[mirror_frr.git] / lib / sha256.c

/*-
 * Copyright 2005,2007,2009 Colin Percival
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <zebra.h>
#include "sha256.h"

#if !HAVE_DECL_BE32DEC
static inline uint32_t be32dec(const void *pp)
{
	const uint8_t *p = (uint8_t const *)pp;

	return ((uint32_t)(p[3]) + ((uint32_t)(p[2]) << 8)
		+ ((uint32_t)(p[1]) << 16) + ((uint32_t)(p[0]) << 24));
}
#else
#include <sys/endian.h>
#endif

#if !HAVE_DECL_BE32ENC
static inline void be32enc(void *pp, uint32_t x)
{
	uint8_t *p = (uint8_t *)pp;

	p[3] = x & 0xff;
	p[2] = (x >> 8) & 0xff;
	p[1] = (x >> 16) & 0xff;
	p[0] = (x >> 24) & 0xff;
}
#else
#include <sys/endian.h>
#endif

/*
 * Encode a length len/4 vector of (uint32_t) into a length len vector of
 * (unsigned char) in big-endian form.  Assumes len is a multiple of 4.
 */
static void be32enc_vect(unsigned char *dst, const uint32_t *src, size_t len)
{
	size_t i;

	for (i = 0; i < len / 4; i++)
		be32enc(dst + i * 4, src[i]);
}

/*
 * Decode a big-endian length len vector of (unsigned char) into a length
 * len/4 vector of (uint32_t).  Assumes len is a multiple of 4.
 */
static void be32dec_vect(uint32_t *dst, const unsigned char *src, size_t len)
{
	size_t i;

	for (i = 0; i < len / 4; i++)
		dst[i] = be32dec(src + i * 4);
}

/* Elementary functions used by SHA256 */
#define Ch(x, y, z)     ((x & (y ^ z)) ^ z)
#define Maj(x, y, z)    ((x & (y | z)) | (y & z))
#define SHR(x, n)       (x >> n)
#define ROTR(x, n)      ((x >> n) | (x << (32 - n)))
#define S0(x)           (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
#define S1(x)           (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
#define s0(x)           (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
#define s1(x)           (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))

/* SHA256 round function */
#define RND(a, b, c, d, e, f, g, h, k)                                         \
	t0 = h + S1(e) + Ch(e, f, g) + k;                                      \
	t1 = S0(a) + Maj(a, b, c);                                             \
	d += t0;                                                               \
	h = t0 + t1;

/* Adjusted round function for rotating state */
#define RNDr(S, W, i, k)                                                       \
	RND(S[(64 - i) % 8], S[(65 - i) % 8], S[(66 - i) % 8],                 \
	    S[(67 - i) % 8], S[(68 - i) % 8], S[(69 - i) % 8],                 \
	    S[(70 - i) % 8], S[(71 - i) % 8], W[i] + k)

/*
 * SHA256 block compression function.  The 256-bit state is transformed via
 * the 512-bit input block to produce a new state.
 */
static void SHA256_Transform(uint32_t *state, const unsigned char block[64])
{
	uint32_t W[64];
	uint32_t S[8];
	uint32_t t0, t1;
	int i;

	/* 1. Prepare message schedule W. */
	be32dec_vect(W, block, 64);
	for (i = 16; i < 64; i++)
		W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];

	/* 2. Initialize working variables. */
	memcpy(S, state, 32);

