AVAILABLE
392 if (HasSHA())
393 return "SHANI";
394 #endif
395 #if CRYPTOPP_SSE2_ASM_AVAILABLE
396 if (HasSSE2())
397 return "SSE2";
398 #endif
399 #if CRYPTOPP_ARM_SHA2_AVAILABLE
400 if (HasSHA2())
401 return "ARMv8";
402 #endif
403 #if (CRYPTOPP_POWER8_SHA_AVAILABLE)
404 if (HasSHA256())
405 return "Power8";
406 #endif
407 return "C++";
408 }
409
410 std::string SHA224::AlgorithmProvider() const
411 {
412 return SHA256_AlgorithmProvider();
413 }
414
415 void SHA224::InitState(HashWordType *state)
416 {
417 static const word32 s[8] = {
418 0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939,
419 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4};
420 memcpy(state, s, sizeof(s));
421 }
422
423 void SHA256::InitState(HashWordType *state)
424 {
425 static const word32 s[8] = {
426 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
427 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
428 memcpy(state, s, sizeof(s));
429 }
430 #endif // Not CRYPTOPP_GENERATE_X64_MASM
431
432 #if defined(CRYPTOPP_X86_ASM_AVAILABLE)
433
434 ANONYMOUS_NAMESPACE_BEGIN
435
436 void CRYPTOPP_FASTCALL SHA256_HashMultipleBlocks_SSE2(word32 *state, const word32 *data, size_t len)
437 {
438 #define LOCALS_SIZE 8*4 + 16*4 + 4*WORD_SZ
439 #define H(i) [BASE+ASM_MOD(1024+7-(i),8)*4]
440 #define G(i) H(i+1)
441 #define F(i) H(i+2)
442 #define E(i) H(i+3)
443 #define D(i) H(i+4)
444 #define C(i) H(i+5)
445 #define B(i) H(i+6)
446 #define A(i) H(i+7)
447 #define Wt(i) BASE+8*4+ASM_MOD(1024+15-(i),16)*4
448 #define Wt_2(i) Wt((i)-2)
449 #define Wt_15(i) Wt((i)-15)
450 #define Wt_7(i) Wt((i)-7)
451 #define K_END [BASE+8*4+16*4+0*WORD_SZ]
452 #define STATE_SAVE [BASE+8*4+16*4+1*WORD_SZ]
453 #define DATA_SAVE [BASE+8*4+16*4+2*WORD_SZ]
454 #define DATA_END [BASE+8*4+16*4+3*WORD_SZ]
455 #define Kt(i) WORD_REG(si)+(i)*4
456 #if CRYPTOPP_BOOL_X86
457 #define BASE esp+4
458 #elif defined(__GNUC__)
459 #define BASE r8
460 #else
461 #define BASE rsp
462 #endif
463
464 #define RA0(i, edx, edi) \
465 AS2( add edx, [Kt(i)] )\
466 AS2( add edx, [Wt(i)] )\
467 AS2( add edx, H(i) )\
468
469 #define RA1(i, edx, edi)
470
471 #define RB0(i, edx, edi)
472
473 #define RB1(i, edx, edi) \
474 AS2( mov AS_REG_7d, [Wt_2(i)] )\
475 AS2( mov edi, [Wt_15(i)])\
476 AS2( mov ebx, AS_REG_7d )\
477 AS2( shr AS_REG_7d, 10 )\
478 AS2( ror ebx, 17 )\
479 AS2( xor AS_REG_7d, ebx )\
480 AS2( ror ebx, 2 )\
481 AS2( xor ebx, AS_REG_7d )/* s1(W_t-2) */\
482 AS2( add ebx, [Wt_7(i)])\
483 AS2( mov AS_REG_7d, edi )\
484 AS2( shr AS_REG_7d, 3 )\
485 AS2( ror edi, 7 )\
486 AS2( add ebx, [Wt(i)])/* s1(W_t-2) + W_t-7 + W_t-16 */\
487 AS2( xor AS_REG_7d, edi )\
488 AS2( add edx, [Kt(i)])\
489 AS2( ror edi, 11 )\
490 AS2( add edx, H(i) )\
491 AS2( xor AS_REG_7d, edi )/* s0(W_t-15) */\
492 AS2( add AS_REG_7d, ebx )/* W_t = s1(W_t-2) + W_t-7 + s0(W_t-15) W_t-16*/\
493 AS2( mov [Wt(i)], AS_REG_7d)\
494 AS2( add edx, AS_REG_7d )\
495
496 #define ROUND(i, r, eax, ecx, edi, edx)\
497 /* in: edi = E */\
498 /* unused: eax, ecx, temp: ebx, AS_REG_7d, out: edx = T1 */\
499 AS2( mov edx, F(i) )\
500 AS2( xor edx, G(i) )\
501 AS2( and edx, edi )\
502 AS2( xor edx, G(i) )/* Ch(E,F,G) = (G^(E&(F^G))) */\
503 AS2( mov AS_REG_7d, edi )\
504 AS2( ror edi, 6 )\
505 AS2( ror AS_REG_7d, 25 )\
506 RA##r(i, edx, edi )/* H + Wt + Kt + Ch(E,F,G) */\
