sha256.c File Reference

#include "precomp.h"
#include "hash_pattern.c"

Include dependency graph for sha256.c:

Go to the source code of this file.

Macros
#define	ALG   SHA224
#define	Alg   Sha224
#define	ALG   SHA256
#define	Alg   Sha256
#define	MAJ(x, y, z)   ((((z) | (y)) & (x) ) | ((z) & (y)))
#define	CH(x, y, z)   ((((z) ^ (y)) & (x)) ^ (z))
#define	USE_CSIGMA0_MULTIROT   0
#define	USE_CSIGMA1_MULTIROT   0
#define	USE_LSIGMA0_MULTIROT   0
#define	USE_LSIGMA1_MULTIROT   0
#define	CSIGMA0(x)   (ROR32((x), 2) ^ ROR32((x), 13) ^ ROR32((x), 22))
#define	CSIGMA1(x)   (ROR32((x), 6) ^ ROR32((x), 11) ^ ROR32((x), 25))
#define	LSIGMA0(x)   (ROR32((x), 7) ^ ROR32((x), 18) ^ ((x)>> 3))
#define	LSIGMA1(x)   (ROR32((x), 17) ^ ROR32((x), 19) ^ ((x)>>10))
#define	CROUND(r16, r)
#define	IROUND(r)
#define	FROUND(r16, rb)
#define	EXPAND(a, b, c, d, r)
#define	DO_ROUND(a, b, c, d, t, r)

Functions
	SYMCRYPT_ALIGN_AT (256) const
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptSha256Init (_Out_ PSYMCRYPT_SHA256_STATE pState)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptSha224Init (_Out_ PSYMCRYPT_SHA224_STATE pState)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptSha256Append (_Inout_ PSYMCRYPT_SHA256_STATE pState, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptSha224Append (_Inout_ PSYMCRYPT_SHA224_STATE pState, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptSha256Result (_Inout_ PSYMCRYPT_SHA256_STATE pState, _Out_writes_(SYMCRYPT_SHA256_RESULT_SIZE) PBYTE pbResult)
SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL	SymCryptSha224Result (_Inout_ PSYMCRYPT_SHA224_STATE pState, _Out_writes_(SYMCRYPT_SHA224_RESULT_SIZE) PBYTE pbResult)
VOID SYMCRYPT_CALL	SymCryptSha256StateExportCore (_In_ PCSYMCRYPT_SHA256_STATE pState, _Out_writes_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PBYTE pbBlob, _In_ UINT32 type)
VOID SYMCRYPT_CALL	SymCryptSha256StateExport (_In_ PCSYMCRYPT_SHA256_STATE pState, _Out_writes_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PBYTE pbBlob)
VOID SYMCRYPT_CALL	SymCryptSha224StateExport (_In_ PCSYMCRYPT_SHA224_STATE pState, _Out_writes_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PBYTE pbBlob)
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptSha256StateImportCore (_Out_ PSYMCRYPT_SHA256_STATE pState, _In_reads_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PCBYTE pbBlob, _In_ UINT32 type)
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptSha256StateImport (_Out_ PSYMCRYPT_SHA256_STATE pState, _In_reads_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PCBYTE pbBlob)
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptSha224StateImport (_Out_ PSYMCRYPT_SHA224_STATE pState, _In_reads_bytes_(SYMCRYPT_SHA224_STATE_EXPORT_SIZE) PCBYTE pbBlob)
VOID SYMCRYPT_CALL	SymCryptSha256Selftest (void)
VOID SYMCRYPT_CALL	SymCryptSha224Selftest (void)
VOID SYMCRYPT_CALL	SymCryptSha256AppendBlocks_ul1 (_Inout_ SYMCRYPT_SHA256_CHAINING_STATE *pChain, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData, _Out_ SIZE_T *pcbRemaining)
VOID SYMCRYPT_CALL	SymCryptSha256AppendBlocks_ul2 (_Inout_ SYMCRYPT_SHA256_CHAINING_STATE *pChain, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData, _Out_ SIZE_T *pcbRemaining)
VOID SYMCRYPT_CALL	SymCryptSha256AppendBlocks (_Inout_ SYMCRYPT_SHA256_CHAINING_STATE *pChain, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData, _Out_ SIZE_T *pcbRemaining)

Variables
const SYMCRYPT_HASH	SymCryptSha224Algorithm_default
const SYMCRYPT_HASH	SymCryptSha256Algorithm_default
const PCSYMCRYPT_HASH	SymCryptSha224Algorithm = &SymCryptSha224Algorithm_default
const PCSYMCRYPT_HASH	SymCryptSha256Algorithm = &SymCryptSha256Algorithm_default
static const UINT32	sha224InitialState [8]
static const UINT32	sha256InitialState [8]
const BYTE	SymCryptSha256KATAnswer [32]
const BYTE	SymCryptSha224KATAnswer [28]

Macro Definition Documentation

ALG [1/2]

#define ALG   SHA224

Definition at line 111 of file sha256.c.

