1 /* $OpenBSD: sha512.c,v 1.15 2016/11/04 13:56:05 miod Exp $ */ 2 /* ==================================================================== 3 * Copyright (c) 2004 The OpenSSL Project. All rights reserved 4 * according to the OpenSSL license [found in ../../LICENSE]. 5 * ==================================================================== 6 */ 7 8 #include <machine/endian.h> 9 10 #include <stdlib.h> 11 #include <string.h> 12 13 #include <openssl/opensslconf.h> 14 15 #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA512) 16 /* 17 * IMPLEMENTATION NOTES. 18 * 19 * As you might have noticed 32-bit hash algorithms: 20 * 21 * - permit SHA_LONG to be wider than 32-bit (case on CRAY); 22 * - optimized versions implement two transform functions: one operating 23 * on [aligned] data in host byte order and one - on data in input 24 * stream byte order; 25 * - share common byte-order neutral collector and padding function 26 * implementations, ../md32_common.h; 27 * 28 * Neither of the above applies to this SHA-512 implementations. Reasons 29 * [in reverse order] are: 30 * 31 * - it's the only 64-bit hash algorithm for the moment of this writing, 32 * there is no need for common collector/padding implementation [yet]; 33 * - by supporting only one transform function [which operates on 34 * *aligned* data in input stream byte order, big-endian in this case] 35 * we minimize burden of maintenance in two ways: a) collector/padding 36 * function is simpler; b) only one transform function to stare at; 37 * - SHA_LONG64 is required to be exactly 64-bit in order to be able to 38 * apply a number of optimizations to mitigate potential performance 39 * penalties caused by previous design decision; 40 * 41 * Caveat lector. 42 * 43 * Implementation relies on the fact that "long long" is 64-bit on 44 * both 32- and 64-bit platforms. If some compiler vendor comes up 45 * with 128-bit long long, adjustment to sha.h would be required. 46 * As this implementation relies on 64-bit integer type, it's totally 47 * inappropriate for platforms which don't support it, most notably 48 * 16-bit platforms. 49 * <appro@fy.chalmers.se> 50 */ 51 52 #include <openssl/crypto.h> 53 #include <openssl/opensslv.h> 54 #include <openssl/sha.h> 55 56 #if !defined(__STRICT_ALIGNMENT) || defined(SHA512_ASM) 57 #define SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA 58 #endif 59 60 int SHA384_Init(SHA512_CTX *c) 61 { 62 c->h[0]=U64(0xcbbb9d5dc1059ed8); 63 c->h[1]=U64(0x629a292a367cd507); 64 c->h[2]=U64(0x9159015a3070dd17); 65 c->h[3]=U64(0x152fecd8f70e5939); 66 