507 AS2( xor AS_REG_7d, edi )\
508 AS2( ror edi, 5 )\
509 AS2( xor AS_REG_7d, edi )/* S1(E) */\
510 AS2( add edx, AS_REG_7d )/* T1 = S1(E) + Ch(E,F,G) + H + Wt + Kt */\
511 RB##r(i, edx, edi )/* H + Wt + Kt + Ch(E,F,G) */\
512 /* in: ecx = A, eax = B^C, edx = T1 */\
513 /* unused: edx, temp: ebx, AS_REG_7d, out: eax = A, ecx = B^C, edx = E */\
514 AS2( mov ebx, ecx )\
515 AS2( xor ecx, B(i) )/* A^B */\
516 AS2( and eax, ecx )\
517 AS2( xor eax, B(i) )/* Maj(A,B,C) = B^((A^B)&(B^C) */\
518 AS2( mov AS_REG_7d, ebx )\
519 AS2( ror ebx, 2 )\
520 AS2( add eax, edx )/* T1 + Maj(A,B,C) */\
521 AS2( add edx, D(i) )\
522 AS2( mov D(i), edx )\
523 AS2( ror AS_REG_7d, 22 )\
524 AS2( xor AS_REG_7d, ebx )\
525 AS2( ror ebx, 11 )\
526 AS2( xor AS_REG_7d, ebx )\
527 AS2( add eax, AS_REG_7d )/* T1 + S0(A) + Maj(A,B,C) */\
528 AS2( mov H(i), eax )\
529
530 // Unroll the use of CRYPTOPP_BOOL_X64 in assembler math. The GAS assembler on X32 (version 2.25)
531 // complains "Error: invalid operands (*ABS* and *UND* sections) for `*` and `-`"
532 #if CRYPTOPP_BOOL_X64
533 #define SWAP_COPY(i) \
534 AS2( mov WORD_REG(bx), [WORD_REG(dx)+i*WORD_SZ])\
535 AS1( bswap WORD_REG(bx))\
536 AS2( mov [Wt(i*2+1)], WORD_REG(bx))
537 #else // X86 and X32
538 #define SWAP_COPY(i) \
539 AS2( mov WORD_REG(bx), [WORD_REG(dx)+i*WORD_SZ])\
540 AS1( bswap WORD_REG(bx))\
541 AS2( mov [Wt(i)], WORD_REG(bx))
542 #endif
543
544 #if defined(__GNUC__)
545 #if CRYPTOPP_BOOL_X64
546 FixedSizeAlignedSecBlock<byte, LOCALS_SIZE> workspace;
547 #endif
548 __asm__ __volatile__
549 (
550 #if CRYPTOPP_BOOL_X64
551 "lea %4, %%r8;"
552 #endif
553 INTEL_NOPREFIX
554 #elif defined(CRYPTOPP_GENERATE_X64_MASM)
555 ALIGN 8
556 SHA256_HashMultipleBlocks_SSE2 PROC FRAME
557 rex_push_reg rsi
558 push_reg rdi
559 push_reg rbx
560 push_reg rbp
561 alloc_stack(LOCALS_SIZE+8)
562 .endprolog
563 mov rdi, r8
564 lea rsi, [?SHA256_K@CryptoPP@@3QBIB + 48*4]
565 #endif
566
567 #if CRYPTOPP_BOOL_X86
568 #ifndef __GNUC__
569 AS2( mov edi, [len])
570 AS2( lea WORD_REG(si), [SHA256_K+48*4])
571 #endif
572 #if !defined(_MSC_VER) || (_MSC_VER < 1400)
573 AS_PUSH_IF86(bx)
574 #endif
575
576 AS_PUSH_IF86(bp)
577 AS2( mov ebx, esp)
578 AS2( and esp, -16)
579 AS2( sub WORD_REG(sp), LOCALS_SIZE)
580 AS_PUSH_IF86(bx)
581 #endif
582 AS2( mov STATE_SAVE, WORD_REG(cx))
583 AS2( mov DATA_SAVE, WORD_REG(dx))
584 AS2( lea WORD_REG(ax), [WORD_REG(di) + WORD_REG(dx)])
585 AS2( mov DATA_END, WORD_REG(ax))
586 AS2( mov K_END, WORD_REG(si))
587
588 #if CRYPTOPP_SSE2_ASM_AVAILABLE
589 #if CRYPTOPP_BOOL_X86
590 AS2( test edi, 1)
591 ASJ( jnz, 2, f)
592 AS1( dec DWORD PTR K_END)
593 #endif
594 AS2( movdqu xmm0, XMMWORD_PTR [WORD_REG(cx)+0*16])
595 AS2( movdqu xmm1, XMMWORD_PTR [WORD_REG(cx)+1*16])
596 #endif
597
598 #if CRYPTOPP_BOOL_X86
599 #if CRYPTOPP_SSE2_ASM_AVAILABLE
600 ASJ( jmp, 0, f)
601 #endif
602 ASL(2) // non-SSE2
603 AS2( mov esi, ecx)
604 AS2( lea edi, A(0))
605 AS2( mov ecx, 8)
606 ATT_NOPREFIX
607 AS1( rep movsd)
608 INTEL_NOPREFIX
609 AS2( mov esi, K_END)
610 ASJ( jmp, 3, f)
611 #endif
612
613 #if CRYPTOPP_SSE2_ASM_AVAILABLE
614 ASL(0)
615 AS2( movdqu E(0), xmm1)
616 AS2( movdqu A(0), xmm0)
617 #endif
618 #if CRYPTOPP_BOOL_X86
619 ASL(3)
620 #endif
621 AS2( sub WORD_REG(si), 48*4)
