1use core::convert::TryInto;
2
3pub struct Sha256Ctx {
4 h: [u32; 8],
5 len_bits: u64,
6 buf: [u8; 64],
7 buf_len: usize,
8}
9
10const SHA256_K: [u32; 64] = [
11 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
12 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
13 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
14 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
15 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
16 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
17 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
18 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
19 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
20 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
21 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
22 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
23 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
24 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
25 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
26 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
27];
28
29fn rotr32(x: u32, n: u32) -> u32 { (x >> n) | (x << (32 - n)) }
30
31fn read_be_u32(block: &[u8], off: usize) -> u32 {
32 u32::from_be_bytes([block[off], block[off + 1], block[off + 2], block[off + 3]])
33}
34
35impl Sha256Ctx {
36 pub fn new() -> Self {
37 Sha256Ctx {
38 h: [
39 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
40 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
41 ],
42 len_bits: 0,
43 buf: [0u8; 64],
44 buf_len: 0,
45 }
46 }
47
48 fn compress(&mut self, block: &[u8; 64]) {
49 let mut w = [0u32; 64];
50 for t in 0..16 {
51 let off = t * 4;
52 w[t] = read_be_u32(block, off);
53 }
54 for t in 16..64 {
55 let s0 = rotr32(w[t-15], 7) ^ rotr32(w[t-15], 18) ^ (w[t-15] >> 3);
56 let s1 = rotr32(w[t-2], 17) ^ rotr32(w[t-2], 19) ^ (w[t-2] >> 10);
57 w[t] = w[t-16].wrapping_add(s0).wrapping_add(w[t-7]).wrapping_add(s1);
58 }
59 let mut a = self.h[0];
60 let mut b = self.h[1];
61 let mut c = self.h[2];
62 let mut d = self.h[3];
63 let mut e = self.h[4];
64 let mut f = self.h[5];
65 let mut g = self.h[6];
66 let mut h = self.h[7];
67 for t in 0..64 {
68 let s1 = rotr32(e, 6) ^ rotr32(e, 11) ^ rotr32(e, 25);
69 let ch = (e & f) ^ ((!e) & g);
70 let temp1 = h.wrapping_add(s1).wrapping_add(ch).wrapping_add(SHA256_K[t]).wrapping_add(w[t]);
71 let s0 = rotr32(a, 2) ^ rotr32(a, 13) ^ rotr32(a, 22);
72 let maj = (a & b) ^ (a & c) ^ (b & c);
73 let temp2 = s0.wrapping_add(maj);
74 h = g;
75 g = f;
76 f = e;
77 e = d.wrapping_add(temp1);
78 d = c;
79 c = b;
80 b = a;
81 a = temp1.wrapping_add(temp2);
82 }
83 self.h[0] = self.h[0].wrapping_add(a);
84 self.h[1] = self.h[1].wrapping_add(b);
85 self.h[2] = self.h[2].wrapping_add(c);
86 self.h[3] = self.h[3].wrapping_add(d);
87 self.h[4] = self.h[4].wrapping_add(e);
88 self.h[5] = self.h[5].wrapping_add(f);
89 self.h[6] = self.h[6].wrapping_add(g);
90 self.h[7] = self.h[7].wrapping_add(h);
91 }
92
93 pub fn update(&mut self, mut data: &[u8]) {
94 self.len_bits = self.len_bits.wrapping_add((data.len() as u64) << 3);
95 if self.buf_len > 0 {
96 let need = 64 - self.buf_len;
97 if data.len() >= need {
98 self.buf[self.buf_len..].copy_from_slice(&data[..need]);
99 let block = self.buf;
100 self.compress(&block);
