diff options
Diffstat (limited to '')
-rw-r--r-- | src/lib/libcrypto/sha/asm/sha1-586.pl | 8 | ||||
-rw-r--r-- | src/lib/libcrypto/sha/asm/sha512-586.pl | 3 | ||||
-rw-r--r-- | src/lib/libcrypto/sha/sha1_aarch64.c | 34 | ||||
-rw-r--r-- | src/lib/libcrypto/sha/sha1_aarch64_ce.S | 214 | ||||
-rw-r--r-- | src/lib/libcrypto/sha/sha3.c | 77 | ||||
-rw-r--r-- | src/lib/libcrypto/sha/sha3_internal.h | 16 |
6 files changed, 297 insertions, 55 deletions
diff --git a/src/lib/libcrypto/sha/asm/sha1-586.pl b/src/lib/libcrypto/sha/asm/sha1-586.pl index 5928e083c1..d2491766f3 100644 --- a/src/lib/libcrypto/sha/asm/sha1-586.pl +++ b/src/lib/libcrypto/sha/asm/sha1-586.pl | |||
@@ -104,13 +104,7 @@ require "x86asm.pl"; | |||
104 | 104 | ||
105 | &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386"); | 105 | &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386"); |
106 | 106 | ||
107 | $xmm=$ymm=0; | 107 | $xmm=$ymm=1; |
108 | for (@ARGV) { $xmm=1 if (/-DOPENSSL_IA32_SSE2/); } | ||
109 | |||
110 | $ymm=1 if ($xmm && | ||
111 | `$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1` | ||
112 | =~ /GNU assembler version ([2-9]\.[0-9]+)/ && | ||
113 | $1>=2.19); # first version supporting AVX | ||
114 | 108 | ||
115 | &external_label("OPENSSL_ia32cap_P") if ($xmm); | 109 | &external_label("OPENSSL_ia32cap_P") if ($xmm); |
116 | 110 | ||
diff --git a/src/lib/libcrypto/sha/asm/sha512-586.pl b/src/lib/libcrypto/sha/asm/sha512-586.pl index c1d0684e92..fe1ff487bc 100644 --- a/src/lib/libcrypto/sha/asm/sha512-586.pl +++ b/src/lib/libcrypto/sha/asm/sha512-586.pl | |||
@@ -38,8 +38,7 @@ require "x86asm.pl"; | |||
38 | 38 | ||
39 | &asm_init($ARGV[0],"sha512-586.pl",$ARGV[$#ARGV] eq "386"); | 39 | &asm_init($ARGV[0],"sha512-586.pl",$ARGV[$#ARGV] eq "386"); |
40 | 40 | ||
41 | $sse2=0; | 41 | $sse2=1; |
42 | for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); } | ||
43 | 42 | ||
44 | &external_label("OPENSSL_ia32cap_P") if ($sse2); | 43 | &external_label("OPENSSL_ia32cap_P") if ($sse2); |
45 | 44 | ||
diff --git a/src/lib/libcrypto/sha/sha1_aarch64.c b/src/lib/libcrypto/sha/sha1_aarch64.c new file mode 100644 index 0000000000..04c87761e0 --- /dev/null +++ b/src/lib/libcrypto/sha/sha1_aarch64.c | |||
@@ -0,0 +1,34 @@ | |||
1 | /* $OpenBSD: sha1_aarch64.c,v 1.1 2025/06/28 12:51:08 jsing Exp $ */ | ||
2 | /* | ||
3 | * Copyright (c) 2025 Joel Sing <jsing@openbsd.org> | ||
4 | * | ||
5 | * Permission to use, copy, modify, and distribute this software for any | ||
6 | * purpose with or without fee is hereby granted, provided that the above | ||
7 | * copyright notice and this permission notice appear in all copies. | ||
8 | * | ||
9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
16 | */ | ||
17 | |||
18 | #include <openssl/sha.h> | ||
19 | |||
20 | #include "crypto_arch.h" | ||
21 | |||
22 | void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num); | ||
23 | void sha1_block_generic(SHA256_CTX *ctx, const void *in, size_t num); | ||
24 | |||
25 | void | ||
26 | sha1_block_data_order(SHA256_CTX *ctx, const void *in, size_t num) | ||
27 | { | ||
