mirror of
https://github.com/python/cpython.git
synced 2025-10-31 05:31:20 +00:00
gh-99108: Import SHA2-384/512 from HACL* (#101707)
Replace the builtin hashlib implementations of SHA2-384 and SHA2-512 originally from LibTomCrypt with formally verified, side-channel resistant code from the [HACL*](https://github.com/hacl-star/hacl-star/) project. The builtins remain a fallback only used when OpenSSL does not provide them.
This commit is contained in:
Jonathan Protzenko
GitHub
parent
8be8101bca
commit
e5da9ab2c8
16 changed files with 1259 additions and 434 deletions
|
|
@ -2608,7 +2608,7 @@ MODULE__MD5_DEPS=$(srcdir)/Modules/hashlib.h
|
|||
MODULE__SHA1_DEPS=$(srcdir)/Modules/hashlib.h
|
||||
MODULE__SHA256_DEPS=$(srcdir)/Modules/hashlib.h $(srcdir)/Modules/_hacl/include/krml/FStar_UInt_8_16_32_64.h $(srcdir)/Modules/_hacl/include/krml/lowstar_endianness.h $(srcdir)/Modules/_hacl/include/krml/internal/target.h $(srcdir)/Modules/_hacl/Hacl_Streaming_SHA2.h
|
||||
MODULE__SHA3_DEPS=$(srcdir)/Modules/_sha3/sha3.c $(srcdir)/Modules/_sha3/sha3.h $(srcdir)/Modules/hashlib.h
|
||||
MODULE__SHA512_DEPS=$(srcdir)/Modules/hashlib.h
|
||||
MODULE__SHA512_DEPS=$(srcdir)/Modules/hashlib.h $(srcdir)/Modules/_hacl/include/krml/FStar_UInt_8_16_32_64.h $(srcdir)/Modules/_hacl/include/krml/lowstar_endianness.h $(srcdir)/Modules/_hacl/include/krml/internal/target.h $(srcdir)/Modules/_hacl/Hacl_Streaming_SHA2.h
|
||||
MODULE__SOCKET_DEPS=$(srcdir)/Modules/socketmodule.h $(srcdir)/Modules/addrinfo.h $(srcdir)/Modules/getaddrinfo.c $(srcdir)/Modules/getnameinfo.c
|
||||
MODULE__SSL_DEPS=$(srcdir)/Modules/_ssl.h $(srcdir)/Modules/_ssl/cert.c $(srcdir)/Modules/_ssl/debughelpers.c $(srcdir)/Modules/_ssl/misc.c $(srcdir)/Modules/_ssl_data.h $(srcdir)/Modules/_ssl_data_111.h $(srcdir)/Modules/_ssl_data_300.h $(srcdir)/Modules/socketmodule.h
|
||||
MODULE__TESTCAPI_DEPS=$(srcdir)/Modules/_testcapi/testcapi_long.h $(srcdir)/Modules/_testcapi/parts.h
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
Replace the builtin :mod:`hashlib` implementations of SHA2-384 and SHA2-512
|
||||
originally from LibTomCrypt with formally verified, side-channel resistant
|
||||
code from the `HACL* <https://github.com/hacl-star/hacl-star/>`_ project.
|
||||
The builtins remain a fallback only used when OpenSSL does not provide them.
|
||||
|
|
@ -80,7 +80,7 @@
|
|||
@MODULE__MD5_TRUE@_md5 md5module.c
|
||||
@MODULE__SHA1_TRUE@_sha1 sha1module.c
|
||||
@MODULE__SHA256_TRUE@_sha256 sha256module.c _hacl/Hacl_Streaming_SHA2.c
|
||||
@MODULE__SHA512_TRUE@_sha512 sha512module.c
|
||||
@MODULE__SHA512_TRUE@_sha512 sha512module.c _hacl/Hacl_Streaming_SHA2.c
|
||||
@MODULE__SHA3_TRUE@_sha3 _sha3/sha3module.c
|
||||
@MODULE__BLAKE2_TRUE@_blake2 _blake2/blake2module.c _blake2/blake2b_impl.c _blake2/blake2s_impl.c
|
||||
|
||||
|
|
|
|||
|
|
@ -250,6 +250,229 @@ static inline void sha224_finish(uint32_t *st, uint8_t *h)
|
|||
memcpy(h, hbuf, (uint32_t)28U * sizeof (uint8_t));
|
||||
}
|
||||
|
||||
void Hacl_SHA2_Scalar32_sha512_init(uint64_t *hash)
|
||||
{
|
||||
KRML_MAYBE_FOR8(i,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)8U,
|
||||
(uint32_t)1U,
|
||||
uint64_t *os = hash;
|
||||
uint64_t x = Hacl_Impl_SHA2_Generic_h512[i];
|
||||
os[i] = x;);
|
||||
}
|
||||
|
||||
static inline void sha512_update(uint8_t *b, uint64_t *hash)
|
||||
{
|
||||
uint64_t hash_old[8U] = { 0U };
|
||||
uint64_t ws[16U] = { 0U };
|
||||
memcpy(hash_old, hash, (uint32_t)8U * sizeof (uint64_t));
|
||||
uint8_t *b10 = b;
|
||||
uint64_t u = load64_be(b10);
|
||||
ws[0U] = u;
|
||||
uint64_t u0 = load64_be(b10 + (uint32_t)8U);
|
||||
ws[1U] = u0;
|
||||
uint64_t u1 = load64_be(b10 + (uint32_t)16U);
|
||||
ws[2U] = u1;
|
||||
uint64_t u2 = load64_be(b10 + (uint32_t)24U);
|
||||
ws[3U] = u2;
|
||||
uint64_t u3 = load64_be(b10 + (uint32_t)32U);
|
||||
ws[4U] = u3;
|
||||
uint64_t u4 = load64_be(b10 + (uint32_t)40U);
|
||||
ws[5U] = u4;
|
||||
uint64_t u5 = load64_be(b10 + (uint32_t)48U);
|
||||
ws[6U] = u5;
|
||||
uint64_t u6 = load64_be(b10 + (uint32_t)56U);
|
||||
ws[7U] = u6;
|
||||
uint64_t u7 = load64_be(b10 + (uint32_t)64U);
|
||||
ws[8U] = u7;
|
||||
uint64_t u8 = load64_be(b10 + (uint32_t)72U);
|
||||
ws[9U] = u8;
|
||||
uint64_t u9 = load64_be(b10 + (uint32_t)80U);
|
||||
ws[10U] = u9;
|
||||
uint64_t u10 = load64_be(b10 + (uint32_t)88U);
|
||||
ws[11U] = u10;
|
||||
uint64_t u11 = load64_be(b10 + (uint32_t)96U);
|
||||
ws[12U] = u11;
|
||||
uint64_t u12 = load64_be(b10 + (uint32_t)104U);
|
||||
ws[13U] = u12;
|
||||
uint64_t u13 = load64_be(b10 + (uint32_t)112U);
|
||||
ws[14U] = u13;
|
||||
uint64_t u14 = load64_be(b10 + (uint32_t)120U);
|
||||
ws[15U] = u14;
|
||||
KRML_MAYBE_FOR5(i0,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)5U,
|
||||
(uint32_t)1U,
|
||||
KRML_MAYBE_FOR16(i,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)16U,
|
||||
(uint32_t)1U,
|
||||
uint64_t k_t = Hacl_Impl_SHA2_Generic_k384_512[(uint32_t)16U * i0 + i];
|
||||
uint64_t ws_t = ws[i];
|
||||
uint64_t a0 = hash[0U];
|
||||
uint64_t b0 = hash[1U];
|
||||
uint64_t c0 = hash[2U];
|
||||
uint64_t d0 = hash[3U];
|
||||
uint64_t e0 = hash[4U];
|
||||
uint64_t f0 = hash[5U];
|
||||
uint64_t g0 = hash[6U];
|
||||
uint64_t h02 = hash[7U];
|
||||
uint64_t k_e_t = k_t;
|
||||
uint64_t
|
||||
t1 =
|
||||
h02
|
||||
+
|
||||
((e0 << (uint32_t)50U | e0 >> (uint32_t)14U)
|
||||
^
|
||||
((e0 << (uint32_t)46U | e0 >> (uint32_t)18U)
|
||||
^ (e0 << (uint32_t)23U | e0 >> (uint32_t)41U)))
|
||||
+ ((e0 & f0) ^ (~e0 & g0))
|
||||
+ k_e_t
|
||||
+ ws_t;
|
||||
uint64_t
|
||||
t2 =
|
||||
((a0 << (uint32_t)36U | a0 >> (uint32_t)28U)
|
||||
^
|
||||
((a0 << (uint32_t)30U | a0 >> (uint32_t)34U)
|
||||
^ (a0 << (uint32_t)25U | a0 >> (uint32_t)39U)))
|
||||
+ ((a0 & b0) ^ ((a0 & c0) ^ (b0 & c0)));
|
||||
uint64_t a1 = t1 + t2;
|
||||
uint64_t b1 = a0;
|
||||
uint64_t c1 = b0;
|
||||
uint64_t d1 = c0;
|
||||
uint64_t e1 = d0 + t1;
|
||||
uint64_t f1 = e0;
|
||||
uint64_t g1 = f0;
|
||||
uint64_t h12 = g0;
|
||||
hash[0U] = a1;
|
||||
hash[1U] = b1;
|
||||
hash[2U] = c1;
|
||||
hash[3U] = d1;
|
||||
hash[4U] = e1;
|
||||
hash[5U] = f1;
|
||||
hash[6U] = g1;
|
||||
hash[7U] = h12;);
|
||||
if (i0 < (uint32_t)4U)
|
||||
{
|
||||
KRML_MAYBE_FOR16(i,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)16U,
|
||||
(uint32_t)1U,
|
||||
uint64_t t16 = ws[i];
|
||||
uint64_t t15 = ws[(i + (uint32_t)1U) % (uint32_t)16U];
|
||||
uint64_t t7 = ws[(i + (uint32_t)9U) % (uint32_t)16U];
|
||||
uint64_t t2 = ws[(i + (uint32_t)14U) % (uint32_t)16U];
|
||||
uint64_t
|
||||
s1 =
|
||||
(t2 << (uint32_t)45U | t2 >> (uint32_t)19U)
|
||||
^ ((t2 << (uint32_t)3U | t2 >> (uint32_t)61U) ^ t2 >> (uint32_t)6U);
|
||||
uint64_t
|
||||
s0 =
|
||||
(t15 << (uint32_t)63U | t15 >> (uint32_t)1U)
|
||||
^ ((t15 << (uint32_t)56U | t15 >> (uint32_t)8U) ^ t15 >> (uint32_t)7U);
|
||||
ws[i] = s1 + t7 + s0 + t16;);
|
||||
});
|
||||
KRML_MAYBE_FOR8(i,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)8U,
|
||||
(uint32_t)1U,
|
||||
uint64_t *os = hash;
|
||||
uint64_t x = hash[i] + hash_old[i];
|
||||
os[i] = x;);
|
||||
}
|
||||
|
||||
static inline void sha512_update_nblocks(uint32_t len, uint8_t *b, uint64_t *st)
|
||||
{
|
||||
uint32_t blocks = len / (uint32_t)128U;
|
||||
for (uint32_t i = (uint32_t)0U; i < blocks; i++)
|
||||
{
|
||||
uint8_t *b0 = b;
|
||||
uint8_t *mb = b0 + i * (uint32_t)128U;
|
||||
sha512_update(mb, st);
|
||||
}
|
||||
}
|
||||
|
||||
static inline void
|
||||
sha512_update_last(FStar_UInt128_uint128 totlen, uint32_t len, uint8_t *b, uint64_t *hash)
|
||||
{
|
||||
uint32_t blocks;
|
||||
if (len + (uint32_t)16U + (uint32_t)1U <= (uint32_t)128U)
|
||||
{
|
||||
blocks = (uint32_t)1U;
|
||||
}
|
||||
else
|
||||
{
|
||||
blocks = (uint32_t)2U;
|
||||
}
|
||||
uint32_t fin = blocks * (uint32_t)128U;
|
||||
uint8_t last[256U] = { 0U };
|
||||
uint8_t totlen_buf[16U] = { 0U };
|
||||
FStar_UInt128_uint128 total_len_bits = FStar_UInt128_shift_left(totlen, (uint32_t)3U);
|
||||
store128_be(totlen_buf, total_len_bits);
|
||||
uint8_t *b0 = b;
|
||||
memcpy(last, b0, len * sizeof (uint8_t));
|
||||
last[len] = (uint8_t)0x80U;
|
||||
memcpy(last + fin - (uint32_t)16U, totlen_buf, (uint32_t)16U * sizeof (uint8_t));
|
||||
uint8_t *last00 = last;
|
||||
uint8_t *last10 = last + (uint32_t)128U;
|
||||
uint8_t *l0 = last00;
|
||||
uint8_t *l1 = last10;
|
||||
uint8_t *lb0 = l0;
|
||||
uint8_t *lb1 = l1;
|
||||
uint8_t *last0 = lb0;
|
||||
uint8_t *last1 = lb1;
|
||||
sha512_update(last0, hash);
|
||||
if (blocks > (uint32_t)1U)
|
||||
{
|
||||
sha512_update(last1, hash);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
static inline void sha512_finish(uint64_t *st, uint8_t *h)
|
||||
{
|
||||
uint8_t hbuf[64U] = { 0U };
|
||||
KRML_MAYBE_FOR8(i,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)8U,
|
||||
(uint32_t)1U,
|
||||
store64_be(hbuf + i * (uint32_t)8U, st[i]););
|
||||
memcpy(h, hbuf, (uint32_t)64U * sizeof (uint8_t));
|
||||
}
|
||||
|
||||
static inline void sha384_init(uint64_t *hash)
|
||||
{
|
||||
KRML_MAYBE_FOR8(i,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)8U,
|
||||
(uint32_t)1U,
|
||||
uint64_t *os = hash;
|
||||
uint64_t x = Hacl_Impl_SHA2_Generic_h384[i];
|
||||
os[i] = x;);
|
||||
}
|
||||
|
||||
static inline void sha384_update_nblocks(uint32_t len, uint8_t *b, uint64_t *st)
|
||||
{
|
||||
sha512_update_nblocks(len, b, st);
|
||||
}
|
||||
|
||||
static void
|
||||
sha384_update_last(FStar_UInt128_uint128 totlen, uint32_t len, uint8_t *b, uint64_t *st)
|
||||
{
|
||||
sha512_update_last(totlen, len, b, st);
|
||||
}
|
||||
|
||||
static inline void sha384_finish(uint64_t *st, uint8_t *h)
|
||||
{
|
||||
uint8_t hbuf[64U] = { 0U };
|
||||
KRML_MAYBE_FOR8(i,
|
||||
(uint32_t)0U,
|
||||
(uint32_t)8U,
|
||||
(uint32_t)1U,
|
||||
store64_be(hbuf + i * (uint32_t)8U, st[i]););
|
||||
memcpy(h, hbuf, (uint32_t)48U * sizeof (uint8_t));
|
||||
}
|
||||
|
||||
/**
|
||||
Allocate initial state for the SHA2_256 hash. The state is to be freed by
|
||||
calling `free_256`.
