6 files changed, 297 insertions, 55 deletions

diff --git a/src/lib/libcrypto/sha/asm/sha1-586.pl b/src/lib/libcrypto/sha/asm/sha1-586.pl
index 5928e083c1..d2491766f3 100644
--- a/src/lib/libcrypto/sha/asm/sha1-586.pl
+++ b/src/lib/libcrypto/sha/asm/sha1-586.pl
@@ -104,13 +104,7 @@ require "x86asm.pl";
 
 &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386");
 
-$xmm=$ymm=0;
-for (@ARGV) { $xmm=1 if (/-DOPENSSL_IA32_SSE2/); }
-
-$ymm=1 if ($xmm &&
-                `$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
-                        =~ /GNU assembler version ([2-9]\.[0-9]+)/ &&
-                $1>=2.19);      # first version supporting AVX
+$xmm=$ymm=1;
 
 &external_label("OPENSSL_ia32cap_P") if ($xmm);
 
diff --git a/src/lib/libcrypto/sha/asm/sha512-586.pl b/src/lib/libcrypto/sha/asm/sha512-586.pl
index c1d0684e92..fe1ff487bc 100644
--- a/src/lib/libcrypto/sha/asm/sha512-586.pl
+++ b/src/lib/libcrypto/sha/asm/sha512-586.pl
@@ -38,8 +38,7 @@ require "x86asm.pl";
 
 &asm_init($ARGV[0],"sha512-586.pl",$ARGV[$#ARGV] eq "386");
 
-$sse2=0;
-for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
+$sse2=1;
 
 &external_label("OPENSSL_ia32cap_P") if ($sse2);
 
