noxtls-crypto 0.2.12

// Copyright (c) 2019-2026, Argenox Technologies LLC
// All rights reserved.
//
// SPDX-License-Identifier: GPL-2.0-only OR LicenseRef-Argenox-Commercial-License
//
// This file is part of the NoxTLS Library.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by the
// Free Software Foundation; version 2 of the License.
//
// Alternatively, this file may be used under the terms of a commercial
// license from Argenox Technologies LLC.
//
// See `noxtls/LICENSE` and `noxtls/LICENSE.md` in this repository for full details.
// CONTACT: info@argenox.com

use super::Digest;
use crate::internal_alloc::Vec;

const SHA256_K: [u32; 64] = [
    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
];

/// Implements SHA-256 compression and streaming digest state.
#[derive(Debug, Clone)]
pub struct Sha256 {
    state: [u32; 8],
    buffer: [u8; 64],
    buffer_len: usize,
    bit_len: u64,
}

impl Default for Sha256 {
    fn default() -> Self {
        Self {
            state: [
                0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab,
                0x5be0cd19,
            ],
            buffer: [0; 64],
            buffer_len: 0,
            bit_len: 0,
        }
    }
}

impl Sha256 {
    pub fn noxtls_new() -> Self {
        Self::default()
    }

    #[inline(always)]
    fn compress(&mut self, block: &[u8; 64]) {
        compress_block(&mut self.state, block);
    }

    pub(crate) fn finalize_array(mut self) -> [u8; 32] {
        self.buffer[self.buffer_len] = 0x80;
        self.buffer_len += 1;

        if self.buffer_len > 56 {
            self.buffer[self.buffer_len..].fill(0);
            compress_block(&mut self.state, &self.buffer);
            self.buffer_len = 0;
        }

        self.buffer[self.buffer_len..56].fill(0);
        self.buffer[56..64].copy_from_slice(&self.bit_len.to_be_bytes());
        compress_block(&mut self.state, &self.buffer);

        let mut out = [0_u8; 32];
        for (chunk, word) in out.chunks_exact_mut(4).zip(self.state) {
            chunk.copy_from_slice(&word.to_be_bytes());
        }
        out
    }
}

impl Digest for Sha256 {
    fn noxtls_update(&mut self, mut data: &[u8]) {
        self.bit_len = self.bit_len.wrapping_add((data.len() as u64) * 8);

        if self.buffer_len > 0 {
            let to_copy = (64 - self.buffer_len).min(data.len());
            self.buffer[self.buffer_len..self.buffer_len + to_copy]
                .copy_from_slice(&data[..to_copy]);
            self.buffer_len += to_copy;
            data = &data[to_copy..];

            if self.buffer_len < 64 {
                return;
            }

            compress_block(&mut self.state, &self.buffer);
            self.buffer_len = 0;
        }

        while data.len() >= 64 {
            let block = data[..64].try_into().expect("full block");
            self.compress(block);
            data = &data[64..];
        }

        if !data.is_empty() {
            self.buffer[..data.len()].copy_from_slice(data);
            self.buffer_len = data.len();
        }
    }

    fn finalize(self) -> Vec<u8> {
        self.finalize_array().to_vec()
    }
}

/// Compresses one 512-bit block into the eight working state words.
///
/// Uses a 16-word rolling schedule so the message expansion stays in registers
/// and on a small stack footprint. This reduces memory traffic on Cortex-M.
fn compress_block(state: &mut [u32; 8], block: &[u8; 64]) {
    macro_rules! sha256_round {
        ($a:ident, $b:ident, $c:ident, $d:ident, $e:ident, $f:ident, $g:ident, $h:ident, $wk:expr, $k:expr) => {{
            let t1 = $h
                .wrapping_add(big_sigma1($e))
                .wrapping_add(ch($e, $f, $g))
                .wrapping_add($k)
                .wrapping_add($wk);
            let t2 = big_sigma0($a).wrapping_add(maj($a, $b, $c));
            $d = $d.wrapping_add(t1);
            $h = t1.wrapping_add(t2);
        }};
    }

    macro_rules! sha256_round_t {
        ($t:expr, $a:ident, $b:ident, $c:ident, $d:ident, $e:ident, $f:ident, $g:ident, $h:ident, $w:ident) => {{
            let wt = schedule_or_load_word(block, &mut $w, $t);
            sha256_round!($a, $b, $c, $d, $e, $f, $g, $h, wt, SHA256_K[$t]);
        }};
    }

    macro_rules! sha256_rounds8 {
        ($start:expr, $a:ident, $b:ident, $c:ident, $d:ident, $e:ident, $f:ident, $g:ident, $h:ident, $w:ident) => {{
            sha256_round_t!($start + 0, $a, $b, $c, $d, $e, $f, $g, $h, $w);
            sha256_round_t!($start + 1, $h, $a, $b, $c, $d, $e, $f, $g, $w);
            sha256_round_t!($start + 2, $g, $h, $a, $b, $c, $d, $e, $f, $w);
            sha256_round_t!($start + 3, $f, $g, $h, $a, $b, $c, $d, $e, $w);
            sha256_round_t!($start + 4, $e, $f, $g, $h, $a, $b, $c, $d, $w);
            sha256_round_t!($start + 5, $d, $e, $f, $g, $h, $a, $b, $c, $w);
            sha256_round_t!($start + 6, $c, $d, $e, $f, $g, $h, $a, $b, $w);
            sha256_round_t!($start + 7, $b, $c, $d, $e, $f, $g, $h, $a, $w);
        }};
    }