28 | if ((crypto_cpu_caps_aarch64 & CRYPTO_CPU_CAPS_AARCH64_SHA1) != 0) { | ||
29 | sha1_block_ce(ctx, in, num); | ||
30 | return; | ||
31 | } | ||
32 | |||
33 | sha1_block_generic(ctx, in, num); | ||
34 | } | ||
diff --git a/src/lib/libcrypto/sha/sha1_aarch64_ce.S b/src/lib/libcrypto/sha/sha1_aarch64_ce.S new file mode 100644 index 0000000000..8ccf230298 --- /dev/null +++ b/src/lib/libcrypto/sha/sha1_aarch64_ce.S | |||
@@ -0,0 +1,214 @@ | |||
1 | /* $OpenBSD: sha1_aarch64_ce.S,v 1.1 2025/06/28 12:51:08 jsing Exp $ */ | ||
2 | /* | ||
3 | * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org> | ||
4 | * | ||
5 | * Permission to use, copy, modify, and distribute this software for any | ||
6 | * purpose with or without fee is hereby granted, provided that the above | ||
7 | * copyright notice and this permission notice appear in all copies. | ||
8 | * | ||
9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
16 | */ | ||
17 | |||
18 | /* | ||
19 | * SHA-1 implementation using the ARM Cryptographic Extension (CE). | ||
20 | * | ||
21 | * There are six instructions for hardware acceleration of SHA-1 - the | ||
22 | * documentation for these instructions is woefully inadequate: | ||
23 | * | ||
24 | * sha1c: hash update (choose) | ||
25 | * sha1h: fixed rotate | ||
26 | * sha1m: hash update (majority) | ||
27 | * sha1p: hash update (parity) | ||
28 | * sha1su0: message schedule update with sigma0 for four rounds | ||
29 | * sha1su1: message schedule update with sigma1 for four rounds | ||
30 | */ | ||
31 | |||
32 | #define ctx x0 | ||
33 | #define in x1 | ||
34 | #define num x2 | ||
35 | |||
36 | /* Note: the lower 64 bits of v8 through v15 are callee saved. */ | ||
37 | |||
38 | #define hc0 v16 | ||
39 | #define hc1 v17 | ||
40 | #define hc1s s17 | ||
41 | |||
42 | #define hs0 v18 | ||
43 | #define hs1 v19 | ||
44 | #define hs1s s19 | ||
45 | |||
46 | #define w0 v20 | ||
47 | #define w1 v21 | ||
48 | #define w2 v22 | ||
49 | #define w3 v23 | ||
50 | |||
51 | #define k0 v24 | ||
52 | #define k1 v25 | ||
53 | #define k2 v26 | ||
54 | #define k3 v27 | ||
55 | |||
56 | #define tmp0 v28 | ||
57 | #define tmp1 s29 | ||
58 | |||
59 | #define tmp2 w11 | ||
60 | |||
61 | /* | ||
62 | * Update message schedule for m0 (W0:W1:W2:W3), using m1 (W4:W5:W6:W7), | ||
63 | * m2 (W8:W9:W10:11) and m3 (W12:W13:W14:W15). The sha1su0 instruction computes | ||
64 | * W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1). | ||
65 | */ | ||
66 | #define sha1_message_schedule_update(m0, m1, m2, m3) \ | ||
67 | sha1su0 m0.4s, m1.4s, m2.4s; \ | ||
68 | sha1su1 m0.4s, m3.4s; | ||
69 | |||
70 | /* | ||
71 | * Compute four SHA-1 rounds by adding W0:W1:W2:W3 + K0:K1:K2:K3, then | ||
72 | * computing the remainder of each round (including the shuffle) via | ||
73 | * sha1{c,p,m}/sha1h. | ||
74 | */ | ||
75 | |||
76 | #define sha1_round1(h0, h1, w, k) \ | ||
77 | add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ | ||
78 | mov tmp1, h0.s[0]; \ | ||
79 | sha1c h0, h1, tmp0.4s; \ | ||
80 | sha1h h1, tmp1; | ||
81 | |||
82 | #define sha1_round2(h0, h1, w, k) \ | ||