c->h[4]=U64(0x67332667ffc00b31); 67 c->h[5]=U64(0x8eb44a8768581511); 68 c->h[6]=U64(0xdb0c2e0d64f98fa7); 69 c->h[7]=U64(0x47b5481dbefa4fa4); 70 71 c->Nl=0; c->Nh=0; 72 c->num=0; c->md_len=SHA384_DIGEST_LENGTH; 73 return 1; 74 } 75 76 int SHA512_Init(SHA512_CTX *c) 77 { 78 c->h[0]=U64(0x6a09e667f3bcc908); 79 c->h[1]=U64(0xbb67ae8584caa73b); 80 c->h[2]=U64(0x3c6ef372fe94f82b); 81 c->h[3]=U64(0xa54ff53a5f1d36f1); 82 c->h[4]=U64(0x510e527fade682d1); 83 c->h[5]=U64(0x9b05688c2b3e6c1f); 84 c->h[6]=U64(0x1f83d9abfb41bd6b); 85 c->h[7]=U64(0x5be0cd19137e2179); 86 87 c->Nl=0; c->Nh=0; 88 c->num=0; c->md_len=SHA512_DIGEST_LENGTH; 89 return 1; 90 } 91 92 #ifndef SHA512_ASM 93 static 94 #endif 95 void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num); 96 97 int SHA512_Final (unsigned char *md, SHA512_CTX *c) 98 { 99 unsigned char *p=(unsigned char *)c->u.p; 100 size_t n=c->num; 101 102 p[n]=0x80; /* There always is a room for one */ 103 n++; 104 if (n > (sizeof(c->u)-16)) 105 memset (p+n,0,sizeof(c->u)-n), n=0, 106 sha512_block_data_order (c,p,1); 107 108 memset (p+n,0,sizeof(c->u)-16-n); 109 #if BYTE_ORDER == BIG_ENDIAN 110 c->u.d[SHA_LBLOCK-2] = c->Nh; 111 c->u.d[SHA_LBLOCK-1] = c->Nl; 112 #else 113 p[sizeof(c->u)-1] = (unsigned char)(c->Nl); 114 p[sizeof(c->u)-2] = (unsigned char)(c->Nl>>8); 115 p[sizeof(c->u)-3] = (unsigned char)(c->Nl>>16); 116 p[sizeof(c->u)-4] = (unsigned char)(c->Nl>>24); 117 p[sizeof(c->u)-5] = (unsigned char)(c->Nl>>32); 118 p[sizeof(c->u)-6] = (unsigned char)(c->Nl>>40); 119 p[sizeof(c->u)-7] = (unsigned char)(c->Nl>>48); 120 p[sizeof(c->u)-8] = (unsigned char)(c->Nl>>56); 121 p[sizeof(c->u)-9] = (unsigned char)(c->Nh); 122 p[sizeof(c->u)-10] = (unsigned char)(c->Nh>>8); 123 p[sizeof(c->u)-11] = (unsigned char)(c->Nh>>16); 124 p[sizeof(c->u)-12] = (unsigned char)(c->Nh>>24); 125 p[sizeof(c->u)-13] = (unsigned char)(c->Nh>>32); 126 p[sizeof(c->u)-14] = (unsigned char)(c->Nh>>40); 127 p[sizeof(c->u)-15] = (unsigned char)(c->Nh>>48); 128 p[sizeof(c->u)-16] = (unsigned char)(c->Nh>>56); 129 #endif 130 131 sha512_block_data_order (c,p,1); 132 133 if (md==0) return 0; 134 135 switch (c->md_len) 136 { 137 /* Let compiler decide if it's appropriate to unroll... */ 138 case SHA384_DIGEST_LENGTH: 139 for (n=0;n<SHA384_DIGEST_LENGTH/8;n++) 140 { 141 SHA_LONG64 t = c->h[n]; 142 143 *(md++) = (unsigned char)(t>>56); 144 *(md++) = (unsigned char)(t>>48); 145 *(md++) = (unsigned char)(t>>40); 146 *(md++) = (unsigned char)(t>>32); 147 *(md++) = (unsigned char)(t>>24); 148 *(md++) = (unsigned char)(t>>16); 149 *(md++) = (unsigned