chiark / gitweb /
NEW etc.: Replace most calls to safe_realloc_ary
[secnet] / sha512.c
CommitLineData
b4a26b17
IJ
1/* sha512.c - Functions to compute SHA512 and SHA384 message digest of files or
2 memory blocks according to the NIST specification FIPS-180-2.
3
4 Copyright (C) 2005, 2006, 2008, 2009, 2010 Free Software Foundation, Inc.
5
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>. */
18
19/* Written by David Madore, considerably copypasting from
20 Scott G. Miller's sha1.c
21*/
22
23#include <config.h>
24
25#include "sha512.h"
26
27#include <stddef.h>
28#include <stdlib.h>
29#include <string.h>
30
31#if USE_UNLOCKED_IO
32# include "unlocked-io.h"
33#endif
34
35#ifdef WORDS_BIGENDIAN
36# define SWAP(n) (n)
37#else
38# define SWAP(n) \
39 u64or (u64or (u64or (u64shl (n, 56), \
40 u64shl (u64and (n, u64lo (0x0000ff00)), 40)), \
41 u64or (u64shl (u64and (n, u64lo (0x00ff0000)), 24), \
42 u64shl (u64and (n, u64lo (0xff000000)), 8))), \
43 u64or (u64or (u64and (u64shr (n, 8), u64lo (0xff000000)), \
44 u64and (u64shr (n, 24), u64lo (0x00ff0000))), \
45 u64or (u64and (u64shr (n, 40), u64lo (0x0000ff00)), \
46 u64shr (n, 56))))
47#endif
48
49#define BLOCKSIZE 32768
50#if BLOCKSIZE % 128 != 0
51# error "invalid BLOCKSIZE"
52#endif
53
54/* This array contains the bytes used to pad the buffer to the next
55 128-byte boundary. */
56static const unsigned char fillbuf[128] = { 0x80, 0 /* , 0, 0, ... */ };
57
58
59/*
60 Takes a pointer to a 512 bit block of data (eight 64 bit ints) and
61 intializes it to the start constants of the SHA512 algorithm. This
62 must be called before using hash in the call to sha512_hash
63*/
64void
65sha512_init_ctx (struct sha512_ctx *ctx)
66{
67 ctx->state[0] = u64hilo (0x6a09e667, 0xf3bcc908);
68 ctx->state[1] = u64hilo (0xbb67ae85, 0x84caa73b);
69 ctx->state[2] = u64hilo (0x3c6ef372, 0xfe94f82b);
70 ctx->state[3] = u64hilo (0xa54ff53a, 0x5f1d36f1);
71 ctx->state[4] = u64hilo (0x510e527f, 0xade682d1);
72 ctx->state[5] = u64hilo (0x9b05688c, 0x2b3e6c1f);
73 ctx->state[6] = u64hilo (0x1f83d9ab, 0xfb41bd6b);
74 ctx->state[7] = u64hilo (0x5be0cd19, 0x137e2179);
75
76 ctx->total[0] = ctx->total[1] = u64lo (0);
77 ctx->buflen = 0;
78}
79
80void
81sha384_init_ctx (struct sha512_ctx *ctx)
82{
83 ctx->state[0] = u64hilo (0xcbbb9d5d, 0xc1059ed8);
84 ctx->state[1] = u64hilo (0x629a292a, 0x367cd507);
85 ctx->state[2] = u64hilo (0x9159015a, 0x3070dd17);
86 ctx->state[3] = u64hilo (0x152fecd8, 0xf70e5939);
87 ctx->state[4] = u64hilo (0x67332667, 0xffc00b31);
88 ctx->state[5] = u64hilo (0x8eb44a87, 0x68581511);
89 ctx->state[6] = u64hilo (0xdb0c2e0d, 0x64f98fa7);
90 ctx->state[7] = u64hilo (0x47b5481d, 0xbefa4fa4);
91
92 ctx->total[0] = ctx->total[1] = u64lo (0);
93 ctx->buflen = 0;
94}
95
96/* Copy the value from V into the memory location pointed to by *CP,
97 If your architecture allows unaligned access, this is equivalent to
98 * (__typeof__ (v) *) cp = v */
99static inline void
100set_uint64 (char *cp, u64 v)
101{
102 memcpy (cp, &v, sizeof v);
103}
104
105/* Put result from CTX in first 64 bytes following RESBUF.