diff --git a/src/lib/libcrypto/sha/sha1_aarch64.c b/src/lib/libcrypto/sha/sha1_aarch64.c
new file mode 100644
index 0000000000..04c87761e0
--- /dev/null
+++ b/src/lib/libcrypto/sha/sha1_aarch64.c
@@ -0,0 +1,34 @@
+/* $OpenBSD: sha1_aarch64.c,v 1.1 2025/06/28 12:51:08 jsing Exp $ */
+/*
+ * Copyright (c) 2025 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <openssl/sha.h>
+
+#include "crypto_arch.h"
+
+void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
+void sha1_block_generic(SHA256_CTX *ctx, const void *in, size_t num);
+
+void
+sha1_block_data_order(SHA256_CTX *ctx, const void *in, size_t num)
+{
+        if ((crypto_cpu_caps_aarch64 & CRYPTO_CPU_CAPS_AARCH64_SHA1) != 0) {
+                sha1_block_ce(ctx, in, num);
+                return;
+        }
+
+        sha1_block_generic(ctx, in, num);
+}
diff --git a/src/lib/libcrypto/sha/sha1_aarch64_ce.S b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
new file mode 100644
index 0000000000..8ccf230298
--- /dev/null
+++ b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
@@ -0,0 +1,214 @@
+/* $OpenBSD: sha1_aarch64_ce.S,v 1.1 2025/06/28 12:51:08 jsing Exp $ */
+/*
+ * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * SHA-1 implementation using the ARM Cryptographic Extension (CE).
+ *
+ * There are six instructions for hardware acceleration of SHA-1 - the
+ * documentation for these instructions is woefully inadequate:
+ *
+ *  sha1c:   hash update (choose)
+ *  sha1h:   fixed rotate
+ *  sha1m:   hash update (majority)
+ *  sha1p:   hash update (parity)
+ *  sha1su0: message schedule update with sigma0 for four rounds
+ *  sha1su1: message schedule update with sigma1 for four rounds
+ */
+
+#define ctx             x0
+#define in              x1
+#define num             x2
+
+/* Note: the lower 64 bits of v8 through v15 are callee saved. */
+
+#define hc0             v16
+#define hc1             v17
+#define hc1s            s17
+
+#define hs0             v18
+#define hs1             v19
+#define hs1s            s19
+
+#define w0              v20
+#define w1              v21
+#define w2              v22
+#define w3              v23
+
+#define k0              v24
+#define k1              v25
+#define k2              v26
+#define k3              v27
+
+#define tmp0            v28
+#define tmp1            s29
+
+#define tmp2            w11
+
+/*
+ * Update message schedule for m0 (W0:W1:W2:W3), using m1 (W4:W5:W6:W7),
+ * m2 (W8:W9:W10:11) and m3 (W12:W13:W14:W15). The sha1su0 instruction computes
+ * W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1).
+ */
+#define sha1_message_schedule_update(m0, m1, m2, m3) \
+        sha1su0 m0.4s, m1.4s, m2.4s;                                    \
+        sha1su1 m0.4s, m3.4s;
+
+/*
+ * Compute four SHA-1 rounds by adding W0:W1:W2:W3 + K0:K1:K2:K3, then
+ * computing the remainder of each round (including the shuffle) via
+ * sha1{c,p,m}/sha1h.
+ */
+
+#define sha1_round1(h0, h1, w, k) \
+        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
+        mov     tmp1, h0.s[0];                                          \
+        sha1c   h0, h1, tmp0.4s;                                        \
+        sha1h   h1, tmp1;
+
+#define sha1_round2(h0, h1, w, k) \
+        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
+        mov     tmp1, h0.s[0];                                          \
+        sha1p   h0, h1, tmp0.4s;                                        \
+        sha1h   h1, tmp1;
+
+#define sha1_round3(h0, h1, w, k) \
+        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
+        mov     tmp1, h0.s[0];                                          \
+        sha1m   h0, h1, tmp0.4s;                                        \
+        sha1h   h1, tmp1;
+
+#define sha1_round4(h0, h1, w, k) \
+        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
+        mov     tmp1, h0.s[0];                                          \
+        sha1p   h0, h1, tmp0.4s;                                        \
+        sha1h   h1, tmp1;
+
+.arch   armv8-a+sha2
+
+.text
+
+/*
+ * void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
+ *
+ * Standard ARM ABI: x0 = ctx, x1 = in, x2 = num
+ */
+.globl  sha1_block_ce
+.type   sha1_block_ce,@function
+sha1_block_ce:
+
+        /*
+         * Load SHA-1 round constants.
+         */
+
+        /* Round 1 - 0x5a827999 */
+        movz    tmp2, #0x5a82, lsl #16
+        movk    tmp2, #0x7999
+        dup     k0.4s, tmp2
+
+        /* Round 2 - 0x6ed9eba1 */
+        movz    tmp2, #0x6ed9, lsl #16
+        movk    tmp2, #0xeba1
+        dup     k1.4s, tmp2
+
+        /* Round 3 - 0x8f1bbcdc */
+        movz    tmp2, #0x8f1b, lsl #16
+        movk    tmp2, #0xbcdc
+        dup     k2.4s, tmp2
+
+        /* Round 4 - 0xca62c1d6 */
+        movz    tmp2, #0xca62, lsl #16
+        movk    tmp2, #0xc1d6
+        dup     k3.4s, tmp2
+
+        /* Load current hash state from context (hc0 = a:b:c:d, hc1 = e). */
+        ld1     {hc0.4s}, [ctx]
+        ldr     hc1s, [ctx, #(4*4)]
+
+block_loop:
+        /* Copy current hash state. */
+        mov     hs0.4s, hc0.4s
+        mov     hs1s, hc1.s[0]
+
+        /* Load and byte swap message schedule. */
+        ld1     {w0.16b, w1.16b, w2.16b, w3.16b}, [in], #64
+        rev32   w0.16b, w0.16b
+        rev32   w1.16b, w1.16b
+        rev32   w2.16b, w2.16b
+        rev32   w3.16b, w3.16b
+
+        /* Rounds 0 through 15 (four rounds at a time). */
+        sha1_round1(hs0, hs1s, w0, k0)
+        sha1_round1(hs0, hs1s, w1, k0)
+        sha1_round1(hs0, hs1s, w2, k0)
+        sha1_round1(hs0, hs1s, w3, k0)
+
+        /* Rounds 16 through 31 (four rounds at a time). */
+        sha1_message_schedule_update(w0, w1, w2, w3)
+        sha1_message_schedule_update(w1, w2, w3, w0)
+        sha1_message_schedule_update(w2, w3, w0, w1)
+        sha1_message_schedule_update(w3, w0, w1, w2)
+
+        sha1_round1(hs0, hs1s, w0, k0)
+        sha1_round2(hs0, hs1s, w1, k1)
+        sha1_round2(hs0, hs1s, w2, k1)
+        sha1_round2(hs0, hs1s, w3, k1)
+
+        /* Rounds 32 through 47 (four rounds at a time). */
+        sha1_message_schedule_update(w0, w1, w2, w3)
+        sha1_message_schedule_update(w1, w2, w3, w0)
+        sha1_message_schedule_update(w2, w3, w0, w1)
+        sha1_message_schedule_update(w3, w0, w1, w2)
+
+        sha1_round2(hs0, hs1s, w0, k1)
+        sha1_round2(hs0, hs1s, w1, k1)
+        sha1_round3(hs0, hs1s, w2, k2)
+        sha1_round3(hs0, hs1s, w3, k2)
+
+        /* Rounds 48 through 63 (four rounds at a time). */
+        sha1_message_schedule_update(w0, w1, w2, w3)
+        sha1_message_schedule_update(w1, w2, w3, w0)
+        sha1_message_schedule_update(w2, w3, w0, w1)
+        sha1_message_schedule_update(w3, w0, w1, w2)
+
+        sha1_round3(hs0, hs1s, w0, k2)
+        sha1_round3(hs0, hs1s, w1, k2)
+        sha1_round3(hs0, hs1s, w2, k2)
+        sha1_round4(hs0, hs1s, w3, k3)
+
+        /* Rounds 64 through 79 (four rounds at a time). */
+        sha1_message_schedule_update(w0, w1, w2, w3)
+        sha1_message_schedule_update(w1, w2, w3, w0)
+        sha1_message_schedule_update(w2, w3, w0, w1)
+        sha1_message_schedule_update(w3, w0, w1, w2)
+
+        sha1_round4(hs0, hs1s, w0, k3)
+        sha1_round4(hs0, hs1s, w1, k3)
+        sha1_round4(hs0, hs1s, w2, k3)
+        sha1_round4(hs0, hs1s, w3, k3)
+
+        /* Add intermediate state to hash state. */
+        add     hc0.4s, hc0.4s, hs0.4s
+        add     hc1.4s, hc1.4s, hs1.4s
+
+        sub     num, num, #1
+        cbnz    num, block_loop
+
+        /* Store hash state to context. */
+        st1     {hc0.4s}, [ctx]
+        str     hc1s, [ctx, #(4*4)]
+
+        ret
diff --git a/src/lib/libcrypto/sha/sha3.c b/src/lib/libcrypto/sha/sha3.c
index 6a7196d582..fde0da94ff 100644
--- a/src/lib/libcrypto/sha/sha3.c
+++ b/src/lib/libcrypto/sha/sha3.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: sha3.c,v 1.16 2024/11/23 15:38:12 jsing Exp $ */
+/*      $OpenBSD: sha3.c,v 1.20 2025/04/18 07:36:11 jsing Exp $ */
 /*
  * The MIT License (MIT)
  *
@@ -26,12 +26,11 @@
 #include <endian.h>
 #include <string.h>
 