	/* 3. Mix. */
	RNDr(S, W, 0, 0x428a2f98);
	RNDr(S, W, 1, 0x71374491);
	RNDr(S, W, 2, 0xb5c0fbcf);
	RNDr(S, W, 3, 0xe9b5dba5);
	RNDr(S, W, 4, 0x3956c25b);
	RNDr(S, W, 5, 0x59f111f1);
	RNDr(S, W, 6, 0x923f82a4);
	RNDr(S, W, 7, 0xab1c5ed5);
	RNDr(S, W, 8, 0xd807aa98);
	RNDr(S, W, 9, 0x12835b01);
	RNDr(S, W, 10, 0x243185be);
	RNDr(S, W, 11, 0x550c7dc3);
	RNDr(S, W, 12, 0x72be5d74);
	RNDr(S, W, 13, 0x80deb1fe);
	RNDr(S, W, 14, 0x9bdc06a7);
	RNDr(S, W, 15, 0xc19bf174);
	RNDr(S, W, 16, 0xe49b69c1);
	RNDr(S, W, 17, 0xefbe4786);
	RNDr(S, W, 18, 0x0fc19dc6);
	RNDr(S, W, 19, 0x240ca1cc);
	RNDr(S, W, 20, 0x2de92c6f);
	RNDr(S, W, 21, 0x4a7484aa);
	RNDr(S, W, 22, 0x5cb0a9dc);
	RNDr(S, W, 23, 0x76f988da);
	RNDr(S, W, 24, 0x983e5152);
	RNDr(S, W, 25, 0xa831c66d);
	RNDr(S, W, 26, 0xb00327c8);
	RNDr(S, W, 27, 0xbf597fc7);
	RNDr(S, W, 28, 0xc6e00bf3);
	RNDr(S, W, 29, 0xd5a79147);
	RNDr(S, W, 30, 0x06ca6351);
	RNDr(S, W, 31, 0x14292967);
	RNDr(S, W, 32, 0x27b70a85);
	RNDr(S, W, 33, 0x2e1b2138);
	RNDr(S, W, 34, 0x4d2c6dfc);
	RNDr(S, W, 35, 0x53380d13);
	RNDr(S, W, 36, 0x650a7354);
	RNDr(S, W, 37, 0x766a0abb);
	RNDr(S, W, 38, 0x81c2c92e);
	RNDr(S, W, 39, 0x92722c85);
	RNDr(S, W, 40, 0xa2bfe8a1);
	RNDr(S, W, 41, 0xa81a664b);
	RNDr(S, W, 42, 0xc24b8b70);
	RNDr(S, W, 43, 0xc76c51a3);
	RNDr(S, W, 44, 0xd192e819);
	RNDr(S, W, 45, 0xd6990624);
	RNDr(S, W, 46, 0xf40e3585);
	RNDr(S, W, 47, 0x106aa070);
	RNDr(S, W, 48, 0x19a4c116);
	RNDr(S, W, 49, 0x1e376c08);
	RNDr(S, W, 50, 0x2748774c);
	RNDr(S, W, 51, 0x34b0bcb5);
	RNDr(S, W, 52, 0x391c0cb3);
	RNDr(S, W, 53, 0x4ed8aa4a);
	RNDr(S, W, 54, 0x5b9cca4f);
	RNDr(S, W, 55, 0x682e6ff3);
	RNDr(S, W, 56, 0x748f82ee);
	RNDr(S, W, 57, 0x78a5636f);
	RNDr(S, W, 58, 0x84c87814);
	RNDr(S, W, 59, 0x8cc70208);
	RNDr(S, W, 60, 0x90befffa);
	RNDr(S, W, 61, 0xa4506ceb);
	RNDr(S, W, 62, 0xbef9a3f7);
	RNDr(S, W, 63, 0xc67178f2);

	/* 4. Mix local working variables into global state */
	for (i = 0; i < 8; i++)
		state[i] += S[i];

	/* Clean the stack. */
	memset(W, 0, 256);
	memset(S, 0, 32);
	memset(&t0, 0, sizeof(t0));
	memset(&t1, 0, sizeof(t0));
}

static unsigned char PAD[64] = {
	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};

/* Add padding and terminating bit-count. */
static void SHA256_Pad(SHA256_CTX *ctx)
{
	unsigned char len[8];
	uint32_t r, plen;

	/*
	 * Convert length to a vector of bytes -- we do this now rather
	 * than later because the length will change after we pad.
	 */
	be32enc_vect(len, ctx->count, 8);

	/* Add 1--64 bytes so that the resulting length is 56 mod 64 */
	r = (ctx->count[1] >> 3) & 0x3f;
	plen = (r < 56) ? (56 - r) : (120 - r);
	SHA256_Update(ctx, PAD, (size_t)plen);

	/* Add the terminating bit-count */
	SHA256_Update(ctx, len, 8);
}

/* SHA-256 initialization.  Begins a SHA-256 operation. */
void SHA256_Init(SHA256_CTX *ctx)
{

	/* Zero bits processed so far */
	ctx->count[0] = ctx->count[1] = 0;

