summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
authorjsing <>2026-05-09 07:12:51 +0000
committerjsing <>2026-05-09 07:12:51 +0000
commit7f13830604735b607b5c5026364a13c0e2536bbc (patch)
tree7921b32453f7608cb1f64385df499b335957e35f /src/lib
parentc972ea47f3b19c39ca1608214558e6a934963752 (diff)
downloadopenbsd-7f13830604735b607b5c5026364a13c0e2536bbc.tar.gz
openbsd-7f13830604735b607b5c5026364a13c0e2536bbc.tar.bz2
openbsd-7f13830604735b607b5c5026364a13c0e2536bbc.zip
Use W rather than X for the SHA-256 message schedule.
This more closely matches the SHA-256 specification in FIPS 180-4. ok tb@
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/libcrypto/sha/sha256.c166
1 files changed, 83 insertions, 83 deletions
diff --git a/src/lib/libcrypto/sha/sha256.c b/src/lib/libcrypto/sha/sha256.c
index 984b084ca0..25911246d2 100644
--- a/src/lib/libcrypto/sha/sha256.c
+++ b/src/lib/libcrypto/sha/sha256.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha256.c,v 1.36 2026/05/09 07:11:05 jsing Exp $ */ 1/* $OpenBSD: sha256.c,v 1.37 2026/05/09 07:12:51 jsing Exp $ */
2/* ==================================================================== 2/* ====================================================================
3 * Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved. 3 * Copyright (c) 1998-2011 The OpenSSL Project. All rights reserved.
4 * 4 *
@@ -163,7 +163,7 @@ sha256_block_generic(SHA256_CTX *ctx, const void *_in, size_t num)
163 const uint8_t *in = _in; 163 const uint8_t *in = _in;
164 const SHA_LONG *in32; 164 const SHA_LONG *in32;
165 SHA_LONG a, b, c, d, e, f, g, h; 165 SHA_LONG a, b, c, d, e, f, g, h;
166 SHA_LONG X[16]; 166 SHA_LONG W[16];
167 int i; 167 int i;
168 168
169 while (num--) { 169 while (num--) {
@@ -179,94 +179,94 @@ sha256_block_generic(SHA256_CTX *ctx, const void *_in, size_t num)
179 if ((size_t)in % 4 == 0) { 179 if ((size_t)in % 4 == 0) {
180 /* Input is 32 bit aligned. */ 180 /* Input is 32 bit aligned. */
181 in32 = (const SHA_LONG *)in; 181 in32 = (const SHA_LONG *)in;
182 X[0] = be32toh(in32[0]); 182 W[0] = be32toh(in32[0]);
183 X[1] = be32toh(in32[1]); 183 W[1] = be32toh(in32[1]);
184 X[2] = be32toh(in32[2]); 184 W[2] = be32toh(in32[2]);
185 X[3] = be32toh(in32[3]); 185 W[3] = be32toh(in32[3]);
186 X[4] = be32toh(in32[4]); 186 W[4] = be32toh(in32[4]);
187 X[5] = be32toh(in32[5]); 187 W[5] = be32toh(in32[5]);
188 X[6] = be32toh(in32[6]); 188 W[6] = be32toh(in32[6]);
189 X[7] = be32toh(in32[7]); 189 W[7] = be32toh(in32[7]);
190 X[8] = be32toh(in32[8]); 190 W[8] = be32toh(in32[8]);
191 X[9] = be32toh(in32[9]); 191 W[9] = be32toh(in32[9]);
192 X[10] = be32toh(in32[10]); 192 W[10] = be32toh(in32[10]);
193 X[11] = be32toh(in32[11]); 193 W[11] = be32toh(in32[11]);
194 X[12] = be32toh(in32[12]); 194 W[12] = be32toh(in32[12]);
195 X[13] = be32toh(in32[13]); 195 W[13] = be32toh(in32[13]);
196 X[14] = be32toh(in32[14]); 196 W[14] = be32toh(in32[14]);
197 X[15] = be32toh(in32[15]); 197 W[15] = be32toh(in32[15]);
198 } else { 198 } else {
199 /* Input is not 32 bit aligned. */ 199 /* Input is not 32 bit aligned. */
200 X[0] = crypto_load_be32toh(&in[0 * 4]); 200 W[0] = crypto_load_be32toh(&in[0 * 4]);
201 X[1] = crypto_load_be32toh(&in[1 * 4]); 201 W[1] = crypto_load_be32toh(&in[1 * 4]);
202 X[2] = crypto_load_be32toh(&in[2 * 4]); 202 W[2] = crypto_load_be32toh(&in[2 * 4]);
203 X[3] = crypto_load_be32toh(&in[3 * 4]); 203 W[3] = crypto_load_be32toh(&in[3 * 4]);
204 X[4] = crypto_load_be32toh(&in[4 * 4]); 204 W[4] = crypto_load_be32toh(&in[4 * 4]);
205 X[5] = crypto_load_be32toh(&in[5 * 4]); 205 W[5] = crypto_load_be32toh(&in[5 * 4]);
206 X[6] = crypto_load_be32toh(&in[6 * 4]); 206 W[6] = crypto_load_be32toh(&in[6 * 4]);