83 | add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ | ||
84 | mov tmp1, h0.s[0]; \ | ||
85 | sha1p h0, h1, tmp0.4s; \ | ||
86 | sha1h h1, tmp1; | ||
87 | |||
88 | #define sha1_round3(h0, h1, w, k) \ | ||
89 | add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ | ||
90 | mov tmp1, h0.s[0]; \ | ||
91 | sha1m h0, h1, tmp0.4s; \ | ||
92 | sha1h h1, tmp1; | ||
93 | |||
94 | #define sha1_round4(h0, h1, w, k) \ | ||
95 | add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ | ||
96 | mov tmp1, h0.s[0]; \ | ||
97 | sha1p h0, h1, tmp0.4s; \ | ||
98 | sha1h h1, tmp1; | ||
99 | |||
100 | .arch armv8-a+sha2 | ||
101 | |||
102 | .text | ||
103 | |||
104 | /* | ||
105 | * void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num); | ||
106 | * | ||
107 | * Standard ARM ABI: x0 = ctx, x1 = in, x2 = num | ||
108 | */ | ||
109 | .globl sha1_block_ce | ||
110 | .type sha1_block_ce,@function | ||
111 | sha1_block_ce: | ||
112 | |||
113 | /* | ||
114 | * Load SHA-1 round constants. | ||
115 | */ | ||
116 | |||
117 | /* Round 1 - 0x5a827999 */ | ||
118 | movz tmp2, #0x5a82, lsl #16 | ||
119 | movk tmp2, #0x7999 | ||
120 | dup k0.4s, tmp2 | ||
121 | |||
122 | /* Round 2 - 0x6ed9eba1 */ | ||
123 | movz tmp2, #0x6ed9, lsl #16 | ||
124 | movk tmp2, #0xeba1 | ||
125 | dup k1.4s, tmp2 | ||
126 | |||
127 | /* Round 3 - 0x8f1bbcdc */ | ||
128 | movz tmp2, #0x8f1b, lsl #16 | ||
129 | movk tmp2, #0xbcdc | ||
130 | dup k2.4s, tmp2 | ||
131 | |||
132 | /* Round 4 - 0xca62c1d6 */ | ||
133 | movz tmp2, #0xca62, lsl #16 | ||
134 | movk tmp2, #0xc1d6 | ||
135 | dup k3.4s, tmp2 | ||
136 | |||
137 | /* Load current hash state from context (hc0 = a:b:c:d, hc1 = e). */ | ||
138 | ld1 {hc0.4s}, [ctx] | ||
139 | ldr hc1s, [ctx, #(4*4)] | ||
140 | |||
141 | block_loop: | ||
142 | /* Copy current hash state. */ | ||
143 | mov hs0.4s, hc0.4s | ||
144 | mov hs1s, hc1.s[0] | ||
145 | |||
146 | /* Load and byte swap message schedule. */ | ||
147 | ld1 {w0.16b, w1.16b, w2.16b, w3.16b}, [in], #64 | ||
148 | rev32 w0.16b, w0.16b | ||
149 | rev32 w1.16b, w1.16b | ||
150 | rev32 w2.16b, w2.16b | ||
151 | rev32 w3.16b, w3.16b | ||
152 | |||
153 | /* Rounds 0 through 15 (four rounds at a time). */ | ||
154 | sha1_round1(hs0, hs1s, w0, k0) | ||
155 | sha1_round1(hs0, hs1s, w1, k0) | ||
156 | sha1_round1(hs0, hs1s, w2, k0) | ||
157 | sha1_round1(hs0, hs1s, w3, k0) | ||
158 | |||
159 | /* Rounds 16 through 31 (four rounds at a time). */ | ||
160 | sha1_message_schedule_update(w0, w1, w2, w3) | ||
161 | sha1_message_schedule_update(w1, w2, w3, w0) | ||
162 | sha1_message_schedule_update(w2, w3, w0, w1) | ||
163 | sha1_message_schedule_update(w3, w0, w1, w2) | ||
164 | |||
165 | sha1_round1(hs0, hs1s, w0, k0) | ||
166 | sha1_round2(hs0, hs1s, w1, k1) | ||
167 | sha1_round2(hs0, hs1s, w2, k1) | ||
168 | sha1_round2(hs0, hs1s, w3, k1) | ||
169 | |||
170 | /* Rounds 32 through 47 (four rounds at a time). */ | ||
171 | sha1_message_schedule_update(w0, w1, w2, w3) | ||
172 | sha1_message_schedule_update(w1, w2, w3, w0) | ||
173 | sha1_message_schedule_update(w2, w3, w0, w1) | ||