101 self.buf_len = 0;
102 data = &data[need..];
103 } else {
104 self.buf[self.buf_len..self.buf_len + data.len()].copy_from_slice(data);
105 self.buf_len += data.len();
106 return;
107 }
108 }
109 while data.len() >= 64 {
110 let block: &[u8;64] = match data[..64].try_into() { Ok(b) => b, Err(_) => unreachable!() };
111 self.compress(block);
112 data = &data[64..];
113 }
114 if !data.is_empty() {
115 self.buf[..data.len()].copy_from_slice(data);
116 self.buf_len = data.len();
117 }
118 }
119
120 pub fn finalize(&mut self, out: &mut [u8;32]) {
121 let msg_len_bits = self.len_bits;
122 self.buf[self.buf_len] = 0x80;
123 self.buf_len += 1;
124
125 if self.buf_len > 56 {
126 for b in &mut self.buf[self.buf_len..64] {
127 *b = 0;
128 }
129 let block = self.buf;
130 self.compress(&block);
131 self.buf_len = 0;
132 }
133
134 for b in &mut self.buf[self.buf_len..56] {
135 *b = 0;
136 }
137 self.buf[56..64].copy_from_slice(&msg_len_bits.to_be_bytes());
138 let block = self.buf;
139 self.compress(&block);
140
141 self.buf_len = 0;
142 for (i, v) in self.h.iter().enumerate() {
143 let bytes = v.to_be_bytes();
144 out[i*4..i*4+4].copy_from_slice(&bytes);
145 }
146 }
147}
148
149pub fn sha256_bytes(data: &[u8], out: &mut [u8;32]) {
150 let mut c = Sha256Ctx::new();
151 c.update(data);
152 c.finalize(out);
153}
154
155pub struct Sha512Ctx {
156 h: [u64;8],
157 len_bits: u128,
158 buf: [u8; 128],
159 buf_len: usize,
160}
161
162const SHA512_K: [u64; 80] = [
163 0x428a2f98d728ae22,0x7137449123ef65cd,0xb5c0fbcfec4d3b2f,0xe9b5dba58189dbbc,
164 0x3956c25bf348b538,0x59f111f1b605d019,0x923f82a4af194f9b,0xab1c5ed5da6d8118,
165 0xd807aa98a3030242,0x12835b0145706fbe,0x243185be4ee4b28c,0x550c7dc3d5ffb4e2,
166 0x72be5d74f27b896f,0x80deb1fe3b1696b1,0x9bdc06a725c71235,0xc19bf174cf692694,
167 0xe49b69c19ef14ad2,0xefbe4786384f25e3,0x0fc19dc68b8cd5b5,0x240ca1cc77ac9c65,
168 0x2de92c6f592b0275,0x4a7484aa6ea6e483,0x5cb0a9dcbd41fbd4,0x76f988da831153b5,
169 0x983e5152ee66dfab,0xa831c66d2db43210,0xb00327c898fb213f,0xbf597fc7beef0ee4,
170 0xc6e00bf33da88fc2,0xd5a79147930aa725,0x06ca6351e003826f,0x142929670a0e6e70,
171 0x27b70a8546d22ffc,0x2e1b21385c26c926,0x4d2c6dfc5ac42aed,0x53380d139d95b3df,
172 0x650a73548baf63de,0x766a0abb3c77b2a8,0x81c2c92e47edaee6,0x92722c851482353b,
173 0xa2bfe8a14cf10364,0xa81a664bbc423001,0xc24b8b70d0f89791,0xc76c51a30654be30,
174 0xd192e819d6ef5218,0xd69906245565a910,0xf40e35855771202a,0x106aa07032bbd1b8,
175 0x19a4c116b8d2d0c8,0x1e376c085141ab53,0x2748774cdf8eeb99,0x34b0bcb5e19b48a8,
176 0x391c0cb3c5c95a63,0x4ed8aa4ae3418acb,0x5b9cca4f7763e373,0x682e6ff3d6b2b8a3,
177 0x748f82ee5defb2fc,0x78a5636f43172f60,0x84c87814a1f0ab72,0x8cc702081a6439ec,
178 0x90befffa23631e28,0xa4506cebde82bde9,0xbef9a3f7b2c67915,0xc67178f2e372532b,
179 0xca273eceea26619c,0xd186b8c721c0c207,0xeada7dd6cde0eb1e,0xf57d4f7fee6ed178,
180 0x06f067aa72176fba,0x0a637dc5a2c898a6,0x113f9804bef90dae,0x1b710b35131c471b,
181 0x28db77f523047d84,0x32caab7b40c72493,0x3c9ebe0a15c9bebc,0x431d67c49c100d4c,
182 0x4cc5d4becb3e42b6,0x597f299cfc657e2a,0x5fcb6fab3ad6faec,0x6c44198c4a475817,
183];
184
185fn rotr64(x: u64, n: u32) -> u64 { (x >> n) | (x << (64 - n)) }
186
187fn read_be_u64(block: &[u8], off: usize) -> u64 {
188 u64::from_be_bytes([
189 block[off],
190 block[off + 1],
191 block[off + 2],
