1 /*
2 * SPDX-License-Identifier: ISC
3 *
4 * Copyright (c) 2013-2015 Todd C. Miller <Todd.Miller@sudo.ws>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 /*
20 * This is an open source non-commercial project. Dear PVS-Studio, please check it.
21 * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
22 */
23
24 /*
25 * Implementation of SHA-224, SHA-256, SHA-384 and SHA-512
26 * as per FIPS 180-4: Secure Hash Standard (SHS)
27 * http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
28 *
29 * Derived from the public domain SHA-1 and SHA-2 implementations
30 * by Steve Reid and Wei Dai respectively.
31 */
32
33 #include <config.h>
34 #include <string.h>
35 #if defined(HAVE_STDINT_H)
36 # include <stdint.h>
37 #elif defined(HAVE_INTTYPES_H)
38 # include <inttypes.h>
39 #endif
40 #if defined(HAVE_ENDIAN_H)
41 # include <endian.h>
42 #elif defined(HAVE_SYS_ENDIAN_H)
43 # include <sys/endian.h>
44 #elif defined(HAVE_MACHINE_ENDIAN_H)
45 # include <machine/endian.h>
46 #else
47 # include "compat/endian.h"
48 #endif
49
50 #include "sudo_compat.h"
51 #include "compat/sha2.h"
52
53 /*
54 * SHA-2 operates on 32-bit and 64-bit words in big endian byte order.
55 * The following macros convert between character arrays and big endian words.
56 */
57 #define BE8TO32(x, y) do { \
58 (x) = (((uint32_t)((y)[0] & 255) << 24) | \
59 ((uint32_t)((y)[1] & 255) << 16) | \
60 ((uint32_t)((y)[2] & 255) << 8) | \
61 ((uint32_t)((y)[3] & 255))); \
62 } while (0)
63
64 #define BE8TO64(x, y) do { \
65 (x) = (((uint64_t)((y)[0] & 255) << 56) | \
66 ((uint64_t)((y)[1] & 255) << 48) | \
67 ((uint64_t)((y)[2] & 255) << 40) | \
68 ((uint64_t)((y)[3] & 255) << 32) | \
69 ((uint64_t)((y)[4] & 255) << 24) | \
70 ((uint64_t)((y)[5] & 255) << 16) | \
71 ((uint64_t)((y)[6] & 255) << 8) | \
72 ((uint64_t)((y)[7] & 255))); \
73 } while (0)
74
75 #define BE32TO8(x, y) do { \
76 (x)[0] = (uint8_t)(((y) >> 24) & 255); \
77 (x)[1] = (uint8_t)(((y) >> 16) & 255); \
78 (x)[2] = (uint8_t)(((y) >> 8) & 255); \
79 (x)[3] = (uint8_t)((y) & 255); \
80 } while (0)
81
82 #define BE64TO8(x, y) do { \
83 (x)[0] = (uint8_t)(((y) >> 56) & 255); \
84 (x)[1] = (uint8_t)(((y) >> 48) & 255); \
85 (x)[2] = (uint8_t)(((y) >> 40) & 255); \
86 (x)[3] = (uint8_t)(((y) >> 32) & 255); \
87 (x)[4] = (uint8_t)(((y) >> 24) & 255); \
88 (x)[5] = (uint8_t)(((y) >> 16) & 255); \
89 (x)[6] = (uint8_t)(((y) >> 8) & 255); \
90 (x)[7] = (uint8_t)((y) & 255); \
91 } while (0)
92
93 #define rotrFixed(x,y) (y ? ((x>>y) | (x<<(sizeof(x)*8-y))) : x)
94
95 #define blk0(i) (W[i])
96 #define blk2(i) (W[i&15]+=s1(W[(i-2)&15])+W[(i-7)&15]+s0(W[(i-15)&15]))
97
98 #define Ch(x,y,z) (z^(x&(y^z)))
99 #define Maj(x,y,z) (y^((x^y)&(y^z)))
100
101 #define a(i) T[(0-i)&7]
102 #define b(i) T[(1-i)&7]
103 #define c(i) T[(2-i)&7]
104 #define d(i) T[(3-i)&7]
105 #define e(i) T[(4-i)&7]
106 #define f(i) T[(5-i)&7]
107 #define g(i) T[(6-i)&7]
108 #define h(i) T[(7-i)&7]
109
110 void
SHA224Init(SHA2_CTX * ctx)111 SHA224Init(SHA2_CTX *ctx)
112 {
113 memset(ctx, 0, sizeof(*ctx));
114 ctx->state.st32[0] = 0xc1059ed8UL;
115 ctx->state.st32[1] = 0x367cd507UL;
116 ctx->state.st32[2] = 0x3070dd17UL;
117 ctx->state.st32[3] = 0xf70e5939UL;
118 ctx->state.st32[4] = 0xffc00b31UL;
119 ctx->state.st32[5] = 0x68581511UL;
120 ctx->state.st32[6] = 0x64f98fa7UL;
121 ctx->state.st32[7] = 0xbefa4fa4UL;
122 }
123