+#include "crypto_internal.h"
 #include "sha3_internal.h"
 
 #define KECCAKF_ROUNDS 24
 
-#define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
-
 static const uint64_t sha3_keccakf_rndc[24] = {
         0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
         0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
@@ -54,7 +53,7 @@ static const int sha3_keccakf_piln[24] = {
 static void
 sha3_keccakf(uint64_t st[25])
 {
-        uint64_t t, bc[5];
+        uint64_t t0, t1, bc[5];
         int i, j, r;
 
         for (i = 0; i < 25; i++)
@@ -67,18 +66,18 @@ sha3_keccakf(uint64_t st[25])
                         bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
 
                 for (i = 0; i < 5; i++) {
-                        t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
+                        t0 = bc[(i + 4) % 5] ^ crypto_rol_u64(bc[(i + 1) % 5], 1);
                         for (j = 0; j < 25; j += 5)
-                                st[j + i] ^= t;
+                                st[j + i] ^= t0;
                 }
 
                 /* Rho Pi */
-                t = st[1];
+                t0 = st[1];
                 for (i = 0; i < 24; i++) {
                         j = sha3_keccakf_piln[i];
-                        bc[0] = st[j];
-                        st[j] = ROTL64(t, sha3_keccakf_rotc[i]);
-                        t = bc[0];
+                        t1 = st[j];
+                        st[j] = crypto_rol_u64(t0, sha3_keccakf_rotc[i]);
+                        t0 = t1;
                 }
 
                 /* Chi */
@@ -98,75 +97,77 @@ sha3_keccakf(uint64_t st[25])
 }
 
 int
-sha3_init(sha3_ctx *c, int mdlen)
+sha3_init(sha3_ctx *ctx, int mdlen)
 {
         if (mdlen < 0 || mdlen >= KECCAK_BYTE_WIDTH / 2)
                 return 0;
 
-        memset(c, 0, sizeof(*c));
+        memset(ctx, 0, sizeof(*ctx));
 
-        c->mdlen = mdlen;
-        c->rsize = KECCAK_BYTE_WIDTH - 2 * mdlen;
+        ctx->mdlen = mdlen;
+        ctx->rsize = KECCAK_BYTE_WIDTH - 2 * mdlen;
 
         return 1;
 }
 
 int
-sha3_update(sha3_ctx *c, const void *data, size_t len)
+sha3_update(sha3_ctx *ctx, const void *_data, size_t len)
 {
+        const uint8_t *data = _data;
         size_t i, j;
 