|
||||
|
|
@ -680,3 +903,434 @@ void Hacl_Streaming_SHA2_sha224(uint8_t *input, uint32_t input_len, uint8_t *dst
|
|||
sha224_finish(st, rb);
|
||||
}
|
||||
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *Hacl_Streaming_SHA2_create_in_512(void)
|
||||
{
|
||||
uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC((uint32_t)128U, sizeof (uint8_t));
|
||||
uint64_t *block_state = (uint64_t *)KRML_HOST_CALLOC((uint32_t)8U, sizeof (uint64_t));
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
s = { .block_state = block_state, .buf = buf, .total_len = (uint64_t)(uint32_t)0U };
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
*p =
|
||||
(Hacl_Streaming_SHA2_state_sha2_384 *)KRML_HOST_MALLOC(sizeof (
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
));
|
||||
p[0U] = s;
|
||||
Hacl_SHA2_Scalar32_sha512_init(block_state);
|
||||
return p;
|
||||
}
|
||||
|
||||
/**
|
||||
Copies the state passed as argument into a newly allocated state (deep copy).
|
||||
The state is to be freed by calling `free_512`. Cloning the state this way is
|
||||
useful, for instance, if your control-flow diverges and you need to feed
|
||||
more (different) data into the hash in each branch.
|
||||
*/
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
*Hacl_Streaming_SHA2_copy_512(Hacl_Streaming_SHA2_state_sha2_384 *s0)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 scrut = *s0;
|
||||
uint64_t *block_state0 = scrut.block_state;
|
||||
uint8_t *buf0 = scrut.buf;
|
||||
uint64_t total_len0 = scrut.total_len;
|
||||
uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC((uint32_t)128U, sizeof (uint8_t));
|
||||
memcpy(buf, buf0, (uint32_t)128U * sizeof (uint8_t));
|
||||
uint64_t *block_state = (uint64_t *)KRML_HOST_CALLOC((uint32_t)8U, sizeof (uint64_t));
|
||||
memcpy(block_state, block_state0, (uint32_t)8U * sizeof (uint64_t));
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
s = { .block_state = block_state, .buf = buf, .total_len = total_len0 };
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
*p =
|
||||
(Hacl_Streaming_SHA2_state_sha2_384 *)KRML_HOST_MALLOC(sizeof (
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
));
|
||||
p[0U] = s;
|
||||
return p;
|
||||
}
|
||||
|
||||
void Hacl_Streaming_SHA2_init_512(Hacl_Streaming_SHA2_state_sha2_384 *s)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 scrut = *s;
|
||||
uint8_t *buf = scrut.buf;
|
||||
uint64_t *block_state = scrut.block_state;
|
||||
Hacl_SHA2_Scalar32_sha512_init(block_state);
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
tmp = { .block_state = block_state, .buf = buf, .total_len = (uint64_t)(uint32_t)0U };
|
||||
s[0U] = tmp;
|
||||
}
|
||||
|
||||
static inline uint32_t
|
||||
update_384_512(Hacl_Streaming_SHA2_state_sha2_384 *p, uint8_t *data, uint32_t len)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 s = *p;
|
||||
uint64_t total_len = s.total_len;
|
||||
if ((uint64_t)len > (uint64_t)18446744073709551615U - total_len)
|
||||
{
|
||||
return (uint32_t)1U;
|
||||
}
|
||||
uint32_t sz;
|
||||
if (total_len % (uint64_t)(uint32_t)128U == (uint64_t)0U && total_len > (uint64_t)0U)
|
||||
{
|
||||
sz = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
sz = (uint32_t)(total_len % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
if (len <= (uint32_t)128U - sz)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 s1 = *p;
|
||||
uint64_t *block_state1 = s1.block_state;
|
||||
uint8_t *buf = s1.buf;
|
||||
uint64_t total_len1 = s1.total_len;
|
||||
uint32_t sz1;
|
||||
if (total_len1 % (uint64_t)(uint32_t)128U == (uint64_t)0U && total_len1 > (uint64_t)0U)
|
||||
{
|
||||
sz1 = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
sz1 = (uint32_t)(total_len1 % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
uint8_t *buf2 = buf + sz1;
|
||||
memcpy(buf2, data, len * sizeof (uint8_t));
|
||||
uint64_t total_len2 = total_len1 + (uint64_t)len;
|
||||
*p
|
||||
=
|
||||
(
|
||||
(Hacl_Streaming_SHA2_state_sha2_384){
|
||||
.block_state = block_state1,
|
||||
.buf = buf,
|
||||
.total_len = total_len2
|
||||
}
|
||||
);
|
||||
}
|
||||
else if (sz == (uint32_t)0U)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 s1 = *p;
|
||||
uint64_t *block_state1 = s1.block_state;
|
||||
uint8_t *buf = s1.buf;
|
||||
uint64_t total_len1 = s1.total_len;
|
||||
uint32_t sz1;
|
||||
if (total_len1 % (uint64_t)(uint32_t)128U == (uint64_t)0U && total_len1 > (uint64_t)0U)
|
||||
{
|
||||
sz1 = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
sz1 = (uint32_t)(total_len1 % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
if (!(sz1 == (uint32_t)0U))
|
||||
{
|
||||
sha512_update_nblocks((uint32_t)128U, buf, block_state1);
|
||||
}
|
||||
uint32_t ite;
|
||||
if ((uint64_t)len % (uint64_t)(uint32_t)128U == (uint64_t)0U && (uint64_t)len > (uint64_t)0U)
|
||||
{
|
||||
ite = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
ite = (uint32_t)((uint64_t)len % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
uint32_t n_blocks = (len - ite) / (uint32_t)128U;
|
||||
uint32_t data1_len = n_blocks * (uint32_t)128U;
|
||||
uint32_t data2_len = len - data1_len;
|
||||
uint8_t *data1 = data;
|
||||
uint8_t *data2 = data + data1_len;
|
||||
sha512_update_nblocks(data1_len, data1, block_state1);
|
||||
uint8_t *dst = buf;
|
||||
memcpy(dst, data2, data2_len * sizeof (uint8_t));
|
||||
*p
|
||||
=
|
||||
(
|
||||
(Hacl_Streaming_SHA2_state_sha2_384){
|
||||
.block_state = block_state1,
|
||||
.buf = buf,
|
||||
.total_len = total_len1 + (uint64_t)len
|
||||
}
|
||||
);
|
||||
}
|
||||
else
|
||||
{
|
||||
uint32_t diff = (uint32_t)128U - sz;
|
||||
uint8_t *data1 = data;
|
||||
uint8_t *data2 = data + diff;
|
||||
Hacl_Streaming_SHA2_state_sha2_384 s1 = *p;
|
||||
uint64_t *block_state10 = s1.block_state;
|
||||
uint8_t *buf0 = s1.buf;
|
||||
uint64_t total_len10 = s1.total_len;
|
||||
uint32_t sz10;
|
||||
if (total_len10 % (uint64_t)(uint32_t)128U == (uint64_t)0U && total_len10 > (uint64_t)0U)
|
||||
{
|
||||
sz10 = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
sz10 = (uint32_t)(total_len10 % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
uint8_t *buf2 = buf0 + sz10;
|
||||
memcpy(buf2, data1, diff * sizeof (uint8_t));
|
||||
uint64_t total_len2 = total_len10 + (uint64_t)diff;
|
||||
*p
|
||||
=
|
||||
(
|
||||
(Hacl_Streaming_SHA2_state_sha2_384){
|
||||
.block_state = block_state10,
|
||||
.buf = buf0,
|
||||
.total_len = total_len2
|
||||
}
|
||||
);
|
||||
Hacl_Streaming_SHA2_state_sha2_384 s10 = *p;
|
||||
uint64_t *block_state1 = s10.block_state;
|
||||
uint8_t *buf = s10.buf;
|
||||
uint64_t total_len1 = s10.total_len;
|
||||
uint32_t sz1;
|
||||
if (total_len1 % (uint64_t)(uint32_t)128U == (uint64_t)0U && total_len1 > (uint64_t)0U)
|
||||
{
|
||||
sz1 = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
sz1 = (uint32_t)(total_len1 % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
if (!(sz1 == (uint32_t)0U))
|
||||
{
|
||||
sha512_update_nblocks((uint32_t)128U, buf, block_state1);
|
||||
}
|
||||
uint32_t ite;
|
||||
if
|
||||
(
|
||||
(uint64_t)(len - diff)
|
||||
% (uint64_t)(uint32_t)128U
|
||||
== (uint64_t)0U
|
||||
&& (uint64_t)(len - diff) > (uint64_t)0U
|
||||
)
|
||||
{
|
||||
ite = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
ite = (uint32_t)((uint64_t)(len - diff) % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
uint32_t n_blocks = (len - diff - ite) / (uint32_t)128U;
|
||||
uint32_t data1_len = n_blocks * (uint32_t)128U;
|
||||
uint32_t data2_len = len - diff - data1_len;
|
||||
uint8_t *data11 = data2;
|
||||
uint8_t *data21 = data2 + data1_len;
|
||||
sha512_update_nblocks(data1_len, data11, block_state1);
|
||||
uint8_t *dst = buf;
|
||||
memcpy(dst, data21, data2_len * sizeof (uint8_t));
|
||||
*p
|
||||
=
|
||||
(
|
||||
(Hacl_Streaming_SHA2_state_sha2_384){
|
||||
.block_state = block_state1,
|
||||
.buf = buf,
|
||||
.total_len = total_len1 + (uint64_t)(len - diff)
|
||||
}
|
||||
);
|
||||
}
|
||||
return (uint32_t)0U;
|
||||
}
|
||||
|
||||
/**
|
||||
Feed an arbitrary amount of data into the hash. This function returns 0 for
|
||||
success, or 1 if the combined length of all of the data passed to `update_512`
|
||||
(since the last call to `init_512`) exceeds 2^125-1 bytes.
|
||||
|
||||
This function is identical to the update function for SHA2_384.
|
||||
*/
|
||||
uint32_t
|
||||
Hacl_Streaming_SHA2_update_512(
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *p,
|
||||
uint8_t *input,
|
||||
uint32_t input_len
|
||||
)
|
||||
{
|
||||
return update_384_512(p, input, input_len);
|
||||
}
|
||||
|
||||
/**
|
||||
Write the resulting hash into `dst`, an array of 64 bytes. The state remains
|
||||
valid after a call to `finish_512`, meaning the user may feed more data into
|
||||
the hash via `update_512`. (The finish_512 function operates on an internal copy of
|
||||
the state and therefore does not invalidate the client-held state `p`.)