174 | sha1_message_schedule_update(w3, w0, w1, w2) | ||
175 | |||
176 | sha1_round2(hs0, hs1s, w0, k1) | ||
177 | sha1_round2(hs0, hs1s, w1, k1) | ||
178 | sha1_round3(hs0, hs1s, w2, k2) | ||
179 | sha1_round3(hs0, hs1s, w3, k2) | ||
180 | |||
181 | /* Rounds 48 through 63 (four rounds at a time). */ | ||
182 | sha1_message_schedule_update(w0, w1, w2, w3) | ||
183 | sha1_message_schedule_update(w1, w2, w3, w0) | ||
184 | sha1_message_schedule_update(w2, w3, w0, w1) | ||
185 | sha1_message_schedule_update(w3, w0, w1, w2) | ||
186 | |||
187 | sha1_round3(hs0, hs1s, w0, k2) | ||
188 | sha1_round3(hs0, hs1s, w1, k2) | ||
189 | sha1_round3(hs0, hs1s, w2, k2) | ||
190 | sha1_round4(hs0, hs1s, w3, k3) | ||
191 | |||
192 | /* Rounds 64 through 79 (four rounds at a time). */ | ||
193 | sha1_message_schedule_update(w0, w1, w2, w3) | ||
194 | sha1_message_schedule_update(w1, w2, w3, w0) | ||
195 | sha1_message_schedule_update(w2, w3, w0, w1) | ||
196 | sha1_message_schedule_update(w3, w0, w1, w2) | ||
197 | |||
198 | sha1_round4(hs0, hs1s, w0, k3) | ||
199 | sha1_round4(hs0, hs1s, w1, k3) | ||
200 | sha1_round4(hs0, hs1s, w2, k3) | ||
201 | sha1_round4(hs0, hs1s, w3, k3) | ||
202 | |||
203 | /* Add intermediate state to hash state. */ | ||
204 | add hc0.4s, hc0.4s, hs0.4s | ||
205 | add hc1.4s, hc1.4s, hs1.4s | ||
206 | |||
207 | sub num, num, #1 | ||
208 | cbnz num, block_loop | ||
209 | |||
210 | /* Store hash state to context. */ | ||
211 | st1 {hc0.4s}, [ctx] | ||
212 | str hc1s, [ctx, #(4*4)] | ||
213 | |||
214 | ret | ||
diff --git a/src/lib/libcrypto/sha/sha3.c b/src/lib/libcrypto/sha/sha3.c index 6a7196d582..fde0da94ff 100644 --- a/src/lib/libcrypto/sha/sha3.c +++ b/src/lib/libcrypto/sha/sha3.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sha3.c,v 1.16 2024/11/23 15:38:12 jsing Exp $ */ | 1 | /* $OpenBSD: sha3.c,v 1.20 2025/04/18 07:36:11 jsing Exp $ */ |
2 | /* | 2 | /* |
3 | * The MIT License (MIT) | 3 | * The MIT License (MIT) |
4 | * | 4 | * |
@@ -26,12 +26,11 @@ | |||
26 | #include <endian.h> | 26 | #include <endian.h> |
27 | #include <string.h> | 27 | #include <string.h> |
28 | 28 | ||
29 | #include "crypto_internal.h" | ||
29 | #include "sha3_internal.h" | 30 | #include "sha3_internal.h" |
30 | 31 | ||
31 | #define KECCAKF_ROUNDS 24 | 32 | #define KECCAKF_ROUNDS 24 |
32 | 33 | ||
33 | #define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y)))) | ||
34 | |||
35 | static const uint64_t sha3_keccakf_rndc[24] = { | 34 | static const uint64_t sha3_keccakf_rndc[24] = { |
36 | 0x0000000000000001, 0x0000000000008082, 0x800000000000808a, | 35 | 0x0000000000000001, 0x0000000000008082, 0x800000000000808a, |
37 | 0x8000000080008000, 0x000000000000808b, 0x0000000080000001, | 36 | 0x8000000080008000, 0x000000000000808b, 0x0000000080000001, |
@@ -54,7 +53,7 @@ static const int sha3_keccakf_piln[24] = { | |||
54 | static void | 53 | static void |
55 | sha3_keccakf(uint64_t st[25]) | 54 | sha3_keccakf(uint64_t st[25]) |
56 | { | 55 | { |
57 | uint64_t t, bc[5]; | 56 | uint64_t t0, t1, bc[5]; |
58 | int i, j, r; | 57 | int i, j, r; |
59 | 58 | ||
