crypto.cc revision 13168
113168Smatt.horsnell@arm.com/* 213168Smatt.horsnell@arm.com * Copyright (c) 2018 ARM Limited 313168Smatt.horsnell@arm.com * All rights reserved 413168Smatt.horsnell@arm.com * 513168Smatt.horsnell@arm.com * The license below extends only to copyright in the software and shall 613168Smatt.horsnell@arm.com * not be construed as granting a license to any other intellectual 713168Smatt.horsnell@arm.com * property including but not limited to intellectual property relating 813168Smatt.horsnell@arm.com * to a hardware implementation of the functionality of the software 913168Smatt.horsnell@arm.com * licensed hereunder. You may use the software subject to the license 1013168Smatt.horsnell@arm.com * terms below provided that you ensure that this notice is replicated 1113168Smatt.horsnell@arm.com * unmodified and in its entirety in all distributions of the software, 1213168Smatt.horsnell@arm.com * modified or unmodified, in source code or in binary form. 1313168Smatt.horsnell@arm.com * 1413168Smatt.horsnell@arm.com * Redistribution and use in source and binary forms, with or without 1513168Smatt.horsnell@arm.com * modification, are permitted provided that the following conditions are 1613168Smatt.horsnell@arm.com * met: redistributions of source code must retain the above copyright 1713168Smatt.horsnell@arm.com * notice, this list of conditions and the following disclaimer; 1813168Smatt.horsnell@arm.com * redistributions in binary form must reproduce the above copyright 1913168Smatt.horsnell@arm.com * notice, this list of conditions and the following disclaimer in the 2013168Smatt.horsnell@arm.com * documentation and/or other materials provided with the distribution; 2113168Smatt.horsnell@arm.com * neither the name of the copyright holders nor the names of its 2213168Smatt.horsnell@arm.com * contributors may be used to endorse or promote products derived from 2313168Smatt.horsnell@arm.com * this software without specific prior written permission. 2413168Smatt.horsnell@arm.com * 2513168Smatt.horsnell@arm.com * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 2613168Smatt.horsnell@arm.com * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 2713168Smatt.horsnell@arm.com * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 2813168Smatt.horsnell@arm.com * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 2913168Smatt.horsnell@arm.com * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 3013168Smatt.horsnell@arm.com * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 3113168Smatt.horsnell@arm.com * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 3213168Smatt.horsnell@arm.com * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 3313168Smatt.horsnell@arm.com * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 3413168Smatt.horsnell@arm.com * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 3513168Smatt.horsnell@arm.com * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 3613168Smatt.horsnell@arm.com * 3713168Smatt.horsnell@arm.com * Authors: Matt Horsnell 3813168Smatt.horsnell@arm.com * Prakash Ramrakhyani 