Alg [1/2]

#define Alg   Sha224

Definition at line 112 of file sha256.c.

ALG [2/2]

#define ALG   SHA256

Definition at line 111 of file sha256.c.

Alg [2/2]

#define Alg   Sha256

Definition at line 112 of file sha256.c.

CH

#define CH	(		x,
			y,
			z
	)		((((z) ^ (y)) & (x)) ^ (z))

Definition at line 555 of file sha256.c.

CROUND

#define CROUND	(		r16,
			r
	)

Value:

    {;\
    ah[ r16   &7] += CSIGMA1(ah[(r16+3)&7]) + CH(ah[(r16+3)&7], ah[(r16+2)&7], ah[(r16+1)&7]) + SymCryptSha256K[r] + Wt;\
    ah[(r16+4)&7] += ah[r16 &7];\
    ah[ r16   &7] += CSIGMA0(ah[(r16+7)&7]) + MAJ(ah[(r16+7)&7], ah[(r16+6)&7], ah[(r16+5)&7]);\
}

Definition at line 707 of file sha256.c.

CSIGMA0

#define CSIGMA0

(

x

)

(ROR32((x), 2) ^ ROR32((x), 13) ^ ROR32((x), 22))

Definition at line 612 of file sha256.c.

CSIGMA1

#define CSIGMA1

(

x

)

(ROR32((x), 6) ^ ROR32((x), 11) ^ ROR32((x), 25))

Definition at line 630 of file sha256.c.

DO_ROUND

#define DO_ROUND	(		a,
			b,
			c,
			d,
			t,
			r
	)

Value:

                t = W[r] + CSIGMA1( W[r-5] ) + W[r-8] + CH( W[r-5], W[r-6], W[r-7] ) + SymCryptSha256K[r]; \
                W[r-4] = t + d; \
                d = t + CSIGMA0( a ) + MAJ( c, b, a );

EXPAND

#define EXPAND	(		a,
			b,
			c,
			d,
			r
	)

Value:

                        c = W[r-15]; \
                        b =  d + LSIGMA1( b ) + W[r-7] + LSIGMA0( c ); \
                        W[r] = b; \

FROUND

#define FROUND	(		r16,
			rb
	)

Value:

    {                                      \
    Wt = LSIGMA1( W[(r16-2) & 15] ) +   W[(r16-7) & 15] +    \
         LSIGMA0( W[(r16-15) & 15]) +   W[r16 & 15];       \
    W[r16] = Wt; \
    CROUND( r16, r16+rb ); \
}

Definition at line 727 of file sha256.c.

IROUND

#define IROUND

(

r

)

Value:

    {\
    Wt = SYMCRYPT_LOAD_MSBFIRST32( &pbData[ 4*r ] );\
    W[r] = Wt; \
    CROUND(r,r);\
    }

Definition at line 717 of file sha256.c.

LSIGMA0

#define LSIGMA0

(

x

)

(ROR32((x), 7) ^ ROR32((x), 18) ^ ((x)>> 3))

Definition at line 647 of file sha256.c.

LSIGMA1

#define LSIGMA1

(

x

)

(ROR32((x), 17) ^ ROR32((x), 19) ^ ((x)>>10))

Definition at line 664 of file sha256.c.

MAJ

#define MAJ	(		x,
			y,
			z
	)		((((z) | (y)) & (x) ) | ((z) & (y)))

Definition at line 554 of file sha256.c.

USE_CSIGMA0_MULTIROT

#define USE_CSIGMA0_MULTIROT   0

Definition at line 591 of file sha256.c.

USE_CSIGMA1_MULTIROT

#define USE_CSIGMA1_MULTIROT   0

Definition at line 592 of file sha256.c.

USE_LSIGMA0_MULTIROT

#define USE_LSIGMA0_MULTIROT   0

Definition at line 593 of file sha256.c.

USE_LSIGMA1_MULTIROT

#define USE_LSIGMA1_MULTIROT   0

Definition at line 594 of file sha256.c.

Function Documentation

SYMCRYPT_ALIGN_AT()

SYMCRYPT_ALIGN_AT

(

256

)

const

Definition at line 54 of file sha256.c.

                                                             {
    0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
    0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
    0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
    0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
    0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
    0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
    0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
    0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
    0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
    0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
    0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
    0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
    0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
    0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
    0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
    0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
};

SymCryptSha224Append()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptSha224Append	(	_Inout_ PSYMCRYPT_SHA224_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData
	)

Definition at line 247 of file sha256.c.

{
    SymCryptSha256Append( (PSYMCRYPT_SHA256_STATE)pState, pbData, cbData );
}

SymCryptSha224Init()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptSha224Init

(

_Out_ PSYMCRYPT_SHA224_STATE

pState

)

Definition at line 148 of file sha256.c.