-        j = c->pt;
+        j = ctx->pt;
         for (i = 0; i < len; i++) {
-                c->state.b[j++] ^= ((const uint8_t *) data)[i];
-                if (j >= c->rsize) {
-                        sha3_keccakf(c->state.q);
+                ctx->state.b[j++] ^= data[i];
+                if (j >= ctx->rsize) {
+                        sha3_keccakf(ctx->state.q);
                         j = 0;
                 }
         }
-        c->pt = j;
+        ctx->pt = j;
 
         return 1;
 }
 
 int
-sha3_final(void *md, sha3_ctx *c)
+sha3_final(void *_md, sha3_ctx *ctx)
 {
+        uint8_t *md = _md;
         int i;
 
-        c->state.b[c->pt] ^= 0x06;
-        c->state.b[c->rsize - 1] ^= 0x80;
-        sha3_keccakf(c->state.q);
+        ctx->state.b[ctx->pt] ^= 0x06;
+        ctx->state.b[ctx->rsize - 1] ^= 0x80;
+        sha3_keccakf(ctx->state.q);
 
-        for (i = 0; i < c->mdlen; i++) {
-                ((uint8_t *) md)[i] = c->state.b[i];
-        }
+        for (i = 0; i < ctx->mdlen; i++)
+                md[i] = ctx->state.b[i];
 
         return 1;
 }
 
 /* SHAKE128 and SHAKE256 extensible-output functionality. */
 void
-shake_xof(sha3_ctx *c)
+shake_xof(sha3_ctx *ctx)
 {
-        c->state.b[c->pt] ^= 0x1F;
-        c->state.b[c->rsize - 1] ^= 0x80;
-        sha3_keccakf(c->state.q);
-        c->pt = 0;
+        ctx->state.b[ctx->pt] ^= 0x1f;
+        ctx->state.b[ctx->rsize - 1] ^= 0x80;
+        sha3_keccakf(ctx->state.q);
+        ctx->pt = 0;
 }
 
 void
-shake_out(sha3_ctx *c, void *out, size_t len)
+shake_out(sha3_ctx *ctx, void *_out, size_t len)
 {
+        uint8_t *out = _out;
         size_t i, j;
 
-        j = c->pt;
+        j = ctx->pt;
         for (i = 0; i < len; i++) {
-                if (j >= c->rsize) {
-                        sha3_keccakf(c->state.q);
+                if (j >= ctx->rsize) {
+                        sha3_keccakf(ctx->state.q);
                         j = 0;
                 }
-                ((uint8_t *) out)[i] = c->state.b[j++];
+                out[i] = ctx->state.b[j++];
         }
-        c->pt = j;
+        ctx->pt = j;
 }
diff --git a/src/lib/libcrypto/sha/sha3_internal.h b/src/lib/libcrypto/sha/sha3_internal.h
index 53a4980c19..db09d06cc0 100644
--- a/src/lib/libcrypto/sha/sha3_internal.h
+++ b/src/lib/libcrypto/sha/sha3_internal.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: sha3_internal.h,v 1.15 2023/04/25 19:32:19 tb Exp $   */
+/*      $OpenBSD: sha3_internal.h,v 1.16 2025/04/18 07:36:11 jsing Exp $        */
 /*
  * The MIT License (MIT)
  *
@@ -66,16 +66,16 @@ typedef struct sha3_ctx_st {
         size_t mdlen;
 } sha3_ctx;
 
-int sha3_init(sha3_ctx *c, int mdlen);
-int sha3_update(sha3_ctx *c, const void *data, size_t len);
-int sha3_final(void *md, sha3_ctx *c);
+int sha3_init(sha3_ctx *ctx, int mdlen);
+int sha3_update(sha3_ctx *ctx, const void *data, size_t len);
+int sha3_final(void *md, sha3_ctx *ctx);
 
 /* SHAKE128 and SHAKE256 extensible-output functions. */
-#define shake128_init(c) sha3_init(c, 16)
-#define shake256_init(c) sha3_init(c, 32)
+#define shake128_init(ctx) sha3_init((ctx), 16)
+#define shake256_init(ctx) sha3_init((ctx), 32)
 #define shake_update sha3_update
 
-void shake_xof(sha3_ctx *c);
-void shake_out(sha3_ctx *c, void *out, size_t len);
+void shake_xof(sha3_ctx *ctx);
+void shake_out(sha3_ctx *ctx, void *out, size_t len);
 
 #endif