124 void
SHA224Transform(uint32_t state[8],const uint8_t buffer[SHA224_BLOCK_LENGTH])125 SHA224Transform(uint32_t state[8], const uint8_t buffer[SHA224_BLOCK_LENGTH])
126 {
127 SHA256Transform(state, buffer);
128 }
129
130 void
SHA224Update(SHA2_CTX * ctx,const uint8_t * data,size_t len)131 SHA224Update(SHA2_CTX *ctx, const uint8_t *data, size_t len)
132 {
133 SHA256Update(ctx, data, len);
134 }
135
136 void
SHA224Pad(SHA2_CTX * ctx)137 SHA224Pad(SHA2_CTX *ctx)
138 {
139 SHA256Pad(ctx);
140 }
141
142 void
SHA224Final(uint8_t digest[SHA224_DIGEST_LENGTH],SHA2_CTX * ctx)143 SHA224Final(uint8_t digest[SHA224_DIGEST_LENGTH], SHA2_CTX *ctx)
144 {
145 SHA256Pad(ctx);
146 if (digest != NULL) {
147 #if BYTE_ORDER == BIG_ENDIAN
148 memcpy(digest, ctx->state.st32, SHA224_DIGEST_LENGTH);
149 #else
150 unsigned int i;
151
152 for (i = 0; i < 7; i++)
153 BE32TO8(digest + (i * 4), ctx->state.st32[i]);
154 #endif
155 memset(ctx, 0, sizeof(*ctx));
156 }
157 }
158
159 static const uint32_t SHA256_K[64] = {
160 0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
161 0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
162 0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
163 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
164 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
165 0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
166 0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
167 0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
168 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
169 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
170 0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
171 0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
172 0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
173 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
174 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
175 0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
176 };
177
178 void
SHA256Init(SHA2_CTX * ctx)179 SHA256Init(SHA2_CTX *ctx)
180 {
181 memset(ctx, 0, sizeof(*ctx));
182 ctx->state.st32[0] = 0x6a09e667UL;
183 ctx->state.st32[1] = 0xbb67ae85UL;
184 ctx->state.st32[2] = 0x3c6ef372UL;
185 ctx->state.st32[3] = 0xa54ff53aUL;
186 ctx->state.st32[4] = 0x510e527fUL;
187 ctx->state.st32[5] = 0x9b05688cUL;
188 ctx->state.st32[6] = 0x1f83d9abUL;
189 ctx->state.st32[7] = 0x5be0cd19UL;
190 }
191
192 /* Round macros for SHA256 */
193 #define R(i) do { \
194 h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA256_K[i+j]+(j?blk2(i):blk0(i)); \
195 d(i)+=h(i); \
196 h(i)+=S0(a(i))+Maj(a(i),b(i),c(i)); \
197 } while (0)
198
199 #define S0(x) (rotrFixed(x,2)^rotrFixed(x,13)^rotrFixed(x,22))
200 #define S1(x) (rotrFixed(x,6)^rotrFixed(x,11)^rotrFixed(x,25))
201 #define s0(x) (rotrFixed(x,7)^rotrFixed(x,18)^(x>>3))
202 #define s1(x) (rotrFixed(x,17)^rotrFixed(x,19)^(x>>10))
203
204 void
SHA256Transform(uint32_t state[8],const uint8_t data[SHA256_BLOCK_LENGTH])205 SHA256Transform(uint32_t state[8], const uint8_t data[SHA256_BLOCK_LENGTH])
206 {
207 uint32_t W[16];
208 uint32_t T[8];
209 unsigned int j;
210
211 /* Copy context state to working vars. */
212 memcpy(T, state, sizeof(T));
213 /* Copy data to W in big endian format. */
214 #if BYTE_ORDER == BIG_ENDIAN
215 memcpy(W, data, sizeof(W));
216 #else
217 for (j = 0; j < 16; j++) {
218 BE8TO32(W[j], data);
219 data += 4;