{
    SYMCRYPT_SET_MAGIC( pState );
 
    pState->dataLengthL = 0;
    //pState->dataLengthH = 0;      // not used
    pState->bytesInBuffer = 0;
 
    memcpy( &pState->chain.H[0], &sha224InitialState[0], sizeof( sha224InitialState ) );
 
    //
    // There is no need to initialize the buffer part of the state as that will be
    // filled before it is used.
    //
}

Referenced by SymCryptSha224Result().

SymCryptSha224Result()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptSha224Result	(	_Inout_ PSYMCRYPT_SHA224_STATE	pState,
		_Out_writes_(SYMCRYPT_SHA224_RESULT_SIZE) PBYTE	pbResult
	)

Definition at line 330 of file sha256.c.

{
    SYMCRYPT_ALIGN BYTE sha256Result[SYMCRYPT_SHA256_RESULT_SIZE];      // Buffer for SHA-256 output
 
    //
    // The SHA-3224 result is the first 28 bytes of the SHA-256 result of our state
    //
    SymCryptSha256Result( (PSYMCRYPT_SHA256_STATE)pState, sha256Result );
    memcpy( pbResult, sha256Result, SYMCRYPT_SHA224_RESULT_SIZE );
 
    //
    // The buffer was already wiped by the SymCryptSha256Result function, we
    // just have to re-initialize for SHA-224
    //
    SymCryptSha224Init( pState );
 
    SymCryptWipeKnownSize( sha256Result, sizeof( sha256Result ) );
}

SymCryptSha224Selftest()

VOID SYMCRYPT_CALL SymCryptSha224Selftest

(

void

)

Definition at line 511 of file sha256.c.

{
    BYTE result[SYMCRYPT_SHA224_RESULT_SIZE];
 
    SymCryptSha224( SymCryptTestMsg3, sizeof( SymCryptTestMsg3 ), result );
 
    SymCryptInjectError( result, sizeof( result ) );
 
    if( memcmp( result, SymCryptSha224KATAnswer, sizeof( result ) ) != 0 ) {
        SymCryptFatal( 'SH22' );
    }
}

SymCryptSha224StateExport()

VOID SYMCRYPT_CALL SymCryptSha224StateExport	(	_In_ PCSYMCRYPT_SHA224_STATE	pState,
		_Out_writes_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PBYTE	pbBlob
	)

Definition at line 401 of file sha256.c.

{
    SymCryptSha256StateExportCore( (PSYMCRYPT_SHA256_STATE)pState, pbBlob, SymCryptBlobTypeSha224State );
}

SymCryptSha224StateImport()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptSha224StateImport	(	_Out_ PSYMCRYPT_SHA224_STATE	pState,
		_In_reads_bytes_(SYMCRYPT_SHA224_STATE_EXPORT_SIZE) PCBYTE	pbBlob
	)

Definition at line 463 of file sha256.c.

{
    return SymCryptSha256StateImportCore( (PSYMCRYPT_SHA256_STATE)pState, pbBlob, SymCryptBlobTypeSha224State );
}

SymCryptSha256Append()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptSha256Append	(	_Inout_ PSYMCRYPT_SHA256_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData
	)

Definition at line 171 of file sha256.c.

{
    UINT32  bytesInBuffer;
    UINT32  freeInBuffer;
    SIZE_T  tmp;
 
    SYMCRYPT_CHECK_MAGIC( pState );
 
    pState->dataLengthL += cbData;      // dataLengthH is not used...
 
    bytesInBuffer = pState->bytesInBuffer;
 
    //
    // If previous data in buffer, buffer new input and transform if possible.
    //
    if( bytesInBuffer > 0 )
    {
        SYMCRYPT_ASSERT( SYMCRYPT_SHA256_INPUT_BLOCK_SIZE > bytesInBuffer );
 
        freeInBuffer = SYMCRYPT_SHA256_INPUT_BLOCK_SIZE - bytesInBuffer;
        if( cbData < freeInBuffer )
        {
            //
            // All the data will fit in the buffer.
            // We don't do anything here.
            // As cbData < inputBlockSize the bulk data processing is skipped,
            // and the data will be copied to the buffer at the end
            // of this code.
        } else {
            //
            // Enough data to fill the whole buffer & process it
            //
            memcpy(&pState->buffer[bytesInBuffer], pbData, freeInBuffer);
            pbData += freeInBuffer;
            cbData -= freeInBuffer;
            SymCryptSha256AppendBlocks( &pState->chain, &pState->buffer[0], SYMCRYPT_SHA256_INPUT_BLOCK_SIZE, &tmp );
 
            bytesInBuffer = 0;
        }
    }
 
    //
    // Internal buffer is empty; process all remaining whole blocks in the input
    //
    if( cbData >= SYMCRYPT_SHA256_INPUT_BLOCK_SIZE )
    {
        SymCryptSha256AppendBlocks( &pState->chain, pbData, cbData, &tmp );
        SYMCRYPT_ASSERT( tmp < SYMCRYPT_SHA256_INPUT_BLOCK_SIZE );
        pbData += cbData - tmp;
        cbData = tmp;
    }
 
    SYMCRYPT_ASSERT( cbData < SYMCRYPT_SHA256_INPUT_BLOCK_SIZE );
 
    //
    // buffer remaining input if necessary.
    //
    if( cbData > 0 )
    {
        memcpy( &pState->buffer[bytesInBuffer], pbData, cbData );
        bytesInBuffer += (UINT32) cbData;
    }
 
    pState->bytesInBuffer = bytesInBuffer;
}

Referenced by SymCryptSha224Append().