	/* Magic initialization constants */
	ctx->state[0] = 0x6A09E667;
	ctx->state[1] = 0xBB67AE85;
	ctx->state[2] = 0x3C6EF372;
	ctx->state[3] = 0xA54FF53A;
	ctx->state[4] = 0x510E527F;
	ctx->state[5] = 0x9B05688C;
	ctx->state[6] = 0x1F83D9AB;
	ctx->state[7] = 0x5BE0CD19;
}

/* Add bytes into the hash */
void SHA256_Update(SHA256_CTX *ctx, const void *in, size_t len)
{
	uint32_t bitlen[2];
	uint32_t r;
	const unsigned char *src = in;

	/* Number of bytes left in the buffer from previous updates */
	r = (ctx->count[1] >> 3) & 0x3f;

	/* Convert the length into a number of bits */
	bitlen[1] = ((uint32_t)len) << 3;
	bitlen[0] = (uint32_t)(len >> 29);

	/* Update number of bits */
	if ((ctx->count[1] += bitlen[1]) < bitlen[1])
		ctx->count[0]++;
	ctx->count[0] += bitlen[0];

	/* Handle the case where we don't need to perform any transforms */
	if (len < 64 - r) {
		memcpy(&ctx->buf[r], src, len);
		return;
	}

	/* Finish the current block */
	memcpy(&ctx->buf[r], src, 64 - r);
	SHA256_Transform(ctx->state, ctx->buf);
	src += 64 - r;
	len -= 64 - r;

	/* Perform complete blocks */
	while (len >= 64) {
		SHA256_Transform(ctx->state, src);
		src += 64;
		len -= 64;
	}

	/* Copy left over data into buffer */
	memcpy(ctx->buf, src, len);
}

/*
 * SHA-256 finalization.  Pads the input data, exports the hash value,
 * and clears the context state.
 */
void SHA256_Final(unsigned char digest[32], SHA256_CTX *ctx)
{

	/* Add padding */
	SHA256_Pad(ctx);

	/* Write the hash */
	be32enc_vect(digest, ctx->state, 32);

	/* Clear the context state */
	memset((void *)ctx, 0, sizeof(*ctx));
}

/* Initialize an HMAC-SHA256 operation with the given key. */
void HMAC__SHA256_Init(HMAC_SHA256_CTX *ctx, const void *_K, size_t Klen)
{
	unsigned char pad[64];
	unsigned char khash[32];
	const unsigned char *K = _K;
	size_t i;

	/* If Klen > 64, the key is really SHA256(K). */
	if (Klen > 64) {
		SHA256_Init(&ctx->ictx);
		SHA256_Update(&ctx->ictx, K, Klen);
		SHA256_Final(khash, &ctx->ictx);
		K = khash;
		Klen = 32;
	}

	/* Inner SHA256 operation is SHA256(K xor [block of 0x36] || data). */
	SHA256_Init(&ctx->ictx);
	memset(pad, 0x36, 64);
	for (i = 0; i < Klen; i++)
		pad[i] ^= K[i];
	SHA256_Update(&ctx->ictx, pad, 64);

	/* Outer SHA256 operation is SHA256(K xor [block of 0x5c] || hash). */
	SHA256_Init(&ctx->octx);
	memset(pad, 0x5c, 64);
	for (i = 0; i < Klen; i++)
		pad[i] ^= K[i];
	SHA256_Update(&ctx->octx, pad, 64);

	/* Clean the stack. */
	memset(khash, 0, 32);
}

/* Add bytes to the HMAC-SHA256 operation. */
void HMAC__SHA256_Update(HMAC_SHA256_CTX *ctx, const void *in, size_t len)
{

	/* Feed data to the inner SHA256 operation. */
	SHA256_Update(&ctx->ictx, in, len);
}

/* Finish an HMAC-SHA256 operation. */
void HMAC__SHA256_Final(unsigned char digest[32], HMAC_SHA256_CTX *ctx)
{
	unsigned char ihash[32];

	/* Finish the inner SHA256 operation. */
	SHA256_Final(ihash, &ctx->ictx);

	/* Feed the inner hash to the outer SHA256 operation. */
	SHA256_Update(&ctx->octx, ihash, 32);