60 | for (i = 0; i < 25; i++) | 59 | for (i = 0; i < 25; i++) |
@@ -67,18 +66,18 @@ sha3_keccakf(uint64_t st[25]) | |||
67 | bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20]; | 66 | bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20]; |
68 | 67 | ||
69 | for (i = 0; i < 5; i++) { | 68 | for (i = 0; i < 5; i++) { |
70 | t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1); | 69 | t0 = bc[(i + 4) % 5] ^ crypto_rol_u64(bc[(i + 1) % 5], 1); |
71 | for (j = 0; j < 25; j += 5) | 70 | for (j = 0; j < 25; j += 5) |
72 | st[j + i] ^= t; | 71 | st[j + i] ^= t0; |
73 | } | 72 | } |
74 | 73 | ||
75 | /* Rho Pi */ | 74 | /* Rho Pi */ |
76 | t = st[1]; | 75 | t0 = st[1]; |
77 | for (i = 0; i < 24; i++) { | 76 | for (i = 0; i < 24; i++) { |
78 | j = sha3_keccakf_piln[i]; | 77 | j = sha3_keccakf_piln[i]; |
79 | bc[0] = st[j]; | 78 | t1 = st[j]; |
80 | st[j] = ROTL64(t, sha3_keccakf_rotc[i]); | 79 | st[j] = crypto_rol_u64(t0, sha3_keccakf_rotc[i]); |
81 | t = bc[0]; | 80 | t0 = t1; |
82 | } | 81 | } |
83 | 82 | ||
84 | /* Chi */ | 83 | /* Chi */ |
@@ -98,75 +97,77 @@ sha3_keccakf(uint64_t st[25]) | |||
98 | } | 97 | } |
99 | 98 | ||
100 | int | 99 | int |
101 | sha3_init(sha3_ctx *c, int mdlen) | 100 | sha3_init(sha3_ctx *ctx, int mdlen) |
102 | { | 101 | { |
103 | if (mdlen < 0 || mdlen >= KECCAK_BYTE_WIDTH / 2) | 102 | if (mdlen < 0 || mdlen >= KECCAK_BYTE_WIDTH / 2) |
104 | return 0; | 103 | return 0; |
105 | 104 | ||
106 | memset(c, 0, sizeof(*c)); | 105 | memset(ctx, 0, sizeof(*ctx)); |
107 | 106 | ||
108 | c->mdlen = mdlen; | 107 | ctx->mdlen = mdlen; |
109 | c->rsize = KECCAK_BYTE_WIDTH - 2 * mdlen; | 108 | ctx->rsize = KECCAK_BYTE_WIDTH - 2 * mdlen; |
110 | 109 | ||
111 | return 1; | 110 | return 1; |
112 | } | 111 | } |
113 | 112 | ||
114 | int | 113 | int |
115 | sha3_update(sha3_ctx *c, const void *data, size_t len) | 114 | sha3_update(sha3_ctx *ctx, const void *_data, size_t len) |
116 | { | 115 | { |
116 | const uint8_t *data = _data; | ||
117 | size_t i, j; | 117 | size_t i, j; |
118 | 118 | ||
119 | j = c->pt; | 119 | j = ctx->pt; |
120 | for (i = 0; i < len; i++) { | 120 | for (i = 0; i < len; i++) { |
121 | c->state.b[j++] ^= ((const uint8_t *) data)[i]; | 121 | ctx->state.b[j++] ^= data[i]; |
122 | if (j >= c->rsize) { | 122 | if (j >= ctx->rsize) { |
123 | sha3_keccakf(c->state.q); | 123 | sha3_keccakf(ctx->state.q); |
124 | j = 0; | 124 | j = 0; |
125 | } | 125 | } |
126 | } | 126 | } |
127 | c->pt = j; | 127 | ctx->pt = j; |
128 | 128 | ||
129 | return 1; | 129 | return 1; |
130 | } | 130 | } |
131 | 131 | ||
132 | int | 132 | int |
133 | sha3_final(void *md, sha3_ctx *c) | 133 | sha3_final(void *_md, sha3_ctx *ctx) |
134 | { | 134 | { |
135 | uint8_t *md = _md; | ||
135 | int i; | 136 | int i; |
136 | 137 | ||
137 | c->state.b[c->pt] ^= 0x06; | 138 | ctx->state.b[ctx->pt] ^= 0x06; |
138 | c->state.b[c->rsize - 1] ^= 0x80; | 139 | ctx->state.b[ctx->rsize - 1] ^= 0x80; |
139 | sha3_keccakf(c->state.q); | 140 | sha3_keccakf(ctx->state.q); |
140 | 141 | ||
141 | for (i = 0; i < c->mdlen; i++) { | 142 | for (i = 0; i < ctx->mdlen; i++) |