SymCryptSha256AppendBlocks()

VOID SYMCRYPT_CALL SymCryptSha256AppendBlocks	(	_Inout_ SYMCRYPT_SHA256_CHAINING_STATE *	pChain,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData,
		_Out_ SIZE_T *	pcbRemaining
	)

Definition at line 1812 of file sha256.c.

{
#if SYMCRYPT_CPU_AMD64
 
    SYMCRYPT_EXTENDED_SAVE_DATA SaveData;
 
    if (SYMCRYPT_CPU_FEATURES_PRESENT(SYMCRYPT_CPU_FEATURES_FOR_SHANI_CODE) &&
        SymCryptSaveXmm(&SaveData) == SYMCRYPT_NO_ERROR)
    {
        SymCryptSha256AppendBlocks_shani(pChain, pbData, cbData, pcbRemaining);
 
        SymCryptRestoreXmm(&SaveData);
    }
    // Temporarily disabling use of Ymm in SHA2
    // else if (SYMCRYPT_CPU_FEATURES_PRESENT(SYMCRYPT_CPU_FEATURE_AVX2 | SYMCRYPT_CPU_FEATURE_BMI2) &&
    //         SymCryptSaveYmm(&SaveData) == SYMCRYPT_NO_ERROR)
    // {
    //     //SymCryptSha256AppendBlocks_ul1(pChain, pbData, cbData, pcbRemaining);
    //     //SymCryptSha256AppendBlocks_ymm_8blocks(pChain, pbData, cbData, pcbRemaining);
    //     SymCryptSha256AppendBlocks_ymm_avx2_asm(pChain, pbData, cbData, pcbRemaining);
 
    //     SymCryptRestoreYmm(&SaveData);
    // }
    else if (SYMCRYPT_CPU_FEATURES_PRESENT(SYMCRYPT_CPU_FEATURE_SSSE3 | SYMCRYPT_CPU_FEATURE_BMI2) &&
            SymCryptSaveXmm(&SaveData) == SYMCRYPT_NO_ERROR)
    {
        //SymCryptSha256AppendBlocks_xmm_4blocks(pChain, pbData, cbData, pcbRemaining);
        SymCryptSha256AppendBlocks_xmm_ssse3_asm(pChain, pbData, cbData, pcbRemaining);
 
        SymCryptRestoreXmm(&SaveData);
    }
    else
    {
       SymCryptSha256AppendBlocks_ul1( pChain, pbData, cbData, pcbRemaining );
       //SymCryptSha256AppendBlocks_ul2(pChain, pbData, cbData, pcbRemaining);
    }
#elif SYMCRYPT_CPU_X86
    SYMCRYPT_EXTENDED_SAVE_DATA  SaveData;
 
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURES_FOR_SHANI_CODE | SYMCRYPT_CPU_FEATURE_SAVEXMM_NOFAIL ) &&
        SymCryptSaveXmm( &SaveData ) == SYMCRYPT_NO_ERROR )
    {
        SymCryptSha256AppendBlocks_shani( pChain, pbData, cbData, pcbRemaining );
        SymCryptRestoreXmm( &SaveData );
    }
    else if (SYMCRYPT_CPU_FEATURES_PRESENT(SYMCRYPT_CPU_FEATURE_SSSE3 | SYMCRYPT_CPU_FEATURE_BMI2)
            && SymCryptSaveXmm(&SaveData) == SYMCRYPT_NO_ERROR)
    {
        SymCryptSha256AppendBlocks_xmm_4blocks(pChain, pbData, cbData, pcbRemaining);
        SymCryptRestoreXmm(&SaveData);
    }
    else {
        SymCryptSha256AppendBlocks_ul1( pChain, pbData, cbData, pcbRemaining );
    }
#elif SYMCRYPT_CPU_ARM64
    if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURE_NEON_SHA256 ) )
    {
        SymCryptSha256AppendBlocks_instr( pChain, pbData, cbData, pcbRemaining );
    } else {
        SymCryptSha256AppendBlocks_ul1( pChain, pbData, cbData, pcbRemaining );
    }
#else
    SymCryptSha256AppendBlocks_ul1( pChain, pbData, cbData, pcbRemaining );
#endif
 
    //SymCryptSha256AppendBlocks_ul2( pChain, pbData, cbData, pcbRemaining );
    //SymCryptSha256AppendBlocks_xmm1( pChain, pbData, cbData, pcbRemaining );  !!! Needs Save/restore logic
    //SymCryptSha256AppendBlocks_xmm2( pChain, pbData, cbData, pcbRemaining );
}

Referenced by SymCryptSha256Append(), and SymCryptSha256Result().