	/* Finish the outer SHA256 operation. */
	SHA256_Final(digest, &ctx->octx);

	/* Clean the stack. */
	memset(ihash, 0, 32);
}

/**
 * PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
 * Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
 * write the output to buf.  The value dkLen must be at most 32 * (2^32 - 1).
 */
void PBKDF2_SHA256(const uint8_t *passwd, size_t passwdlen, const uint8_t *salt,
		   size_t saltlen, uint64_t c, uint8_t *buf, size_t dkLen)
{
	HMAC_SHA256_CTX PShctx, hctx;
	size_t i;
	uint8_t ivec[4];
	uint8_t U[32];
	uint8_t T[32];
	uint64_t j;
	int k;
	size_t clen;

	/* Compute HMAC state after processing P and S. */
	HMAC__SHA256_Init(&PShctx, passwd, passwdlen);
	HMAC__SHA256_Update(&PShctx, salt, saltlen);

	/* Iterate through the blocks. */
	for (i = 0; i * 32 < dkLen; i++) {
		/* Generate INT(i + 1). */
		be32enc(ivec, (uint32_t)(i + 1));

		/* Compute U_1 = PRF(P, S || INT(i)). */
		memcpy(&hctx, &PShctx, sizeof(HMAC_SHA256_CTX));
		HMAC__SHA256_Update(&hctx, ivec, 4);
		HMAC__SHA256_Final(U, &hctx);

		/* T_i = U_1 ... */
		memcpy(T, U, 32);

		for (j = 2; j <= c; j++) {
			/* Compute U_j. */
			HMAC__SHA256_Init(&hctx, passwd, passwdlen);
			HMAC__SHA256_Update(&hctx, U, 32);
			HMAC__SHA256_Final(U, &hctx);

			/* ... xor U_j ... */
			for (k = 0; k < 32; k++)
				T[k] ^= U[k];
		}

		/* Copy as many bytes as necessary into buf. */
		clen = dkLen - i * 32;
		if (clen > 32)
			clen = 32;
		memcpy(&buf[i * 32], T, clen);
	}