192 block[off + 3],
193 block[off + 4],
194 block[off + 5],
195 block[off + 6],
196 block[off + 7],
197 ])
198}
199
200impl Sha512Ctx {
201 pub fn new() -> Self {
202 Sha512Ctx {
203 h: [
204 0x6a09e667f3bcc908,0xbb67ae8584caa73b,0x3c6ef372fe94f82b,0xa54ff53a5f1d36f1,
205 0x510e527fade682d1,0x9b05688c2b3e6c1f,0x1f83d9abfb41bd6b,0x5be0cd19137e2179,
206 ],
207 len_bits: 0,
208 buf: [0u8; 128],
209 buf_len: 0,
210 }
211 }
212
213 fn compress(&mut self, block: &[u8;128]) {
214 let mut w = [0u64; 80];
215 for t in 0..16 {
216 let off = t * 8;
217 w[t] = read_be_u64(block, off);
218 }
219 for t in 16..80 {
220 let s0 = rotr64(w[t-15], 1) ^ rotr64(w[t-15], 8) ^ (w[t-15] >> 7);
221 let s1 = rotr64(w[t-2], 19) ^ rotr64(w[t-2], 61) ^ (w[t-2] >> 6);
222 w[t] = w[t-16].wrapping_add(s0).wrapping_add(w[t-7]).wrapping_add(s1);
223 }
224 let mut a = self.h[0];
225 let mut b = self.h[1];
226 let mut c = self.h[2];
227 let mut d = self.h[3];
228 let mut e = self.h[4];
229 let mut f = self.h[5];
230 let mut g = self.h[6];
231 let mut h = self.h[7];
232 for t in 0..80 {
233 let s1 = rotr64(e, 14) ^ rotr64(e, 18) ^ rotr64(e, 41);
234 let ch = (e & f) ^ ((!e) & g);
235 let temp1 = h.wrapping_add(s1).wrapping_add(ch).wrapping_add(SHA512_K[t]).wrapping_add(w[t]);
236 let s0 = rotr64(a, 28) ^ rotr64(a, 34) ^ rotr64(a, 39);
237 let maj = (a & b) ^ (a & c) ^ (b & c);
238 let temp2 = s0.wrapping_add(maj);
239 h = g;
240 g = f;
241 f = e;
242 e = d.wrapping_add(temp1);
243 d = c;
244 c = b;
245 b = a;
246 a = temp1.wrapping_add(temp2);
247 }
248 for i in 0..8 { self.h[i] = self.h[i].wrapping_add([a,b,c,d,e,f,g,h][i]); }
249 }
250
251 pub fn update(&mut self, mut data: &[u8]) {
252 self.len_bits = self.len_bits.wrapping_add((data.len() as u128) << 3);
253 if self.buf_len > 0 {
254 let need = 128 - self.buf_len;
255 if data.len() >= need {
256 self.buf[self.buf_len..].copy_from_slice(&data[..need]);
257 let block = self.buf;
258 self.compress(&block);
259 self.buf_len = 0;
260 data = &data[need..];
261 } else {
262 self.buf[self.buf_len..self.buf_len + data.len()].copy_from_slice(data);
263 self.buf_len += data.len();
264 return;
265 }
266 }
267 while data.len() >= 128 {
268 let block: &[u8;128] = match data[..128].try_into() { Ok(b) => b, Err(_) => unreachable!() };
269 self.compress(block);
270 data = &data[128..];
271 }
272 if !data.is_empty() {
273 self.buf[..data.len()].copy_from_slice(data);
274 self.buf_len = data.len();
275 }
276 }
277
278 pub fn finalize(&mut self, out: &mut [u8;64]) {
279 let msg_len_bits = self.len_bits;
280 self.buf[self.buf_len] = 0x80;
281 self.buf_len += 1;
282
283 if self.buf_len > 112 {
284 for b in &mut self.buf[self.buf_len..128] {
285 *b = 0;
286 }
287 let block = self.buf;
288 self.compress(&block);
289 self.buf_len = 0;
290 }
291
292 for b in &mut self.buf[self.buf_len..112] {
293 *b = 0;
294 }
295 self.buf[112..128].copy_from_slice(&msg_len_bits.to_be_bytes());
296 let block = self.buf;
297 self.compress(&block);
298
299 self.buf_len = 0;
300 for (i, v) in self.h.iter().enumerate() {
301 let bytes = v.to_be_bytes();
302 out[i*8..i*8+8].copy_from_slice(&bytes);
303 }
304 }
305}
306
307pub fn sha512_bytes(data: &[u8], out: &mut [u8;64]) {
308 let mut c = Sha512Ctx::new();
309 c.update(data);
310 c.finalize(out);
311}