char)(t>>8); 150 *(md++) = (unsigned char)(t); 151 } 152 break; 153 case SHA512_DIGEST_LENGTH: 154 for (n=0;n<SHA512_DIGEST_LENGTH/8;n++) 155 { 156 SHA_LONG64 t = c->h[n]; 157 158 *(md++) = (unsigned char)(t>>56); 159 *(md++) = (unsigned char)(t>>48); 160 *(md++) = (unsigned char)(t>>40); 161 *(md++) = (unsigned char)(t>>32); 162 *(md++) = (unsigned char)(t>>24); 163 *(md++) = (unsigned char)(t>>16); 164 *(md++) = (unsigned char)(t>>8); 165 *(md++) = (unsigned char)(t); 166 } 167 break; 168 /* ... as well as make sure md_len is not abused. */ 169 default: return 0; 170 } 171 172 return 1; 173 } 174 175 int SHA384_Final (unsigned char *md,SHA512_CTX *c) 176 { return SHA512_Final (md,c); } 177 178 int SHA512_Update (SHA512_CTX *c, const void *_data, size_t len) 179 { 180 SHA_LONG64 l; 181 unsigned char *p=c->u.p; 182 const unsigned char *data=(const unsigned char *)_data; 183 184 if (len==0) return 1; 185 186 l = (c->Nl+(((SHA_LONG64)len)<<3))&U64(0xffffffffffffffff); 187 if (l < c->Nl) c->Nh++; 188 if (sizeof(len)>=8) c->Nh+=(((SHA_LONG64)len)>>61); 189 c->Nl=l; 190 191 if (c->num != 0) 192 { 193 size_t n = sizeof(c->u) - c->num; 194 195 if (len < n) 196 { 197 memcpy (p+c->num,data,len), c->num += (unsigned int)len; 198 return 1; 199 } 200 else { 201 memcpy (p+c->num,data,n), c->num = 0; 202 len-=n, data+=n; 203 sha512_block_data_order (c,p,1); 204 } 205 } 206 207 if (len >= sizeof(c->u)) 208 { 209 #ifndef SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA 210 if ((size_t)data%sizeof(c->u.d[0]) != 0) 211 while (len >= sizeof(c->u)) 212 memcpy (p,data,sizeof(c->u)), 213 sha512_block_data_order (c,p,1), 214 len -= sizeof(c->u), 215 data += sizeof(c->u); 216 else 217 #endif 218 sha512_block_data_order (c,data,len/sizeof(c->u)), 219 data += len, 220 len %= sizeof(c->u), 221 data -= len; 222 } 223 224 if (len != 0) memcpy (p,data,len), c->num = (int)len; 225 226 return 1; 227 } 228 229 int SHA384_Update (SHA512_CTX *c, const void *data, size_t len) 230 { return SHA512_Update (c,data,len); } 231 232 void SHA512_Transform (SHA512_CTX *c, const unsigned char *data) 233 { 234 #ifndef SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA 235 if ((size_t)data%sizeof(c->u.d[0]) != 0) 236 memcpy(c->u.p,data,sizeof(c->u.p)), 237 data = c->u.p; 238 #endif 239 sha512_block_data_order (c,data,1); 240 } 241 242 unsigned char *SHA384(const unsigned char *d, size_t n, unsigned char *md) 243 { 244 SHA512_CTX c; 245 static unsigned char m[SHA384_DIGEST_LENGTH]; 246 247 if (md == NULL) md=m; 248 SHA384_Init(&c); 249 SHA512_Update(&c,d,n); 250 