622 SWAP_COPY(0) SWAP_COPY(1) SWAP_COPY(2) SWAP_COPY(3)
623 SWAP_COPY(4) SWAP_COPY(5) SWAP_COPY(6) SWAP_COPY(7)
624 #if CRYPTOPP_BOOL_X86
625 SWAP_COPY(8) SWAP_COPY(9) SWAP_COPY(10) SWAP_COPY(11)
626 SWAP_COPY(12) SWAP_COPY(13) SWAP_COPY(14) SWAP_COPY(15)
627 #endif
628 AS2( mov edi, E(0)) // E
629 AS2( mov eax, B(0)) // B
630 AS2( xor eax, C(0)) // B^C
631 AS2( mov ecx, A(0)) // A
632
633 ROUND(0, 0, eax, ecx, edi, edx)
634 ROUND(1, 0, ecx, eax, edx, edi)
635 ROUND(2, 0, eax, ecx, edi, edx)
636 ROUND(3, 0, ecx, eax, edx, edi)
637 ROUND(4, 0, eax, ecx, edi, edx)
638 ROUND(5, 0, ecx, eax, edx, edi)
639 ROUND(6, 0, eax, ecx, edi, edx)
640 ROUND(7, 0, ecx, eax, edx, edi)
641 ROUND(8, 0, eax, ecx, edi, edx)
642 ROUND(9, 0, ecx, eax, edx, edi)
643 ROUND(10, 0, eax, ecx, edi, edx)
644 ROUND(11, 0, ecx, eax, edx, edi)
645 ROUND(12, 0, eax, ecx, edi, edx)
646 ROUND(13, 0, ecx, eax, edx, edi)
647 ROUND(14, 0, eax, ecx, edi, edx)
648 ROUND(15, 0, ecx, eax, edx, edi)
649
650 ASL(1)
651 AS2(add WORD_REG(si), 4*16)
652 ROUND(0, 1, eax, ecx, edi, edx)
653 ROUND(1, 1, ecx, eax, edx, edi)
654 ROUND(2, 1, eax, ecx, edi, edx)
655 ROUND(3, 1, ecx, eax, edx, edi)
656 ROUND(4, 1, eax, ecx, edi, edx)
657 ROUND(5, 1, ecx, eax, edx, edi)
658 ROUND(6, 1, eax, ecx, edi, edx)
659 ROUND(7, 1, ecx, eax, edx, edi)
660 ROUND(8, 1, eax, ecx, edi, edx)
661 ROUND(9, 1, ecx, eax, edx, edi)
662 ROUND(10, 1, eax, ecx, edi, edx)
663 ROUND(11, 1, ecx, eax, edx, edi)
664 ROUND(12, 1, eax, ecx, edi, edx)
665 ROUND(13, 1, ecx, eax, edx, edi)
666 ROUND(14, 1, eax, ecx, edi, edx)
667 ROUND(15, 1, ecx, eax, edx, edi)
668 AS2( cmp WORD_REG(si), K_END)
669 ATT_NOPREFIX
670 ASJ( jb, 1, b)
671 INTEL_NOPREFIX
672
673 AS2( mov WORD_REG(dx), DATA_SAVE)
674 AS2( add WORD_REG(dx), 64)
675 AS2( mov AS_REG_7, STATE_SAVE)
676 AS2( mov DATA_SAVE, WORD_REG(dx))
677
678 #if CRYPTOPP_SSE2_ASM_AVAILABLE
679 #if CRYPTOPP_BOOL_X86
680 AS2( test DWORD PTR K_END, 1)
681 ASJ( jz, 4, f)
682 #endif
683 AS2( movdqu xmm1, XMMWORD_PTR [AS_REG_7+1*16])
684 AS2( movdqu xmm0, XMMWORD_PTR [AS_REG_7+0*16])
685 AS2( paddd xmm1, E(0))
686 AS2( paddd xmm0, A(0))
687 AS2( movdqu [AS_REG_7+1*16], xmm1)
688 AS2( movdqu [AS_REG_7+0*16], xmm0)
689 AS2( cmp WORD_REG(dx), DATA_END)
690 ATT_NOPREFIX
691 ASJ( jb, 0, b)
692 INTEL_NOPREFIX
693 #endif
694
695 #if CRYPTOPP_BOOL_X86
696 #if CRYPTOPP_SSE2_ASM_AVAILABLE
697 ASJ( jmp, 5, f)
698 ASL(4) // non-SSE2
699 #endif
700 AS2( add [AS_REG_7+0*4], ecx) // A
701 AS2( add [AS_REG_7+4*4], edi) // E
702 AS2( mov eax, B(0))
703 AS2( mov ebx, C(0))
704 AS2( mov ecx, D(0))
705 AS2( add [AS_REG_7+1*4], eax)
706 AS2( add [AS_REG_7+2*4], ebx)
707 AS2( add [AS_REG_7+3*4], ecx)
708 AS2( mov eax, F(0))
709 AS2( mov ebx, G(0))
710 AS2( mov ecx, H(0))
711 AS2( add [AS_REG_7+5*4], eax)
712 AS2( add [AS_REG_7+6*4], ebx)
713 AS2( add [AS_REG_7+7*4], ecx)
714 AS2( mov ecx, AS_REG_7d)
715 AS2( cmp WORD_REG(dx), DATA_END)
716 ASJ( jb, 2, b)
717 #if CRYPTOPP_SSE2_ASM_AVAILABLE
718 ASL(5)
719 #endif
720 #endif
721
722 AS_POP_IF86(sp)
723 AS_POP_IF86(bp)
724 #if !defined(_MSC_VER) || (_MSC_VER < 1400)
725 AS_POP_IF86(bx)
726 #endif
727
728 #ifdef CRYPTOPP_GENERATE_X64_MASM
729 add rsp, LOCALS_SIZE+8
730 pop rbp
731 pop rbx
732 pop rdi
733 pop rsi
734 ret
735 SHA256_HashMultipleBlocks_SSE2 ENDP
736 #endif
737