3913168Smatt.horsnell@arm.com */ 4013168Smatt.horsnell@arm.com 4113168Smatt.horsnell@arm.com#include <cstdio> 4213168Smatt.horsnell@arm.com#include <iostream> 4313168Smatt.horsnell@arm.com#include <string> 4413168Smatt.horsnell@arm.com 4513168Smatt.horsnell@arm.com#include "crypto.hh" 4613168Smatt.horsnell@arm.com 4713168Smatt.horsnell@arm.comnamespace ArmISA { 4813168Smatt.horsnell@arm.com 4913168Smatt.horsnell@arm.comvoid 5013168Smatt.horsnell@arm.comCrypto::sha256Op( 5113168Smatt.horsnell@arm.com uint32_t *X, 5213168Smatt.horsnell@arm.com uint32_t *Y, 5313168Smatt.horsnell@arm.com uint32_t *Z) 5413168Smatt.horsnell@arm.com{ 5513168Smatt.horsnell@arm.com uint32_t T0, T1, T2, T3; 5613168Smatt.horsnell@arm.com for (int i = 0; i < 4; ++i) { 5713168Smatt.horsnell@arm.com T0 = choose(Y[0], Y[1], Y[2]); 5813168Smatt.horsnell@arm.com T1 = majority(X[0], X[1], X[2]); 5913168Smatt.horsnell@arm.com T2 = Y[3] + sigma1(Y[0]) + T0 + Z[i]; 6013168Smatt.horsnell@arm.com X[3] = T2 + X[3]; 6113168Smatt.horsnell@arm.com Y[3] = T2 + sigma0(X[0]) + T1; 6213168Smatt.horsnell@arm.com // Rotate 6313168Smatt.horsnell@arm.com T3 = Y[3]; 6413168Smatt.horsnell@arm.com Y[3] = Y[2]; Y[2] = Y[1]; Y[1] = Y[0]; Y[0] = X[3]; 6513168Smatt.horsnell@arm.com X[3] = X[2]; X[2] = X[1]; X[1] = X[0]; X[0] = T3; 6613168Smatt.horsnell@arm.com } 6713168Smatt.horsnell@arm.com} 6813168Smatt.horsnell@arm.com 6913168Smatt.horsnell@arm.comvoid 7013168Smatt.horsnell@arm.comCrypto::_sha1Op( 7113168Smatt.horsnell@arm.com uint32_t *X, 7213168Smatt.horsnell@arm.com uint32_t *Y, 7313168Smatt.horsnell@arm.com uint32_t *Z, 7413168Smatt.horsnell@arm.com SHAOp op) 7513168Smatt.horsnell@arm.com{ 7613168Smatt.horsnell@arm.com uint32_t T1, T2; 7713168Smatt.horsnell@arm.com 7813168Smatt.horsnell@arm.com for (int i = 0; i < 4; ++i) { 7913168Smatt.horsnell@arm.com switch (op) { 8013168Smatt.horsnell@arm.com case CHOOSE: T1 = choose(X[1], X[2], X[3]); break; 8113168Smatt.horsnell@arm.com case PARITY: T1 = parity(X[1], X[2], X[3]); break; 8213168Smatt.horsnell@arm.com case MAJORITY: T1 = majority(X[1], X[2], X[3]); break; 8313168Smatt.horsnell@arm.com default: return; 8413168Smatt.horsnell@arm.com } 8513168Smatt.horsnell@arm.com Y[0] += ror(X[0], 27) + T1 + Z[i]; 8613168Smatt.horsnell@arm.com X[1] = ror(X[1], 2); 8713168Smatt.horsnell@arm.com T2 = Y[0]; 8813168Smatt.horsnell@arm.com Y[0] = X[3]; 8913168Smatt.horsnell@arm.com X[3] = X[2]; X[2] = X[1]; X[1] = X[0]; X[0] = T2; 9013168Smatt.horsnell@arm.com } 9113168Smatt.horsnell@arm.com} 9213168Smatt.horsnell@arm.com 9313168Smatt.horsnell@arm.comvoid 9413168Smatt.horsnell@arm.comCrypto::sha256H( 9513168Smatt.horsnell@arm.com uint8_t *output, 9613168Smatt.horsnell@arm.com uint8_t *input, 9713168Smatt.horsnell@arm.com uint8_t *input2) 9813168Smatt.horsnell@arm.com{ 9913168Smatt.horsnell@arm.com uint32_t X[4], Y[4], Z[4]; 10013168Smatt.horsnell@arm.com load3Reg(&X[0], &Y[0], &Z[0], output, input, input2); 10113168Smatt.horsnell@arm.com sha256Op(&X[0], &Y[0], &Z[0]); 10213168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 10313168Smatt.horsnell@arm.com} 