SHA512_Final(md,&c); 251 explicit_bzero(&c,sizeof(c)); 252 return(md); 253 } 254 255 unsigned char *SHA512(const unsigned char *d, size_t n, unsigned char *md) 256 { 257 SHA512_CTX c; 258 static unsigned char m[SHA512_DIGEST_LENGTH]; 259 260 if (md == NULL) md=m; 261 SHA512_Init(&c); 262 SHA512_Update(&c,d,n); 263 SHA512_Final(md,&c); 264 explicit_bzero(&c,sizeof(c)); 265 return(md); 266 } 267 268 #ifndef SHA512_ASM 269 static const SHA_LONG64 K512[80] = { 270 U64(0x428a2f98d728ae22),U64(0x7137449123ef65cd), 271 U64(0xb5c0fbcfec4d3b2f),U64(0xe9b5dba58189dbbc), 272 U64(0x3956c25bf348b538),U64(0x59f111f1b605d019), 273 U64(0x923f82a4af194f9b),U64(0xab1c5ed5da6d8118), 274 U64(0xd807aa98a3030242),U64(0x12835b0145706fbe), 275 U64(0x243185be4ee4b28c),U64(0x550c7dc3d5ffb4e2), 276 U64(0x72be5d74f27b896f),U64(0x80deb1fe3b1696b1), 277 U64(0x9bdc06a725c71235),U64(0xc19bf174cf692694), 278 U64(0xe49b69c19ef14ad2),U64(0xefbe4786384f25e3), 279 U64(0x0fc19dc68b8cd5b5),U64(0x240ca1cc77ac9c65), 280 U64(0x2de92c6f592b0275),U64(0x4a7484aa6ea6e483), 281 U64(0x5cb0a9dcbd41fbd4),U64(0x76f988da831153b5), 282 U64(0x983e5152ee66dfab),U64(0xa831c66d2db43210), 283 U64(0xb00327c898fb213f),U64(0xbf597fc7beef0ee4), 284 U64(0xc6e00bf33da88fc2),U64(0xd5a79147930aa725), 285 U64(0x06ca6351e003826f),U64(0x142929670a0e6e70), 286 U64(0x27b70a8546d22ffc),U64(0x2e1b21385c26c926), 287 U64(0x4d2c6dfc5ac42aed),U64(0x53380d139d95b3df), 288 U64(0x650a73548baf63de),U64(0x766a0abb3c77b2a8), 289 U64(0x81c2c92e47edaee6),U64(0x92722c851482353b), 290 U64(0xa2bfe8a14cf10364),U64(0xa81a664bbc423001), 291 U64(0xc24b8b70d0f89791),U64(0xc76c51a30654be30), 292 U64(0xd192e819d6ef5218),U64(0xd69906245565a910), 293 U64(0xf40e35855771202a),U64(0x106aa07032bbd1b8), 294 U64(0x19a4c116b8d2d0c8),U64(0x1e376c085141ab53), 295 U64(0x2748774cdf8eeb99),U64(0x34b0bcb5e19b48a8), 296 U64(0x391c0cb3c5c95a63),U64(0x4ed8aa4ae3418acb), 297 U64(0x5b9cca4f7763e373),U64(0x682e6ff3d6b2b8a3), 298 U64(0x748f82ee5defb2fc),U64(0x78a5636f43172f60), 299 U64(0x84c87814a1f0ab72),U64(0x8cc702081a6439ec), 300 U64(0x90befffa23631e28),U64(0xa4506cebde82bde9), 301 U64(0xbef9a3f7b2c67915),U64(0xc67178f2e372532b), 302 U64(0xca273eceea26619c),U64(0xd186b8c721c0c207), 303 U64(0xeada7dd6cde0eb1e),U64(0xf57d4f7fee6ed178), 304 U64(0x06f067aa72176fba),U64(0x0a637dc5a2c898a6), 305 U64(0x113f9804bef90dae),U64(0x1b710b35131c471b), 306 U64(0x28db77f523047d84),U64(0x32caab7b40c72493), 307 U64(0x3c9ebe0a15c9bebc),U64(0x431d67c49c100d4c), 308 U64(0x4cc5d4becb3e42b6),U64(0x597f299cfc657e2a), 309 U64(0x5fcb6fab3ad6faec),U64(0x6c44198c4a475817) }; 310 