738 #ifdef __GNUC__
739 ATT_PREFIX
740 :
741 : "c" (state), "d" (data), "S" (SHA256_K+48), "D" (len)
742 #if CRYPTOPP_BOOL_X64
743 , "m" (workspace[0])
744 #endif
745 : "memory", "cc", "%eax"
746 #if CRYPTOPP_BOOL_X64
747 , "%rbx", "%r8", "%r10"
748 #endif
749 );
750 #endif
751 }
752
753 ANONYMOUS_NAMESPACE_END
754
755 #endif // CRYPTOPP_X86_ASM_AVAILABLE
756
757 #ifndef CRYPTOPP_GENERATE_X64_MASM
758
759 #ifdef CRYPTOPP_X64_MASM_AVAILABLE
760 extern "C" {
761 void CRYPTOPP_FASTCALL SHA256_HashMultipleBlocks_SSE2(word32 *state, const word32 *data, size_t len);
762 }
763 #endif
764
765 std::string SHA256::AlgorithmProvider() const
766 {
767 return SHA256_AlgorithmProvider();
768 }
769
770 void SHA256::Transform(word32 *state, const word32 *data)
771 {
772 CRYPTOPP_ASSERT(state);
773 CRYPTOPP_ASSERT(data);
774
775 #if CRYPTOPP_SHANI_AVAILABLE
776 if (HasSHA())
777 {
778 SHA256_HashMultipleBlocks_SHANI(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
779 return;
780 }
781 #endif
782 #if CRYPTOPP_ARM_SHA2_AVAILABLE
783 if (HasSHA2())
784 {
785 SHA256_HashMultipleBlocks_ARMV8(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
786 return;
787 }
788 #endif
789 #if CRYPTOPP_POWER8_SHA_AVAILABLE
790 if (HasSHA256())
791 {
792 SHA256_HashMultipleBlocks_POWER8(state, data, SHA256::BLOCKSIZE, LITTLE_ENDIAN_ORDER);
793 return;
794 }
795 #endif
796
797 SHA256_HashBlock_CXX(state, data);
798 }
799
800 size_t SHA256::HashMultipleBlocks(const word32 *input, size_t length)
801 {
802 CRYPTOPP_ASSERT(input);
803 CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
804
805 #if CRYPTOPP_SHANI_AVAILABLE
806 if (HasSHA())
807 {
808 SHA256_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
809 return length & (SHA256::BLOCKSIZE - 1);
810 }
811 #endif
812 #if CRYPTOPP_SSE2_ASM_AVAILABLE || CRYPTOPP_X64_MASM_AVAILABLE
813 if (HasSSE2())
814 {
815 const size_t res = length & (SHA256::BLOCKSIZE - 1);
816 SHA256_HashMultipleBlocks_SSE2(m_state, input, length-res);
817 return res;
818 }
819 #endif
820 #if CRYPTOPP_ARM_SHA2_AVAILABLE
821 if (HasSHA2())
822 {
823 SHA256_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
824 return length & (SHA256::BLOCKSIZE - 1);
825 }
826 #endif
827 #if CRYPTOPP_POWER8_SHA_AVAILABLE
828 if (HasSHA256())
829 {
830 SHA256_HashMultipleBlocks_POWER8(m_state, input, length, BIG_ENDIAN_ORDER);
831 return length & (SHA256::BLOCKSIZE - 1);
832 }
833 #endif
834
835 const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
836 word32 *dataBuf = this->DataBuf();
837 do
838 {
839 if (noReverse)
840 {
841 SHA256_HashBlock_CXX(m_state, input);
842 }
843 else
844 {
845 ByteReverse(dataBuf, input, SHA256::BLOCKSIZE);
846 SHA256_HashBlock_CXX(m_state, dataBuf);
847 }
848
849 input += SHA256::BLOCKSIZE/sizeof(word32);
850 length -= SHA256::BLOCKSIZE;
851 }
852 while (length >= SHA256::BLOCKSIZE);
853 return length;
854 }
855
856 size_t SHA224::HashMultipleBlocks(const word32 *input, size_t length)
857 {
858 CRYPTOPP_ASSERT(input);
859 CRYPTOPP_ASSERT(length >= SHA256::BLOCKSIZE);
860
861 #if CRYPTOPP_SHANI_AVAILABLE
862 if (HasSHA())
863 {
864 SHA256_HashMultipleBlocks_SHANI(m_state, input, length, BIG_ENDIAN_ORDER);
865 return length & (SHA256::BLOCKSIZE - 1);
866 }
867 #endif
868 #if CRYPTOPP_SSE2_ASM_AVAILABLE || CRYPTOPP_X64_MASM_AVAILABLE