220 }
221 #endif
222 /* 64 operations, partially loop unrolled. */
223 for (j = 0; j < 64; j += 16)
224 {
225 R( 0); R( 1); R( 2); R( 3);
226 R( 4); R( 5); R( 6); R( 7);
227 R( 8); R( 9); R(10); R(11);
228 R(12); R(13); R(14); R(15);
229 }
230 /* Add the working vars back into context state. */
231 state[0] += a(0);
232 state[1] += b(0);
233 state[2] += c(0);
234 state[3] += d(0);
235 state[4] += e(0);
236 state[5] += f(0);
237 state[6] += g(0);
238 state[7] += h(0);
239 /* Cleanup */
240 explicit_bzero(T, sizeof(T));
241 explicit_bzero(W, sizeof(W));
242 }
243
244 #undef S0
245 #undef S1
246 #undef s0
247 #undef s1
248 #undef R
249
250 void
SHA256Update(SHA2_CTX * ctx,const uint8_t * data,size_t len)251 SHA256Update(SHA2_CTX *ctx, const uint8_t *data, size_t len)
252 {
253 size_t i = 0, j;
254
255 j = (size_t)((ctx->count[0] >> 3) & (SHA256_BLOCK_LENGTH - 1));
256 ctx->count[0] += ((uint64_t)len << 3);
257 if ((j + len) > SHA256_BLOCK_LENGTH - 1) {
258 memcpy(&ctx->buffer[j], data, (i = SHA256_BLOCK_LENGTH - j));
259 SHA256Transform(ctx->state.st32, ctx->buffer);
260 for ( ; i + SHA256_BLOCK_LENGTH - 1 < len; i += SHA256_BLOCK_LENGTH)
261 SHA256Transform(ctx->state.st32, (uint8_t *)&data[i]);
262 j = 0;
263 }
264 memcpy(&ctx->buffer[j], &data[i], len - i);
265 }
266
267 void
SHA256Pad(SHA2_CTX * ctx)268 SHA256Pad(SHA2_CTX *ctx)
269 {
270 uint8_t finalcount[8];
271
272 /* Store unpadded message length in bits in big endian format. */
273 BE64TO8(finalcount, ctx->count[0]);
274
275 /* Append a '1' bit (0x80) to the message. */
276 SHA256Update(ctx, (uint8_t *)"\200", 1);
277
278 /* Pad message such that the resulting length modulo 512 is 448. */
279 while ((ctx->count[0] & 504) != 448)
280 SHA256Update(ctx, (uint8_t *)"\0", 1);
281
282 /* Append length of message in bits and do final SHA256Transform(). */
283 SHA256Update(ctx, finalcount, sizeof(finalcount));
284 }
285
286 void
SHA256Final(uint8_t digest[SHA256_DIGEST_LENGTH],SHA2_CTX * ctx)287 SHA256Final(uint8_t digest[SHA256_DIGEST_LENGTH], SHA2_CTX *ctx)
288 {
289 SHA256Pad(ctx);
290 if (digest != NULL) {
291 #if BYTE_ORDER == BIG_ENDIAN
292 memcpy(digest, ctx->state.st32, SHA256_DIGEST_LENGTH);
293 #else
294 unsigned int i;
295
296 for (i = 0; i < 8; i++)
297 BE32TO8(digest + (i * 4), ctx->state.st32[i]);
298 #endif
299 memset(ctx, 0, sizeof(*ctx));
300 }
301 }
302
303 void
SHA384Init(SHA2_CTX * ctx)304 SHA384Init(SHA2_CTX *ctx)
305 {
306 memset(ctx, 0, sizeof(*ctx));
307 ctx->state.st64[0] = 0xcbbb9d5dc1059ed8ULL;
308 ctx->state.st64[1] = 0x629a292a367cd507ULL;
309 ctx->state.st64[2] = 0x9159015a3070dd17ULL;
310 ctx->state.st64[3] = 0x152fecd8f70e5939ULL;
311 ctx->state.st64[4] = 0x67332667ffc00b31ULL;
312 ctx->state.st64[5] = 0x8eb44a8768581511ULL;
313 ctx->state.st64[6] = 0xdb0c2e0d64f98fa7ULL;
314 ctx->state.st64[7] = 0x47b5481dbefa4fa4ULL;
315 }
316
317 void
SHA384Transform(uint64_t state[8],const uint8_t data[SHA384_BLOCK_LENGTH])318 SHA384Transform(uint64_t state[8], const uint8_t data[SHA384_BLOCK_LENGTH])
319 {
320 SHA512Transform(state, data);
321 }
322
323 void
SHA384Update(SHA2_CTX * ctx,const uint8_t * data,size_t len)324 SHA384Update(SHA2_CTX *ctx, const uint8_t *data, size_t len)
325 {
326 SHA512Update(ctx, data, len);
327 }
328
329 void
SHA384Pad(SHA2_CTX * ctx)330 SHA384Pad(SHA2_CTX *ctx)
331 {
332 SHA512Pad(ctx);
333 }
334
335 void