	/* Clean PShctx, since we never called _Final on it. */
	memset(&PShctx, 0, sizeof(HMAC_SHA256_CTX));
}
Commit	Line	Data
7f57883e DS	1	/*-
	2	* Copyright 2005,2007,2009 Colin Percival
	3	* All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	15	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	16	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	17	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	18	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	19	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	20	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	21	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	22	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	23	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	24	* SUCH DAMAGE.
	25	*/
	26
	27	#include <zebra.h>
	28	#include "sha256.h"
	29
ba0cb3fe	30	#if !HAVE_DECL_BE32DEC
d62a17ae	31	static inline uint32_t be32dec(const void *pp)
7f57883e	32	{
d62a17ae	33	const uint8_t p = (uint8_t const )pp;
7f57883e	34
d62a17ae	35	return ((uint32_t)(p[3]) + ((uint32_t)(p[2]) << 8)
d62a17ae	36	+ ((uint32_t)(p[1]) << 16) + ((uint32_t)(p[0]) << 24));
7f57883e	37	}
a8a5dbc0 DS	38	#else
a8a5dbc0 DS	39	#include <sys/endian.h>
ba0cb3fe	40	#endif
7f57883e	41
ba0cb3fe	42	#if !HAVE_DECL_BE32ENC
d62a17ae	43	static inline void be32enc(void *pp, uint32_t x)
7f57883e	44	{
d62a17ae	45	uint8_t p = (uint8_t )pp;
7f57883e	46
d62a17ae	47	p[3] = x & 0xff;
	48	p[2] = (x >> 8) & 0xff;
	49	p[1] = (x >> 16) & 0xff;
	50	p[0] = (x >> 24) & 0xff;
7f57883e	51	}
a8a5dbc0 DS	52	#else
a8a5dbc0 DS	53	#include <sys/endian.h>
4f13df62	54	#endif
7f57883e DS	55
	56	/*
	57	* Encode a length len/4 vector of (uint32_t) into a length len vector of
	58	* (unsigned char) in big-endian form. Assumes len is a multiple of 4.
	59	*/
d62a17ae	60	static void be32enc_vect(unsigned char dst, const uint32_t src, size_t len)
7f57883e	61	{
d62a17ae	62	size_t i;
7f57883e	63
d62a17ae	64	for (i = 0; i < len / 4; i++)
d62a17ae	65	be32enc(dst + i * 4, src[i]);
7f57883e DS	66	}
	67
	68	/*
	69	* Decode a big-endian length len vector of (unsigned char) into a length
	70	* len/4 vector of (uint32_t). Assumes len is a multiple of 4.
	71	*/
d62a17ae	72	static void be32dec_vect(uint32_t dst, const unsigned char src, size_t len)
7f57883e	73	{
d62a17ae	74	size_t i;
7f57883e	75
d62a17ae	76	for (i = 0; i < len / 4; i++)
d62a17ae	77	dst[i] = be32dec(src + i * 4);
7f57883e DS	78	}
	79
	80	/* Elementary functions used by SHA256 */
	81	#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
	82	#define Maj(x, y, z) ((x & (y \| z)) \| (y & z))
	83	#define SHR(x, n) (x >> n)
	84	#define ROTR(x, n) ((x >> n) \| (x << (32 - n)))
	85	#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
	86	#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
	87	#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
	88	#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
	89
	90	/* SHA256 round function */
d62a17ae	91	#define RND(a, b, c, d, e, f, g, h, k) \
	92	t0 = h + S1(e) + Ch(e, f, g) + k; \
	93	t1 = S0(a) + Maj(a, b, c); \
	94	d += t0; \
	95	h = t0 + t1;
7f57883e DS	96
7f57883e DS	97	/* Adjusted round function for rotating state */
d62a17ae	98	#define RNDr(S, W, i, k) \
	99	RND(S[(64 - i) % 8], S[(65 - i) % 8], S[(66 - i) % 8], \
	100	S[(67 - i) % 8], S[(68 - i) % 8], S[(69 - i) % 8], \