869 if (HasSSE2())
870 {
871 const size_t res = length & (SHA256::BLOCKSIZE - 1);
872 SHA256_HashMultipleBlocks_SSE2(m_state, input, length-res);
873 return res;
874 }
875 #endif
876 #if CRYPTOPP_ARM_SHA2_AVAILABLE
877 if (HasSHA2())
878 {
879 SHA256_HashMultipleBlocks_ARMV8(m_state, input, length, BIG_ENDIAN_ORDER);
880 return length & (SHA256::BLOCKSIZE - 1);
881 }
882 #endif
883 #if CRYPTOPP_POWER8_SHA_AVAILABLE
884 if (HasSHA256())
885 {
886 SHA256_HashMultipleBlocks_POWER8(m_state, input, length, BIG_ENDIAN_ORDER);
887 return length & (SHA256::BLOCKSIZE - 1);
888 }
889 #endif
890
891 const bool noReverse = NativeByteOrderIs(this->GetByteOrder());
892 word32 *dataBuf = this->DataBuf();
893 do
894 {
895 if (noReverse)
896 {
897 SHA256_HashBlock_CXX(m_state, input);
898 }
899 else
900 {
901 ByteReverse(dataBuf, input, SHA256::BLOCKSIZE);
902 SHA256_HashBlock_CXX(m_state, dataBuf);
903 }
904
905 input += SHA256::BLOCKSIZE/sizeof(word32);
906 length -= SHA256::BLOCKSIZE;
907 }
908 while (length >= SHA256::BLOCKSIZE);
909 return length;
910 }
911
912 // *************************************************************
913
914 std::string SHA512_AlgorithmProvider()
915 {
916 #if CRYPTOPP_SSE2_ASM_AVAILABLE
917 if (HasSSE2())
918 return "SSE2";
919 #endif
920 #if (CRYPTOPP_POWER8_SHA_AVAILABLE)
921 if (HasSHA512())
922 return "Power8";
923 #endif
924 return "C++";
925 }
926
927 std::string SHA384::AlgorithmProvider() const
928 {
929 return SHA512_AlgorithmProvider();
930 }
931
932 std::string SHA512::AlgorithmProvider() const
933 {
934 return SHA512_AlgorithmProvider();
935 }
936
937 void SHA384::InitState(HashWordType *state)
938 {
939 const word64 s[8] = {
940 W64LIT(0xcbbb9d5dc1059ed8), W64LIT(0x629a292a367cd507),
941 W64LIT(0x9159015a3070dd17), W64LIT(0x152fecd8f70e5939),
942 W64LIT(0x67332667ffc00b31), W64LIT(0x8eb44a8768581511),
943 W64LIT(0xdb0c2e0d64f98fa7), W64LIT(0x47b5481dbefa4fa4)};
944 memcpy(state, s, sizeof(s));
945 }
946
947 void SHA512::InitState(HashWordType *state)
948 {
949 const word64 s[8] = {
950 W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
951 W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
952 W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
953 W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)};
954 memcpy(state, s, sizeof(s));
955 }
956
957 #if CRYPTOPP_SSE2_ASM_AVAILABLE && (CRYPTOPP_BOOL_X86)
958
959 ANONYMOUS_NAMESPACE_BEGIN
960
961 // No inlining due to https://github.com/weidai11/cryptopp/issues/684
962 // g++ -DNDEBUG -g2 -O3 -pthread -pipe -c sha.cpp
963 // sha.cpp: Assembler messages:
964 // sha.cpp:1155: Error: symbol `SHA512_Round' is already defined
965 // sha.cpp:1155: Error: symbol `SHA512_Round' is already defined
966
967 CRYPTOPP_NOINLINE CRYPTOPP_NAKED
968 void CRYPTOPP_FASTCALL SHA512_HashBlock_SSE2(word64 *state, const word64 *data)
969 {
970 #ifdef __GNUC__
971 __asm__ __volatile__
972 (
973 INTEL_NOPREFIX
974 AS_PUSH_IF86( bx)
975 AS2( mov ebx, eax)
976 #else
977 AS1( push ebx)
978 AS1( push esi)
979 AS1( push edi)
980 AS2( lea ebx, SHA512_K)
981 #endif
982
983 AS2( mov eax, esp)
984 AS2( and esp, 0xfffffff0)
985 AS2( sub esp, 27*16) // 17*16 for expanded data, 20*8 for state
986 AS_PUSH_IF86( ax)
987 AS2( xor eax, eax)
988