106 The result must be in little endian byte order. */
107void *
108sha512_read_ctx (const struct sha512_ctx *ctx, void *resbuf)
109{
110 int i;
111 char *r = resbuf;
112
113 for (i = 0; i < 8; i++)
114 set_uint64 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
115
116 return resbuf;
117}
118
119void *
120sha384_read_ctx (const struct sha512_ctx *ctx, void *resbuf)
121{
122 int i;
123 char *r = resbuf;
124
125 for (i = 0; i < 6; i++)
126 set_uint64 (r + i * sizeof ctx->state[0], SWAP (ctx->state[i]));
127
128 return resbuf;
129}
130
131/* Process the remaining bytes in the internal buffer and the usual
132 prolog according to the standard and write the result to RESBUF. */
133static void
134sha512_conclude_ctx (struct sha512_ctx *ctx)
135{
136 /* Take yet unprocessed bytes into account. */
137 size_t bytes = ctx->buflen;
138 size_t size = (bytes < 112) ? 128 / 8 : 128 * 2 / 8;
139
140 /* Now count remaining bytes. */
141 ctx->total[0] = u64plus (ctx->total[0], u64lo (bytes));
142 if (u64lt (ctx->total[0], u64lo (bytes)))
143 ctx->total[1] = u64plus (ctx->total[1], u64lo (1));
144
145 /* Put the 128-bit file length in *bits* at the end of the buffer.
146 Use set_uint64 rather than a simple assignment, to avoid risk of
147 unaligned access. */
148 set_uint64 ((char *) &ctx->buffer[size - 2],
149 SWAP (u64or (u64shl (ctx->total[1], 3),
150 u64shr (ctx->total[0], 61))));
151 set_uint64 ((char *) &ctx->buffer[size - 1],
152 SWAP (u64shl (ctx->total[0], 3)));
153
154 memcpy (&((char *) ctx->buffer)[bytes], fillbuf, (size - 2) * 8 - bytes);
155
156 /* Process last bytes. */
157 sha512_process_block (ctx->buffer, size * 8, ctx);
158}
159
160void *
161sha512_finish_ctx (struct sha512_ctx *ctx, void *resbuf)
162{
163 sha512_conclude_ctx (ctx);
164 return sha512_read_ctx (ctx, resbuf);
165}
166
167void *
168sha384_finish_ctx (struct sha512_ctx *ctx, void *resbuf)
169{
170 sha512_conclude_ctx (ctx);
171 return sha384_read_ctx (ctx, resbuf);
172}
173
174/* Compute SHA512 message digest for bytes read from STREAM. The
175 resulting message digest number will be written into the 64 bytes
176 beginning at RESBLOCK. */
177int
178sha512_stream (FILE *stream, void *resblock)
179{
180 struct sha512_ctx ctx;
181 size_t sum;
182
183 char *buffer = malloc (BLOCKSIZE + 72);
184 if (!buffer)
185 return 1;
186
187 /* Initialize the computation context. */
188 sha512_init_ctx (&ctx);
189
190 /* Iterate over full file contents. */
191 while (1)
192 {
193 /* We read the file in blocks of BLOCKSIZE bytes. One call of the
194 computation function processes the whole buffer so that with the
195 next round of the loop another block can be read. */
196 size_t n;
197 sum = 0;
198
199 /* Read block. Take care for partial reads. */
200 while (1)
201 {
202 n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
203
204 sum += n;
205
206 if (sum == BLOCKSIZE)
207 break;
208
209 if (n == 0)
210 {
211 /* Check for the error flag IFF N == 0, so that we don't
212 exit the loop after a partial read due to e.g., EAGAIN
213 or EWOULDBLOCK. */
214 if (ferror (stream))
215 {
216 free (buffer);
217 return 1;
218 }
219 goto process_partial_block;
220 }
221
222 /* We've read at least one byte, so ignore errors. But always
223 check for EOF, since feof may be true even though N > 0.