SymCryptSha256AppendBlocks_ul1()

VOID SYMCRYPT_CALL SymCryptSha256AppendBlocks_ul1	(	_Inout_ SYMCRYPT_SHA256_CHAINING_STATE *	pChain,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData,
		_Out_ SIZE_T *	pcbRemaining
	)

Definition at line 739 of file sha256.c.

{
    SYMCRYPT_ALIGN UINT32 W[16];
    SYMCRYPT_ALIGN UINT32 ah[8];
    int round;
    UINT32 Wt;
 
    while( cbData >= 64 )
    {
        ah[7] = pChain->H[0];
        ah[6] = pChain->H[1];
        ah[5] = pChain->H[2];
        ah[4] = pChain->H[3];
        ah[3] = pChain->H[4];
        ah[2] = pChain->H[5];
        ah[1] = pChain->H[6];
        ah[0] = pChain->H[7];
 
        //
        // initial rounds 1 to 16
        //
 
        IROUND(  0 );
        IROUND(  1 );
        IROUND(  2 );
        IROUND(  3 );
        IROUND(  4 );
        IROUND(  5 );
        IROUND(  6 );
        IROUND(  7 );
        IROUND(  8 );
        IROUND(  9 );
        IROUND( 10 );
        IROUND( 11 );
        IROUND( 12 );
        IROUND( 13 );
        IROUND( 14 );
        IROUND( 15 );
 
 
        //
        // rounds 16 to 64.
        //
        for( round=16; round<64; round += 16 )
        {
            FROUND(  0, round );
            FROUND(  1, round );
            FROUND(  2, round );
            FROUND(  3, round );
            FROUND(  4, round );
            FROUND(  5, round );
            FROUND(  6, round );
            FROUND(  7, round );
            FROUND(  8, round );
            FROUND(  9, round );
            FROUND( 10, round );
            FROUND( 11, round );
            FROUND( 12, round );
            FROUND( 13, round );
            FROUND( 14, round );
            FROUND( 15, round );
        }
 
        pChain->H[0] = ah[7] + pChain->H[0];
        pChain->H[1] = ah[6] + pChain->H[1];
        pChain->H[2] = ah[5] + pChain->H[2];
        pChain->H[3] = ah[4] + pChain->H[3];
        pChain->H[4] = ah[3] + pChain->H[4];
        pChain->H[5] = ah[2] + pChain->H[5];
        pChain->H[6] = ah[1] + pChain->H[6];
        pChain->H[7] = ah[0] + pChain->H[7];
 
        pbData += 64;
        cbData -= 64;
 
    }
 
    *pcbRemaining = cbData;
 
    //
    // Wipe the variables;
    //
    SymCryptWipeKnownSize( ah, sizeof( ah ) );
    SymCryptWipeKnownSize( W, sizeof( W ) );
    SYMCRYPT_FORCE_WRITE32( &Wt, 0 );
}

Referenced by SymCryptSha256AppendBlocks().

SymCryptSha256AppendBlocks_ul2()

VOID SYMCRYPT_CALL SymCryptSha256AppendBlocks_ul2	(	_Inout_ SYMCRYPT_SHA256_CHAINING_STATE *	pChain,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData,
		_Out_ SIZE_T *	pcbRemaining
	)

Definition at line 832 of file sha256.c.

{
    //
    // Different arrangement of the code, currently 25 c/B vs 20 c/b for the version above.
    // On Atom: 50 c/B vs 41 c/B for the one above.
    //
    SYMCRYPT_ALIGN UINT32 buf[4 + 8 + 64];    // chaining state concatenated with the expanded input block
    UINT32 * W = &buf[4 + 8];
    UINT32 * ha = &buf[4]; // initial state words, in order h, g, ..., b, a
    UINT32 A, B, C, D, T;
    int r;
 
    ha[7] = pChain->H[0]; buf[3] = ha[7];
    ha[6] = pChain->H[1]; buf[2] = ha[6];
    ha[5] = pChain->H[2]; buf[1] = ha[5];
    ha[4] = pChain->H[3]; buf[0] = ha[4];
    ha[3] = pChain->H[4];
    ha[2] = pChain->H[5];
    ha[1] = pChain->H[6];
    ha[0] = pChain->H[7];
 
    while( cbData >= 64 )
    {
        //
        // Capture the input into W[0..15]
        //
        for( r=0; r<16; r++ )
        {
            W[r] = SYMCRYPT_LOAD_MSBFIRST32( &pbData[ 4*r ] );
        }
 
        //
        // Expand the message
        //
        A = W[15];
        B = W[14];
        D = W[0];
        for( r=16; r<64; r+= 2 )
        {
            // Loop invariant: A=W[r-1], B = W[r-2], D = W[r-16]
 