SHA384Final(uint8_t digest[SHA384_DIGEST_LENGTH],SHA2_CTX * ctx)336 SHA384Final(uint8_t digest[SHA384_DIGEST_LENGTH], SHA2_CTX *ctx)
337 {
338 SHA384Pad(ctx);
339 if (digest != NULL) {
340 #if BYTE_ORDER == BIG_ENDIAN
341 memcpy(digest, ctx->state.st64, SHA384_DIGEST_LENGTH);
342 #else
343 unsigned int i;
344
345 for (i = 0; i < 6; i++)
346 BE64TO8(digest + (i * 8), ctx->state.st64[i]);
347 #endif
348 memset(ctx, 0, sizeof(*ctx));
349 }
350 }
351
352 static const uint64_t SHA512_K[80] = {
353 0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
354 0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
355 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
356 0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
357 0xd807aa98a3030242ULL, 0x12835b0145706fbeULL,
358 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
359 0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL,
360 0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
361 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
362 0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL,
363 0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL,
364 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
365 0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL,
366 0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL,
367 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
368 0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
369 0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL,
370 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
371 0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL,
372 0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
373 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
374 0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL,
375 0xd192e819d6ef5218ULL, 0xd69906245565a910ULL,
376 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
377 0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL,
378 0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL,
379 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
380 0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
381 0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL,
382 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
383 0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL,
384 0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
385 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
386 0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL,
387 0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL,
388 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
389 0x28db77f523047d84ULL, 0x32caab7b40c72493ULL,
390 0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL,
391 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
392 0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
393 };
394
395 void
SHA512Init(SHA2_CTX * ctx)396 SHA512Init(SHA2_CTX *ctx)
397 {
398 memset(ctx, 0, sizeof(*ctx));
399 ctx->state.st64[0] = 0x6a09e667f3bcc908ULL;
400 ctx->state.st64[1] = 0xbb67ae8584caa73bULL;
401 ctx->state.st64[2] = 0x3c6ef372fe94f82bULL;
402 ctx->state.st64[3] = 0xa54ff53a5f1d36f1ULL;
403 ctx->state.st64[4] = 0x510e527fade682d1ULL;
404 ctx->state.st64[5] = 0x9b05688c2b3e6c1fULL;
405 ctx->state.st64[6] = 0x1f83d9abfb41bd6bULL;
406 ctx->state.st64[7] = 0x5be0cd19137e2179ULL;
407 }
408