311 #if defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) 312 # if defined(__x86_64) || defined(__x86_64__) 313 # define ROTR(a,n) ({ SHA_LONG64 ret; \ 314 asm ("rorq %1,%0" \ 315 : "=r"(ret) \ 316 : "J"(n),"0"(a) \ 317 : "cc"); ret; }) 318 # define PULL64(x) ({ SHA_LONG64 ret=*((const SHA_LONG64 *)(&(x))); \ 319 asm ("bswapq %0" \ 320 : "=r"(ret) \ 321 : "0"(ret)); ret; }) 322 # elif (defined(__i386) || defined(__i386__)) 323 # define PULL64(x) ({ const unsigned int *p=(const unsigned int *)(&(x));\ 324 unsigned int hi=p[0],lo=p[1]; \ 325 asm ("bswapl %0; bswapl %1;" \ 326 : "=r"(lo),"=r"(hi) \ 327 : "0"(lo),"1"(hi)); \ 328 ((SHA_LONG64)hi)<<32|lo; }) 329 # elif (defined(_ARCH_PPC) && defined(__64BIT__)) || defined(_ARCH_PPC64) 330 # define ROTR(a,n) ({ SHA_LONG64 ret; \ 331 asm ("rotrdi %0,%1,%2" \ 332 : "=r"(ret) \ 333 : "r"(a),"K"(n)); ret; }) 334 # endif 335 #endif 336 337 #ifndef PULL64 338 #define B(x,j) (((SHA_LONG64)(*(((const unsigned char *)(&x))+j)))<<((7-j)*8)) 339 #define PULL64(x) (B(x,0)|B(x,1)|B(x,2)|B(x,3)|B(x,4)|B(x,5)|B(x,6)|B(x,7)) 340 #endif 341 342 #ifndef ROTR 343 #define ROTR(x,s) (((x)>>s) | (x)<<(64-s)) 344 #endif 345 346 #define Sigma0(x) (ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39)) 347 #define Sigma1(x) (ROTR((x),14) ^ ROTR((x),18) ^ ROTR((x),41)) 348 #define sigma0(x) (ROTR((x),1) ^ ROTR((x),8) ^ ((x)>>7)) 349 #define sigma1(x) (ROTR((x),19) ^ ROTR((x),61) ^ ((x)>>6)) 350 351 #define Ch(x,y,z) (((x) & (y)) ^ ((~(x)) & (z))) 352 #define Maj(x,y,z) (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z))) 353 354 355 #if defined(__i386) || defined(__i386__) || defined(_M_IX86) 356 /* 357 * This code should give better results on 32-bit CPU with less than 358 * ~24 registers, both size and performance wise... 359 */ 360 static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num) 361 { 362 const SHA_LONG64 *W=in; 363 SHA_LONG64 A,E,T; 364 SHA_LONG64 X[9+80],*F; 365 int i; 366 367 while (num--) { 368 369 F = X+80; 370 A = ctx->h[0]; F[1] = ctx->h[1]; 371 F[2] = ctx->h[2]; F[3] = ctx->h[3]; 372 E = ctx->h[4]; F[5] = ctx->h[5]; 373 F[6] = ctx->h[6]; F[7] = ctx->h[7]; 374 375 for (i=0;i<16;i++,F--) 376 { 377 T = PULL64(W[i]); 378 F[0] = A; 379 F[4] = E; 380 F[8] = T; 381 T += F[7] + Sigma1(E) + Ch(E,F[5],F[6]) + K512[i]; 382 E = F[3] + T; 383 A = T + Sigma0(A) + Maj(A,F[1],F[2]); 384 } 385 386 for (;i<80;i++,F--) 387 { 388 T = sigma0(F[8+16-1]); 389 T += sigma1(F[8+16-14]); 390 T += F[8+16] + F[8+16-9]; 391 392 F[0] = A; 393 F[4] = E; 394 F[8] = T; 395 T += F[7] + Sigma1(E) + Ch(E,F[5],F[6]) + K512[i]; 