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_finish_512(Hacl_Streaming_SHA2_state_sha2_384 *p, uint8_t *dst)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 scrut = *p;
|
||||
uint64_t *block_state = scrut.block_state;
|
||||
uint8_t *buf_ = scrut.buf;
|
||||
uint64_t total_len = scrut.total_len;
|
||||
uint32_t r;
|
||||
if (total_len % (uint64_t)(uint32_t)128U == (uint64_t)0U && total_len > (uint64_t)0U)
|
||||
{
|
||||
r = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
r = (uint32_t)(total_len % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
uint8_t *buf_1 = buf_;
|
||||
uint64_t tmp_block_state[8U] = { 0U };
|
||||
memcpy(tmp_block_state, block_state, (uint32_t)8U * sizeof (uint64_t));
|
||||
uint32_t ite;
|
||||
if (r % (uint32_t)128U == (uint32_t)0U && r > (uint32_t)0U)
|
||||
{
|
||||
ite = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
ite = r % (uint32_t)128U;
|
||||
}
|
||||
uint8_t *buf_last = buf_1 + r - ite;
|
||||
uint8_t *buf_multi = buf_1;
|
||||
sha512_update_nblocks((uint32_t)0U, buf_multi, tmp_block_state);
|
||||
uint64_t prev_len_last = total_len - (uint64_t)r;
|
||||
sha512_update_last(FStar_UInt128_add(FStar_UInt128_uint64_to_uint128(prev_len_last),
|
||||
FStar_UInt128_uint64_to_uint128((uint64_t)r)),
|
||||
r,
|
||||
buf_last,
|
||||
tmp_block_state);
|
||||
sha512_finish(tmp_block_state, dst);
|
||||
}
|
||||
|
||||
/**
|
||||
Free a state allocated with `create_in_512`.
|
||||
|
||||
This function is identical to the free function for SHA2_384.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_free_512(Hacl_Streaming_SHA2_state_sha2_384 *s)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 scrut = *s;
|
||||
uint8_t *buf = scrut.buf;
|
||||
uint64_t *block_state = scrut.block_state;
|
||||
KRML_HOST_FREE(block_state);
|
||||
KRML_HOST_FREE(buf);
|
||||
KRML_HOST_FREE(s);
|
||||
}
|
||||
|
||||
/**
|
||||
Hash `input`, of len `input_len`, into `dst`, an array of 64 bytes.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_sha512(uint8_t *input, uint32_t input_len, uint8_t *dst)
|
||||
{
|
||||
uint8_t *ib = input;
|
||||
uint8_t *rb = dst;
|
||||
uint64_t st[8U] = { 0U };
|
||||
Hacl_SHA2_Scalar32_sha512_init(st);
|
||||
uint32_t rem = input_len % (uint32_t)128U;
|
||||
FStar_UInt128_uint128 len_ = FStar_UInt128_uint64_to_uint128((uint64_t)input_len);
|
||||
sha512_update_nblocks(input_len, ib, st);
|
||||
uint32_t rem1 = input_len % (uint32_t)128U;
|
||||
uint8_t *b0 = ib;
|
||||
uint8_t *lb = b0 + input_len - rem1;
|
||||
sha512_update_last(len_, rem, lb, st);
|
||||
sha512_finish(st, rb);
|
||||
}
|
||||
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *Hacl_Streaming_SHA2_create_in_384(void)
|
||||
{
|
||||
uint8_t *buf = (uint8_t *)KRML_HOST_CALLOC((uint32_t)128U, sizeof (uint8_t));
|
||||
uint64_t *block_state = (uint64_t *)KRML_HOST_CALLOC((uint32_t)8U, sizeof (uint64_t));
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
s = { .block_state = block_state, .buf = buf, .total_len = (uint64_t)(uint32_t)0U };
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
*p =
|
||||
(Hacl_Streaming_SHA2_state_sha2_384 *)KRML_HOST_MALLOC(sizeof (
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
));
|
||||
p[0U] = s;
|
||||
sha384_init(block_state);
|
||||
return p;
|
||||
}
|
||||
|
||||
void Hacl_Streaming_SHA2_init_384(Hacl_Streaming_SHA2_state_sha2_384 *s)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 scrut = *s;
|
||||
uint8_t *buf = scrut.buf;
|
||||
uint64_t *block_state = scrut.block_state;
|
||||
sha384_init(block_state);
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
tmp = { .block_state = block_state, .buf = buf, .total_len = (uint64_t)(uint32_t)0U };
|
||||
s[0U] = tmp;
|
||||
}
|
||||
|
||||
uint32_t
|
||||
Hacl_Streaming_SHA2_update_384(
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *p,
|
||||
uint8_t *input,
|
||||
uint32_t input_len
|
||||
)
|
||||
{
|
||||
return update_384_512(p, input, input_len);
|
||||
}
|
||||
|
||||
/**
|
||||
Write the resulting hash into `dst`, an array of 48 bytes. The state remains
|
||||
valid after a call to `finish_384`, meaning the user may feed more data into
|
||||
the hash via `update_384`.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_finish_384(Hacl_Streaming_SHA2_state_sha2_384 *p, uint8_t *dst)
|
||||
{
|
||||
Hacl_Streaming_SHA2_state_sha2_384 scrut = *p;
|
||||
uint64_t *block_state = scrut.block_state;
|
||||
uint8_t *buf_ = scrut.buf;
|
||||
uint64_t total_len = scrut.total_len;
|
||||
uint32_t r;
|
||||
if (total_len % (uint64_t)(uint32_t)128U == (uint64_t)0U && total_len > (uint64_t)0U)
|
||||
{
|
||||
r = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
r = (uint32_t)(total_len % (uint64_t)(uint32_t)128U);
|
||||
}
|
||||
uint8_t *buf_1 = buf_;
|
||||
uint64_t tmp_block_state[8U] = { 0U };
|
||||
memcpy(tmp_block_state, block_state, (uint32_t)8U * sizeof (uint64_t));
|
||||
uint32_t ite;
|
||||
if (r % (uint32_t)128U == (uint32_t)0U && r > (uint32_t)0U)
|
||||
{
|
||||
ite = (uint32_t)128U;
|
||||
}
|
||||
else
|
||||
{
|
||||
ite = r % (uint32_t)128U;
|
||||
}
|
||||
uint8_t *buf_last = buf_1 + r - ite;
|
||||
uint8_t *buf_multi = buf_1;
|
||||
sha384_update_nblocks((uint32_t)0U, buf_multi, tmp_block_state);
|
||||
uint64_t prev_len_last = total_len - (uint64_t)r;
|
||||
sha384_update_last(FStar_UInt128_add(FStar_UInt128_uint64_to_uint128(prev_len_last),
|
||||
FStar_UInt128_uint64_to_uint128((uint64_t)r)),
|
||||
r,
|
||||
buf_last,
|
||||
tmp_block_state);
|
||||
sha384_finish(tmp_block_state, dst);
|
||||
}
|
||||
|
||||
void Hacl_Streaming_SHA2_free_384(Hacl_Streaming_SHA2_state_sha2_384 *p)
|
||||
{
|
||||
Hacl_Streaming_SHA2_free_512(p);
|
||||
}
|
||||
|
||||
/**
|
||||
Hash `input`, of len `input_len`, into `dst`, an array of 48 bytes.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_sha384(uint8_t *input, uint32_t input_len, uint8_t *dst)
|
||||
{
|
||||
uint8_t *ib = input;
|
||||
uint8_t *rb = dst;
|
||||
uint64_t st[8U] = { 0U };
|
||||
sha384_init(st);
|
||||
uint32_t rem = input_len % (uint32_t)128U;
|
||||
FStar_UInt128_uint128 len_ = FStar_UInt128_uint64_to_uint128((uint64_t)input_len);
|
||||
sha384_update_nblocks(input_len, ib, st);
|
||||
uint32_t rem1 = input_len % (uint32_t)128U;
|
||||
uint8_t *b0 = ib;
|
||||
uint8_t *lb = b0 + input_len - rem1;
|
||||
sha384_update_last(len_, rem, lb, st);
|
||||
sha384_finish(st, rb);
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -32,13 +32,12 @@ extern "C" {
|
|||
|
||||
#include <string.h>
|
||||
#include "python_hacl_namespaces.h"
|
||||
#include "krml/FStar_UInt_8_16_32_64.h"
|
||||
#include "krml/types.h"
|
||||
#include "krml/lowstar_endianness.h"
|
||||
#include "krml/internal/target.h"
|
||||
|
||||
|
||||
|
||||
|
||||
typedef struct Hacl_Streaming_SHA2_state_sha2_224_s
|
||||
{
|
||||
uint32_t *block_state;
|
||||
|
|
@ -49,6 +48,16 @@ Hacl_Streaming_SHA2_state_sha2_224;
|
|||
|
||||
typedef Hacl_Streaming_SHA2_state_sha2_224 Hacl_Streaming_SHA2_state_sha2_256;
|
||||
|
||||
typedef struct Hacl_Streaming_SHA2_state_sha2_384_s
|
||||
{
|
||||
uint64_t *block_state;
|
||||
uint8_t *buf;
|
||||
uint64_t total_len;
|
||||
}
|
||||
Hacl_Streaming_SHA2_state_sha2_384;
|
||||
|
||||
typedef Hacl_Streaming_SHA2_state_sha2_384 Hacl_Streaming_SHA2_state_sha2_512;
|
||||
|
||||
/**
|
||||
Allocate initial state for the SHA2_256 hash. The state is to be freed by
|
||||
calling `free_256`.
|
||||
|
|
@ -128,6 +137,78 @@ Hash `input`, of len `input_len`, into `dst`, an array of 28 bytes.
|
|||
*/
|
||||
void Hacl_Streaming_SHA2_sha224(uint8_t *input, uint32_t input_len, uint8_t *dst);
|
||||
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *Hacl_Streaming_SHA2_create_in_512(void);
|
||||
|
||||
/**
|
||||
Copies the state passed as argument into a newly allocated state (deep copy).
|
||||
The state is to be freed by calling `free_512`. Cloning the state this way is
|
||||
useful, for instance, if your control-flow diverges and you need to feed
|
||||
more (different) data into the hash in each branch.
|
||||
*/
|
||||
Hacl_Streaming_SHA2_state_sha2_384
|
||||
*Hacl_Streaming_SHA2_copy_512(Hacl_Streaming_SHA2_state_sha2_384 *s0);
|
||||
|
||||
void Hacl_Streaming_SHA2_init_512(Hacl_Streaming_SHA2_state_sha2_384 *s);
|
||||
|
||||
/**
|
||||
Feed an arbitrary amount of data into the hash. This function returns 0 for
|
||||
success, or 1 if the combined length of all of the data passed to `update_512`
|
||||
(since the last call to `init_512`) exceeds 2^125-1 bytes.
|
||||
|
||||
This function is identical to the update function for SHA2_384.
|
||||
*/
|
||||
uint32_t
|
||||
Hacl_Streaming_SHA2_update_512(
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *p,
|
||||
uint8_t *input,
|
||||
uint32_t input_len
|
||||
);
|
||||
|
||||
/**
|
||||
Write the resulting hash into `dst`, an array of 64 bytes. The state remains
|
||||
valid after a call to `finish_512`, meaning the user may feed more data into
|
||||
the hash via `update_512`. (The finish_512 function operates on an internal copy of
|
||||
the state and therefore does not invalidate the client-held state `p`.)