10413168Smatt.horsnell@arm.com 10513168Smatt.horsnell@arm.comvoid 10613168Smatt.horsnell@arm.comCrypto::sha256H2( 10713168Smatt.horsnell@arm.com uint8_t *output, 10813168Smatt.horsnell@arm.com uint8_t *input, 10913168Smatt.horsnell@arm.com uint8_t *input2) 11013168Smatt.horsnell@arm.com{ 11113168Smatt.horsnell@arm.com uint32_t X[4], Y[4], Z[4]; 11213168Smatt.horsnell@arm.com load3Reg(&X[0], &Y[0], &Z[0], output, input, input2); 11313168Smatt.horsnell@arm.com sha256Op(&Y[0], &X[0], &Z[0]); 11413168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 11513168Smatt.horsnell@arm.com} 11613168Smatt.horsnell@arm.com 11713168Smatt.horsnell@arm.comvoid 11813168Smatt.horsnell@arm.comCrypto::sha256Su0(uint8_t *output, uint8_t *input) 11913168Smatt.horsnell@arm.com{ 12013168Smatt.horsnell@arm.com uint32_t X[4], Y[4]; 12113168Smatt.horsnell@arm.com uint32_t T[4]; 12213168Smatt.horsnell@arm.com 12313168Smatt.horsnell@arm.com load2Reg(&X[0], &Y[0], output, input); 12413168Smatt.horsnell@arm.com 12513168Smatt.horsnell@arm.com T[3] = Y[0]; T[2] = X[3]; T[1] = X[2]; T[0] = X[1]; 12613168Smatt.horsnell@arm.com 12713168Smatt.horsnell@arm.com T[3] = ror(T[3], 7) ^ ror(T[3], 18) ^ (T[3] >> 3); 12813168Smatt.horsnell@arm.com T[2] = ror(T[2], 7) ^ ror(T[2], 18) ^ (T[2] >> 3); 12913168Smatt.horsnell@arm.com T[1] = ror(T[1], 7) ^ ror(T[1], 18) ^ (T[1] >> 3); 13013168Smatt.horsnell@arm.com T[0] = ror(T[0], 7) ^ ror(T[0], 18) ^ (T[0] >> 3); 13113168Smatt.horsnell@arm.com 13213168Smatt.horsnell@arm.com X[3] += T[3]; 13313168Smatt.horsnell@arm.com X[2] += T[2]; 13413168Smatt.horsnell@arm.com X[1] += T[1]; 13513168Smatt.horsnell@arm.com X[0] += T[0]; 13613168Smatt.horsnell@arm.com 13713168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 13813168Smatt.horsnell@arm.com} 13913168Smatt.horsnell@arm.com 14013168Smatt.horsnell@arm.comvoid 14113168Smatt.horsnell@arm.comCrypto::sha256Su1( 14213168Smatt.horsnell@arm.com uint8_t *output, 14313168Smatt.horsnell@arm.com uint8_t *input, 14413168Smatt.horsnell@arm.com uint8_t *input2) 14513168Smatt.horsnell@arm.com{ 14613168Smatt.horsnell@arm.com uint32_t X[4], Y[4], Z[4]; 14713168Smatt.horsnell@arm.com uint32_t T0[4], T1[4], T2[4], T3[4]; 14813168Smatt.horsnell@arm.com 14913168Smatt.horsnell@arm.com load3Reg(&X[0], &Y[0], &Z[0], output, input, input2); 15013168Smatt.horsnell@arm.com 15113168Smatt.horsnell@arm.com T0[3] = Z[0]; T0[2] = Y[3]; T0[1] = Y[2]; T0[0] = Y[1]; 15213168Smatt.horsnell@arm.com T1[1] = Z[3]; T1[0] = Z[2]; 15313168Smatt.horsnell@arm.com T1[1] = ror(T1[1], 17) ^ ror(T1[1], 19) ^ (T1[1] >> 10); 15413168Smatt.horsnell@arm.com T1[0] = ror(T1[0], 17) ^ ror(T1[0], 19) ^ (T1[0] >> 10); 15513168Smatt.horsnell@arm.com T3[1] = X[1] + T0[1]; T3[0] = X[0] + T0[0]; 15613168Smatt.horsnell@arm.com T1[1] = T3[1] + T1[1]; T1[0] = T3[0] + T1[0]; 15713168Smatt.horsnell@arm.com T2[1] = ror(T1[1], 17) ^ ror(T1[1], 19) ^ (T1[1] >> 10); 15813168Smatt.horsnell@arm.com T2[0] = ror(T1[0], 17) ^ ror(T1[0], 19) ^ (T1[0] >> 10); 15913168Smatt.horsnell@arm.com T3[1] = X[3] + T0[3]; T3[0] = X[2] + T0[2]; 16013168Smatt.horsnell@arm.com X[3] = T3[1] + T2[1]; 