            //
            // Macro for one word of message expansion.
            // Invariant:
            // on entry: a = W[r-1], b = W[r-2], d = W[r-16]
            // on exit:  W[r] computed, a = W[r-1], b = W[r], c = W[r-15]
            //
            #define EXPAND( a, b, c, d, r ) \
                        c = W[r-15]; \
                        b =  d + LSIGMA1( b ) + W[r-7] + LSIGMA0( c ); \
                        W[r] = b; \
 
            EXPAND( A, B, C, D, r );
            EXPAND( B, A, D, C, (r+1));
 
            #undef EXPAND
        }
 
        A = ha[7];
        B = ha[6];
        C = ha[5];
        D = ha[4];
 
        for( r=0; r<64; r += 4 )
        {
            //
            // Loop invariant:
            // A, B, C, and D are the a,b,c,d values of the current state.
            // W[r] is the next expanded message word to be processed.
            // W[r-8 .. r-5] contain the current state words h, g, f, e.
            //
 
            //
            // Macro to compute one round
            //
            #define DO_ROUND( a, b, c, d, t, r ) \
                t = W[r] + CSIGMA1( W[r-5] ) + W[r-8] + CH( W[r-5], W[r-6], W[r-7] ) + SymCryptSha256K[r]; \
                W[r-4] = t + d; \
                d = t + CSIGMA0( a ) + MAJ( c, b, a );
 
            DO_ROUND( A, B, C, D, T, r );
            DO_ROUND( D, A, B, C, T, (r+1) );
            DO_ROUND( C, D, A, B, T, (r+2) );
            DO_ROUND( B, C, D, A, T, (r+3) );
            #undef DO_ROUND
        }
 
        buf[3] = ha[7] = buf[3] + A;
        buf[2] = ha[6] = buf[2] + B;
        buf[1] = ha[5] = buf[1] + C;
        buf[0] = ha[4] = buf[0] + D;
        ha[3] += W[r-5];
        ha[2] += W[r-6];
        ha[1] += W[r-7];
        ha[0] += W[r-8];
 
        pbData += 64;
        cbData -= 64;
    }
 
    pChain->H[0] = ha[7];
    pChain->H[1] = ha[6];
    pChain->H[2] = ha[5];
    pChain->H[3] = ha[4];
    pChain->H[4] = ha[3];
    pChain->H[5] = ha[2];
    pChain->H[6] = ha[1];
    pChain->H[7] = ha[0];
 
    *pcbRemaining = cbData;
 
    SymCryptWipeKnownSize( buf, sizeof( buf ) );
    SYMCRYPT_FORCE_WRITE32( &A, 0 );
    SYMCRYPT_FORCE_WRITE32( &B, 0 );
    SYMCRYPT_FORCE_WRITE32( &D, 0 );
    SYMCRYPT_FORCE_WRITE32( &T, 0 );
}

SymCryptSha256Init()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptSha256Init

(

_Out_ PSYMCRYPT_SHA256_STATE

pState

)

Definition at line 125 of file sha256.c.

{
    SYMCRYPT_SET_MAGIC( pState );
 
    pState->dataLengthL = 0;
    //pState->dataLengthH = 0;      // not used
    pState->bytesInBuffer = 0;
 
    memcpy( &pState->chain.H[0], &sha256InitialState[0], sizeof( sha256InitialState ) );
 
    //
    // There is no need to initialize the buffer part of the state as that will be
    // filled before it is used.
    //
}

SymCryptSha256Result()

SYMCRYPT_NOINLINE VOID SYMCRYPT_CALL SymCryptSha256Result	(	_Inout_ PSYMCRYPT_SHA256_STATE	pState,
		_Out_writes_(SYMCRYPT_SHA256_RESULT_SIZE) PBYTE	pbResult
	)

Definition at line 262 of file sha256.c.

{
    //
    // We don't use the common padding code as that is slower, and SHA-256 is very frequently used in
    // performance-sensitive areas.
    //
    UINT32 bytesInBuffer;
    SIZE_T tmp;
 
    SYMCRYPT_CHECK_MAGIC( pState );
 
    bytesInBuffer = pState->bytesInBuffer;
 
    //
    // The buffer is never completely full, so we can always put the first
    // padding byte in.
    //
    pState->buffer[bytesInBuffer++] = 0x80;
 
    if( bytesInBuffer > 64-8 ) {
        //
        // No room for the rest of the padding. Pad with zeroes & process block
        // bytesInBuffer is at most 64, so we do not have an integer underflow
        //
        SymCryptWipe( &pState->buffer[bytesInBuffer], 64-bytesInBuffer );
        SymCryptSha256AppendBlocks( &pState->chain, pState->buffer, 64, &tmp );
        bytesInBuffer = 0;
    }
 
    //
    // Set rest of padding
    // At this point bytesInBuffer <= 64-8, so we don't have an underflow
    // We wipe to the end of the buffer as it is 16-aligned,
    // and it is faster to wipe to an aligned point
    //
    SymCryptWipe( &pState->buffer[bytesInBuffer], 64-bytesInBuffer );
    SYMCRYPT_STORE_MSBFIRST64( &pState->buffer[64-8], pState->dataLengthL * 8 );
 
    //
    // Process the final block
    //
    SymCryptSha256AppendBlocks( &pState->chain, pState->buffer, 64, &tmp );
 
    //
    // Write the output in the correct byte order
    //
    SymCryptUint32ToMsbFirst( &pState->chain.H[0], pbResult, 8 );
 
    //
    // Wipe & re-initialize
    // We have to wipe the whole state because the Init call
    // might be optimized away by a smart compiler.
    //
    SymCryptWipeKnownSize( pState, sizeof( *pState ) );
 
    memcpy( &pState->chain.H[0], &sha256InitialState[0], sizeof( sha256InitialState ) );
    SYMCRYPT_SET_MAGIC( pState );
}

Referenced by SymCryptSha224Result().