207 X[7] = crypto_load_be32toh(&in[7 * 4]); 207 W[7] = crypto_load_be32toh(&in[7 * 4]);
208 X[8] = crypto_load_be32toh(&in[8 * 4]); 208 W[8] = crypto_load_be32toh(&in[8 * 4]);
209 X[9] = crypto_load_be32toh(&in[9 * 4]); 209 W[9] = crypto_load_be32toh(&in[9 * 4]);
210 X[10] = crypto_load_be32toh(&in[10 * 4]); 210 W[10] = crypto_load_be32toh(&in[10 * 4]);
211 X[11] = crypto_load_be32toh(&in[11 * 4]); 211 W[11] = crypto_load_be32toh(&in[11 * 4]);
212 X[12] = crypto_load_be32toh(&in[12 * 4]); 212 W[12] = crypto_load_be32toh(&in[12 * 4]);
213 X[13] = crypto_load_be32toh(&in[13 * 4]); 213 W[13] = crypto_load_be32toh(&in[13 * 4]);
214 X[14] = crypto_load_be32toh(&in[14 * 4]); 214 W[14] = crypto_load_be32toh(&in[14 * 4]);
215 X[15] = crypto_load_be32toh(&in[15 * 4]); 215 W[15] = crypto_load_be32toh(&in[15 * 4]);
216 } 216 }
217 in += SHA256_CBLOCK; 217 in += SHA256_CBLOCK;
218 218
219 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[0], X[0]); 219 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[0], W[0]);
220 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[1], X[1]); 220 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[1], W[1]);
221 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[2], X[2]); 221 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[2], W[2]);
222 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[3], X[3]); 222 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[3], W[3]);
223 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[4], X[4]); 223 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[4], W[4]);
224 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[5], X[5]); 224 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[5], W[5]);
225 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[6], X[6]); 225 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[6], W[6]);
226 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[7], X[7]); 226 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[7], W[7]);
227 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[8], X[8]); 227 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[8], W[8]);
228 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[9], X[9]); 228 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[9], W[9]);
229 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[10], X[10]); 229 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[10], W[10]);
230 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[11], X[11]); 230 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[11], W[11]);
231 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[12], X[12]); 231 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[12], W[12]);
232 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[13], X[13]); 232 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[13], W[13]);
233 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[14], X[14]); 233 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[14], W[14]);
234 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[15], X[15]); 234 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[15], W[15]);
235 235
236 for (i = 16; i < 64; i += 16) { 236 for (i = 16; i < 64; i += 16) {
237 sha256_msg_schedule_update(&X[0], X[1], X[9], X[14]); 237 sha256_msg_schedule_update(&W[0], W[1], W[9], W[14]);
238 sha256_msg_schedule_update(&X[1], X[2], X[10], X[15]); 238 sha256_msg_schedule_update(&W[1], W[2], W[10], W[15]);
239 sha256_msg_schedule_update(&X[2], X[3], X[11], X[0]); 239 sha256_msg_schedule_update(&W[2], W[3], W[11], W[0]);
240 sha256_msg_schedule_update(&X[3], X[4], X[12], X[1]); 240 sha256_msg_schedule_update(&W[3], W[4], W[12], W[1]);
241 sha256_msg_schedule_update(&X[4], X[5], X[13], X[2]); 241 sha256_msg_schedule_update(&W[4], W[5], W[13], W[2]);