989 AS2( lea edi, [esp+4+8*8]) // start at middle of state buffer. will decrement pointer each round to avoid copying
990 AS2( lea esi, [esp+4+20*8+8]) // 16-byte alignment, then add 8
991
992 AS2( movdqu xmm0, [ecx+0*16])
993 AS2( movdq2q mm4, xmm0)
994 AS2( movdqu [edi+0*16], xmm0)
995 AS2( movdqu xmm0, [ecx+1*16])
996 AS2( movdqu [edi+1*16], xmm0)
997 AS2( movdqu xmm0, [ecx+2*16])
998 AS2( movdq2q mm5, xmm0)
999 AS2( movdqu [edi+2*16], xmm0)
1000 AS2( movdqu xmm0, [ecx+3*16])
1001 AS2( movdqu [edi+3*16], xmm0)
1002 ASJ( jmp, 0, f)
1003
1004 #define SSE2_S0_S1(r, a, b, c) \
1005 AS2( movq mm6, r)\
1006 AS2( psrlq r, a)\
1007 AS2( movq mm7, r)\
1008 AS2( psllq mm6, 64-c)\
1009 AS2( pxor mm7, mm6)\
1010 AS2( psrlq r, b-a)\
1011 AS2( pxor mm7, r)\
1012 AS2( psllq mm6, c-b)\
1013 AS2( pxor mm7, mm6)\
1014 AS2( psrlq r, c-b)\
1015 AS2( pxor r, mm7)\
1016 AS2( psllq mm6, b-a)\
1017 AS2( pxor r, mm6)
1018
1019 #define SSE2_s0(r, a, b, c) \
1020 AS2( movdqu xmm6, r)\
1021 AS2( psrlq r, a)\
1022 AS2( movdqu xmm7, r)\
1023 AS2( psllq xmm6, 64-c)\
1024 AS2( pxor xmm7, xmm6)\
1025 AS2( psrlq r, b-a)\
1026 AS2( pxor xmm7, r)\
1027 AS2( psrlq r, c-b)\
1028 AS2( pxor r, xmm7)\
1029 AS2( psllq xmm6, c-a)\
1030 AS2( pxor r, xmm6)
1031
1032 #define SSE2_s1(r, a, b, c) \
1033 AS2( movdqu xmm6, r)\
1034 AS2( psrlq r, a)\
1035 AS2( movdqu xmm7, r)\
1036 AS2( psllq xmm6, 64-c)\
1037 AS2( pxor xmm7, xmm6)\
1038 AS2( psrlq r, b-a)\
1039 AS2( pxor xmm7, r)\
1040 AS2( psllq xmm6, c-b)\
1041 AS2( pxor xmm7, xmm6)\
1042 AS2( psrlq r, c-b)\
1043 AS2( pxor r, xmm7)
1044 ASL(SHA512_Round)
1045
1046 // k + w is in mm0, a is in mm4, e is in mm5
1047 AS2( paddq mm0, [edi+7*8]) // h
1048 AS2( movq mm2, [edi+5*8]) // f
1049 AS2( movq mm3, [edi+6*8]) // g
1050 AS2( pxor mm2, mm3)
1051 AS2( pand mm2, mm5)
1052 SSE2_S0_S1(mm5,14,18,41)
1053 AS2( pxor mm2, mm3)
1054 AS2( paddq mm0, mm2) // h += Ch(e,f,g)
1055 AS2( paddq mm5, mm0) // h += S1(e)
1056 AS2( movq mm2, [edi+1*8]) // b
1057 AS2( movq mm1, mm2)
1058 AS2( por mm2, mm4)
1059 AS2( pand mm2, [edi+2*8]) // c
1060 AS2( pand mm1, mm4)
1061 AS2( por mm1, mm2)
1062 AS2( paddq mm1, mm5) // temp = h + Maj(a,b,c)
1063 AS2( paddq mm5, [edi+3*8]) // e = d + h
1064 AS2( movq [edi+3*8], mm5)
1065 AS2( movq [edi+11*8], mm5)
1066 SSE2_S0_S1(mm4,28,34,39) // S0(a)
1067 AS2( paddq mm4, mm1) // a = temp + S0(a)
1068 AS2( movq [edi-8], mm4)
1069 AS2( movq [edi+7*8], mm4)
1070 AS1( ret)
1071
1072 // first 16 rounds
1073 ASL(0)
1074 AS2( movq mm0, [edx+eax*8])
1075 AS2( movq [esi+eax*8], mm0)
1076 AS2( movq [esi+eax*8+16*8], mm0)
1077 AS2( paddq mm0, [ebx+eax*8])
1078 ASC( call, SHA512_Round)
1079
1080 AS1( inc eax)
1081 AS2( sub edi, 8)
1082 AS2( test eax, 7)
1083 ASJ( jnz, 0, b)
1084 AS2( add edi, 8*8)
1085 AS2( cmp eax, 16)
1086 ASJ( jne, 0, b)
1087
1088 // rest of the rounds
1089 AS2( movdqu xmm0, [esi+(16-2)*8])
1090 ASL(1)
1091 // data expansion, W[i-2] already in xmm0
1092 AS2( movdqu xmm3, [esi])
1093 AS2( paddq xmm3, [esi+(16-7)*8])
1094 AS2( movdqu xmm2, [esi+(16-15)*8])
1095 SSE2_s1(xmm0, 6, 19, 61)
1096 AS2( paddq xmm0, xmm3)
1097 SSE2_s0(xmm2, 1, 7, 8)
1098 AS2( paddq xmm0, xmm2)
1099 AS2( movdq2q mm0, xmm0)
1100 AS2( movhlps xmm1, xmm0)
1101 AS2( paddq mm0, [ebx+eax*8])
1102 AS2( movlps [esi], xmm0)
1103 AS2( movlps [esi+8], xmm1)
1104 AS2( movlps [esi+8*16], xmm0)