16113168Smatt.horsnell@arm.com X[2] = T3[0] + T2[0]; 16213168Smatt.horsnell@arm.com X[1] = T1[1]; X[0] = T1[0]; 16313168Smatt.horsnell@arm.com 16413168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 16513168Smatt.horsnell@arm.com} 16613168Smatt.horsnell@arm.com 16713168Smatt.horsnell@arm.comvoid 16813168Smatt.horsnell@arm.comCrypto::sha1Op( 16913168Smatt.horsnell@arm.com uint8_t *output, 17013168Smatt.horsnell@arm.com uint8_t *input, 17113168Smatt.horsnell@arm.com uint8_t *input2, 17213168Smatt.horsnell@arm.com SHAOp op) 17313168Smatt.horsnell@arm.com{ 17413168Smatt.horsnell@arm.com uint32_t X[4], Y[4], Z[4]; 17513168Smatt.horsnell@arm.com load3Reg(&X[0], &Y[0], &Z[0], output, input, input2); 17613168Smatt.horsnell@arm.com _sha1Op(&X[0], &Y[0], &Z[0], op); 17713168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 17813168Smatt.horsnell@arm.com} 17913168Smatt.horsnell@arm.com 18013168Smatt.horsnell@arm.comvoid 18113168Smatt.horsnell@arm.comCrypto::sha1C( 18213168Smatt.horsnell@arm.com uint8_t *output, 18313168Smatt.horsnell@arm.com uint8_t *input, 18413168Smatt.horsnell@arm.com uint8_t *input2) 18513168Smatt.horsnell@arm.com{ 18613168Smatt.horsnell@arm.com sha1Op(output, input, input2, CHOOSE); 18713168Smatt.horsnell@arm.com} 18813168Smatt.horsnell@arm.com 18913168Smatt.horsnell@arm.comvoid 19013168Smatt.horsnell@arm.comCrypto::sha1P( 19113168Smatt.horsnell@arm.com uint8_t *output, 19213168Smatt.horsnell@arm.com uint8_t *input, 19313168Smatt.horsnell@arm.com uint8_t *input2) 19413168Smatt.horsnell@arm.com{ 19513168Smatt.horsnell@arm.com sha1Op(output, input, input2, PARITY); 19613168Smatt.horsnell@arm.com} 19713168Smatt.horsnell@arm.com 19813168Smatt.horsnell@arm.comvoid 19913168Smatt.horsnell@arm.comCrypto::sha1M( 20013168Smatt.horsnell@arm.com uint8_t *output, 20113168Smatt.horsnell@arm.com uint8_t *input, 20213168Smatt.horsnell@arm.com uint8_t *input2) 20313168Smatt.horsnell@arm.com{ 20413168Smatt.horsnell@arm.com sha1Op(output, input, input2, MAJORITY); 20513168Smatt.horsnell@arm.com} 20613168Smatt.horsnell@arm.com 20713168Smatt.horsnell@arm.comvoid 20813168Smatt.horsnell@arm.comCrypto::sha1H(uint8_t *output, uint8_t *input) 20913168Smatt.horsnell@arm.com{ 21013168Smatt.horsnell@arm.com uint32_t X[4], Y[4]; 21113168Smatt.horsnell@arm.com load2Reg(&X[0], &Y[0], output, input); 21213168Smatt.horsnell@arm.com X[0] = ror(Y[0], 2); 21313168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 21413168Smatt.horsnell@arm.com} 21513168Smatt.horsnell@arm.com 21613168Smatt.horsnell@arm.comvoid 21713168Smatt.horsnell@arm.comCrypto::sha1Su0( 21813168Smatt.horsnell@arm.com uint8_t *output, 21913168Smatt.horsnell@arm.com uint8_t *input, 22013168Smatt.horsnell@arm.com uint8_t *input2) 22113168Smatt.horsnell@arm.com{ 22213168Smatt.horsnell@arm.com uint32_t X[4], Y[4], Z[4], T[4]; 22313168Smatt.horsnell@arm.com load3Reg(&X[0], &Y[0], &Z[0], output, input, input2); 22413168Smatt.horsnell@arm.com 22513168Smatt.horsnell@arm.com T[3] = Y[1]; T[2] = Y[0]; T[1] = X[3]; T[0] = X[2]; 22613168Smatt.horsnell@arm.com X[3] = T[3] ^ X[3] ^ Z[3]; 