396 E = F[3] + T; 397 A = T + Sigma0(A) + Maj(A,F[1],F[2]); 398 } 399 400 ctx->h[0] += A; ctx->h[1] += F[1]; 401 ctx->h[2] += F[2]; ctx->h[3] += F[3]; 402 ctx->h[4] += E; ctx->h[5] += F[5]; 403 ctx->h[6] += F[6]; ctx->h[7] += F[7]; 404 405 W+=SHA_LBLOCK; 406 } 407 } 408 409 #elif defined(OPENSSL_SMALL_FOOTPRINT) 410 411 static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num) 412 { 413 const SHA_LONG64 *W=in; 414 SHA_LONG64 a,b,c,d,e,f,g,h,s0,s1,T1,T2; 415 SHA_LONG64 X[16]; 416 int i; 417 418 while (num--) { 419 420 a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; 421 e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7]; 422 423 for (i=0;i<16;i++) 424 { 425 #if BYTE_ORDER == BIG_ENDIAN 426 T1 = X[i] = W[i]; 427 #else 428 T1 = X[i] = PULL64(W[i]); 429 #endif 430 T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i]; 431 T2 = Sigma0(a) + Maj(a,b,c); 432 h = g; g = f; f = e; e = d + T1; 433 d = c; c = b; b = a; a = T1 + T2; 434 } 435 436 for (;i<80;i++) 437 { 438 s0 = X[(i+1)&0x0f]; s0 = sigma0(s0); 439 s1 = X[(i+14)&0x0f]; s1 = sigma1(s1); 440 441 T1 = X[i&0xf] += s0 + s1 + X[(i+9)&0xf]; 442 T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i]; 443 T2 = Sigma0(a) + Maj(a,b,c); 444 h = g; g = f; f = e; e = d + T1; 445 d = c; c = b; b = a; a = T1 + T2; 446 } 447 448 ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d; 449 ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h; 450 451 W+=SHA_LBLOCK; 452 } 453 } 454 455 #else 456 457 #define ROUND_00_15(i,a,b,c,d,e,f,g,h) do { \ 458 T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i]; \ 459 h = Sigma0(a) + Maj(a,b,c); \ 460 d += T1; h += T1; } while (0) 461 462 #define ROUND_16_80(i,j,a,b,c,d,e,f,g,h,X) do { \ 463 s0 = X[(j+1)&0x0f]; s0 = sigma0(s0); \ 464 s1 = X[(j+14)&0x0f]; s1 = sigma1(s1); \ 465 T1 = X[(j)&0x0f] += s0 + s1 + X[(j+9)&0x0f]; \ 466 ROUND_00_15(i+j,a,b,c,d,e,f,g,h); } while (0) 467 468 static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num) 469 { 470 const SHA_LONG64 *W=in; 471 SHA_LONG64 a,b,c,d,e,f,g,h,s0,s1,T1; 472 SHA_LONG64 X[16]; 473 int i; 474 475 while (num--) { 476 477 a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; 478 e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7]; 479 480 #if BYTE_ORDER == BIG_ENDIAN 481 T1 = X[0] = W[0]; ROUND_00_15(0,a,b,c,d,e,f,g,h); 482 T1 = X[1] = W[1]; ROUND_00_15(1,h,a,b,c,d,e,f,g); 483 T1 = X[2] = W[2]; ROUND_00_15(2,g,h,a,b,c,d,e,f); 484 T1 = X[3] = W[3]; ROUND_00_15(3,f,g,h,a,b,c,d,e); 485 T1 = X[4] = W[4]; ROUND_00_15(4,e,f,g,h,a,b,c,d); 486 T1 = X[5] = W[5]; ROUND_00_15(5,d,e,f,g,h,a,b,c); 487 T1 = X[6] = W[6]; ROUND_00_15(6,c,d,e,f,g,h,a,b); 488 T1 = X[7] = W[7]; ROUND_00_15(7,b,c,d,e,f,g,h,a); 489 T1 = X[8] = W[8]; ROUND_00_15(8,a,b,c,d,e,f,g,h); 490 T1 = X[9] = W[9]; ROUND_00_15(9,h,a,b,c,d,e,f,g); 491 T1 = X[10] = W[10]; ROUND_00_15(10,g,h,a,b,c,d,e,f); 492 T1 = X[11] = W[11]; ROUND_00_15(11,f,g,h,a,b,c,d,e); 493 T1 = X[12] = W[12]; ROUND_00_15(12,e,f,g,h,a,b,c,d); 494 T1 = X[13] = W[13]; ROUND_00_15(13,d,e,f,g,h,a,b,c); 495 T1 = X[14] = W[14]; ROUND_00_15(14,c,d,e,f,g,h,a,b); 496 T1 = X[15] = W[15]; ROUND_00_15(15,b,c,d,e,f,g,h,a); 497 #else 498 T1 = X[0] = PULL64(W[0]); ROUND_00_15(0,a,b,c,d,e,f,g,h); 499 T1 = X[1] = PULL64(W[1]); ROUND_00_15(1,h,a,b,c,d,e,f,g); 500 T1 = X[2] = PULL64(W[2]); ROUND_00_15(2,g,h,a,b,c,d,e,f); 501 T1 = X[3] = PULL64(W[3]); ROUND_00_15(3,f,g,h,a,b,c,d,e); 502 T1 = X[4] = PULL64(W[4]); ROUND_00_15(4,e,f,g,h,a,b,c,d); 503 T1 = X[5] = PULL64(W[5]); ROUND_00_15(5,d,e,f,g,h,a,b,c); 504 T1 = X[6] = PULL64(W[6]); ROUND_00_15(6,c,d,e,f,g,h,a,b); 505 T1 = X[7] = PULL64(W[7]); ROUND_00_15(7,b,c,d,e,f,g,h,a); 506 T1 = X[8] = PULL64(W[8]); ROUND_00_15(8,a,b,c,d,e,f,g,h); 507 T1 = X[9] = PULL64(W[9]); ROUND_00_15(9,h,a,b,c,d,e,f,g); 508 T1 = X[10] = PULL64(W[10]); ROUND_00_15(10,g,h,a,b,c,d,e,f); 509 T1 = X[11] = PULL64(W[11]); ROUND_00_15(11,f,g,h,a,b,c,d,e); 510 T1 = X[12] = PULL64(W[12]); ROUND_00_15(12,e,f,g,h,a,b,c,d); 511 T1 = X[13] = PULL64(W[13]); ROUND_00_15(13,d,e,f,g,h,a,b,c); 512 T1 = X[14] = PULL64(W[14]); ROUND_00_15(14,c,d,e,f,g,h,a,b); 513 T1 = X[15] = PULL64(W[15]); ROUND_00_15(15,b,c,d,e,f,g,h,a); 514 #endif 515 516 for (i=16;i<80;i+=16) 517 { 518 ROUND_16_80(i, 0,a,b,c,d,e,f,g,h,X); 519 ROUND_16_80(i, 1,h,a,b,c,d,e,f,g,X); 520 ROUND_16_80(i, 2,g,h,a,b,c,d,e,f,X); 521 ROUND_16_80(i, 3,f,g,h,a,b,c,d,e,X); 522 ROUND_16_80(i, 4,e,f,g,h,a,b,c,d,X); 523 ROUND_16_80(i, 5,d,e,f,g,h,a,b,c,X); 524 ROUND_16_80(i, 6,c,d,e,f,g,h,a,b,X); 525 ROUND_16_80(i, 7,b,c,d,e,f,g,h,a,X); 526 ROUND_16_80(i, 8,a,b,c,d,e,f,g,h,X); 527 ROUND_16_80(i, 9,h,a,b,c,d,e,f,g,X); 528 ROUND_16_80(i,10,g,h,a,b,c,d,e,f,X); 529 ROUND_16_80(i,11,f,g,h,a,b,c,d,e,X); 530 ROUND_16_80(i,12,e,f,g,h,a,b,c,d,X); 531 ROUND_16_80(i,13,d,e,f,g,h,a,b,c,X); 532 ROUND_16_80(i,14,c,d,e,f,g,h,a,b,X); 533 ROUND_16_80(i,15,b,c,d,e,f,g,h,a,X); 534 } 535 536 ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d; 537 ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h; 538 539 W+=SHA_LBLOCK; 540 } 541 } 542 543 #endif 544 545 #endif /* SHA512_ASM */ 546 547 #endif /* !OPENSSL_NO_SHA512 */ 548