242 sha256_msg_schedule_update(&X[5], X[6], X[14], X[3]); 242 sha256_msg_schedule_update(&W[5], W[6], W[14], W[3]);
243 sha256_msg_schedule_update(&X[6], X[7], X[15], X[4]); 243 sha256_msg_schedule_update(&W[6], W[7], W[15], W[4]);
244 sha256_msg_schedule_update(&X[7], X[8], X[0], X[5]); 244 sha256_msg_schedule_update(&W[7], W[8], W[0], W[5]);
245 sha256_msg_schedule_update(&X[8], X[9], X[1], X[6]); 245 sha256_msg_schedule_update(&W[8], W[9], W[1], W[6]);
246 sha256_msg_schedule_update(&X[9], X[10], X[2], X[7]); 246 sha256_msg_schedule_update(&W[9], W[10], W[2], W[7]);
247 sha256_msg_schedule_update(&X[10], X[11], X[3], X[8]); 247 sha256_msg_schedule_update(&W[10], W[11], W[3], W[8]);
248 sha256_msg_schedule_update(&X[11], X[12], X[4], X[9]); 248 sha256_msg_schedule_update(&W[11], W[12], W[4], W[9]);
249 sha256_msg_schedule_update(&X[12], X[13], X[5], X[10]); 249 sha256_msg_schedule_update(&W[12], W[13], W[5], W[10]);
250 sha256_msg_schedule_update(&X[13], X[14], X[6], X[11]); 250 sha256_msg_schedule_update(&W[13], W[14], W[6], W[11]);
251 sha256_msg_schedule_update(&X[14], X[15], X[7], X[12]); 251 sha256_msg_schedule_update(&W[14], W[15], W[7], W[12]);
252 sha256_msg_schedule_update(&X[15], X[0], X[8], X[13]); 252 sha256_msg_schedule_update(&W[15], W[0], W[8], W[13]);
253 253
254 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 0], X[0]); 254 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 0], W[0]);
255 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 1], X[1]); 255 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 1], W[1]);
256 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 2], X[2]); 256 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 2], W[2]);
257 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 3], X[3]); 257 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 3], W[3]);
258 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 4], X[4]); 258 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 4], W[4]);
259 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 5], X[5]); 259 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 5], W[5]);
260 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 6], X[6]); 260 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 6], W[6]);
261 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 7], X[7]); 261 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 7], W[7]);
262 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 8], X[8]); 262 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 8], W[8]);
263 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 9], X[9]); 263 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 9], W[9]);
264 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 10], X[10]); 264 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 10], W[10]);
265 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 11], X[11]); 265 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 11], W[11]);
266 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 12], X[12]); 266 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 12], W[12]);
267 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 13], X[13]); 267 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 13], W[13]);
268 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 14], X[14]); 268 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 14], W[14]);
269 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 15], X[15]); 269 sha256_round(&a, &b, &c, &d, &e, &f, &g, &h, K256[i + 15], W[15]);
270 } 270 }
271 271
272 ctx->h[0] += a; 272 ctx->h[0] += a;
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-06 08:28:17 +0000