	101	S[(70 - i) % 8], S[(71 - i) % 8], W[i] + k)
7f57883e DS	102
	103	/*
	104	* SHA256 block compression function. The 256-bit state is transformed via
	105	* the 512-bit input block to produce a new state.
	106	*/
d62a17ae	107	static void SHA256_Transform(uint32_t *state, const unsigned char block[64])
7f57883e	108	{
d62a17ae	109	uint32_t W[64];
	110	uint32_t S[8];
	111	uint32_t t0, t1;
	112	int i;
	113
	114	/* 1. Prepare message schedule W. */
	115	be32dec_vect(W, block, 64);
	116	for (i = 16; i < 64; i++)
	117	W[i] = s1(W[i - 2]) + W[i - 7] + s0(W[i - 15]) + W[i - 16];
	118
	119	/* 2. Initialize working variables. */
	120	memcpy(S, state, 32);
	121
	122	/* 3. Mix. */
	123	RNDr(S, W, 0, 0x428a2f98);
	124	RNDr(S, W, 1, 0x71374491);
	125	RNDr(S, W, 2, 0xb5c0fbcf);
	126	RNDr(S, W, 3, 0xe9b5dba5);
	127	RNDr(S, W, 4, 0x3956c25b);
	128	RNDr(S, W, 5, 0x59f111f1);
	129	RNDr(S, W, 6, 0x923f82a4);
	130	RNDr(S, W, 7, 0xab1c5ed5);
	131	RNDr(S, W, 8, 0xd807aa98);
	132	RNDr(S, W, 9, 0x12835b01);
	133	RNDr(S, W, 10, 0x243185be);
	134	RNDr(S, W, 11, 0x550c7dc3);
	135	RNDr(S, W, 12, 0x72be5d74);
	136	RNDr(S, W, 13, 0x80deb1fe);
	137	RNDr(S, W, 14, 0x9bdc06a7);
	138	RNDr(S, W, 15, 0xc19bf174);
	139	RNDr(S, W, 16, 0xe49b69c1);
	140	RNDr(S, W, 17, 0xefbe4786);
	141	RNDr(S, W, 18, 0x0fc19dc6);
	142	RNDr(S, W, 19, 0x240ca1cc);
	143	RNDr(S, W, 20, 0x2de92c6f);
	144	RNDr(S, W, 21, 0x4a7484aa);
	145	RNDr(S, W, 22, 0x5cb0a9dc);
	146	RNDr(S, W, 23, 0x76f988da);
	147	RNDr(S, W, 24, 0x983e5152);
	148	RNDr(S, W, 25, 0xa831c66d);
	149	RNDr(S, W, 26, 0xb00327c8);
	150	RNDr(S, W, 27, 0xbf597fc7);
	151	RNDr(S, W, 28, 0xc6e00bf3);
	152	RNDr(S, W, 29, 0xd5a79147);
	153	RNDr(S, W, 30, 0x06ca6351);
	154	RNDr(S, W, 31, 0x14292967);
	155	RNDr(S, W, 32, 0x27b70a85);
	156	RNDr(S, W, 33, 0x2e1b2138);
	157	RNDr(S, W, 34, 0x4d2c6dfc);
	158	RNDr(S, W, 35, 0x53380d13);
	159	RNDr(S, W, 36, 0x650a7354);
	160	RNDr(S, W, 37, 0x766a0abb);
	161	RNDr(S, W, 38, 0x81c2c92e);
	162	RNDr(S, W, 39, 0x92722c85);
	163	RNDr(S, W, 40, 0xa2bfe8a1);
	164	RNDr(S, W, 41, 0xa81a664b);
	165	RNDr(S, W, 42, 0xc24b8b70);
	166	RNDr(S, W, 43, 0xc76c51a3);
	167	RNDr(S, W, 44, 0xd192e819);
	168	RNDr(S, W, 45, 0xd6990624);
	169	RNDr(S, W, 46, 0xf40e3585);
	170	RNDr(S, W, 47, 0x106aa070);
	171	RNDr(S, W, 48, 0x19a4c116);
	172	RNDr(S, W, 49, 0x1e376c08);
173	RNDr(S, W, 50, 0x2748774c);
174	RNDr(S, W, 51, 0x34b0bcb5);
175	RNDr(S, W, 52, 0x391c0cb3);
176	RNDr(S, W, 53, 0x4ed8aa4a);
177	RNDr(S, W, 54, 0x5b9cca4f);
178	RNDr(S, W, 55, 0x682e6ff3);
179	RNDr(S, W, 56, 0x748f82ee);
180	RNDr(S, W, 57, 0x78a5636f);
181	RNDr(S, W, 58, 0x84c87814);
182	RNDr(S, W, 59, 0x8cc70208);
183	RNDr(S, W, 60, 0x90befffa);
184	RNDr(S, W, 61, 0xa4506ceb);
185	RNDr(S, W, 62, 0xbef9a3f7);
186	RNDr(S, W, 63, 0xc67178f2);
187
188	/* 4. Mix local working variables into global state */
189	for (i = 0; i < 8; i++)
190	state[i] += S[i];
191
192	/* Clean the stack. */
193	memset(W, 0, 256);
194	memset(S, 0, 32);
7faf667a DS	195	memset(&t0, 0, sizeof(t0));
7faf667a DS	196	memset(&t1, 0, sizeof(t0));
7f57883e DS	197	}
	198
	199	static unsigned char PAD[64] = {
d62a17ae	200	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	201	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	202	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
7f57883e DS	203
