From c5a1df04ea6c560aea72e60dc1eb022cb3763d5f Mon Sep 17 00:00:00 2001 From: James Clarke Date: Sun, 6 Nov 2016 19:49:59 +0000 Subject: [PATCH] Fix unaligned memory accesses; fixes #108 --- cbits/cryptonite_bitfn.h | 80 +++++++++++++++++++++++++++++++++++++++++++++ cbits/cryptonite_chacha.c | 39 ++++++++++------------ cbits/cryptonite_md5.c | 25 +++++++------- cbits/cryptonite_poly1305.c | 33 ++++++++----------- cbits/cryptonite_salsa.c | 39 ++++++++++------------ cbits/cryptonite_scrypt.c | 14 ++------ cbits/cryptonite_sha1.c | 19 +++++------ cbits/cryptonite_sha256.c | 14 ++++---- cbits/cryptonite_sha3.c | 16 ++++----- cbits/cryptonite_sha512.c | 17 ++++++---- 10 files changed, 177 insertions(+), 119 deletions(-) diff --git a/cbits/cryptonite_bitfn.h b/cbits/cryptonite_bitfn.h index 3a00dd8..dfb5eb9 100644 --- a/cbits/cryptonite_bitfn.h +++ b/cbits/cryptonite_bitfn.h @@ -165,6 +165,86 @@ static inline void array_copy64(uint64_t *d, uint64_t *s, uint32_t nb) } #endif +static inline uint32_t load_be32(const uint8_t *p) +{ + return ((uint32_t)p[0] << 24) | + ((uint32_t)p[1] << 16) | + ((uint32_t)p[2] << 8) | + ((uint32_t)p[3] ); +} + +static inline uint64_t load_be64(const uint8_t *p) +{ + return ((uint64_t)p[0] << 56) | + ((uint64_t)p[1] << 48) | + ((uint64_t)p[2] << 40) | + ((uint64_t)p[3] << 32) | + ((uint64_t)p[4] << 24) | + ((uint64_t)p[5] << 16) | + ((uint64_t)p[6] << 8) | + ((uint64_t)p[7] ); +} + +static inline void store_be32(uint8_t *p, uint32_t val) +{ + p[0] = (val >> 24); + p[1] = (val >> 16) & 0xFF; + p[2] = (val >> 8) & 0xFF; + p[3] = (val ) & 0xFF; +} + +static inline void store_be64(uint8_t *p, uint64_t val) +{ + p[0] = (val >> 56); + p[1] = (val >> 48) & 0xFF; + p[2] = (val >> 40) & 0xFF; + p[3] = (val >> 32) & 0xFF; + p[4] = (val >> 24) & 0xFF; + p[5] = (val >> 16) & 0xFF; + p[6] = (val >> 8) & 0xFF; + p[7] = (val ) & 0xFF; +} + +static inline uint32_t load_le32(const uint8_t *p) +{ + return ((uint32_t)p[0] ) | + ((uint32_t)p[1] << 8) | + ((uint32_t)p[2] << 16) | + ((uint32_t)p[3] << 24); +} + +static inline uint64_t load_le64(const uint8_t *p) +{ + return ((uint64_t)p[0] ) | + ((uint64_t)p[1] << 8) | + ((uint64_t)p[2] << 16) | + ((uint64_t)p[3] << 24) | + ((uint64_t)p[4] << 32) | + ((uint64_t)p[5] << 40) | + ((uint64_t)p[6] << 48) | + ((uint64_t)p[7] << 56); +} + +static inline void store_le32(uint8_t *p, uint32_t val) +{ + p[0] = (val ) & 0xFF; + p[1] = (val >> 8) & 0xFF; + p[2] = (val >> 16) & 0xFF; + p[3] = (val >> 24); +} + +static inline void store_le64(uint8_t *p, uint64_t val) +{ + p[0] = (val ) & 0xFF; + p[1] = (val >> 8) & 0xFF; + p[2] = (val >> 16) & 0xFF; + p[3] = (val >> 24) & 0xFF; + p[4] = (val >> 32) & 0xFF; + p[5] = (val >> 40) & 0xFF; + p[6] = (val >> 48) & 0xFF; + p[7] = (val >> 56); +} + #ifdef __GNUC__ #define bitfn_ntz(n) __builtin_ctz(n) #else diff --git a/cbits/cryptonite_chacha.c b/cbits/cryptonite_chacha.c index 24e3ec0..4ee6f44 100644 --- a/cbits/cryptonite_chacha.c +++ b/cbits/cryptonite_chacha.c @@ -46,11 +46,6 @@ static const uint8_t sigma[16] = "expand 32-byte k"; static const uint8_t tau[16] = "expand 16-byte k"; -static inline uint32_t load32(const uint8_t *p) -{ - return le32_to_cpu(*((uint32_t *) p)); -} - static void chacha_core(int rounds, block *out, const cryptonite_chacha_state *in) { uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; @@ -104,33 +99,33 @@ void cryptonite_chacha_init_core(cryptonite_chacha_state *st, const uint8_t *constants = (keylen == 32) ? sigma : tau; int i; - st->d[0] = load32(constants + 0); - st->d[1] = load32(constants + 4); - st->d[2] = load32(constants + 8); - st->d[3] = load32(constants + 12); + st->d[0] = load_le32(constants + 0); + st->d[1] = load_le32(constants + 4); + st->d[2] = load_le32(constants + 8); + st->d[3] = load_le32(constants + 12); - st->d[4] = load32(key + 0); - st->d[5] = load32(key + 4); - st->d[6] = load32(key + 8); - st->d[7] = load32(key + 12); + st->d[4] = load_le32(key + 0); + st->d[5] = load_le32(key + 4); + st->d[6] = load_le32(key + 8); + st->d[7] = load_le32(key + 12); /* we repeat the key on 128 bits */ if (keylen == 32) key += 16; - st->d[8] = load32(key + 0); - st->d[9] = load32(key + 4); - st->d[10] = load32(key + 8); - st->d[11] = load32(key + 12); + st->d[8] = load_le32(key + 0); + st->d[9] = load_le32(key + 4); + st->d[10] = load_le32(key + 8); + st->d[11] = load_le32(key + 12); st->d[12] = 0; switch (ivlen) { case 8: st->d[13] = 0; - st->d[14] = load32(iv + 0); - st->d[15] = load32(iv + 4); + st->d[14] = load_le32(iv + 0); + st->d[15] = load_le32(iv + 4); break; case 12: - st->d[13] = load32(iv + 0); - st->d[14] = load32(iv + 4); - st->d[15] = load32(iv + 8); + st->d[13] = load_le32(iv + 0); + st->d[14] = load_le32(iv + 4); + st->d[15] = load_le32(iv + 8); default: return; } diff --git a/cbits/cryptonite_md5.c b/cbits/cryptonite_md5.c index 4612a5e..3c4df08 100644 --- a/cbits/cryptonite_md5.c +++ b/cbits/cryptonite_md5.c @@ -44,15 +44,15 @@ void cryptonite_md5_init(struct md5_ctx *ctx) #define f4(x, y, z) (y ^ (x | ~z)) #define R(f, a, b, c, d, i, k, s) a += f(b, c, d) + w[i] + k; a = rol32(a, s); a += b -static void md5_do_chunk(struct md5_ctx *ctx, uint32_t *buf) +static void md5_do_chunk(struct md5_ctx *ctx, const uint8_t *buf) { uint32_t a, b, c, d; -#ifdef ARCH_IS_BIG_ENDIAN uint32_t w[16]; - cpu_to_le32_array(w, buf, 16); -#else - uint32_t *w = buf; -#endif +#define CPY(i) w[i] = load_le32(buf+4*i) + CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7); + CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15); +#undef CPY + a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; R(f1, a, b, c, d, 0, 0xd76aa478, 7); @@ -137,7 +137,7 @@ void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t le if (index && len >= to_fill) { memcpy(ctx->buf + index, data, to_fill); - md5_do_chunk(ctx, (uint32_t *) ctx->buf); + md5_do_chunk(ctx, ctx->buf); len -= to_fill; data += to_fill; index = 0; @@ -145,7 +145,7 @@ void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t le /* process as much 64-block as possible */ for (; len >= 64; len -= 64, data += 64) - md5_do_chunk(ctx, (uint32_t *) data); + md5_do_chunk(ctx, data); /* append data into buf */ if (len) @@ -157,7 +157,6 @@ void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out) static uint8_t padding[64] = { 0x80, }; uint64_t bits; uint32_t index, padlen; - uint32_t *p = (uint32_t *) out; /* add padding and update data with it */ bits = cpu_to_le64(ctx->sz << 3); @@ -171,8 +170,8 @@ void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out) cryptonite_md5_update(ctx, (uint8_t *) &bits, sizeof(bits)); /* output hash */ - p[0] = cpu_to_le32(ctx->h[0]); - p[1] = cpu_to_le32(ctx->h[1]); - p[2] = cpu_to_le32(ctx->h[2]); - p[3] = cpu_to_le32(ctx->h[3]); + store_le32(out , ctx->h[0]); + store_le32(out+ 4, ctx->h[1]); + store_le32(out+ 