1 /* sha512.c - TinyCrypt SHA-512 crypto hash algorithm implementation */
9  *    - Redistributions of source code must retain the above copyright notice,
12  *    - Redistributions in binary form must reproduce the above copyright
16  *    - Neither the name of Intel Corporation nor the names of its contributors
53 	s->iv[0] = 0x6a09e667f3bcc908;  in tc_sha512_init()
54 	s->iv[1] = 0xbb67ae8584caa73b;  in tc_sha512_init()
55 	s->iv[2] = 0x3c6ef372fe94f82b;  in tc_sha512_init()
56 	s->iv[3] = 0xa54ff53a5f1d36f1;  in tc_sha512_init()
57 	s->iv[4] = 0x510e527fade682d1;  in tc_sha512_init()
58 	s->iv[5] = 0x9b05688c2b3e6c1f;  in tc_sha512_init()
59 	s->iv[6] = 0x1f83d9abfb41bd6b;  in tc_sha512_init()
60 	s->iv[7] = 0x5be0cd19137e2179;  in tc_sha512_init()
74 	while (datalen-- > 0) {  in tc_sha512_update()
75 		s->leftover[s->leftover_offset++] = *(data++);  in tc_sha512_update()
76 		if (s->leftover_offset >= TC_SHA512_BLOCK_SIZE) {  in tc_sha512_update()
77 			compress(s->iv, s->leftover);  in tc_sha512_update()
78 			s->leftover_offset = 0;  in tc_sha512_update()
79 			s->bits_hashed += (TC_SHA512_BLOCK_SIZE << 3);  in tc_sha512_update()
95 	s->bits_hashed += (s->leftover_offset << 3);  in tc_sha512_final()
97 	s->leftover[s->leftover_offset++] = 0x80; /* always room for one byte */  in tc_sha512_final()
98 	if (s->leftover_offset > (sizeof(s->leftover) - 16)) {  in tc_sha512_final()
100 		_set(s->leftover + s->leftover_offset, 0x00,  in tc_sha512_final()
101 		     sizeof(s->leftover) - s->leftover_offset);  in tc_sha512_final()
102 		compress(s->iv, s->leftover);  in tc_sha512_final()
103 		s->leftover_offset = 0;  in tc_sha512_final()
107 	 * add the padding and the length in big-Endian format  in tc_sha512_final()
109 	 * NOTE: SHA-512 uses 128 bits for the length of the message, but the  in tc_sha512_final()
113 	_set(s->leftover + s->leftover_offset, 0x00,  in tc_sha512_final()
114 	     sizeof(s->leftover) - 8 - s->leftover_offset);  in tc_sha512_final()
115 	s->leftover[sizeof(s->leftover) - 1]  = (uint8_t)(s->bits_hashed);  in tc_sha512_final()
116 	s->leftover[sizeof(s->leftover) - 2]  = (uint8_t)(s->bits_hashed >> 8);  in tc_sha512_final()
117 	s->leftover[sizeof(s->leftover) - 3]  = (uint8_t)(s->bits_hashed >> 16);  in tc_sha512_final()
118 	s->leftover[sizeof(s->leftover) - 4]  = (uint8_t)(s->bits_hashed >> 24);  in tc_sha512_final()
119 	s->leftover[sizeof(s->leftover) - 5]  = (uint8_t)(s->bits_hashed >> 32);  in tc_sha512_final()
120 	s->leftover[sizeof(s->leftover) - 6]  = (uint8_t)(s->bits_hashed >> 40);  in tc_sha512_final()
121 	s->leftover[sizeof(s->leftover) - 7]  = (uint8_t)(s->bits_hashed >> 48);  in tc_sha512_final()
122 	s->leftover[sizeof(s->leftover) - 8]  = (uint8_t)(s->bits_hashed >> 56);  in tc_sha512_final()
125 	compress(s->iv, s->leftover);  in tc_sha512_final()
129 		uint64_t t = *((uint64_t *) &s->iv[i]);  in tc_sha512_final()
147  * Initializing SHA-512 Hash constant words K.
172 	return (((a) >> n) | ((a) << (64 - n)));  in ROTR()
200 	uint64_t a, b, c, d, e, f, g, h;  in compress()  local
208 	e = iv[4]; f = iv[5]; g = iv[6]; h = iv[7];  in compress()
213 		t1 += h + Sigma1(e) + Ch(e, f, g) + k512[i];  in compress()
215 		h = g; g = f; f = e; e = d + t1;  in compress()
226 		t1 += h + Sigma1(e) + Ch(e, f, g) + k512[i];  in compress()
228 		h = g; g = f; f = e; e = d + t1;  in compress()
233 	iv[4] += e; iv[5] += f; iv[6] += g; iv[7] += h;  in compress()