SymCryptSha256Selftest()

VOID SYMCRYPT_CALL SymCryptSha256Selftest

(

void

)

Definition at line 485 of file sha256.c.

{
    BYTE result[SYMCRYPT_SHA256_RESULT_SIZE];
 
    SymCryptSha256( SymCryptTestMsg3, sizeof( SymCryptTestMsg3 ), result );
 
    SymCryptInjectError( result, sizeof( result ) );
 
    if( memcmp( result, SymCryptSha256KATAnswer, sizeof( result ) ) != 0 ) {
        SymCryptFatal( 'SH25' );
    }
}

SymCryptSha256StateExport()

VOID SYMCRYPT_CALL SymCryptSha256StateExport	(	_In_ PCSYMCRYPT_SHA256_STATE	pState,
		_Out_writes_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PBYTE	pbBlob
	)

Definition at line 391 of file sha256.c.

{
    SymCryptSha256StateExportCore( pState, pbBlob, SymCryptBlobTypeSha256State );
}

SymCryptSha256StateExportCore()

VOID SYMCRYPT_CALL SymCryptSha256StateExportCore	(	_In_ PCSYMCRYPT_SHA256_STATE	pState,
		_Out_writes_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PBYTE	pbBlob,
		_In_ UINT32	type
	)

Definition at line 354 of file sha256.c.

{
    SYMCRYPT_ALIGN SYMCRYPT_SHA256_STATE_EXPORT_BLOB blob;           // local copy to have proper alignment.
    C_ASSERT( sizeof( blob ) == SYMCRYPT_SHA256_STATE_EXPORT_SIZE );
 
    SYMCRYPT_CHECK_MAGIC( pState );
 
    SymCryptWipeKnownSize( &blob, sizeof( blob ) ); // wipe to avoid any data leakage
 
    blob.header.magic = SYMCRYPT_BLOB_MAGIC;
    blob.header.size = SYMCRYPT_SHA256_STATE_EXPORT_SIZE;
    blob.header.type = type;
 
    //
    // Copy the relevant data. Buffer will be 0-padded.
    //
 
    SymCryptUint32ToMsbFirst( &pState->chain.H[0], &blob.chain[0], 8 );
    blob.dataLength = pState->dataLengthL;
    memcpy( &blob.buffer[0], &pState->buffer[0], blob.dataLength & 0x3f );
 
    SYMCRYPT_ASSERT( (PCBYTE) &blob + sizeof( blob ) - sizeof( SYMCRYPT_BLOB_TRAILER ) == (PCBYTE) &blob.trailer );
    SymCryptMarvin32( SymCryptMarvin32DefaultSeed, (PCBYTE) &blob, sizeof( blob ) - sizeof( SYMCRYPT_BLOB_TRAILER ), &blob.trailer.checksum[0] );
 
    memcpy( pbBlob, &blob, sizeof( blob ) );
 
//cleanup:
    SymCryptWipeKnownSize( &blob, sizeof( blob ) );
    return;
}

Referenced by SymCryptSha224StateExport(), and SymCryptSha256StateExport().

SymCryptSha256StateImport()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptSha256StateImport	(	_Out_ PSYMCRYPT_SHA256_STATE	pState,
		_In_reads_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PCBYTE	pbBlob
	)

Definition at line 453 of file sha256.c.

{
    return SymCryptSha256StateImportCore( pState, pbBlob, SymCryptBlobTypeSha256State );
}

SymCryptSha256StateImportCore()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptSha256StateImportCore	(	_Out_ PSYMCRYPT_SHA256_STATE	pState,
		_In_reads_bytes_(SYMCRYPT_SHA256_STATE_EXPORT_SIZE) PCBYTE	pbBlob,
		_In_ UINT32	type
	)

Definition at line 411 of file sha256.c.