1105 AS2( movlps [esi+8*17], xmm1)
1106 // 2 rounds
1107 ASC( call, SHA512_Round)
1108 AS2( sub edi, 8)
1109 AS2( movdq2q mm0, xmm1)
1110 AS2( paddq mm0, [ebx+eax*8+8])
1111 ASC( call, SHA512_Round)
1112 // update indices and loop
1113 AS2( add esi, 16)
1114 AS2( add eax, 2)
1115 AS2( sub edi, 8)
1116 AS2( test eax, 7)
1117 ASJ( jnz, 1, b)
1118 // do housekeeping every 8 rounds
1119 AS2( mov esi, 0xf)
1120 AS2( and esi, eax)
1121 AS2( lea esi, [esp+4+20*8+8+esi*8])
1122 AS2( add edi, 8*8)
1123 AS2( cmp eax, 80)
1124 ASJ( jne, 1, b)
1125
1126 #define SSE2_CombineState(i) \
1127 AS2( movdqu xmm0, [edi+i*16])\
1128 AS2( paddq xmm0, [ecx+i*16])\
1129 AS2( movdqu [ecx+i*16], xmm0)
1130
1131 SSE2_CombineState(0)
1132 SSE2_CombineState(1)
1133 SSE2_CombineState(2)
1134 SSE2_CombineState(3)
1135
1136 AS_POP_IF86( sp)
1137 AS1( emms)
1138
1139 #if defined(__GNUC__)
1140 AS_POP_IF86( bx)
1141 ATT_PREFIX
1142 :
1143 : "a" (SHA512_K), "c" (state), "d" (data)
1144 : "%esi", "%edi", "memory", "cc"
1145 );
1146 #else
1147 AS1( pop edi)
1148 AS1( pop esi)
1149 AS1( pop ebx)
1150 AS1( ret)
1151 #endif
1152 }
1153
1154 ANONYMOUS_NAMESPACE_END
1155
1156 #endif // CRYPTOPP_SSE2_ASM_AVAILABLE
1157
1158 ANONYMOUS_NAMESPACE_BEGIN
1159
1160 #define a(i) T[(0-i)&7]
1161 #define b(i) T[(1-i)&7]
1162 #define c(i) T[(2-i)&7]
1163 #define d(i) T[(3-i)&7]
1164 #define e(i) T[(4-i)&7]
1165 #define f(i) T[(5-i)&7]
1166 #define g(i) T[(6-i)&7]
1167 #define h(i) T[(7-i)&7]
1168
1169 #define blk0(i) (W[i]=data[i])
1170 #define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
1171
1172 #define Ch(x,y,z) (z^(x&(y^z)))
1173 #define Maj(x,y,z) (y^((x^y)&(y^z)))
1174
1175 #define s0(x) (rotrConstant<1>(x)^rotrConstant<8>(x)^(x>>7))
1176 #define s1(x) (rotrConstant<19>(x)^rotrConstant<61>(x)^(x>>6))
1177 #define S0(x) (rotrConstant<28>(x)^rotrConstant<34>(x)^rotrConstant<39>(x))
1178 #define S1(x) (rotrConstant<14>(x)^rotrConstant<18>(x)^rotrConstant<41>(x))
1179
1180 #define R(i) h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA512_K[i+j]+\
1181 (j?blk2(i):blk0(i));d(i)+=h(i);h(i)+=S0(a(i))+Maj(a(i),b(i),c(i));
1182
1183 void SHA512_HashBlock_CXX(word64 *state, const word64 *data)
1184 {
1185 CRYPTOPP_ASSERT(state);
1186 CRYPTOPP_ASSERT(data);
1187
1188 word64 W[16]={0}, T[8];
1189
1190 /* Copy context->state[] to working vars */
1191 std::memcpy(T, state, sizeof(T));
1192
1193 /* 80 operations, partially loop unrolled */
1194 for (unsigned int j=0; j<80; j+=16)
1195 {
1196 R( 0); R( 1); R( 2); R( 3);
1197 R( 4); R( 5); R( 6); R( 7);
1198 R( 8); R( 9); R(10); R(11);
1199 R(12); R(13); R(14); R(15);
1200 }
1201
1202 state[0] += a(0);
1203 state[1] += b(0);
1204 state[2] += c(0);
1205 state[3] += d(0);
1206 state[4] += e(0);
1207 state[5] += f(0);
1208 state[6] += g(0);
1209 state[7] += h(0);
1210 }
1211
1212 ANONYMOUS_NAMESPACE_END
1213
1214 void SHA512::Transform(word64 *state, const word64 *data)
1215 {
1216 CRYPTOPP_ASSERT(state);
1217 CRYPTOPP_ASSERT(data);
1218
1219 #if CRYPTOPP_SSE2_ASM_AVAILABLE && (CRYPTOPP_BOOL_X86)
1220 if (HasSSE2())
1221 {
1222 SHA512_HashBlock_SSE2(state, data);
1223 return;
1224 }
1225 #endif
1226 #if CRYPTOPP_POWER8_SHA_AVAILABLE
1227 if (HasSHA512())
1228 {
1229 SHA512_HashMultipleBlocks_POWER8(state, data, SHA512::BLOCKSIZE, BIG_ENDIAN_ORDER);