409 /* Round macros for SHA512 */
410 #define R(i) do { \
411 h(i)+=S1(e(i))+Ch(e(i),f(i),g(i))+SHA512_K[i+j]+(j?blk2(i):blk0(i)); \
412 d(i)+=h(i); \
413 h(i)+=S0(a(i))+Maj(a(i),b(i),c(i)); \
414 } while (0)
415
416 #define S0(x) (rotrFixed(x,28)^rotrFixed(x,34)^rotrFixed(x,39))
417 #define S1(x) (rotrFixed(x,14)^rotrFixed(x,18)^rotrFixed(x,41))
418 #define s0(x) (rotrFixed(x,1)^rotrFixed(x,8)^(x>>7))
419 #define s1(x) (rotrFixed(x,19)^rotrFixed(x,61)^(x>>6))
420
421 void
SHA512Transform(uint64_t state[8],const uint8_t data[SHA512_BLOCK_LENGTH])422 SHA512Transform(uint64_t state[8], const uint8_t data[SHA512_BLOCK_LENGTH])
423 {
424 uint64_t W[16];
425 uint64_t T[8];
426 unsigned int j;
427
428 /* Copy context state to working vars. */
429 memcpy(T, state, sizeof(T));
430 /* Copy data to W in big endian format. */
431 #if BYTE_ORDER == BIG_ENDIAN
432 memcpy(W, data, sizeof(W));
433 #else
434 for (j = 0; j < 16; j++) {
435 BE8TO64(W[j], data);
436 data += 8;
437 }
438 #endif
439 /* 80 operations, partially loop unrolled. */
440 for (j = 0; j < 80; j += 16)
441 {
442 R( 0); R( 1); R( 2); R( 3);
443 R( 4); R( 5); R( 6); R( 7);
444 R( 8); R( 9); R(10); R(11);
445 R(12); R(13); R(14); R(15);
446 }
447 /* Add the working vars back into context state. */
448 state[0] += a(0);
449 state[1] += b(0);
450 state[2] += c(0);
451 state[3] += d(0);
452 state[4] += e(0);
453 state[5] += f(0);
454 state[6] += g(0);
455 state[7] += h(0);
456 /* Cleanup. */
457 explicit_bzero(T, sizeof(T));
458 explicit_bzero(W, sizeof(W));
459 }
460
461 void
SHA512Update(SHA2_CTX * ctx,const uint8_t * data,size_t len)462 SHA512Update(SHA2_CTX *ctx, const uint8_t *data, size_t len)
463 {
464 size_t i = 0, j;
465
466 j = (size_t)((ctx->count[0] >> 3) & (SHA512_BLOCK_LENGTH - 1));
467 ctx->count[0] += ((uint64_t)len << 3);
468 if (ctx->count[0] < ((uint64_t)len << 3))
469 ctx->count[1]++;
470 if ((j + len) > SHA512_BLOCK_LENGTH - 1) {
471 memcpy(&ctx->buffer[j], data, (i = SHA512_BLOCK_LENGTH - j));
472 SHA512Transform(ctx->state.st64, ctx->buffer);
473 for ( ; i + SHA512_BLOCK_LENGTH - 1 < len; i += SHA512_BLOCK_LENGTH)
474 SHA512Transform(ctx->state.st64, (uint8_t *)&data[i]);
475 j = 0;
476 }
477 memcpy(&ctx->buffer[j], &data[i], len - i);
478 }
479
480 void
SHA512Pad(SHA2_CTX * ctx)481 SHA512Pad(SHA2_CTX *ctx)
482 {
483 uint8_t finalcount[16];
484
485 /* Store unpadded message length in bits in big endian format. */
486 BE64TO8(finalcount, ctx->count[1]);
487 BE64TO8(finalcount + 8, ctx->count[0]);
488
489 /* Append a '1' bit (0x80) to the message. */
490 SHA512Update(ctx, (uint8_t *)"\200", 1);
491
492 /* Pad message such that the resulting length modulo 1024 is 896. */
493 while ((ctx->count[0] & 1008) != 896)
494 SHA512Update(ctx, (uint8_t *)"\0", 1);
495
496 /* Append length of message in bits and do final SHA512Transform(). */
497 SHA512Update(ctx, finalcount, sizeof(finalcount));
498 }
499
500 void
SHA512Final(uint8_t digest[SHA512_DIGEST_LENGTH],SHA2_CTX * ctx)501 SHA512Final(uint8_t digest[SHA512_DIGEST_LENGTH], SHA2_CTX *ctx)
502 {
503 SHA512Pad(ctx);
504 if (digest != NULL) {
505 #if BYTE_ORDER == BIG_ENDIAN
506 memcpy(digest, ctx->state.st64, SHA512_DIGEST_LENGTH);
507 #else
508 unsigned int i;
509
510 for (i = 0; i < 8; i++)
511 BE64TO8(digest + (i * 8), ctx->state.st64[i]);
512 #endif
513 memset(ctx, 0, sizeof(*ctx));
514 }
515 }
516