7f57883e DS	204	/* Add padding and terminating bit-count. */
d62a17ae	205	static void SHA256_Pad(SHA256_CTX *ctx)
7f57883e	206	{
d62a17ae	207	unsigned char len[8];
	208	uint32_t r, plen;
	209
	210	/*
	211	* Convert length to a vector of bytes -- we do this now rather
	212	* than later because the length will change after we pad.
	213	*/
	214	be32enc_vect(len, ctx->count, 8);
	215
	216	/* Add 1--64 bytes so that the resulting length is 56 mod 64 */
	217	r = (ctx->count[1] >> 3) & 0x3f;
	218	plen = (r < 56) ? (56 - r) : (120 - r);
	219	SHA256_Update(ctx, PAD, (size_t)plen);
	220
	221	/* Add the terminating bit-count */
	222	SHA256_Update(ctx, len, 8);
7f57883e DS	223	}
	224
	225	/* SHA-256 initialization. Begins a SHA-256 operation. */
d62a17ae	226	void SHA256_Init(SHA256_CTX *ctx)
7f57883e DS	227	{
7f57883e DS	228
d62a17ae	229	/* Zero bits processed so far */
	230	ctx->count[0] = ctx->count[1] = 0;
	231
	232	/* Magic initialization constants */
	233	ctx->state[0] = 0x6A09E667;
	234	ctx->state[1] = 0xBB67AE85;
	235	ctx->state[2] = 0x3C6EF372;
	236	ctx->state[3] = 0xA54FF53A;
	237	ctx->state[4] = 0x510E527F;
	238	ctx->state[5] = 0x9B05688C;
	239	ctx->state[6] = 0x1F83D9AB;
	240	ctx->state[7] = 0x5BE0CD19;
7f57883e DS	241	}
	242
	243	/* Add bytes into the hash */
d62a17ae	244	void SHA256_Update(SHA256_CTX ctx, const void in, size_t len)
7f57883e	245	{
d62a17ae	246	uint32_t bitlen[2];
	247	uint32_t r;
	248	const unsigned char *src = in;
	249
	250	/* Number of bytes left in the buffer from previous updates */
	251	r = (ctx->count[1] >> 3) & 0x3f;
	252
	253	/* Convert the length into a number of bits */
	254	bitlen[1] = ((uint32_t)len) << 3;
	255	bitlen[0] = (uint32_t)(len >> 29);
	256
	257	/* Update number of bits */
	258	if ((ctx->count[1] += bitlen[1]) < bitlen[1])
	259	ctx->count[0]++;
	260	ctx->count[0] += bitlen[0];
	261
	262	/* Handle the case where we don't need to perform any transforms */
	263	if (len < 64 - r) {
	264	memcpy(&ctx->buf[r], src, len);
	265	return;
	266	}
	267
	268	/* Finish the current block */
	269	memcpy(&ctx->buf[r], src, 64 - r);
	270	SHA256_Transform(ctx->state, ctx->buf);
	271	src += 64 - r;
	272	len -= 64 - r;
	273
	274	/* Perform complete blocks */
	275	while (len >= 64) {
	276	SHA256_Transform(ctx->state, src);
	277	src += 64;
	278	len -= 64;
	279	}
	280
	281	/* Copy left over data into buffer */
	282	memcpy(ctx->buf, src, len);
7f57883e DS	283	}
	284
	285	/*
	286	* SHA-256 finalization. Pads the input data, exports the hash value,
	287	* and clears the context state.
	288	*/
d62a17ae	289	void SHA256_Final(unsigned char digest[32], SHA256_CTX *ctx)
7f57883e DS	290	{
7f57883e DS	291
d62a17ae	292	/* Add padding */
d62a17ae	293	SHA256_Pad(ctx);
7f57883e	294
d62a17ae	295	/* Write the hash */
d62a17ae	296	be32enc_vect(digest, ctx->state, 32);
7f57883e	297
d62a17ae	298	/* Clear the context state */
d62a17ae	299	memset((void )ctx, 0, sizeof(ctx));
7f57883e DS	300	}
	301
	302	/* Initialize an HMAC-SHA256 operation with the given key. */
d62a17ae	303	void HMAC__SHA256_Init(HMAC_SHA256_CTX ctx, const void _K, size_t Klen)
7f57883e	304	{
d62a17ae	305	unsigned char pad[64];
	306	unsigned char khash[32];
	307	const unsigned char *K = _K;
	308	size_t i;
	309
	310	/* If Klen > 64, the key is really SHA256(K). */
	311	if (Klen > 64) {
	312	SHA256_Init(&ctx->ictx);