1230 return;
1231 }
1232 #endif
1233
1234 SHA512_HashBlock_CXX(state, data);
1235 }
1236
1237 #undef Ch
1238 #undef Maj
1239
1240 #undef s0
1241 #undef s1
1242 #undef S0
1243 #undef S1
1244
1245 #undef blk0
1246 #undef blk1
1247 #undef blk2
1248
1249 #undef R
1250
1251 #undef a
1252 #undef b
1253 #undef c
1254 #undef d
1255 #undef e
1256 #undef f
1257 #undef g
1258 #undef h
1259
1260 NAMESPACE_END
1261
1262 #endif // Not CRYPTOPP_GENERATE_X64_MASM
1263 #endif // Not CRYPTOPP_IMPORTS
HasSHA
bool HasSHA()
Determines SHA availability.
Definition: cpu.h:189
NativeByteOrderIs
bool NativeByteOrderIs(ByteOrder order)
Determines whether order follows native byte ordering.
Definition: misc.h:1156
misc.h
Utility functions for the Crypto++ library.
SHA1::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:225
ByteOrder
ByteOrder
Provides the byte ordering.
Definition: cryptlib.h:143
SHA384::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:937
SHA256::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:765
config.h
Library configuration file.
SHA384::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:927
SHA1::Transform
static void Transform(HashWordType *digest, const HashWordType *data)
Operate the hash.
Definition: sha.cpp:251
LITTLE_ENDIAN_ORDER
byte order is little-endian
Definition: cryptlib.h:145
SHA224::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:410
secblock.h
Classes and functions for secure memory allocations.
SHA224::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:415
HasSHA256
bool HasSHA256()
Determine if a PowerPC processor has SHA256 available.
Definition: cpu.h:695
IteratedHash< word32, BigEndian, T_BlockSize >::GetByteOrder
ByteOrder GetByteOrder() const
Provides the byte order of the hash.
Definition: iterhash.h:144
SHA1::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:242
pch.h
Precompiled header file.
HasSHA1
bool HasSHA1()
Determine if an ARM processor has SHA1 available.
Definition: cpu.h:469
FixedSizeAlignedSecBlock
Fixed size stack-based SecBlock with 16-byte alignment.
Definition: secblock.h:1089
HasSHA512
bool HasSHA512()
Determine if an ARM processor has SHA512 available.
Definition: cpu.h:509
BIG_ENDIAN_ORDER
byte order is big-endian
Definition: cryptlib.h:147
CRYPTOPP_ASSERT
#define CRYPTOPP_ASSERT(exp)
Debugging and diagnostic assertion.
Definition: trap.h:69
cpu.h
Functions for CPU features and intrinsics.
sha.h
Classes for SHA-1 and SHA-2 family of message digests.
SHA512::Transform
static void Transform(HashWordType *digest, const HashWordType *data)
Operate the hash.
Definition: sha.cpp:1214
HasSSE2
bool HasSSE2()
Determines SSE2 availability.
Definition: cpu.h:116
HasSHA2
bool HasSHA2()
Determine if an ARM processor has SHA256 available.
Definition: cpu.h:489
SHA512::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:947
SHA256::Transform
static void Transform(HashWordType *digest, const HashWordType *data)
Operate the hash.
Definition: sha.cpp:770
CryptoPP
Crypto++ library namespace.
SHA256::InitState
static void InitState(HashWordType *state)
Initialize state array.
Definition: sha.cpp:423
ByteReverse
byte ByteReverse(byte value)
Reverses bytes in a 8-bit value.
Definition: misc.h:1940
SHA512::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: sha.cpp:932