142 | ((uint8_t *) md)[i] = c->state.b[i]; | 143 | md[i] = ctx->state.b[i]; |
143 | } | ||
144 | 144 | ||
145 | return 1; | 145 | return 1; |
146 | } | 146 | } |
147 | 147 | ||
148 | /* SHAKE128 and SHAKE256 extensible-output functionality. */ | 148 | /* SHAKE128 and SHAKE256 extensible-output functionality. */ |
149 | void | 149 | void |
150 | shake_xof(sha3_ctx *c) | 150 | shake_xof(sha3_ctx *ctx) |
151 | { | 151 | { |
152 | c->state.b[c->pt] ^= 0x1F; | 152 | ctx->state.b[ctx->pt] ^= 0x1f; |
153 | c->state.b[c->rsize - 1] ^= 0x80; | 153 | ctx->state.b[ctx->rsize - 1] ^= 0x80; |
154 | sha3_keccakf(c->state.q); | 154 | sha3_keccakf(ctx->state.q); |
155 | c->pt = 0; | 155 | ctx->pt = 0; |
156 | } | 156 | } |
157 | 157 | ||
158 | void | 158 | void |
159 | shake_out(sha3_ctx *c, void *out, size_t len) | 159 | shake_out(sha3_ctx *ctx, void *_out, size_t len) |
160 | { | 160 | { |
161 | uint8_t *out = _out; | ||
161 | size_t i, j; | 162 | size_t i, j; |
162 | 163 | ||
163 | j = c->pt; | 164 | j = ctx->pt; |
164 | for (i = 0; i < len; i++) { | 165 | for (i = 0; i < len; i++) { |
165 | if (j >= c->rsize) { | 166 | if (j >= ctx->rsize) { |
166 | sha3_keccakf(c->state.q); | 167 | sha3_keccakf(ctx->state.q); |
167 | j = 0; | 168 | j = 0; |
168 | } | 169 | } |
169 | ((uint8_t *) out)[i] = c->state.b[j++]; | 170 | out[i] = ctx->state.b[j++]; |
170 | } | 171 | } |
171 | c->pt = j; | 172 | ctx->pt = j; |
172 | } | 173 | } |
diff --git a/src/lib/libcrypto/sha/sha3_internal.h b/src/lib/libcrypto/sha/sha3_internal.h index 53a4980c19..db09d06cc0 100644 --- a/src/lib/libcrypto/sha/sha3_internal.h +++ b/src/lib/libcrypto/sha/sha3_internal.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sha3_internal.h,v 1.15 2023/04/25 19:32:19 tb Exp $ */ | 1 | /* $OpenBSD: sha3_internal.h,v 1.16 2025/04/18 07:36:11 jsing Exp $ */ |
2 | /* | 2 | /* |
3 | * The MIT License (MIT) | 3 | * The MIT License (MIT) |
4 | * | 4 | * |
@@ -66,16 +66,16 @@ typedef struct sha3_ctx_st { | |||
66 | size_t mdlen; | 66 | size_t mdlen; |
67 | } sha3_ctx; | 67 | } sha3_ctx; |
68 | 68 | ||
69 | int sha3_init(sha3_ctx *c, int mdlen); | 69 | int sha3_init(sha3_ctx *ctx, int mdlen); |
70 | int sha3_update(sha3_ctx *c, const void *data, size_t len); | 70 | int sha3_update(sha3_ctx *ctx, const void *data, size_t len); |
71 | int sha3_final(void *md, sha3_ctx *c); | 71 | int sha3_final(void *md, sha3_ctx *ctx); |
72 | 72 | ||
73 | /* SHAKE128 and SHAKE256 extensible-output functions. */ | 73 | /* SHAKE128 and SHAKE256 extensible-output functions. */ |
74 | #define shake128_init(c) sha3_init(c, 16) | 74 | #define shake128_init(ctx) sha3_init((ctx), 16) |
75 | #define shake256_init(c) sha3_init(c, 32) | 75 | #define shake256_init(ctx) sha3_init((ctx), 32) |
76 | #define shake_update sha3_update | 76 | #define shake_update sha3_update |
77 | 77 | ||
78 | void shake_xof(sha3_ctx *c); | 78 | void shake_xof(sha3_ctx *ctx); |
79 | void shake_out(sha3_ctx *c, void *out, size_t len); | 79 | void shake_out(sha3_ctx *ctx, void *out, size_t len); |
80 | 80 | ||
81 | #endif | 81 | #endif |