	313	SHA256_Update(&ctx->ictx, K, Klen);
	314	SHA256_Final(khash, &ctx->ictx);
	315	K = khash;
	316	Klen = 32;
	317	}
	318
	319	/* Inner SHA256 operation is SHA256(K xor [block of 0x36] \|\| data). */
	320	SHA256_Init(&ctx->ictx);
	321	memset(pad, 0x36, 64);
	322	for (i = 0; i < Klen; i++)
	323	pad[i] ^= K[i];
	324	SHA256_Update(&ctx->ictx, pad, 64);
	325
	326	/* Outer SHA256 operation is SHA256(K xor [block of 0x5c] \|\| hash). */
	327	SHA256_Init(&ctx->octx);
	328	memset(pad, 0x5c, 64);
	329	for (i = 0; i < Klen; i++)
	330	pad[i] ^= K[i];
	331	SHA256_Update(&ctx->octx, pad, 64);
	332
	333	/* Clean the stack. */
	334	memset(khash, 0, 32);
7f57883e DS	335	}
	336
	337	/* Add bytes to the HMAC-SHA256 operation. */
d62a17ae	338	void HMAC__SHA256_Update(HMAC_SHA256_CTX ctx, const void in, size_t len)
7f57883e DS	339	{
7f57883e DS	340
d62a17ae	341	/* Feed data to the inner SHA256 operation. */
d62a17ae	342	SHA256_Update(&ctx->ictx, in, len);
7f57883e DS	343	}
	344
	345	/* Finish an HMAC-SHA256 operation. */
d62a17ae	346	void HMAC__SHA256_Final(unsigned char digest[32], HMAC_SHA256_CTX *ctx)
7f57883e	347	{
d62a17ae	348	unsigned char ihash[32];
7f57883e	349
d62a17ae	350	/* Finish the inner SHA256 operation. */
d62a17ae	351	SHA256_Final(ihash, &ctx->ictx);
7f57883e	352
d62a17ae	353	/* Feed the inner hash to the outer SHA256 operation. */
d62a17ae	354	SHA256_Update(&ctx->octx, ihash, 32);
7f57883e	355
d62a17ae	356	/* Finish the outer SHA256 operation. */
d62a17ae	357	SHA256_Final(digest, &ctx->octx);
7f57883e	358
d62a17ae	359	/* Clean the stack. */
d62a17ae	360	memset(ihash, 0, 32);
7f57883e DS	361	}
	362
	363	/**
	364	* PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
	365	* Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
	366	* write the output to buf. The value dkLen must be at most 32 * (2^32 - 1).
	367	*/
d62a17ae	368	void PBKDF2_SHA256(const uint8_t passwd, size_t passwdlen, const uint8_t salt,
d62a17ae	369	size_t saltlen, uint64_t c, uint8_t *buf, size_t dkLen)
7f57883e	370	{
d62a17ae	371	HMAC_SHA256_CTX PShctx, hctx;
	372	size_t i;
	373	uint8_t ivec[4];
	374	uint8_t U[32];
	375	uint8_t T[32];
	376	uint64_t j;
	377	int k;
	378	size_t clen;
	379
	380	/* Compute HMAC state after processing P and S. */
	381	HMAC__SHA256_Init(&PShctx, passwd, passwdlen);
	382	HMAC__SHA256_Update(&PShctx, salt, saltlen);
	383
	384	/* Iterate through the blocks. */
	385	for (i = 0; i * 32 < dkLen; i++) {
	386	/* Generate INT(i + 1). */
	387	be32enc(ivec, (uint32_t)(i + 1));
	388
	389	/* Compute U_1 = PRF(P, S \|\| INT(i)). */
	390	memcpy(&hctx, &PShctx, sizeof(HMAC_SHA256_CTX));
	391	HMAC__SHA256_Update(&hctx, ivec, 4);
	392	HMAC__SHA256_Final(U, &hctx);
	393
	394	/* T_i = U_1 ... */
	395	memcpy(T, U, 32);
	396
	397	for (j = 2; j <= c; j++) {
	398	/* Compute U_j. */
	399	HMAC__SHA256_Init(&hctx, passwd, passwdlen);
	400	HMAC__SHA256_Update(&hctx, U, 32);
	401	HMAC__SHA256_Final(U, &hctx);
	402
	403	/* ... xor U_j ... */
	404	for (k = 0; k < 32; k++)
	405	T[k] ^= U[k];
	406	}
	407
	408	/* Copy as many bytes as necessary into buf. */
	409	clen = dkLen - i * 32;
	410	if (clen > 32)
	411	clen = 32;
	412	memcpy(&buf[i * 32], T, clen);
	413	}
	414
	415	/* Clean PShctx, since we never called _Final on it. */
	416	memset(&PShctx, 0, sizeof(HMAC_SHA256_CTX));
7f57883e	417	}