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_finish_512(Hacl_Streaming_SHA2_state_sha2_384 *p, uint8_t *dst);
|
||||
|
||||
/**
|
||||
Free a state allocated with `create_in_512`.
|
||||
|
||||
This function is identical to the free function for SHA2_384.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_free_512(Hacl_Streaming_SHA2_state_sha2_384 *s);
|
||||
|
||||
/**
|
||||
Hash `input`, of len `input_len`, into `dst`, an array of 64 bytes.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_sha512(uint8_t *input, uint32_t input_len, uint8_t *dst);
|
||||
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *Hacl_Streaming_SHA2_create_in_384(void);
|
||||
|
||||
void Hacl_Streaming_SHA2_init_384(Hacl_Streaming_SHA2_state_sha2_384 *s);
|
||||
|
||||
uint32_t
|
||||
Hacl_Streaming_SHA2_update_384(
|
||||
Hacl_Streaming_SHA2_state_sha2_384 *p,
|
||||
uint8_t *input,
|
||||
uint32_t input_len
|
||||
);
|
||||
|
||||
/**
|
||||
Write the resulting hash into `dst`, an array of 48 bytes. The state remains
|
||||
valid after a call to `finish_384`, meaning the user may feed more data into
|
||||
the hash via `update_384`.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_finish_384(Hacl_Streaming_SHA2_state_sha2_384 *p, uint8_t *dst);
|
||||
|
||||
void Hacl_Streaming_SHA2_free_384(Hacl_Streaming_SHA2_state_sha2_384 *p);
|
||||
|
||||
/**
|
||||
Hash `input`, of len `input_len`, into `dst`, an array of 48 bytes.
|
||||
*/
|
||||
void Hacl_Streaming_SHA2_sha384(uint8_t *input, uint32_t input_len, uint8_t *dst);
|
||||
|
||||
#if defined(__cplusplus)
|
||||
}
|
||||
#endif
|
||||
|
|
|
|||
347
Modules/_hacl/include/krml/FStar_UInt128_Verified.h
Normal file
347
Modules/_hacl/include/krml/FStar_UInt128_Verified.h
Normal file
|
|
@ -0,0 +1,347 @@
|
|||
/*
|
||||
Copyright (c) INRIA and Microsoft Corporation. All rights reserved.
|
||||
Licensed under the Apache 2.0 License.
|
||||
*/
|
||||
|
||||
|
||||
#ifndef __FStar_UInt128_Verified_H
|
||||
#define __FStar_UInt128_Verified_H
|
||||
|
||||
|
||||
|
||||
#include "FStar_UInt_8_16_32_64.h"
|
||||
#include <inttypes.h>
|
||||
#include <stdbool.h>
|
||||
#include "krml/types.h"
|
||||
#include "krml/internal/target.h"
|
||||
static inline uint64_t FStar_UInt128_constant_time_carry(uint64_t a, uint64_t b)
|
||||
{
|
||||
return (a ^ ((a ^ b) | ((a - b) ^ b))) >> (uint32_t)63U;
|
||||
}
|
||||
|
||||
static inline uint64_t FStar_UInt128_carry(uint64_t a, uint64_t b)
|
||||
{
|
||||
return FStar_UInt128_constant_time_carry(a, b);
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_add(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low + b.low;
|
||||
lit.high = a.high + b.high + FStar_UInt128_carry(a.low + b.low, b.low);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_add_underspec(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low + b.low;
|
||||
lit.high = a.high + b.high + FStar_UInt128_carry(a.low + b.low, b.low);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_add_mod(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low + b.low;
|
||||
lit.high = a.high + b.high + FStar_UInt128_carry(a.low + b.low, b.low);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_sub(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low - b.low;
|
||||
lit.high = a.high - b.high - FStar_UInt128_carry(a.low, a.low - b.low);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_sub_underspec(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low - b.low;
|
||||
lit.high = a.high - b.high - FStar_UInt128_carry(a.low, a.low - b.low);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_sub_mod_impl(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low - b.low;
|
||||
lit.high = a.high - b.high - FStar_UInt128_carry(a.low, a.low - b.low);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_sub_mod(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
return FStar_UInt128_sub_mod_impl(a, b);
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_logand(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low & b.low;
|
||||
lit.high = a.high & b.high;
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_logxor(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low ^ b.low;
|
||||
lit.high = a.high ^ b.high;
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_logor(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low | b.low;
|
||||
lit.high = a.high | b.high;
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128 FStar_UInt128_lognot(FStar_UInt128_uint128 a)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = ~a.low;
|
||||
lit.high = ~a.high;
|
||||
return lit;
|
||||
}
|
||||
|
||||
static uint32_t FStar_UInt128_u32_64 = (uint32_t)64U;
|
||||
|
||||
static inline uint64_t FStar_UInt128_add_u64_shift_left(uint64_t hi, uint64_t lo, uint32_t s)
|
||||
{
|
||||
return (hi << s) + (lo >> (FStar_UInt128_u32_64 - s));
|
||||
}
|
||||
|
||||
static inline uint64_t
|
||||
FStar_UInt128_add_u64_shift_left_respec(uint64_t hi, uint64_t lo, uint32_t s)
|
||||
{
|
||||
return FStar_UInt128_add_u64_shift_left(hi, lo, s);
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_shift_left_small(FStar_UInt128_uint128 a, uint32_t s)
|
||||
{
|
||||
if (s == (uint32_t)0U)
|
||||
{
|
||||
return a;
|
||||
}
|
||||
else
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.low << s;
|
||||
lit.high = FStar_UInt128_add_u64_shift_left_respec(a.high, a.low, s);
|
||||
return lit;
|
||||
}
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_shift_left_large(FStar_UInt128_uint128 a, uint32_t s)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = (uint64_t)0U;
|
||||
lit.high = a.low << (s - FStar_UInt128_u32_64);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_shift_left(FStar_UInt128_uint128 a, uint32_t s)
|
||||
{
|
||||
if (s < FStar_UInt128_u32_64)
|
||||
{
|
||||
return FStar_UInt128_shift_left_small(a, s);
|
||||
}
|
||||
else
|
||||
{
|
||||
return FStar_UInt128_shift_left_large(a, s);
|
||||
}
|
||||
}
|
||||
|
||||
static inline uint64_t FStar_UInt128_add_u64_shift_right(uint64_t hi, uint64_t lo, uint32_t s)
|
||||
{
|
||||
return (lo >> s) + (hi << (FStar_UInt128_u32_64 - s));
|
||||
}
|
||||
|
||||
static inline uint64_t
|
||||
FStar_UInt128_add_u64_shift_right_respec(uint64_t hi, uint64_t lo, uint32_t s)
|
||||
{
|
||||
return FStar_UInt128_add_u64_shift_right(hi, lo, s);
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_shift_right_small(FStar_UInt128_uint128 a, uint32_t s)
|
||||
{
|
||||
if (s == (uint32_t)0U)
|
||||
{
|
||||
return a;
|
||||
}
|
||||
else
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = FStar_UInt128_add_u64_shift_right_respec(a.high, a.low, s);
|
||||
lit.high = a.high >> s;
|
||||
return lit;
|
||||
}
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_shift_right_large(FStar_UInt128_uint128 a, uint32_t s)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a.high >> (s - FStar_UInt128_u32_64);
|
||||
lit.high = (uint64_t)0U;
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_shift_right(FStar_UInt128_uint128 a, uint32_t s)
|
||||
{
|
||||
if (s < FStar_UInt128_u32_64)
|
||||
{
|
||||
return FStar_UInt128_shift_right_small(a, s);
|
||||
}
|
||||
else
|
||||
{
|
||||
return FStar_UInt128_shift_right_large(a, s);
|
||||
}
|
||||
}
|
||||
|
||||
static inline bool FStar_UInt128_eq(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
return a.low == b.low && a.high == b.high;
|
||||
}
|
||||
|
||||
static inline bool FStar_UInt128_gt(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
return a.high > b.high || (a.high == b.high && a.low > b.low);
|
||||
}
|
||||
|
||||
static inline bool FStar_UInt128_lt(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
return a.high < b.high || (a.high == b.high && a.low < b.low);
|
||||
}
|
||||
|
||||
static inline bool FStar_UInt128_gte(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
return a.high > b.high || (a.high == b.high && a.low >= b.low);
|
||||
}
|
||||
|
||||
static inline bool FStar_UInt128_lte(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
return a.high < b.high || (a.high == b.high && a.low <= b.low);
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_eq_mask(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = FStar_UInt64_eq_mask(a.low, b.low) & FStar_UInt64_eq_mask(a.high, b.high);
|
||||
lit.high = FStar_UInt64_eq_mask(a.low, b.low) & FStar_UInt64_eq_mask(a.high, b.high);
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128
|
||||
FStar_UInt128_gte_mask(FStar_UInt128_uint128 a, FStar_UInt128_uint128 b)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low =
|
||||
(FStar_UInt64_gte_mask(a.high, b.high) & ~FStar_UInt64_eq_mask(a.high, b.high))
|
||||
| (FStar_UInt64_eq_mask(a.high, b.high) & FStar_UInt64_gte_mask(a.low, b.low));
|
||||
lit.high =
|
||||
(FStar_UInt64_gte_mask(a.high, b.high) & ~FStar_UInt64_eq_mask(a.high, b.high))
|
||||
| (FStar_UInt64_eq_mask(a.high, b.high) & FStar_UInt64_gte_mask(a.low, b.low));
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128 FStar_UInt128_uint64_to_uint128(uint64_t a)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low = a;
|
||||
lit.high = (uint64_t)0U;
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline uint64_t FStar_UInt128_uint128_to_uint64(FStar_UInt128_uint128 a)
|
||||
{
|
||||
return a.low;
|
||||
}
|
||||
|
||||
static inline uint64_t FStar_UInt128_u64_mod_32(uint64_t a)
|
||||
{
|
||||
return a & (uint64_t)0xffffffffU;
|
||||
}
|
||||
|
||||
static uint32_t FStar_UInt128_u32_32 = (uint32_t)32U;
|
||||
|
||||
static inline uint64_t FStar_UInt128_u32_combine(uint64_t hi, uint64_t lo)
|
||||
{
|
||||
return lo + (hi << FStar_UInt128_u32_32);
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128 FStar_UInt128_mul32(uint64_t x, uint32_t y)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low =
|
||||
FStar_UInt128_u32_combine((x >> FStar_UInt128_u32_32)
|
||||
* (uint64_t)y
|
||||
+ (FStar_UInt128_u64_mod_32(x) * (uint64_t)y >> FStar_UInt128_u32_32),
|
||||
FStar_UInt128_u64_mod_32(FStar_UInt128_u64_mod_32(x) * (uint64_t)y));
|
||||
lit.high =
|
||||
((x >> FStar_UInt128_u32_32)
|
||||
* (uint64_t)y
|
||||
+ (FStar_UInt128_u64_mod_32(x) * (uint64_t)y >> FStar_UInt128_u32_32))
|
||||
>> FStar_UInt128_u32_32;
|
||||
return lit;
|
||||
}
|
||||
|
||||
static inline uint64_t FStar_UInt128_u32_combine_(uint64_t hi, uint64_t lo)
|
||||
{
|
||||
return lo + (hi << FStar_UInt128_u32_32);
|
||||
}
|
||||
|
||||
static inline FStar_UInt128_uint128 FStar_UInt128_mul_wide(uint64_t x, uint64_t y)
|
||||
{
|
||||
FStar_UInt128_uint128 lit;
|
||||
lit.low =
|
||||
FStar_UInt128_u32_combine_(FStar_UInt128_u64_mod_32(x)
|
||||
* (y >> FStar_UInt128_u32_32)
|
||||
+
|
||||
FStar_UInt128_u64_mod_32((x >> FStar_UInt128_u32_32)
|
||||
* FStar_UInt128_u64_mod_32(y)
|
||||
+ (FStar_UInt128_u64_mod_32(x) * FStar_UInt128_u64_mod_32(y) >> FStar_UInt128_u32_32)),
|
||||
FStar_UInt128_u64_mod_32(FStar_UInt128_u64_mod_32(x) * FStar_UInt128_u64_mod_32(y)));
|
||||
lit.high =
|
||||
(x >> FStar_UInt128_u32_32)
|
||||
* (y >> FStar_UInt128_u32_32)
|
||||
+
|
||||
(((x >> FStar_UInt128_u32_32)
|
||||
* FStar_UInt128_u64_mod_32(y)
|
||||
+ (FStar_UInt128_u64_mod_32(x) * FStar_UInt128_u64_mod_32(y) >> FStar_UInt128_u32_32))
|
||||
>> FStar_UInt128_u32_32)
|
||||
+
|
||||
((FStar_UInt128_u64_mod_32(x)
|
||||
* (y >> FStar_UInt128_u32_32)
|
||||
+
|
||||
FStar_UInt128_u64_mod_32((x >> FStar_UInt128_u32_32)
|
||||
* FStar_UInt128_u64_mod_32(y)
|
||||
+ (FStar_UInt128_u64_mod_32(x) * FStar_UInt128_u64_mod_32(y) >> FStar_UInt128_u32_32)))
|
||||
>> FStar_UInt128_u32_32);
|
||||
return lit;
|
||||
}
|
||||
|
||||
|
||||
#define __FStar_UInt128_Verified_H_DEFINED
|
||||
#endif
|
||||
|
|
@ -14,7 +14,7 @@
|
|||
#include <stdbool.h>
|
||||
|
||||
#include "krml/lowstar_endianness.h"
|
||||
#include "krml/FStar_UInt_8_16_32_64.h"
|
||||
#include "krml/types.h"
|
||||
#include "krml/internal/target.h"
|
||||
static inline uint64_t FStar_UInt64_eq_mask(uint64_t a, uint64_t b)
|
||||
{
|
||||
|
|
|
|||
68
Modules/_hacl/include/krml/fstar_uint128_struct_endianness.h
Normal file
68
Modules/_hacl/include/krml/fstar_uint128_struct_endianness.h
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved.
