1 | #![allow (clippy::many_single_char_names)] |
2 | use crate::consts::{BLOCK_LEN, K64X2}; |
3 | use core::convert::TryInto; |
4 | |
5 | fn add(a: [u64; 2], b: [u64; 2]) -> [u64; 2] { |
6 | [a[0].wrapping_add(b[0]), a[1].wrapping_add(b[1])] |
7 | } |
8 | |
9 | /// Not an intrinsic, but works like an unaligned load. |
10 | fn sha512load(v0: [u64; 2], v1: [u64; 2]) -> [u64; 2] { |
11 | [v1[1], v0[0]] |
12 | } |
13 | |
14 | /// Performs 2 rounds of the SHA-512 message schedule update. |
15 | pub fn sha512_schedule_x2(v0: [u64; 2], v1: [u64; 2], v4to5: [u64; 2], v7: [u64; 2]) -> [u64; 2] { |
16 | // sigma 0 |
17 | fn sigma0(x: u64) -> u64 { |
18 | ((x << 63) | (x >> 1)) ^ ((x << 56) | (x >> 8)) ^ (x >> 7) |
19 | } |
20 | |
21 | // sigma 1 |
22 | fn sigma1(x: u64) -> u64 { |
23 | ((x << 45) | (x >> 19)) ^ ((x << 3) | (x >> 61)) ^ (x >> 6) |
24 | } |
25 | |
26 | let [w1, w0] = v0; |
27 | let [_, w2] = v1; |
28 | let [w10, w9] = v4to5; |
29 | let [w15, w14] = v7; |
30 | |
31 | let w16 = sigma1(w14) |
32 | .wrapping_add(w9) |
33 | .wrapping_add(sigma0(w1)) |
34 | .wrapping_add(w0); |
35 | let w17 = sigma1(w15) |
36 | .wrapping_add(w10) |
37 | .wrapping_add(sigma0(w2)) |
38 | .wrapping_add(w1); |
39 | |
40 | [w17, w16] |
41 | } |
42 | |
43 | /// Performs one round of the SHA-512 message block digest. |
44 | pub fn sha512_digest_round( |
45 | ae: [u64; 2], |
46 | bf: [u64; 2], |
47 | cg: [u64; 2], |
48 | dh: [u64; 2], |
49 | wk0: u64, |
50 | ) -> [u64; 2] { |
51 | macro_rules! big_sigma0 { |
52 | ($a:expr) => { |
53 | ($a.rotate_right(28) ^ $a.rotate_right(34) ^ $a.rotate_right(39)) |
54 | }; |
55 | } |
56 | macro_rules! big_sigma1 { |
57 | ($a:expr) => { |
58 | ($a.rotate_right(14) ^ $a.rotate_right(18) ^ $a.rotate_right(41)) |
59 | }; |
60 | } |
61 | macro_rules! bool3ary_202 { |
62 | ($a:expr, $b:expr, $c:expr) => { |
63 | $c ^ ($a & ($b ^ $c)) |
64 | }; |
65 | } // Choose, MD5F, SHA1C |
66 | macro_rules! bool3ary_232 { |
67 | ($a:expr, $b:expr, $c:expr) => { |
68 | ($a & $b) ^ ($a & $c) ^ ($b & $c) |
69 | }; |
70 | } // Majority, SHA1M |
71 | |
72 | let [a0, e0] = ae; |
73 | let [b0, f0] = bf; |
74 | let [c0, g0] = cg; |
75 | let [d0, h0] = dh; |
76 | |
77 | // a round |
78 | let x0 = big_sigma1!(e0) |
79 | .wrapping_add(bool3ary_202!(e0, f0, g0)) |
80 | .wrapping_add(wk0) |
81 | .wrapping_add(h0); |
82 | let y0 = big_sigma0!(a0).wrapping_add(bool3ary_232!(a0, b0, c0)); |
83 | let (a1, _, _, _, e1, _, _, _) = ( |
84 | x0.wrapping_add(y0), |
85 | a0, |
86 | b0, |
87 | c0, |
88 | x0.wrapping_add(d0), |
89 | e0, |
90 | f0, |
91 | g0, |
92 | ); |
93 | |
94 | [a1, e1] |
95 | } |
96 | |