{
    SYMCRYPT_ERROR                      scError = SYMCRYPT_NO_ERROR;
    SYMCRYPT_ALIGN SYMCRYPT_SHA256_STATE_EXPORT_BLOB   blob;                       // local copy to have proper alignment.
    BYTE                                checksum[8];
 
    C_ASSERT( sizeof( blob ) == SYMCRYPT_SHA256_STATE_EXPORT_SIZE );
    memcpy( &blob, pbBlob, sizeof( blob ) );
 
    if( blob.header.magic != SYMCRYPT_BLOB_MAGIC ||
        blob.header.size != SYMCRYPT_SHA256_STATE_EXPORT_SIZE ||
        blob.header.type != type )
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    SymCryptMarvin32( SymCryptMarvin32DefaultSeed, (PCBYTE) &blob, sizeof( blob ) - sizeof( SYMCRYPT_BLOB_TRAILER ), checksum );
    if( memcmp( checksum, &blob.trailer.checksum[0], 8 ) != 0 )
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    SymCryptMsbFirstToUint32( &blob.chain[0], &pState->chain.H[0], 8 );
    pState->dataLengthL = blob.dataLength;
    pState->bytesInBuffer = blob.dataLength & 0x3f;
    memcpy( &pState->buffer[0], &blob.buffer[0], pState->bytesInBuffer );
 
    SYMCRYPT_SET_MAGIC( pState );
 
cleanup:
    SymCryptWipeKnownSize( &blob, sizeof(blob) );
    return scError;
}

Referenced by SymCryptSha224StateImport(), and SymCryptSha256StateImport().

Variable Documentation

sha224InitialState

const UINT32 sha224InitialState[8]

static

Initial value:

= {
    0xc1059ed8UL,
    0x367cd507UL,
    0x3070dd17UL,
    0xf70e5939UL,
    0xffc00b31UL,
    0x68581511UL,
    0x64f98fa7UL,
    0xbefa4fa4UL,
}

Definition at line 77 of file sha256.c.

Referenced by SymCryptSha224Init().

sha256InitialState

const UINT32 sha256InitialState[8]

static

Initial value:

= {
    0x6a09e667UL,
    0xbb67ae85UL,
    0x3c6ef372UL,
    0xa54ff53aUL,
    0x510e527fUL,
    0x9b05688cUL,
    0x1f83d9abUL,
    0x5be0cd19UL,
}

Definition at line 88 of file sha256.c.

Referenced by SymCryptSha256Init(), and SymCryptSha256Result().

SymCryptSha224Algorithm

const PCSYMCRYPT_HASH SymCryptSha224Algorithm = &SymCryptSha224Algorithm_default

Definition at line 45 of file sha256.c.

SymCryptSha224Algorithm_default

const SYMCRYPT_HASH SymCryptSha224Algorithm_default

Initial value:

= {
    &SymCryptSha224Init,
    &SymCryptSha224Append,
    &SymCryptSha224Result,
    &SymCryptSha256AppendBlocks,
    &SymCryptSha224StateCopy,
    sizeof( SYMCRYPT_SHA224_STATE ),
    SYMCRYPT_SHA224_RESULT_SIZE,
    SYMCRYPT_SHA224_INPUT_BLOCK_SIZE,
    SYMCRYPT_FIELD_OFFSET( SYMCRYPT_SHA224_STATE, chain ),
    SYMCRYPT_FIELD_SIZE( SYMCRYPT_SHA224_STATE, chain ),
}

Definition at line 19 of file sha256.c.

SymCryptSha224KATAnswer

const BYTE SymCryptSha224KATAnswer[28]

Initial value:

= {
    0x23, 0x09, 0x7d, 0x22, 0x34, 0x05, 0xd8, 0x22,
    0x86, 0x42, 0xa4, 0x77, 0xbd, 0xa2, 0x55, 0xb3,
    0x2a, 0xad, 0xbc, 0xe4, 0xbd, 0xa0, 0xb3, 0xf7,
    0xe3, 0x6c, 0x9d, 0xa7,
    }

Definition at line 502 of file sha256.c.

Referenced by SymCryptSha224Selftest().

SymCryptSha256Algorithm

const PCSYMCRYPT_HASH SymCryptSha256Algorithm = &SymCryptSha256Algorithm_default

Definition at line 46 of file sha256.c.

Referenced by init_hash_impl(), and SymCryptSshKdfSha256SelfTest().

SymCryptSha256Algorithm_default

const SYMCRYPT_HASH SymCryptSha256Algorithm_default

Initial value:

= {
    &SymCryptSha256Init,
    &SymCryptSha256Append,
    &SymCryptSha256Result,
    &SymCryptSha256AppendBlocks,
    &SymCryptSha256StateCopy,
    sizeof( SYMCRYPT_SHA256_STATE ),
    SYMCRYPT_SHA256_RESULT_SIZE,
    SYMCRYPT_SHA256_INPUT_BLOCK_SIZE,
    SYMCRYPT_FIELD_OFFSET( SYMCRYPT_SHA256_STATE, chain ),
    SYMCRYPT_FIELD_SIZE( SYMCRYPT_SHA256_STATE, chain ),
}

Definition at line 32 of file sha256.c.

SymCryptSha256KATAnswer

const BYTE SymCryptSha256KATAnswer[32]

Initial value:

= {
    0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea,
    0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23,
    0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
    0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad,
    }

Definition at line 476 of file sha256.c.

Referenced by SymCryptSha256Selftest().