|
||||
Licensed under the Apache 2.0 License. */
|
||||
|
||||
#ifndef FSTAR_UINT128_STRUCT_ENDIANNESS_H
|
||||
#define FSTAR_UINT128_STRUCT_ENDIANNESS_H
|
||||
|
||||
/* Hand-written implementation of endianness-related uint128 functions
|
||||
* for the extracted uint128 implementation */
|
||||
|
||||
/* Access 64-bit fields within the int128. */
|
||||
#define HIGH64_OF(x) ((x)->high)
|
||||
#define LOW64_OF(x) ((x)->low)
|
||||
|
||||
/* A series of definitions written using pointers. */
|
||||
|
||||
inline static void load128_le_(uint8_t *b, uint128_t *r) {
|
||||
LOW64_OF(r) = load64_le(b);
|
||||
HIGH64_OF(r) = load64_le(b + 8);
|
||||
}
|
||||
|
||||
inline static void store128_le_(uint8_t *b, uint128_t *n) {
|
||||
store64_le(b, LOW64_OF(n));
|
||||
store64_le(b + 8, HIGH64_OF(n));
|
||||
}
|
||||
|
||||
inline static void load128_be_(uint8_t *b, uint128_t *r) {
|
||||
HIGH64_OF(r) = load64_be(b);
|
||||
LOW64_OF(r) = load64_be(b + 8);
|
||||
}
|
||||
|
||||
inline static void store128_be_(uint8_t *b, uint128_t *n) {
|
||||
store64_be(b, HIGH64_OF(n));
|
||||
store64_be(b + 8, LOW64_OF(n));
|
||||
}
|
||||
|
||||
#ifndef KRML_NOSTRUCT_PASSING
|
||||
|
||||
inline static uint128_t load128_le(uint8_t *b) {
|
||||
uint128_t r;
|
||||
load128_le_(b, &r);
|
||||
return r;
|
||||
}
|
||||
|
||||
inline static void store128_le(uint8_t *b, uint128_t n) {
|
||||
store128_le_(b, &n);
|
||||
}
|
||||
|
||||
inline static uint128_t load128_be(uint8_t *b) {
|
||||
uint128_t r;
|
||||
load128_be_(b, &r);
|
||||
return r;
|
||||
}
|
||||
|
||||
inline static void store128_be(uint8_t *b, uint128_t n) {
|
||||
store128_be_(b, &n);
|
||||
}
|
||||
|
||||
#else /* !defined(KRML_STRUCT_PASSING) */
|
||||
|
||||
# define print128 print128_
|
||||
# define load128_le load128_le_
|
||||
# define store128_le store128_le_
|
||||
# define load128_be load128_be_
|
||||
# define store128_be store128_be_
|
||||
|
||||
#endif /* KRML_STRUCT_PASSING */
|
||||
|
||||
#endif
|
||||
14
Modules/_hacl/include/krml/types.h
Normal file
14
Modules/_hacl/include/krml/types.h
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
#pragma once
|
||||
|
||||
#include <inttypes.h>
|
||||
|
||||
typedef struct FStar_UInt128_uint128_s {
|
||||
uint64_t low;
|
||||
uint64_t high;
|
||||
} FStar_UInt128_uint128, uint128_t;
|
||||
|
||||
#define KRML_VERIFIED_UINT128
|
||||
|
||||
#include "krml/lowstar_endianness.h"
|
||||
#include "krml/fstar_uint128_struct_endianness.h"
|
||||
#include "krml/FStar_UInt128_Verified.h"
|
||||
|
|
@ -10,19 +10,36 @@
|
|||
#define Hacl_Streaming_SHA2_state_sha2_224_s python_hashlib_Hacl_Streaming_SHA2_state_sha2_224_s
|
||||
#define Hacl_Streaming_SHA2_state_sha2_224 python_hashlib_Hacl_Streaming_SHA2_state_sha2_224
|
||||
#define Hacl_Streaming_SHA2_state_sha2_256 python_hashlib_Hacl_Streaming_SHA2_state_sha2_256
|
||||
#define Hacl_Streaming_SHA2_state_sha2_384_s python_hashlib_Hacl_Streaming_SHA2_state_sha2_384_s
|
||||
#define Hacl_Streaming_SHA2_state_sha2_384 python_hashlib_Hacl_Streaming_SHA2_state_sha2_384
|
||||
#define Hacl_Streaming_SHA2_state_sha2_512 python_hashlib_Hacl_Streaming_SHA2_state_sha2_512
|
||||
#define Hacl_Streaming_SHA2_create_in_256 python_hashlib_Hacl_Streaming_SHA2_create_in_256
|
||||
#define Hacl_Streaming_SHA2_create_in_224 python_hashlib_Hacl_Streaming_SHA2_create_in_224
|
||||
#define Hacl_Streaming_SHA2_create_in_512 python_hashlib_Hacl_Streaming_SHA2_create_in_512
|
||||
#define Hacl_Streaming_SHA2_create_in_384 python_hashlib_Hacl_Streaming_SHA2_create_in_384
|
||||
#define Hacl_Streaming_SHA2_copy_256 python_hashlib_Hacl_Streaming_SHA2_copy_256
|
||||
#define Hacl_Streaming_SHA2_copy_224 python_hashlib_Hacl_Streaming_SHA2_copy_224
|
||||
#define Hacl_Streaming_SHA2_copy_512 python_hashlib_Hacl_Streaming_SHA2_copy_512
|
||||
#define Hacl_Streaming_SHA2_copy_384 python_hashlib_Hacl_Streaming_SHA2_copy_384
|
||||
#define Hacl_Streaming_SHA2_init_256 python_hashlib_Hacl_Streaming_SHA2_init_256
|
||||
#define Hacl_Streaming_SHA2_init_224 python_hashlib_Hacl_Streaming_SHA2_init_224
|
||||
#define Hacl_Streaming_SHA2_init_512 python_hashlib_Hacl_Streaming_SHA2_init_512
|
||||
#define Hacl_Streaming_SHA2_init_384 python_hashlib_Hacl_Streaming_SHA2_init_384
|
||||
#define Hacl_Streaming_SHA2_update_256 python_hashlib_Hacl_Streaming_SHA2_update_256
|
||||
#define Hacl_Streaming_SHA2_update_224 python_hashlib_Hacl_Streaming_SHA2_update_224
|
||||
#define Hacl_Streaming_SHA2_update_512 python_hashlib_Hacl_Streaming_SHA2_update_512
|
||||
#define Hacl_Streaming_SHA2_update_384 python_hashlib_Hacl_Streaming_SHA2_update_384
|
||||
#define Hacl_Streaming_SHA2_finish_256 python_hashlib_Hacl_Streaming_SHA2_finish_256
|
||||
#define Hacl_Streaming_SHA2_finish_224 python_hashlib_Hacl_Streaming_SHA2_finish_224
|
||||
#define Hacl_Streaming_SHA2_finish_512 python_hashlib_Hacl_Streaming_SHA2_finish_512
|
||||
#define Hacl_Streaming_SHA2_finish_384 python_hashlib_Hacl_Streaming_SHA2_finish_384
|
||||
#define Hacl_Streaming_SHA2_free_256 python_hashlib_Hacl_Streaming_SHA2_free_256
|
||||
#define Hacl_Streaming_SHA2_free_224 python_hashlib_Hacl_Streaming_SHA2_free_224
|
||||
#define Hacl_Streaming_SHA2_free_512 python_hashlib_Hacl_Streaming_SHA2_free_512
|
||||
#define Hacl_Streaming_SHA2_free_384 python_hashlib_Hacl_Streaming_SHA2_free_384
|
||||
#define Hacl_Streaming_SHA2_sha256 python_hashlib_Hacl_Streaming_SHA2_sha256
|
||||
#define Hacl_Streaming_SHA2_sha224 python_hashlib_Hacl_Streaming_SHA2_sha224
|
||||
#define Hacl_Streaming_SHA2_sha512 python_hashlib_Hacl_Streaming_SHA2_sha512
|
||||
#define Hacl_Streaming_SHA2_sha384 python_hashlib_Hacl_Streaming_SHA2_sha384
|
||||
|
||||
#endif // _PYTHON_HACL_NAMESPACES_H
|
||||
|
|
|
|||
|
|
@ -31,13 +31,10 @@ extern "C" {
|
|||
#endif
|
||||
|
||||
#include <string.h>
|
||||
#include "krml/FStar_UInt_8_16_32_64.h"
|
||||
#include "krml/types.h"
|
||||
#include "krml/lowstar_endianness.h"
|
||||
#include "krml/internal/target.h"