22713168Smatt.horsnell@arm.com X[2] = T[2] ^ X[2] ^ Z[2]; 22813168Smatt.horsnell@arm.com X[1] = T[1] ^ X[1] ^ Z[1]; 22913168Smatt.horsnell@arm.com X[0] = T[0] ^ X[0] ^ Z[0]; 23013168Smatt.horsnell@arm.com 23113168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 23213168Smatt.horsnell@arm.com} 23313168Smatt.horsnell@arm.com 23413168Smatt.horsnell@arm.comvoid 23513168Smatt.horsnell@arm.comCrypto::sha1Su1(uint8_t *output, uint8_t *input) 23613168Smatt.horsnell@arm.com{ 23713168Smatt.horsnell@arm.com uint32_t X[4], Y[4], T[4]; 23813168Smatt.horsnell@arm.com load2Reg(&X[0], &Y[0], output, input); 23913168Smatt.horsnell@arm.com 24013168Smatt.horsnell@arm.com T[3] = X[3] ^ 0x0; 24113168Smatt.horsnell@arm.com T[2] = X[2] ^ Y[3]; 24213168Smatt.horsnell@arm.com T[1] = X[1] ^ Y[2]; 24313168Smatt.horsnell@arm.com T[0] = X[0] ^ Y[1]; 24413168Smatt.horsnell@arm.com X[2] = ror(T[2], 31); X[1] = ror(T[1], 31); X[0] = ror(T[0], 31); 24513168Smatt.horsnell@arm.com X[3] = ror(T[3], 31) ^ ror(T[0], 30); 24613168Smatt.horsnell@arm.com 24713168Smatt.horsnell@arm.com store1Reg(output, &X[0]); 24813168Smatt.horsnell@arm.com} 24913168Smatt.horsnell@arm.com 25013168Smatt.horsnell@arm.comvoid 25113168Smatt.horsnell@arm.comCrypto::load2Reg( 25213168Smatt.horsnell@arm.com uint32_t *X, 25313168Smatt.horsnell@arm.com uint32_t *Y, 25413168Smatt.horsnell@arm.com uint8_t *output, 25513168Smatt.horsnell@arm.com uint8_t *input) 25613168Smatt.horsnell@arm.com{ 25713168Smatt.horsnell@arm.com for (int i = 0; i < 4; ++i) { 25813168Smatt.horsnell@arm.com X[i] = *((uint32_t *)&output[i*4]); 25913168Smatt.horsnell@arm.com Y[i] = *((uint32_t *)&input[i*4]); 26013168Smatt.horsnell@arm.com } 26113168Smatt.horsnell@arm.com} 26213168Smatt.horsnell@arm.com 26313168Smatt.horsnell@arm.comvoid 26413168Smatt.horsnell@arm.comCrypto::load3Reg( 26513168Smatt.horsnell@arm.com uint32_t *X, 26613168Smatt.horsnell@arm.com uint32_t *Y, 26713168Smatt.horsnell@arm.com uint32_t *Z, 26813168Smatt.horsnell@arm.com uint8_t *output, 26913168Smatt.horsnell@arm.com uint8_t *input, 27013168Smatt.horsnell@arm.com uint8_t *input2) 27113168Smatt.horsnell@arm.com{ 27213168Smatt.horsnell@arm.com for (int i = 0; i < 4; ++i) { 27313168Smatt.horsnell@arm.com X[i] = *((uint32_t *)&output[i*4]); 27413168Smatt.horsnell@arm.com Y[i] = *((uint32_t *)&input[i*4]); 27513168Smatt.horsnell@arm.com Z[i] = *((uint32_t *)&input2[i*4]); 27613168Smatt.horsnell@arm.com } 27713168Smatt.horsnell@arm.com} 27813168Smatt.horsnell@arm.com 27913168Smatt.horsnell@arm.comvoid 28013168Smatt.horsnell@arm.comCrypto::store1Reg(uint8_t *output, uint32_t *X) 28113168Smatt.horsnell@arm.com{ 28213168Smatt.horsnell@arm.com for (int i = 0; i < 4; ++i) { 28313168Smatt.horsnell@arm.com output[i*4] = (uint8_t)(X[i]); 28413168Smatt.horsnell@arm.com output[i*4+1] = (uint8_t)(X[i] >> 8); 28513168Smatt.horsnell@arm.com output[i*4+2] = (uint8_t)(X[i] >> 16); 28613168Smatt.horsnell@arm.com output[i*4+3] = (uint8_t)(X[i] >> 24); 28713168Smatt.horsnell@arm.com } 28813168Smatt.horsnell@arm.com} 28913168Smatt.horsnell@arm.com 29013168Smatt.horsnell@arm.com} // namespace ArmISA 291