97 | /// Process a block with the SHA-512 algorithm. |
98 | pub fn sha512_digest_block_u64(state: &mut [u64; 8], block: &[u64; 16]) { |
99 | let k = &K64X2; |
100 | |
101 | macro_rules! schedule { |
102 | ($v0:expr, $v1:expr, $v4:expr, $v5:expr, $v7:expr) => { |
103 | sha512_schedule_x2($v0, $v1, sha512load($v4, $v5), $v7) |
104 | }; |
105 | } |
106 | |
107 | macro_rules! rounds4 { |
108 | ($ae:ident, $bf:ident, $cg:ident, $dh:ident, $wk0:expr, $wk1:expr) => {{ |
109 | let [u, t] = $wk0; |
110 | let [w, v] = $wk1; |
111 | |
112 | $dh = sha512_digest_round($ae, $bf, $cg, $dh, t); |
113 | $cg = sha512_digest_round($dh, $ae, $bf, $cg, u); |
114 | $bf = sha512_digest_round($cg, $dh, $ae, $bf, v); |
115 | $ae = sha512_digest_round($bf, $cg, $dh, $ae, w); |
116 | }}; |
117 | } |
118 | |
119 | let mut ae = [state[0], state[4]]; |
120 | let mut bf = [state[1], state[5]]; |
121 | let mut cg = [state[2], state[6]]; |
122 | let mut dh = [state[3], state[7]]; |
123 | |
124 | // Rounds 0..20 |
125 | let (mut w1, mut w0) = ([block[3], block[2]], [block[1], block[0]]); |
126 | rounds4!(ae, bf, cg, dh, add(k[0], w0), add(k[1], w1)); |
127 | let (mut w3, mut w2) = ([block[7], block[6]], [block[5], block[4]]); |
128 | rounds4!(ae, bf, cg, dh, add(k[2], w2), add(k[3], w3)); |
129 | let (mut w5, mut w4) = ([block[11], block[10]], [block[9], block[8]]); |
130 | rounds4!(ae, bf, cg, dh, add(k[4], w4), add(k[5], w5)); |
131 | let (mut w7, mut w6) = ([block[15], block[14]], [block[13], block[12]]); |
132 | rounds4!(ae, bf, cg, dh, add(k[6], w6), add(k[7], w7)); |
133 | let mut w8 = schedule!(w0, w1, w4, w5, w7); |
134 | let mut w9 = schedule!(w1, w2, w5, w6, w8); |
135 | rounds4!(ae, bf, cg, dh, add(k[8], w8), add(k[9], w9)); |
136 | |
137 | // Rounds 20..40 |
138 | w0 = schedule!(w2, w3, w6, w7, w9); |
139 | w1 = schedule!(w3, w4, w7, w8, w0); |
140 | rounds4!(ae, bf, cg, dh, add(k[10], w0), add(k[11], w1)); |
141 | w2 = schedule!(w4, w5, w8, w9, w1); |
142 | w3 = schedule!(w5, w6, w9, w0, w2); |
143 | rounds4!(ae, bf, cg, dh, add(k[12], w2), add(k[13], w3)); |
144 | w4 = schedule!(w6, w7, w0, w1, w3); |
145 | w5 = schedule!(w7, w8, w1, w2, w4); |
146 | rounds4!(ae, bf, cg, dh, add(k[14], w4), add(k[15], w5)); |
147 | w6 = schedule!(w8, w9, w2, w3, w5); |
148 | w7 = schedule!(w9, w0, w3, w4, w6); |
149 | rounds4!(ae, bf, cg, dh, add(k[16], w6), add(k[17], w7)); |
150 | w8 = schedule!(w0, w1, w4, w5, w7); |
151 | w9 = schedule!(w1, w2, w5, w6, w8); |
152 | rounds4!(ae, bf, cg, dh, add(k[18], w8), add(k[19], w9)); |
153 | |
154 | // Rounds 40..60 |
155 | w0 = schedule!(w2, w3, w6, w7, w9); |