|
||||
|
||||
|
||||
|
||||
|
||||
static const
|
||||
uint32_t
|
||||
Hacl_Impl_SHA2_Generic_h224[8U] =
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ fi
|
|||
|
||||
# Update this when updating to a new version after verifying that the changes
|
||||
# the update brings in are good.
|
||||
expected_hacl_star_rev=94aabbb4cf71347d3779a8db486c761403c6d036
|
||||
expected_hacl_star_rev=4751fc2b11639f651718abf8522fcc36902ca67c
|
||||
|
||||
hacl_dir="$(realpath "$1")"
|
||||
cd "$(dirname "$0")"
|
||||
|
|
@ -54,6 +54,8 @@ include_files=(
|
|||
declare -a lib_files
|
||||
lib_files=(
|
||||
krmllib/dist/minimal/FStar_UInt_8_16_32_64.h
|
||||
krmllib/dist/minimal/fstar_uint128_struct_endianness.h
|
||||
krmllib/dist/minimal/FStar_UInt128_Verified.h
|
||||
)
|
||||
|
||||
# C files for the algorithms themselves: current directory
|
||||
|
|
@ -82,10 +84,27 @@ fi
|
|||
|
||||
readarray -t all_files < <(find . -name '*.h' -or -name '*.c')
|
||||
|
||||
# types.h is a simple wrapper that defines the uint128 type then proceeds to
|
||||
# include FStar_UInt_8_16_32_64.h; we jump the types.h step since our current
|
||||
# selection of algorithms does not necessitate the use of uint128
|
||||
$sed -i 's!#include.*types.h"!#include "krml/FStar_UInt_8_16_32_64.h"!g' "${all_files[@]}"
|
||||
# types.h originally contains a complex series of if-defs and auxiliary type
|
||||
# definitions; here, we just need a proper uint128 type in scope
|
||||
# is a simple wrapper that defines the uint128 type
|
||||
cat > include/krml/types.h <<EOF
|
||||
#pragma once
|
||||
|
||||
#include <inttypes.h>
|
||||
|
||||
typedef struct FStar_UInt128_uint128_s {
|
||||
uint64_t low;
|
||||
uint64_t high;
|
||||
} FStar_UInt128_uint128, uint128_t;
|
||||
|
||||
#define KRML_VERIFIED_UINT128
|
||||
|
||||
#include "krml/lowstar_endianness.h"
|
||||
#include "krml/fstar_uint128_struct_endianness.h"
|
||||
#include "krml/FStar_UInt128_Verified.h"
|
||||
EOF
|
||||
# Adjust the include path to reflect the local directory structure
|
||||
$sed -i 's!#include.*types.h"!#include "krml/types.h"!g' "${all_files[@]}"
|
||||
$sed -i 's!#include.*compat.h"!!g' "${all_files[@]}"
|
||||
|
||||
# FStar_UInt_8_16_32_64 contains definitions useful in the general case, but not
|
||||
|
|
@ -103,22 +122,6 @@ $sed -i 's!#include.*Hacl_Krmllib.h"!!g' "${all_files[@]}"
|
|||
# included in $dist_files).
|
||||
$sed -i 's!#include.*internal/Hacl_Streaming_SHA2.h"!#include "Hacl_Streaming_SHA2.h"!g' "${all_files[@]}"
|
||||
|
||||
# The SHA2 file contains all variants of SHA2. We strip 384 and 512 for the time
|
||||
# being, to be included later.
|
||||
# This regexp matches a separator (two new lines), followed by:
|
||||
#
|
||||
# <non-empty-line>*
|
||||
# ... 384 or 512 ... {
|
||||
# <indented-line>*
|
||||
# }
|
||||
#
|
||||
# The first non-empty lines are the comment block. The second ... may spill over
|
||||
# the next following lines if the arguments are printed in one-per-line mode.
|
||||
$sed -i -z 's/\n\n\([^\n]\+\n\)*[^\n]*\(384\|512\)[^{]*{\n\?\( [^\n]*\n\)*}//g' Hacl_Streaming_SHA2.c
|
||||
|
||||
# Same thing with function prototypes
|
||||
$sed -i -z 's/\n\n\([^\n]\+\n\)*[^\n]*\(384\|512\)[^;]*;//g' Hacl_Streaming_SHA2.h
|
||||
|
||||
# Use globally unique names for the Hacl_ C APIs to avoid linkage conflicts.
|
||||
$sed -i -z 's!#include <string.h>\n!#include <string.h>\n#include "python_hacl_namespaces.h"\n!' Hacl_Streaming_SHA2.h
|
||||
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@
|
|||
Andrew Kuchling (amk@amk.ca)
|
||||
Greg Stein (gstein@lyra.org)
|
||||
Trevor Perrin (trevp@trevp.net)
|
||||
Jonathan Protzenko (jonathan@protzenko.fr)
|
||||
|
||||
Copyright (C) 2005-2007 Gregory P. Smith (greg@krypto.org)
|
||||
Licensed to PSF under a Contributor Agreement.
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@
|
|||
Andrew Kuchling (amk@amk.ca)
|
||||
Greg Stein (gstein@lyra.org)
|
||||
Trevor Perrin (trevp@trevp.net)
|
||||
Jonathan Protzenko (jonathan@protzenko.fr)
|
||||
|
||||
Copyright (C) 2005-2007 Gregory P. Smith (greg@krypto.org)
|
||||
Licensed to PSF under a Contributor Agreement.
|
||||
|
|
@ -31,400 +32,32 @@ class SHA512Type "SHAobject *" "&PyType_Type"
|
|||
[clinic start generated code]*/
|
||||
/*[clinic end generated code: output=da39a3ee5e6b4b0d input=81a3ccde92bcfe8d]*/
|
||||
|
||||
/* Some useful types */
|
||||
|
||||
typedef unsigned char SHA_BYTE;
|
||||
typedef uint32_t SHA_INT32; /* 32-bit integer */
|
||||
typedef uint64_t SHA_INT64; /* 64-bit integer */
|
||||
|
||||
/* The SHA block size and message digest sizes, in bytes */
|
||||
|
||||
#define SHA_BLOCKSIZE 128
|
||||
#define SHA_DIGESTSIZE 64
|
||||
|
||||
/* The structure for storing SHA info */
|
||||
/* The SHA2-384 and SHA2-512 implementations defer to the HACL* verified
|
||||
* library. */
|
||||
|
||||
#include "_hacl/Hacl_Streaming_SHA2.h"
|
||||
|
||||
typedef struct {
|
||||
PyObject_HEAD
|
||||
SHA_INT64 digest[8]; /* Message digest */
|
||||
SHA_INT32 count_lo, count_hi; /* 64-bit bit count */
|
||||
SHA_BYTE data[SHA_BLOCKSIZE]; /* SHA data buffer */
|
||||
int local; /* unprocessed amount in data */
|
||||
int digestsize;
|
||||
Hacl_Streaming_SHA2_state_sha2_512 *state;
|
||||
} SHAobject;
|
||||
|
||||
#include "clinic/sha512module.c.h"
|
||||
|
||||
/* When run on a little-endian CPU we need to perform byte reversal on an
|
||||
array of longwords. */
|
||||
|
||||
#if PY_LITTLE_ENDIAN
|
||||
static void longReverse(SHA_INT64 *buffer, int byteCount)
|
||||
{
|
||||
byteCount /= sizeof(*buffer);
|
||||
for (; byteCount--; buffer++) {
|
||||
*buffer = _Py_bswap64(*buffer);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
static void SHAcopy(SHAobject *src, SHAobject *dest)
|
||||
{
|
||||
dest->local = src->local;
|
||||
dest->digestsize = src->digestsize;
|
||||
dest->count_lo = src->count_lo;
|
||||
dest->count_hi = src->count_hi;
|
||||
memcpy(dest->digest, src->digest, sizeof(src->digest));
|
||||
memcpy(dest->data, src->data, sizeof(src->data));
|
||||
dest->state = Hacl_Streaming_SHA2_copy_512(src->state);
|
||||
}
|
||||
|
||||
|
||||
/* ------------------------------------------------------------------------
|
||||
*
|
||||
* This code for the SHA-512 algorithm was noted as public domain. The
|
||||
* original headers are pasted below.
|
||||
*
|
||||
* Several changes have been made to make it more compatible with the
|
||||
* Python environment and desired interface.
|
||||
*
|
||||
*/
|
||||
|
||||
/* LibTomCrypt, modular cryptographic library -- Tom St Denis
|
||||
*
|
||||
* LibTomCrypt is a library that provides various cryptographic
|
||||
* algorithms in a highly modular and flexible manner.
|
||||
*
|
||||
* The library is free for all purposes without any express
|
||||
* guarantee it works.
|
||||
*
|
||||
* Tom St Denis, tomstdenis@iahu.ca, https://www.libtom.net
|
||||
*/
|
||||
|
||||
|
||||
/* SHA512 by Tom St Denis */
|
||||
|
||||
/* Various logical functions */
|
||||
#define ROR64(x, y) \
|
||||
( ((((x) & 0xFFFFFFFFFFFFFFFFULL)>>((unsigned long long)(y) & 63)) | \
|
||||
((x)<<((unsigned long long)(64-((y) & 63))))) & 0xFFFFFFFFFFFFFFFFULL)
|
||||
#define Ch(x,y,z) (z ^ (x & (y ^ z)))
|
||||
#define Maj(x,y,z) (((x | y) & z) | (x & y))
|
||||
#define S(x, n) ROR64((x),(n))
|
||||
#define R(x, n) (((x) & 0xFFFFFFFFFFFFFFFFULL) >> ((unsigned long long)n))
|
||||
#define Sigma0(x) (S(x, 28) ^ S(x, 34) ^ S(x, 39))
|
||||
#define Sigma1(x) (S(x, 14) ^ S(x, 18) ^ S(x, 41))
|
||||
#define Gamma0(x) (S(x, 1) ^ S(x, 8) ^ R(x, 7))
|
||||
#define Gamma1(x) (S(x, 19) ^ S(x, 61) ^ R(x, 6))
|
||||
|
||||
|
||||
static void
|
||||
sha512_transform(SHAobject *sha_info)
|
||||
{
|
||||
int i;
|
||||
SHA_INT64 S[8], W[80], t0, t1;
|
||||
|
||||
memcpy(W, sha_info->data, sizeof(sha_info->data));
|
||||
#if PY_LITTLE_ENDIAN
|
||||
longReverse(W, (int)sizeof(sha_info->data));
|
||||
#endif
|
||||
|
||||
for (i = 16; i < 80; ++i) {
|
||||
W[i] = Gamma1(W[i - 2]) + W[i - 7] + Gamma0(W[i - 15]) + W[i - 16];
|
||||
}
|
||||
for (i = 0; i < 8; ++i) {
|
||||
S[i] = sha_info->digest[i];
|
||||
}
|
||||
|
||||
/* Compress */
|
||||
#define RND(a,b,c,d,e,f,g,h,i,ki) \
|
||||
t0 = h + Sigma1(e) + Ch(e, f, g) + ki + W[i]; \
|
||||
t1 = Sigma0(a) + Maj(a, b, c); \
|
||||
d += t0; \
|
||||
h = t0 + t1;
|
||||
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],0,0x428a2f98d728ae22ULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],1,0x7137449123ef65cdULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],2,0xb5c0fbcfec4d3b2fULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],3,0xe9b5dba58189dbbcULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],4,0x3956c25bf348b538ULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],5,0x59f111f1b605d019ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],6,0x923f82a4af194f9bULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],7,0xab1c5ed5da6d8118ULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],8,0xd807aa98a3030242ULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],9,0x12835b0145706fbeULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],10,0x243185be4ee4b28cULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],11,0x550c7dc3d5ffb4e2ULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],12,0x72be5d74f27b896fULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],13,0x80deb1fe3b1696b1ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],14,0x9bdc06a725c71235ULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],15,0xc19bf174cf692694ULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],16,0xe49b69c19ef14ad2ULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],17,0xefbe4786384f25e3ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],18,0x0fc19dc68b8cd5b5ULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],19,0x240ca1cc77ac9c65ULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],20,0x2de92c6f592b0275ULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],21,0x4a7484aa6ea6e483ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],22,0x5cb0a9dcbd41fbd4ULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],23,0x76f988da831153b5ULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],24,0x983e5152ee66dfabULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],25,0xa831c66d2db43210ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],26,0xb00327c898fb213fULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],27,0xbf597fc7beef0ee4ULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],28,0xc6e00bf33da88fc2ULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],29,0xd5a79147930aa725ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],30,0x06ca6351e003826fULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],31,0x142929670a0e6e70ULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],32,0x27b70a8546d22ffcULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],33,0x2e1b21385c26c926ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],34,0x4d2c6dfc5ac42aedULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],35,0x53380d139d95b3dfULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],36,0x650a73548baf63deULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],37,0x766a0abb3c77b2a8ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],38,0x81c2c92e47edaee6ULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],39,0x92722c851482353bULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],40,0xa2bfe8a14cf10364ULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],41,0xa81a664bbc423001ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],42,0xc24b8b70d0f89791ULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],43,0xc76c51a30654be30ULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],44,0xd192e819d6ef5218ULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],45,0xd69906245565a910ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],46,0xf40e35855771202aULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],47,0x106aa07032bbd1b8ULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],48,0x19a4c116b8d2d0c8ULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],49,0x1e376c085141ab53ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],50,0x2748774cdf8eeb99ULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],51,0x34b0bcb5e19b48a8ULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],52,0x391c0cb3c5c95a63ULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],53,0x4ed8aa4ae3418acbULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],54,0x5b9cca4f7763e373ULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],55,0x682e6ff3d6b2b8a3ULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],56,0x748f82ee5defb2fcULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],57,0x78a5636f43172f60ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],58,0x84c87814a1f0ab72ULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],59,0x8cc702081a6439ecULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],60,0x90befffa23631e28ULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],61,0xa4506cebde82bde9ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],62,0xbef9a3f7b2c67915ULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],63,0xc67178f2e372532bULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],64,0xca273eceea26619cULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],65,0xd186b8c721c0c207ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],66,0xeada7dd6cde0eb1eULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],67,0xf57d4f7fee6ed178ULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],68,0x06f067aa72176fbaULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],69,0x0a637dc5a2c898a6ULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],70,0x113f9804bef90daeULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],71,0x1b710b35131c471bULL);
|
||||
RND(S[0],S[1],S[2],S[3],S[4],S[5],S[6],S[7],72,0x28db77f523047d84ULL);
|
||||
RND(S[7],S[0],S[1],S[2],S[3],S[4],S[5],S[6],73,0x32caab7b40c72493ULL);
|
||||
RND(S[6],S[7],S[0],S[1],S[2],S[3],S[4],S[5],74,0x3c9ebe0a15c9bebcULL);
|
||||
RND(S[5],S[6],S[7],S[0],S[1],S[2],S[3],S[4],75,0x431d67c49c100d4cULL);
|
||||
RND(S[4],S[5],S[6],S[7],S[0],S[1],S[2],S[3],76,0x4cc5d4becb3e42b6ULL);
|
||||
RND(S[3],S[4],S[5],S[6],S[7],S[0],S[1],S[2],77,0x597f299cfc657e2aULL);
|
||||
RND(S[2],S[3],S[4],S[5],S[6],S[7],S[0],S[1],78,0x5fcb6fab3ad6faecULL);
|
||||
RND(S[1],S[2],S[3],S[4],S[5],S[6],S[7],S[0],79,0x6c44198c4a475817ULL);
|
||||
|
||||
#undef RND
|
||||
|
||||
/* feedback */
|
||||
for (i = 0; i < 8; i++) {
|
||||
sha_info->digest[i] = sha_info->digest[i] + S[i];
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
/* initialize the SHA digest */
|
||||
|
||||
static void
|
||||
sha512_init(SHAobject *sha_info)
|
||||
{
|
||||
sha_info->digest[0] = Py_ULL(0x6a09e667f3bcc908);
|
||||
sha_info->digest[1] = Py_ULL(0xbb67ae8584caa73b);
|
||||
sha_info->digest[2] = Py_ULL(0x3c6ef372fe94f82b);
|
||||
sha_info->digest[3] = Py_ULL(0xa54ff53a5f1d36f1);
|
||||
sha_info->digest[4] = Py_ULL(0x510e527fade682d1);
|
||||
sha_info->digest[5] = Py_ULL(0x9b05688c2b3e6c1f);
|
||||
sha_info->digest[6] = Py_ULL(0x1f83d9abfb41bd6b);
|
||||
sha_info->digest[7] = Py_ULL(0x5be0cd19137e2179);
|
||||
sha_info->count_lo = 0L;
|
||||
sha_info->count_hi = 0L;
|
||||
sha_info->local = 0;
|
||||
sha_info->digestsize = 64;
|
||||
}
|
||||
|
||||
static void
|
||||
sha384_init(SHAobject *sha_info)
|
||||
{
|
||||
sha_info->digest[0] = Py_ULL(0xcbbb9d5dc1059ed8);
|
||||
sha_info->digest[1] = Py_ULL(0x629a292a367cd507);
|
||||
sha_info->digest[2] = Py_ULL(0x9159015a3070dd17);
|
||||
sha_info->digest[3] = Py_ULL(0x152fecd8f70e5939);
|
||||
sha_info->digest[4] = Py_ULL(0x67332667ffc00b31);
|
||||
sha_info->digest[5] = Py_ULL(0x8eb44a8768581511);
|
||||
sha_info->digest[6] = Py_ULL(0xdb0c2e0d64f98fa7);
|
||||
sha_info->digest[7] = Py_ULL(0x47b5481dbefa4fa4);
|
||||
sha_info->count_lo = 0L;
|
||||
sha_info->count_hi = 0L;
|
||||
sha_info->local = 0;
|
||||
sha_info->digestsize = 48;
|
||||
}
|
||||
|
||||
|
||||
/* update the SHA digest */
|
||||
|
||||
static void
|
||||
sha512_update(SHAobject *sha_info, SHA_BYTE *buffer, Py_ssize_t count)
|
||||
{
|
||||
Py_ssize_t i;
|
||||
SHA_INT32 clo;
|
||||
|
||||
clo = sha_info->count_lo + ((SHA_INT32) count << 3);
|
||||
if (clo < sha_info->count_lo) {
|
||||
++sha_info->count_hi;
|
||||
}
|
||||
sha_info->count_lo = clo;
|
||||
sha_info->count_hi += (SHA_INT32) count >> 29;
|
||||
if (sha_info->local) {
|
||||
i = SHA_BLOCKSIZE - sha_info->local;
|
||||
if (i > count) {
|
||||
i = count;
|
||||
}
|
||||
memcpy(((SHA_BYTE *) sha_info->data) + sha_info->local, buffer, i);
|
||||
count -= i;
|
||||
buffer += i;
|
||||
sha_info->local += (int)i;
|
||||
if (sha_info->local == SHA_BLOCKSIZE) {
|
||||
sha512_transform(sha_info);
|
||||
}
|
||||
else {
|
||||
return;
|
||||
}
|
||||
}
|
||||
while (count >= SHA_BLOCKSIZE) {
|
||||
memcpy(sha_info->data, buffer, SHA_BLOCKSIZE);
|
||||
buffer += SHA_BLOCKSIZE;
|
||||
count -= SHA_BLOCKSIZE;
|
||||
sha512_transform(sha_info);
|
||||
}
|
||||
memcpy(sha_info->data, buffer, count);
|
||||
sha_info->local = (int)count;
|
||||
}
|
||||
|
||||
/* finish computing the SHA digest */
|
||||
|
||||
static void
|
||||
sha512_final(unsigned char digest[SHA_DIGESTSIZE], SHAobject *sha_info)
|
||||
{
|
||||
int count;
|
||||
SHA_INT32 lo_bit_count, hi_bit_count;
|
||||
|
||||
lo_bit_count = sha_info->count_lo;
|
||||
hi_bit_count = sha_info->count_hi;
|
||||
count = (int) ((lo_bit_count >> 3) & 0x7f);
|
||||
((SHA_BYTE *) sha_info->data)[count++] = 0x80;
|
||||
if (count > SHA_BLOCKSIZE - 16) {
|
||||
memset(((SHA_BYTE *) sha_info->data) + count, 0,
|
||||
SHA_BLOCKSIZE - count);
|
||||
sha512_transform(sha_info);
|
||||
memset((SHA_BYTE *) sha_info->data, 0, SHA_BLOCKSIZE - 16);
|
||||
}
|
||||
else {
|
||||
memset(((SHA_BYTE *) sha_info->data) + count, 0,
|
||||
SHA_BLOCKSIZE - 16 - count);
|
||||
}
|
||||
|
||||
/* GJS: note that we add the hi/lo in big-endian. sha512_transform will
|
||||
swap these values into host-order. */
|
||||
sha_info->data[112] = 0;
|
||||
sha_info->data[113] = 0;
|
||||
sha_info->data[114] = 0;
|
||||
sha_info->data[115] = 0;
|
||||
sha_info->data[116] = 0;
|
||||
sha_info->data[117] = 0;
|
||||
sha_info->data[118] = 0;
|
||||
sha_info->data[119] = 0;
|
||||
sha_info->data[120] = (hi_bit_count >> 24) & 0xff;
|
||||
sha_info->data[121] = (hi_bit_count >> 16) & 0xff;
|
||||
sha_info->data[122] = (hi_bit_count >> 8) & 0xff;
|
||||
sha_info->data[123] = (hi_bit_count >> 0) & 0xff;
|
||||
sha_info->data[124] = (lo_bit_count >> 24) & 0xff;
|
||||
sha_info->data[125] = (lo_bit_count >> 16) & 0xff;
|
||||
sha_info->data[126] = (lo_bit_count >> 8) & 0xff;
|
||||
sha_info->data[127] = (lo_bit_count >> 0) & 0xff;
|
||||
sha512_transform(sha_info);
|
||||
digest[ 0] = (unsigned char) ((sha_info->digest[0] >> 56) & 0xff);
|
||||
digest[ 1] = (unsigned char) ((sha_info->digest[0] >> 48) & 0xff);
|
||||
digest[ 2] = (unsigned char) ((sha_info->digest[0] >> 40) & 0xff);
|
||||
digest[ 3] = (unsigned char) ((sha_info->digest[0] >> 32) & 0xff);
|
||||
digest[ 4] = (unsigned char) ((sha_info->digest[0] >> 24) & 0xff);
|
||||
digest[ 5] = (unsigned char) ((sha_info->digest[0] >> 16) & 0xff);
|
||||
digest[ 6] = (unsigned char) ((sha_info->digest[0] >> 8) & 0xff);
|
||||
digest[ 7] = (unsigned char) ((sha_info->digest[0] ) & 0xff);
|
||||
digest[ 8] = (unsigned char) ((sha_info->digest[1] >> 56) & 0xff);
|
||||
digest[ 9] = (unsigned char) ((sha_info->digest[1] >> 48) & 0xff);
|
||||
digest[10] = (unsigned char) ((sha_info->digest[1] >> 40) & 0xff);
|
||||
digest[11] = (unsigned char) ((sha_info->digest[1] >> 32) & 0xff);
|
||||
digest[12] = (unsigned char) ((sha_info->digest[1] >> 24) & 0xff);
|
||||
digest[13] = (unsigned char) ((sha_info->digest[1] >> 16) & 0xff);
|
||||
digest[14] = (unsigned char) ((sha_info->digest[1] >> 8) & 0xff);
|
||||
digest[15] = (unsigned char) ((sha_info->digest[1] ) & 0xff);
|
||||
digest[16] = (unsigned char) ((sha_info->digest[2] >> 56) & 0xff);
|
||||
digest[17] = (unsigned char) ((sha_info->digest[2] >> 48) & 0xff);
|
||||
digest[18] = (unsigned char) ((sha_info->digest[2] >> 40) & 0xff);
|
||||
digest[19] = (unsigned char) ((sha_info->digest[2] >> 32) & 0xff);
|
||||
digest[20] = (unsigned char) ((sha_info->digest[2] >> 24) & 0xff);
|
||||
digest[21] = (unsigned char) ((sha_info->digest[2] >> 16) & 0xff);
|
||||
digest[22] = (unsigned char) ((sha_info->digest[2] >> 8) & 0xff);
|
||||
digest[23] = (unsigned char) ((sha_info->digest[2] ) & 0xff);
|
||||
digest[24] = (unsigned char) ((sha_info->digest[3] >> 56) & 0xff);
|
||||
digest[25] = (unsigned char) ((sha_info->digest[3] >> 48) & 0xff);
|
||||
digest[26] = (unsigned char) ((sha_info->digest[3] >> 40) & 0xff);
|
||||
digest[27] = (unsigned char) ((sha_info->digest[3] >> 32) & 0xff);
|
||||
digest[28] = (unsigned char) ((sha_info->digest[3] >> 24) & 0xff);
|
||||
digest[29] = (unsigned char) ((sha_info->digest[3] >> 16) & 0xff);
|
||||
digest[30] = (unsigned char) ((sha_info->digest[3] >> 8) & 0xff);
|
||||
digest[31] = (unsigned char) ((sha_info->digest[3] ) & 0xff);
|
||||
digest[32] = (unsigned char) ((sha_info->digest[4] >> 56) & 0xff);
|
||||
digest[33] = (unsigned char) ((sha_info->digest[4] >> 48) & 0xff);
|
||||
digest[34] = (unsigned char) ((sha_info->digest[4] >> 40) & 0xff);
|
||||
digest[35] = (unsigned char) ((sha_info->digest[4] >> 32) & 0xff);
|
||||
digest[36] = (unsigned char) ((sha_info->digest[4] >> 24) & 0xff);
|
||||
digest[37] = (unsigned char) ((sha_info->digest[4] >> 16) & 0xff);
|
||||
digest[38] = (unsigned char) ((sha_info->digest[4] >> 8) & 0xff);
|
||||
digest[39] = (unsigned char) ((sha_info->digest[4] ) & 0xff);
|
||||
digest[40] = (unsigned char) ((sha_info->digest[5] >> 56) & 0xff);
|
||||
digest[41] = (unsigned char) ((sha_info->digest[5] >> 48) & 0xff);
|
||||
digest[42] = (unsigned char) ((sha_info->digest[5] >> 40) & 0xff);
|
||||
digest[43] = (unsigned char) ((sha_info->digest[5] >> 32) & 0xff);
|
||||
digest[44] = (unsigned char) ((sha_info->digest[5] >> 24) & 0xff);
|
||||
digest[45] = (unsigned char) ((sha_info->digest[5] >> 16) & 0xff);
|
||||
digest[46] = (unsigned char) ((sha_info->digest[5] >> 8) & 0xff);
|
||||
digest[47] = (unsigned char) ((sha_info->digest[5] ) & 0xff);
|
||||
digest[48] = (unsigned char) ((sha_info->digest[6] >> 56) & 0xff);
|
||||
digest[49] = (unsigned char) ((sha_info->digest[6] >> 48) & 0xff);
|
||||
digest[50] = (unsigned char) ((sha_info->digest[6] >> 40) & 0xff);
|
||||
digest[51] = (unsigned char) ((sha_info->digest[6] >> 32) & 0xff);
|
||||
digest[52] = (unsigned char) ((sha_info->digest[6] >> 24) & 0xff);
|
||||
digest[53] = (unsigned char) ((sha_info->digest[6] >> 16) & 0xff);
|
||||
digest[54] = (unsigned char) ((sha_info->digest[6] >> 8) & 0xff);
|
||||
digest[55] = (unsigned char) ((sha_info->digest[6] ) & 0xff);
|
||||
digest[56] = (unsigned char) ((sha_info->digest[7] >> 56) & 0xff);
|
||||
digest[57] = (unsigned char) ((sha_info->digest[7] >> 48) & 0xff);
|
||||
digest[58] = (unsigned char) ((sha_info->digest[7] >> 40) & 0xff);
|
||||
digest[59] = (unsigned char) ((sha_info->digest[7] >> 32) & 0xff);
|
||||
digest[60] = (unsigned char) ((sha_info->digest[7] >> 24) & 0xff);
|
||||
digest[61] = (unsigned char) ((sha_info->digest[7] >> 16) & 0xff);
|
||||
digest[62] = (unsigned char) ((sha_info->digest[7] >> 8) & 0xff);
|
||||
digest[63] = (unsigned char) ((sha_info->digest[7] ) & 0xff);
|
||||
}
|
||||
|
||||
/*
|
||||
* End of copied SHA code.