8, ctx->h[2]); + store_le32(out+12, ctx->h[3]); } diff --git a/cbits/cryptonite_poly1305.c b/cbits/cryptonite_poly1305.c index 60dc5e0..9fa1fd1 100644 --- a/cbits/cryptonite_poly1305.c +++ b/cbits/cryptonite_poly1305.c @@ -38,11 +38,6 @@ #include "cryptonite_poly1305.h" #include "cryptonite_bitfn.h" -static inline uint32_t load32(uint8_t *p) -{ - return (le32_to_cpu(*((uint32_t *) p))); -} - static void poly1305_do_chunk(poly1305_ctx *ctx, uint8_t *data, int blocks, int final) { /* following is a cleanup copy of code available poly1305-donna */ @@ -61,11 +56,11 @@ static void poly1305_do_chunk(poly1305_ctx *ctx, uint8_t *data, int blocks, int s1 = r1 * 5; s2 = r2 * 5; s3 = r3 * 5; s4 = r4 * 5; while (blocks--) { - h0 += (load32(data+ 0) ) & 0x3ffffff; - h1 += (load32(data+ 3) >> 2) & 0x3ffffff; - h2 += (load32(data+ 6) >> 4) & 0x3ffffff; - h3 += (load32(data+ 9) >> 6) & 0x3ffffff; - h4 += (load32(data+12) >> 8) | hibit; + h0 += (load_le32(data+ 0) ) & 0x3ffffff; + h1 += (load_le32(data+ 3) >> 2) & 0x3ffffff; + h2 += (load_le32(data+ 6) >> 4) & 0x3ffffff; + h3 += (load_le32(data+ 9) >> 6) & 0x3ffffff; + h4 += (load_le32(data+12) >> 8) | hibit; d0 = ((uint64_t)h0 * r0) + ((uint64_t)h1 * s4) + ((uint64_t)h2 * s3) + ((uint64_t)h3 * s2) + ((uint64_t)h4 * s1); d1 = ((uint64_t)h0 * r1) + ((uint64_t)h1 * r0) + ((uint64_t)h2 * s4) + ((uint64_t)h3 * s3) + ((uint64_t)h4 * s2); @@ -94,16 +89,16 @@ void cryptonite_poly1305_init(poly1305_ctx *ctx, poly1305_key *key) memset(ctx, 0, sizeof(poly1305_ctx)); - ctx->r[0] = (load32(&k[ 0]) ) & 0x3ffffff; - ctx->r[1] = (load32(&k[ 3]) >> 2) & 0x3ffff03; - ctx->r[2] = (load32(&k[ 6]) >> 4) & 0x3ffc0ff; - ctx->r[3] = (load32(&k[ 9]) >> 6) & 0x3f03fff; - ctx->r[4] = (load32(&k[12]) >> 8) & 0x00fffff; + ctx->r[0] = (load_le32(&k[ 0]) ) & 0x3ffffff; + ctx->r[1] = (load_le32(&k[ 3]) >> 2) & 0x3ffff03; + ctx->r[2] = (load_le32(&k[ 6]) >> 4) & 0x3ffc0ff; + ctx->r[3] = (load_le32(&k[ 9]) >> 6) & 0x3f03fff; + ctx->r[4] = (load_le32(&k[12]) >> 8) & 0x00fffff; - ctx->pad[0] = load32(&k[16]); - ctx->pad[1] = load32(&k[20]); - ctx->pad[2] = load32(&k[24]); - ctx->pad[3] = load32(&k[28]); + ctx->pad[0] = load_le32(&k[16]); + ctx->pad[1] = load_le32(&k[20]); + ctx->pad[2] = load_le32(&k[24]); + ctx->pad[3] = load_le32(&k[28]); ctx->index = 0; } diff --git a/cbits/cryptonite_salsa.c b/cbits/cryptonite_salsa.c index 0bd9660..38fc396 100644 --- a/cbits/cryptonite_salsa.c +++ b/cbits/cryptonite_salsa.c @@ -58,11 +58,6 @@ static const uint8_t tau[16] = "expand 16-byte k"; QR (x15,x12,x13,x14); \ } -static inline uint32_t load32(const uint8_t *p) -{ - return le32_to_cpu(*((uint32_t *) p)); -} - static void salsa_core(int rounds, block *out, const cryptonite_salsa_state *in) { uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; @@ -126,34 +121,34 @@ void cryptonite_salsa_init_core(cryptonite_salsa_state *st, const uint8_t *constants = (keylen == 32) ? sigma : tau; int i; - st->d[0] = load32(constants + 0); - st->d[5] = load32(constants + 4); - st->d[10] = load32(constants + 8); - st->d[15] = load32(constants + 12); + st->d[0] = load_le32(constants + 0); + st->d[5] = load_le32(constants + 4); + st->d[10] = load_le32(constants + 8); + st->d[15] = load_le32(constants + 12); - st->d[1] = load32(key + 0); - st->d[2] = load32(key + 4); - st->d[3] = load32(key + 8); - st->d[4] = load32(key + 12); + st->d[1] = load_le32(key + 0); + st->d[2] = load_le32(key + 4); + st->d[3] = load_le32(key + 8); + st->d[4] = load_le32(key + 12); /* we repeat the key on 128 bits */ if (keylen == 32) key += 16; - st->d[11] = load32(key + 0); - st->d[12] = load32(key + 4); - st->d[13] = load32(key + 8); - st->d[14] = load32(key + 12); + st->d[11] = load_le32(key + 0); + st->d[12] = load_le32(key + 4); + st->d[13] = load_le32(key + 8); + st->d[14] = load_le32(key + 12); st->d[9] = 0; switch (ivlen) { case 8: - st->d[6] = load32(iv + 0); - st->d[7] = load32(iv + 4); + st->d[6] = load_le32(iv + 0); + st->d[7] = load_le32(iv + 4); st->d[8] = 0; break; case 12: - st->d[6] = load32(iv + 0); - st->d[7] = load32(iv + 4); - st->d[8] = load32(iv + 8); + st->d[6] = load_le32(iv + 0); + st->d[7] = load_le32(iv + 4); + st->d[8] = load_le32(iv + 8); default: return; } diff --git a/cbits/cryptonite_scrypt.c b/cbits/cryptonite_scrypt.c index eaf28ac..bc6c137 100644 --- a/cbits/cryptonite_scrypt.c +++ b/cbits/cryptonite_scrypt.c @@ -49,16 +49,6 @@ static inline uint64_t integerify(uint32_t *B, const uint32_t r) return B[(2*r-1) * 16] | (uint64_t)B[(2*r-1) * 16 + 1] << 32; } -static inline uint32_t load32(const uint8_t *p) -{ - return le32_to_cpu(*((uint32_t *) p)); -} - -static inline void store32(const uint8_t *p, uint32_t val) -{ - *((uint32_t *) p) = cpu_to_le32(val); -} - void cryptonite_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint32_t *V, uint32_t *XY) { uint32_t *X = XY; @@ -69,7 +59,7 @@ void cryptonite_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint const int r32 = 32*r; for (k = 0; k < r32; k++) - X[k] = load32(&B[4 * k]); + X[k] = load_le32(&B[4 * k]); for (i = 0; i < N; i += 2) { array_copy32(&V[i * r32], X, r32); blockmix_salsa8(X, Y, Z, r); @@ -86,5 +76,5 @@ void cryptonite_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint blockmix_salsa8(Y, X, Z, r); } for (k = 0; k < r32; k++) - store32(&B[4*k], X[k]); + store_le32(&B[4*k], X[k]); } diff --git a/cbits/cryptonite_sha1.c b/cbits/cryptonite_sha1.c index 33b6fa0..c508903 100644 --- a/cbits/cryptonite_sha1.c +++ b/cbits/cryptonite_sha1.c @@ -53,11 +53,11 @@ void cryptonite_sha1_init(struct sha1_ctx *ctx) #define M(i) (w[i & 0x0f] = rol32(w[i & 0x0f] ^ w[(i - 14) & 0x0f] \ ^ w[(i - 8) & 0x0f] ^ w[(i - 3) & 0x0f], 1)) -static inline void sha1_do_chunk(struct sha1_ctx *ctx, uint32_t *buf) +static inline void sha1_do_chunk(struct sha1_ctx *ctx, const uint8_t *buf) { uint32_t a, b, c, d, e; uint32_t w[16]; -#define CPY(i) w[i] = be32_to_cpu(buf[i]) +#define CPY(i) w[i] = load_be32(buf+4*i) CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7); CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15); #undef CPY @@ -167,7 +167,7 @@ void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t /* process partial buffer if there's enough data to make a block */ if (index && len >= to_fill) { memcpy(ctx->buf + index, data, to_fill); - sha1_do_chunk(ctx, (uint32_t *) ctx->buf); + sha1_do_chunk(ctx, ctx->buf); len -= to_fill; data += to_fill; index = 0; @@ -175,7 +175,7 @@ void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t /* process as much 64-block as possible */ for (; len >= 64; len -= 64, data += 64) - sha1_do_chunk(ctx, (uint32_t *) data); + sha1_do_chunk(ctx, data); /* append data into buf */ if (len) @@ -187,7 +187,6 @@ void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out) static uint8_t padding[64] = { 0x80, }; uint64_t bits; uint32_t index, padlen; - uint32_t *p = (uint32_t *) out; /* add padding and update data with it */ bits = cpu_to_be64(ctx->sz << 3); @@ -201,9 +200,9 @@ void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out) cryptonite_sha1_update(ctx, (uint8_t *) &bits, sizeof(bits)); /* output hash */ - p[0] = cpu_to_be32(ctx->h[0]); - p[1] = cpu_to_be32(ctx->h[1]); - p[2] = cpu_to_be32(ctx->h[2]); - p[3] = cpu_to_be32(ctx->h[3]); - p[4] = cpu_to_be32(ctx->h[4]); + store_be32(out , ctx->h[0]); + store_be32(out+ 4, ctx->h[1]); + store_be32(out+ 8, ctx->h[2]); + store_be32(out+12, ctx->h[3]); + store_be32(out+16, ctx->h[4]); } diff --git a/cbits/cryptonite_sha256.c b/cbits/cryptonite_sha256.c index b93d815..7df46e0 100644 --- a/cbits/cryptonite_sha256.c +++ b/cbits/cryptonite_sha256.c @@ -74,13 +74,16 @@ static const uint32_t k[] = { #define s0(x) (ror32(x, 7) ^ ror32(x,18) ^ (x >> 3)) #define s1(x) (ror32(x,17) ^ ror32(x,19) ^ (x >> 10)) -static void sha256_do_chunk(struct sha256_ctx *ctx, uint32_t buf[]) +static void sha256_do_chunk(struct sha256_ctx *ctx, const uint8_t *buf) { uint32_t a, b, c, d, e, f, g, h, t1, t2; int i; uint32_t w[64]; - cpu_to_be32_array(w, buf, 16); +#define CPY(i) w[i] = load_be32(buf+4*i) + CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7); + CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15); +#undef CPY for (i = 16; i < 64; i++) w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16]; @@ -128,7 +131,7 @@ void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint3 /* process partial buffer if there's enough data to make a block */ if (index && len >= to_fill) { memcpy(ctx->buf + index, data, to_fill); - sha256_do_chunk(ctx, (uint32_t *) ctx->buf); + sha256_do_chunk(ctx, ctx->buf); len -= to_fill; data += to_fill; index = 0; @@ -136,7 +139,7 @@ void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint3 /* process as much 64-block as possible */ for (; len >= 64; len -= 64, data += 64) - sha256_do_chunk(ctx, (uint32_t *) data); + sha256_do_chunk(ctx, data); /* append data into buf */ if (len) @@ -156,7 +159,6 @@ void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out) static uint8_t padding[64] = { 0x80, }; uint64_t bits; uint32_t i, index, padlen; - uint32_t *p = (uint32_t *) out; /* cpu -> big endian */ bits = cpu_to_be64(ctx->sz << 3); @@ -171,5 +173,5 @@ void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out) /* store to digest */ for (i = 0; i < 8; i++) - p[i] = cpu_to_be32(ctx->h[i]); + store_be32(out+4*i, ctx->h[i]); } diff --git a/cbits/cryptonite_sha3.c b/cbits/cryptonite_sha3.c index 5605421..befc783 100644 --- a/cbits/cryptonite_sha3.c +++ b/cbits/cryptonite_sha3.c @@ -49,14 +49,14 @@ static const int keccak_rotc[24] = static const int keccak_piln[24] = { 10,7,11,17,18,3,5,16,8,21,24,4,15,23,19,13,12,2,20,14,22,9,6,1 }; -static inline void sha3_do_chunk(uint64_t state[25], uint64_t buf[], int bufsz) +static inline void sha3_do_chunk(uint64_t state[25], const uint8_t *buf, int bufsz) { int i, j, r; uint64_t tmp, bc[5]; /* merge buf with state */ - for (i = 0; i < bufsz; i++) - state[i] ^= le64_to_cpu(buf[i]); + for (i = 0; i < bufsz / 8; i++) + state[i] ^= load_le64(buf+8*i); /* run keccak rounds */ for (r = 0; r < KECCAK_NB_ROUNDS; r++) { @@ -111,14 +111,14 @@ void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t to_fill = ctx->bufsz - ctx->bufindex; if (ctx->bufindex == ctx->bufsz) { - sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8); + sha3_do_chunk(ctx->state, ctx->buf, ctx->bufsz); ctx->bufindex = 0; } /* process partial buffer if there's enough data to make a block */ if (ctx->bufindex && len >= to_fill) { memcpy(ctx->buf + ctx->bufindex, data, to_fill); - sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8); + sha3_do_chunk(ctx->state, ctx->buf, ctx->bufsz); len -= to_fill; data += to_fill; ctx->bufindex = 0; @@ -126,7 +126,7 @@ void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t /* process as much ctx->bufsz-block */ for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz) - sha3_do_chunk(ctx->state, (uint64_t *) data, ctx->bufsz / 8); + sha3_do_chunk(ctx->state, data, ctx->bufsz); /* append data into buf */ if (len) { @@ -141,7 +141,7 @@ void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *o /* process full buffer if needed */ if (ctx->bufindex == ctx->bufsz) { - sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8); + sha3_do_chunk(ctx->state, ctx->buf, ctx->bufsz); ctx->bufindex = 0; } @@ -151,7 +151,7 @@ void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *o ctx->buf[ctx->bufsz - 1] |= 0x80; /* process */ - sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8); + sha3_do_chunk(ctx->state, ctx->buf, ctx->bufsz); /* output */ cpu_to_le64_array(w, ctx->state, 25); diff --git a/cbits/cryptonite_sha512.c b/cbits/cryptonite_sha512.c index 75ec791..dca76c6 100644 --- a/cbits/cryptonite_sha512.c +++ b/cbits/cryptonite_sha512.c @@ -90,13 +90,16 @@ static const uint64_t k[] = { #define s0(x) (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7)) #define s1(x) (ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6)) -static void sha512_do_chunk(struct sha512_ctx *ctx, uint64_t *buf) +static void sha512_do_chunk(struct sha512_ctx *ctx, const uint8_t *buf) { uint64_t a, b, c, d, e, f, g, h, t1, t2; int i; uint64_t w[80]; - cpu_to_be64_array(w, buf, 16); +#define CPY(i) w[i] = load_be64(buf+8*i) + CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7); + CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15); +#undef CPY for (i = 16; i < 80; i++) w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16]; @@ -147,7 +150,7 @@ void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint3 /* process partial buffer if there's enough data to make a block */ if (index && len >= to_fill) { memcpy(ctx->buf + index, data, to_fill); - sha512_do_chunk(ctx, (uint64_t *) ctx->buf); + sha512_do_chunk(ctx, ctx->buf); len -= to_fill; data += to_fill; index = 0; @@ -155,7 +158,7 @@ void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint3 /* process as much 128-block as possible */ for (; len >= 128; len -= 128, data += 128) - sha512_do_chunk(ctx, (uint64_t *) data); + sha512_do_chunk(ctx, data); /* append data into buf */ if (len) @@ -224,7 +227,7 @@ void cryptonite_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen) break; default: { char buf[8+4]; - uint8_t out[64]; + uint64_t out[8]; int i; cryptonite_sha512_init(ctx); @@ -233,12 +236,12 @@ void cryptonite_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen) i = sprintf(buf, "SHA-512/%d", hashlen); cryptonite_sha512_update(ctx, (uint8_t *) buf, i); - cryptonite_sha512_finalize(ctx, out); + cryptonite_sha512_finalize(ctx, (uint8_t *) out); /* re-init the context, otherwise len is changed */ memset(ctx, 0, sizeof(*ctx)); for (i = 0; i < 8; i++) - ctx->h[i] = cpu_to_be64(((uint64_t *) out)[i]); + ctx->h[i] = cpu_to_be64(out[i]); } } }