156 | w1 = schedule!(w3, w4, w7, w8, w0); |
157 | rounds4!(ae, bf, cg, dh, add(k[20], w0), add(k[21], w1)); |
158 | w2 = schedule!(w4, w5, w8, w9, w1); |
159 | w3 = schedule!(w5, w6, w9, w0, w2); |
160 | rounds4!(ae, bf, cg, dh, add(k[22], w2), add(k[23], w3)); |
161 | w4 = schedule!(w6, w7, w0, w1, w3); |
162 | w5 = schedule!(w7, w8, w1, w2, w4); |
163 | rounds4!(ae, bf, cg, dh, add(k[24], w4), add(k[25], w5)); |
164 | w6 = schedule!(w8, w9, w2, w3, w5); |
165 | w7 = schedule!(w9, w0, w3, w4, w6); |
166 | rounds4!(ae, bf, cg, dh, add(k[26], w6), add(k[27], w7)); |
167 | w8 = schedule!(w0, w1, w4, w5, w7); |
168 | w9 = schedule!(w1, w2, w5, w6, w8); |
169 | rounds4!(ae, bf, cg, dh, add(k[28], w8), add(k[29], w9)); |
170 | |
171 | // Rounds 60..80 |
172 | w0 = schedule!(w2, w3, w6, w7, w9); |
173 | w1 = schedule!(w3, w4, w7, w8, w0); |
174 | rounds4!(ae, bf, cg, dh, add(k[30], w0), add(k[31], w1)); |
175 | w2 = schedule!(w4, w5, w8, w9, w1); |
176 | w3 = schedule!(w5, w6, w9, w0, w2); |
177 | rounds4!(ae, bf, cg, dh, add(k[32], w2), add(k[33], w3)); |
178 | w4 = schedule!(w6, w7, w0, w1, w3); |
179 | w5 = schedule!(w7, w8, w1, w2, w4); |
180 | rounds4!(ae, bf, cg, dh, add(k[34], w4), add(k[35], w5)); |
181 | w6 = schedule!(w8, w9, w2, w3, w5); |
182 | w7 = schedule!(w9, w0, w3, w4, w6); |
183 | rounds4!(ae, bf, cg, dh, add(k[36], w6), add(k[37], w7)); |
184 | w8 = schedule!(w0, w1, w4, w5, w7); |
185 | w9 = schedule!(w1, w2, w5, w6, w8); |
186 | rounds4!(ae, bf, cg, dh, add(k[38], w8), add(k[39], w9)); |
187 | |
188 | let [a, e] = ae; |
189 | let [b, f] = bf; |
190 | let [c, g] = cg; |
191 | let [d, h] = dh; |
192 | |
193 | state[0] = state[0].wrapping_add(a); |
194 | state[1] = state[1].wrapping_add(b); |
195 | state[2] = state[2].wrapping_add(c); |
196 | state[3] = state[3].wrapping_add(d); |
197 | state[4] = state[4].wrapping_add(e); |
198 | state[5] = state[5].wrapping_add(f); |
199 | state[6] = state[6].wrapping_add(g); |
200 | state[7] = state[7].wrapping_add(h); |
201 | } |
202 | |
203 | pub fn compress(state: &mut [u64; 8], blocks: &[[u8; 128]]) { |
204 | let mut block_u32: [u64; 16] = [0u64; BLOCK_LEN]; |
205 | // since LLVM can't properly use aliasing yet it will make |
206 | // unnecessary state stores without this copy |
207 | let mut state_cpy: [u64; 8] = *state; |
208 | for block: &[u8; 128] in blocks { |
209 | for (o: &mut u64, chunk: &[u8]) in block_u32.iter_mut().zip(block.chunks_exact(chunk_size:8)) { |
210 | *o = u64::from_be_bytes(chunk.try_into().unwrap()); |
211 | } |
212 | sha512_digest_block_u64(&mut state_cpy, &block_u32); |
213 | } |
214 | *state = state_cpy; |
215 | } |
216 | |