|
||||
*
|
||||
* ------------------------------------------------------------------------
|
||||
*/
|
||||
|
||||
typedef struct {
|
||||
PyTypeObject* sha384_type;
|
||||
PyTypeObject* sha512_type;
|
||||
|
|
@ -463,14 +96,31 @@ SHA_traverse(PyObject *ptr, visitproc visit, void *arg)
|
|||
}
|
||||
|
||||
static void
|
||||
SHA512_dealloc(PyObject *ptr)
|
||||
SHA512_dealloc(SHAobject *ptr)
|
||||
{
|
||||
Hacl_Streaming_SHA2_free_512(ptr->state);
|
||||
PyTypeObject *tp = Py_TYPE(ptr);
|
||||
PyObject_GC_UnTrack(ptr);
|
||||
PyObject_GC_Del(ptr);
|
||||
Py_DECREF(tp);
|
||||
}
|
||||
|
||||
/* HACL* takes a uint32_t for the length of its parameter, but Py_ssize_t can be
|
||||
* 64 bits. */
|
||||
static void update_512(Hacl_Streaming_SHA2_state_sha2_512 *state, uint8_t *buf, Py_ssize_t len) {
|
||||
/* Note: we explicitly ignore the error code on the basis that it would take >
|
||||
* 1 billion years to overflow the maximum admissible length for this API
|
||||
* (namely, 2^64-1 bytes). */
|
||||
while (len > UINT32_MAX) {
|
||||
Hacl_Streaming_SHA2_update_512(state, buf, UINT32_MAX);
|
||||
len -= UINT32_MAX;
|
||||
buf += UINT32_MAX;
|
||||
}
|
||||
/* Cast to uint32_t is safe: upon exiting the loop, len <= UINT32_MAX, and
|
||||
* therefore fits in a uint32_t */
|
||||
Hacl_Streaming_SHA2_update_512(state, buf, (uint32_t) len);
|
||||
}
|
||||
|
||||
|
||||
/* External methods for a hash object */
|
||||
|
||||
|
|
@ -514,11 +164,10 @@ static PyObject *
|
|||
SHA512Type_digest_impl(SHAobject *self)
|
||||
/*[clinic end generated code: output=1080bbeeef7dde1b input=f6470dd359071f4b]*/
|
||||
{
|
||||
unsigned char digest[SHA_DIGESTSIZE];
|
||||
SHAobject temp;
|
||||
|
||||
SHAcopy(self, &temp);
|
||||
sha512_final(digest, &temp);
|
||||
uint8_t digest[SHA_DIGESTSIZE];
|
||||
// HACL performs copies under the hood so that self->state remains valid
|
||||
// after this call.
|
||||
Hacl_Streaming_SHA2_finish_512(self->state, digest);
|
||||
return PyBytes_FromStringAndSize((const char *)digest, self->digestsize);
|
||||
}
|
||||
|
||||
|
|
@ -532,13 +181,8 @@ static PyObject *
|
|||
SHA512Type_hexdigest_impl(SHAobject *self)
|
||||
/*[clinic end generated code: output=7373305b8601e18b input=498b877b25cbe0a2]*/
|
||||
{
|
||||
unsigned char digest[SHA_DIGESTSIZE];
|
||||
SHAobject temp;
|
||||
|
||||
/* Get the raw (binary) digest value */
|
||||
SHAcopy(self, &temp);
|
||||
sha512_final(digest, &temp);
|
||||
|
||||
uint8_t digest[SHA_DIGESTSIZE];
|
||||
Hacl_Streaming_SHA2_finish_512(self->state, digest);
|
||||
return _Py_strhex((const char *)digest, self->digestsize);
|
||||
}
|
||||
|
||||
|
|
@ -559,7 +203,7 @@ SHA512Type_update(SHAobject *self, PyObject *obj)
|
|||
|
||||
GET_BUFFER_VIEW_OR_ERROUT(obj, &buf);
|
||||
|
||||
sha512_update(self, buf.buf, buf.len);
|
||||
update_512(self->state, buf.buf, buf.len);
|
||||
|
||||
PyBuffer_Release(&buf);
|
||||
Py_RETURN_NONE;
|
||||
|
|
@ -622,15 +266,6 @@ static PyType_Spec sha512_sha384_type_spec = {
|
|||
.slots = sha512_sha384_type_slots
|
||||
};
|
||||
|
||||
static PyType_Slot sha512_sha512_type_slots[] = {
|
||||
{Py_tp_dealloc, SHA512_dealloc},
|
||||
{Py_tp_methods, SHA_methods},
|
||||
{Py_tp_members, SHA_members},
|
||||
{Py_tp_getset, SHA_getseters},
|
||||
{Py_tp_traverse, SHA_traverse},
|
||||
{0,0}
|
||||
};
|
||||
|
||||
// Using PyType_GetModuleState() on this type is safe since
|
||||
// it cannot be subclassed: it does not have the Py_TPFLAGS_BASETYPE flag.
|
||||
static PyType_Spec sha512_sha512_type_spec = {
|
||||
|
|
@ -638,7 +273,7 @@ static PyType_Spec sha512_sha512_type_spec = {
|
|||
.basicsize = sizeof(SHAobject),
|
||||
.flags = (Py_TPFLAGS_DEFAULT | Py_TPFLAGS_DISALLOW_INSTANTIATION |
|
||||
Py_TPFLAGS_IMMUTABLETYPE | Py_TPFLAGS_HAVE_GC),
|
||||
.slots = sha512_sha512_type_slots
|
||||
.slots = sha512_sha384_type_slots
|
||||
};
|
||||
|
||||
/* The single module-level function: new() */
|
||||
|
|
@ -671,7 +306,8 @@ _sha512_sha512_impl(PyObject *module, PyObject *string, int usedforsecurity)
|
|||
return NULL;
|
||||
}
|
||||
|
||||
sha512_init(new);
|
||||
new->state = Hacl_Streaming_SHA2_create_in_512();
|
||||
new->digestsize = 64;
|
||||
|
||||
if (PyErr_Occurred()) {
|
||||
Py_DECREF(new);
|
||||
|
|
@ -680,7 +316,7 @@ _sha512_sha512_impl(PyObject *module, PyObject *string, int usedforsecurity)
|
|||
return NULL;
|
||||
}
|
||||
if (string) {
|
||||
sha512_update(new, buf.buf, buf.len);
|
||||
update_512(new->state, buf.buf, buf.len);
|
||||
PyBuffer_Release(&buf);
|
||||
}
|
||||
|
||||
|
|
@ -715,7 +351,8 @@ _sha512_sha384_impl(PyObject *module, PyObject *string, int usedforsecurity)
|
|||
return NULL;
|
||||
}
|
||||
|
||||
sha384_init(new);
|
||||
new->state = Hacl_Streaming_SHA2_create_in_384();
|
||||
new->digestsize = 48;
|
||||
|
||||
if (PyErr_Occurred()) {
|
||||
Py_DECREF(new);
|
||||
|
|
@ -724,7 +361,7 @@ _sha512_sha384_impl(PyObject *module, PyObject *string, int usedforsecurity)
|
|||
return NULL;
|
||||
}
|
||||
if (string) {
|
||||
sha512_update(new, buf.buf, buf.len);
|
||||
update_512(new->state, buf.buf, buf.len);
|
||||
PyBuffer_Release(&buf);
|
||||
}
|
||||
|
||||
|
|
|
|||
2
configure
generated
vendored
2
configure
generated
vendored
|
|
@ -26950,7 +26950,7 @@ fi
|
|||
as_fn_append MODULE_BLOCK "MODULE__SHA512_STATE=$py_cv_module__sha512$as_nl"
|
||||
if test "x$py_cv_module__sha512" = xyes; then :
|
||||
|
||||
|
||||
as_fn_append MODULE_BLOCK "MODULE__SHA512_CFLAGS=-I\$(srcdir)/Modules/_hacl/include -I\$(srcdir)/Modules/_hacl/internal -D_BSD_SOURCE -D_DEFAULT_SOURCE$as_nl"
|
||||
|
||||
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -7200,7 +7200,9 @@ PY_STDLIB_MOD([_sha1], [test "$with_builtin_sha1" = yes])
|
|||
PY_STDLIB_MOD([_sha256],
|
||||
[test "$with_builtin_sha256" = yes], [],
|
||||
[-I\$(srcdir)/Modules/_hacl/include -I\$(srcdir)/Modules/_hacl/internal -D_BSD_SOURCE -D_DEFAULT_SOURCE])
|
||||
PY_STDLIB_MOD([_sha512], [test "$with_builtin_sha512" = yes])
|
||||
PY_STDLIB_MOD([_sha512],
|
||||
[test "$with_builtin_sha512" = yes], [],
|
||||
[-I\$(srcdir)/Modules/_hacl/include -I\$(srcdir)/Modules/_hacl/internal -D_BSD_SOURCE -D_DEFAULT_SOURCE])
|
||||
PY_STDLIB_MOD([_sha3], [test "$with_builtin_sha3" = yes])
|
||||
PY_STDLIB_MOD([_blake2],
|
||||
[test "$with_builtin_blake2" = yes], [],
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue