1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
|
/* $OpenBSD: sha1_aarch64_ce.S,v 1.1 2025/06/28 12:51:08 jsing Exp $ */
/*
* Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/*
* SHA-1 implementation using the ARM Cryptographic Extension (CE).
*
* There are six instructions for hardware acceleration of SHA-1 - the
* documentation for these instructions is woefully inadequate:
*
* sha1c: hash update (choose)
* sha1h: fixed rotate
* sha1m: hash update (majority)
* sha1p: hash update (parity)
* sha1su0: message schedule update with sigma0 for four rounds
* sha1su1: message schedule update with sigma1 for four rounds
*/
#define ctx x0
#define in x1
#define num x2
/* Note: the lower 64 bits of v8 through v15 are callee saved. */
#define hc0 v16
#define hc1 v17
#define hc1s s17
#define hs0 v18
#define hs1 v19
#define hs1s s19
#define w0 v20
#define w1 v21
#define w2 v22
#define w3 v23
#define k0 v24
#define k1 v25
#define k2 v26
#define k3 v27
#define tmp0 v28
#define tmp1 s29
#define tmp2 w11
/*
* Update message schedule for m0 (W0:W1:W2:W3), using m1 (W4:W5:W6:W7),
* m2 (W8:W9:W10:11) and m3 (W12:W13:W14:W15). The sha1su0 instruction computes
* W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1).
*/
#define sha1_message_schedule_update(m0, m1, m2, m3) \
sha1su0 m0.4s, m1.4s, m2.4s; \
sha1su1 m0.4s, m3.4s;
/*
* Compute four SHA-1 rounds by adding W0:W1:W2:W3 + K0:K1:K2:K3, then
* computing the remainder of each round (including the shuffle) via
* sha1{c,p,m}/sha1h.
*/
#define sha1_round1(h0, h1, w, k) \
add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
mov tmp1, h0.s[0]; \
sha1c h0, h1, tmp0.4s; \
sha1h h1, tmp1;
#define sha1_round2(h0, h1, w, k) \
add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
mov tmp1, h0.s[0]; \
sha1p h0, h1, tmp0.4s; \
sha1h h1, tmp1;
#define sha1_round3(h0, h1, w, k) \
add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
mov tmp1, h0.s[0]; \
sha1m h0, h1, tmp0.4s; \
sha1h h1, tmp1;
#define sha1_round4(h0, h1, w, k) \
add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
mov tmp1, h0.s[0]; \
sha1p h0, h1, tmp0.4s; \
sha1h h1, tmp1;
.arch armv8-a+sha2
.text
/*
* void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
*
* Standard ARM ABI: x0 = ctx, x1 = in, x2 = num
*/
.globl sha1_block_ce
.type sha1_block_ce,@function
sha1_block_ce:
/*
* Load SHA-1 round constants.
*/
/* Round 1 - 0x5a827999 */
movz tmp2, #0x5a82, lsl #16
movk tmp2, #0x7999
dup k0.4s, tmp2
/* Round 2 - 0x6ed9eba1 */
movz tmp2, #0x6ed9, lsl #16
movk tmp2, #0xeba1
dup k1.4s, tmp2
/* Round 3 - 0x8f1bbcdc */
movz tmp2, #0x8f1b, lsl #16
movk tmp2, #0xbcdc
dup k2.4s, tmp2
/* Round 4 - 0xca62c1d6 */
movz tmp2, #0xca62, lsl #16
movk tmp2, #0xc1d6
dup k3.4s, tmp2
/* Load current hash state from context (hc0 = a:b:c:d, hc1 = e). */
ld1 {hc0.4s}, [ctx]
ldr hc1s, [ctx, #(4*4)]
block_loop:
/* Copy current hash state. */
mov hs0.4s, hc0.4s
mov hs1s, hc1.s[0]
/* Load and byte swap message schedule. */
ld1 {w0.16b, w1.16b, w2.16b, w3.16b}, [in], #64
rev32 w0.16b, w0.16b
rev32 w1.16b, w1.16b
rev32 w2.16b, w2.16b
rev32 w3.16b, w3.16b
/* Rounds 0 through 15 (four rounds at a time). */
sha1_round1(hs0, hs1s, w0, k0)
sha1_round1(hs0, hs1s, w1, k0)
sha1_round1(hs0, hs1s, w2, k0)
sha1_round1(hs0, hs1s, w3, k0)
/* Rounds 16 through 31 (four rounds at a time). */
sha1_message_schedule_update(w0, w1, w2, w3)
sha1_message_schedule_update(w1, w2, w3, w0)
sha1_message_schedule_update(w2, w3, w0, w1)
sha1_message_schedule_update(w3, w0, w1, w2)
sha1_round1(hs0, hs1s, w0, k0)
sha1_round2(hs0, hs1s, w1, k1)
sha1_round2(hs0, hs1s, w2, k1)
sha1_round2(hs0, hs1s, w3, k1)
/* Rounds 32 through 47 (four rounds at a time). */
sha1_message_schedule_update(w0, w1, w2, w3)
sha1_message_schedule_update(w1, w2, w3, w0)
sha1_message_schedule_update(w2, w3, w0, w1)
sha1_message_schedule_update(w3, w0, w1, w2)
sha1_round2(hs0, hs1s, w0, k1)
sha1_round2(hs0, hs1s, w1, k1)
sha1_round3(hs0, hs1s, w2, k2)
sha1_round3(hs0, hs1s, w3, k2)
/* Rounds 48 through 63 (four rounds at a time). */
sha1_message_schedule_update(w0, w1, w2, w3)
sha1_message_schedule_update(w1, w2, w3, w0)
sha1_message_schedule_update(w2, w3, w0, w1)
sha1_message_schedule_update(w3, w0, w1, w2)
sha1_round3(hs0, hs1s, w0, k2)
sha1_round3(hs0, hs1s, w1, k2)
sha1_round3(hs0, hs1s, w2, k2)
sha1_round4(hs0, hs1s, w3, k3)
/* Rounds 64 through 79 (four rounds at a time). */
sha1_message_schedule_update(w0, w1, w2, w3)
sha1_message_schedule_update(w1, w2, w3, w0)
sha1_message_schedule_update(w2, w3, w0, w1)
sha1_message_schedule_update(w3, w0, w1, w2)
sha1_round4(hs0, hs1s, w0, k3)
sha1_round4(hs0, hs1s, w1, k3)
sha1_round4(hs0, hs1s, w2, k3)
sha1_round4(hs0, hs1s, w3, k3)
/* Add intermediate state to hash state. */
add hc0.4s, hc0.4s, hs0.4s
add hc1.4s, hc1.4s, hs1.4s
sub num, num, #1
cbnz num, block_loop
/* Store hash state to context. */
st1 {hc0.4s}, [ctx]
str hc1s, [ctx, #(4*4)]
ret
|