    let mut w = [0_u32; 16];
    let mut a = state[0];
    let mut b = state[1];
    let mut c = state[2];
    let mut d = state[3];
    let mut e = state[4];
    let mut f = state[5];
    let mut g = state[6];
    let mut h = state[7];

    sha256_rounds8!(0, a, b, c, d, e, f, g, h, w);
    sha256_rounds8!(8, a, b, c, d, e, f, g, h, w);
    sha256_rounds8!(16, a, b, c, d, e, f, g, h, w);
    sha256_rounds8!(24, a, b, c, d, e, f, g, h, w);
    sha256_rounds8!(32, a, b, c, d, e, f, g, h, w);
    sha256_rounds8!(40, a, b, c, d, e, f, g, h, w);
    sha256_rounds8!(48, a, b, c, d, e, f, g, h, w);
    sha256_rounds8!(56, a, b, c, d, e, f, g, h, w);

    state[0] = state[0].wrapping_add(a);
    state[1] = state[1].wrapping_add(b);
    state[2] = state[2].wrapping_add(c);
    state[3] = state[3].wrapping_add(d);
    state[4] = state[4].wrapping_add(e);
    state[5] = state[5].wrapping_add(f);
    state[6] = state[6].wrapping_add(g);
    state[7] = state[7].wrapping_add(h);
}

#[inline(always)]
fn schedule_or_load_word(block: &[u8; 64], w: &mut [u32; 16], t: usize) -> u32 {
    if t < 16 {
        let word = load_be_word(block, t);
        w[t] = word;
        word
    } else {
        let slot = t & 15;
        let word = w[slot]
            .wrapping_add(small_sigma0(w[(t + 1) & 15]))
            .wrapping_add(w[(t + 9) & 15])
            .wrapping_add(small_sigma1(w[(t + 14) & 15]));
        w[slot] = word;
        word
    }
}

#[inline(always)]
fn load_be_word(block: &[u8; 64], index: usize) -> u32 {
    let offset = index * 4;
    ((block[offset] as u32) << 24)
        | ((block[offset + 1] as u32) << 16)
        | ((block[offset + 2] as u32) << 8)
        | (block[offset + 3] as u32)
}

#[inline(always)]
fn ch(x: u32, y: u32, z: u32) -> u32 {
    z ^ (x & (y ^ z))
}

#[inline(always)]
fn maj(x: u32, y: u32, z: u32) -> u32 {
    (x & (y | z)) | (y & z)
}

#[inline(always)]
fn big_sigma0(x: u32) -> u32 {
    x.rotate_right(2) ^ x.rotate_right(13) ^ x.rotate_right(22)
}

#[inline(always)]
fn big_sigma1(x: u32) -> u32 {
    x.rotate_right(6) ^ x.rotate_right(11) ^ x.rotate_right(25)
}

#[inline(always)]
fn small_sigma0(x: u32) -> u32 {
    x.rotate_right(7) ^ x.rotate_right(18) ^ (x >> 3)
}

#[inline(always)]
fn small_sigma1(x: u32) -> u32 {
    x.rotate_right(17) ^ x.rotate_right(19) ^ (x >> 10)
}

/// Computes SHA-256 of `data` and returns the 32-byte digest.
#[must_use]
pub fn noxtls_sha256(data: &[u8]) -> [u8; 32] {
    let mut hasher = Sha256::noxtls_new();
    hasher.noxtls_update(data);
    hasher.finalize_array()
}

#[cfg(test)]
mod tests {
    use super::{compress_block, noxtls_sha256, Sha256};
    use crate::hash::mdigest::Digest;

    #[test]
    fn empty_input_vector() {
        let digest = noxtls_sha256(b"");
        let expected = [
            0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f,
            0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b,
            0x78, 0x52, 0xb8, 0x55,
        ];
        assert_eq!(digest, expected);
    }

    #[test]
    fn abc_vector() {
        let digest = noxtls_sha256(b"abc");
        let expected = [
            0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde, 0x5d, 0xae,
            0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c, 0xb4, 0x10, 0xff, 0x61,
            0xf2, 0x00, 0x15, 0xad,
        ];
        assert_eq!(digest, expected);
    }

    #[test]
    fn incremental_matches_one_shot() {
        let data = [0x5au8; 1024];
        let one_shot = noxtls_sha256(&data);
        let mut hasher = Sha256::noxtls_new();
        hasher.noxtls_update(&data[..400]);
        hasher.noxtls_update(&data[400..]);
        let incremental = hasher.finalize_array();
        assert_eq!(one_shot, incremental);
    }

    #[test]
    fn compress_block_is_deterministic() {
        let mut state = [
            0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab,
            0x5be0cd19,
        ];
        let block = [0u8; 64];
        compress_block(&mut state, &block);
        assert_ne!(
            state,
            [
                0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab,
                0x5be0cd19
            ]
        );
    }
}