224 Otherwise, we could end up calling fread after EOF. */
225 if (feof (stream))
226 goto process_partial_block;
227 }
228
229 /* Process buffer with BLOCKSIZE bytes. Note that
230 BLOCKSIZE % 128 == 0
231 */
232 sha512_process_block (buffer, BLOCKSIZE, &ctx);
233 }
234
235 process_partial_block:;
236
237 /* Process any remaining bytes. */
238 if (sum > 0)
239 sha512_process_bytes (buffer, sum, &ctx);
240
241 /* Construct result in desired memory. */
242 sha512_finish_ctx (&ctx, resblock);
243 free (buffer);
244 return 0;
245}
246
247/* FIXME: Avoid code duplication */
248int
249sha384_stream (FILE *stream, void *resblock)
250{
251 struct sha512_ctx ctx;
252 size_t sum;
253
254 char *buffer = malloc (BLOCKSIZE + 72);
255 if (!buffer)
256 return 1;
257
258 /* Initialize the computation context. */
259 sha384_init_ctx (&ctx);
260
261 /* Iterate over full file contents. */
262 while (1)
263 {
264 /* We read the file in blocks of BLOCKSIZE bytes. One call of the
265 computation function processes the whole buffer so that with the
266 next round of the loop another block can be read. */
267 size_t n;
268 sum = 0;
269
270 /* Read block. Take care for partial reads. */
271 while (1)
272 {
273 n = fread (buffer + sum, 1, BLOCKSIZE - sum, stream);
274
275 sum += n;
276
277 if (sum == BLOCKSIZE)
278 break;
279
280 if (n == 0)
281 {
282 /* Check for the error flag IFF N == 0, so that we don't
283 exit the loop after a partial read due to e.g., EAGAIN
284 or EWOULDBLOCK. */
285 if (ferror (stream))
286 {
287 free (buffer);
288 return 1;
289 }
290 goto process_partial_block;
291 }
292
293 /* We've read at least one byte, so ignore errors. But always
294 check for EOF, since feof may be true even though N > 0.
295 Otherwise, we could end up calling fread after EOF. */
296 if (feof (stream))
297 goto process_partial_block;
298 }
299
300 /* Process buffer with BLOCKSIZE bytes. Note that
301 BLOCKSIZE % 128 == 0
302 */
303 sha512_process_block (buffer, BLOCKSIZE, &ctx);
304 }
305
306 process_partial_block:;
307
308 /* Process any remaining bytes. */
309 if (sum > 0)
310 sha512_process_bytes (buffer, sum, &ctx);
311
312 /* Construct result in desired memory. */
313 sha384_finish_ctx (&ctx, resblock);
314 free (buffer);
315 return 0;
316}
317
318/* Compute SHA512 message digest for LEN bytes beginning at BUFFER. The
319 result is always in little endian byte order, so that a byte-wise
320 output yields to the wanted ASCII representation of the message
321 digest. */
322void *
323sha512_buffer (const char *buffer, size_t len, void *resblock)
324{
325 struct sha512_ctx ctx;
326
327 /* Initialize the computation context. */
328 sha512_init_ctx (&ctx);
329
330 /* Process whole buffer but last len % 128 bytes. */
331 sha512_process_bytes (buffer, len, &ctx);
332
333 /* Put result in desired memory area. */
334 return sha512_finish_ctx (&ctx, resblock);
335}
336
337void *
338sha384_buffer (const char *buffer, size_t len, void *resblock)
339{
340 struct sha512_ctx ctx;
341
342 /* Initialize the computation context. */
343 sha384_init_ctx (&ctx);
344
345 /* Process whole buffer but last len % 128 bytes. */
346 sha512_process_bytes (buffer, len, &ctx);
347
348 /* Put result in desired memory area. */
349 return sha384_finish_ctx (&ctx, resblock);
350}
351
352void
353sha512_process_bytes (const void *buffer, size_t len, struct sha512_ctx *ctx)
354{
355 /* When we already have some bits in our internal buffer concatenate
356 both inputs first. */
357 if (ctx->buflen != 0)
358 {
359 size_t left_over = ctx->buflen;
360 size_t add = 256 - left_over > len ? len : 256 - left_over;
361
362 memcpy (&((char *) ctx->buffer)[left_over], buffer, add);
363 ctx->buflen += add;
364
365 if (ctx->buflen > 128)
366 {
367 sha512_process_block (ctx->buffer, ctx->buflen & ~127, ctx);
368
369 ctx->buflen &= 127;
370 /* The regions in the following copy operation cannot overlap. */
371 memcpy (ctx->buffer,
372 &((char *) ctx->buffer)[(left_over + add) & ~127],
373 ctx->buflen);
374 }
375
376 buffer = (const char *) buffer + add;
377 len -= add;
378 }
379
380 /* Process available complete blocks. */
381 if (len >= 128)
382 {
383#if !_STRING_ARCH_unaligned
384# define alignof(type) offsetof (struct { char c; type x; }, x)
385# define UNALIGNED_P(p) (((size_t) p) % alignof (u64) != 0)
386 if (UNALIGNED_P (buffer))
387 while (len > 128)
388 {
389 sha512_process_block (memcpy (ctx->buffer, buffer, 128), 128, ctx);
390 buffer = (const char *) buffer + 128;
391 len -= 128;
392 }
393 else
394#endif
395 {
396 sha512_process_block (buffer, len & ~127, ctx);
397 buffer = (const char *) buffer + (len & ~127);
398 len &= 127;
399 }
400 }
401
402 /* Move remaining bytes in internal buffer. */
403 if (len > 0)
404 {
405 size_t left_over = ctx->buflen;
406
407 memcpy (&((char *) ctx->buffer)[left_over], buffer, len);
408 left_over += len;
409 if (left_over >= 128)
410 {
411 sha512_process_block (ctx->buffer, 128, ctx);
412 left_over -= 128;
413 memcpy (ctx->buffer, &ctx->buffer[16], left_over);
414 }
415 ctx->buflen = left_over;
416 }
417}
418
419/* --- Code below is the primary difference between sha1.c and sha512.c --- */
420
421/* SHA512 round constants */
422#define K(I) sha512_round_constants[I]
423static u64 const sha512_round_constants[80] = {
424 u64init (0x428a2f98, 0xd728ae22), u64init (0x71374491, 0x23ef65cd),
425 u64init (0xb5c0fbcf, 0xec4d3b2f), u64init (0xe9b5dba5, 0x8189dbbc),
426 u64init (0x3956c25b, 0xf348b538), u64init (0x59f111f1, 0xb605d019),
427 u64init (0x923f82a4, 0xaf194f9b), u64init (0xab1c5ed5, 0xda6d8118),
428 u64init (0xd807aa98, 0xa3030242), u64init (0x12835b01, 0x45706fbe),
429 u64init (0x243185be, 0x4ee4b28c), u64init (0x550c7dc3, 0xd5ffb4e2),
430 u64init (0x72be5d74, 0xf27b896f), u64init (0x80deb1fe, 0x3b1696b1),
431 u64init (0x9bdc06a7, 0x25c71235), u64init (0xc19bf174, 0xcf692694),
432 u64init (0xe49b69c1, 0x9ef14ad2), u64init (0xefbe4786, 0x384f25e3),
433 u64init (0x0fc19dc6, 0x8b8cd5b5), u64init (0x240ca1cc, 0x77ac9c65),
434 u64init (0x2de92c6f, 0x592b0275), u64init (0x4a7484aa, 0x6ea6e483),
435 u64init (0x5cb0a9dc, 0xbd41fbd4), u64init (0x76f988da, 0x831153b5),
436 u64init (0x983e5152, 0xee66dfab), u64init (0xa831c66d, 0x2db43210),
437 u64init (0xb00327c8, 0x98fb213f), u64init (0xbf597fc7, 0xbeef0ee4),
438 u64init (0xc6e00bf3, 0x3da88fc2), u64init (0xd5a79147, 0x930aa725),
439 u64init (0x06ca6351, 0xe003826f), u64init (0x14292967, 0x0a0e6e70),
440 u64init (0x27b70a85, 0x46d22ffc), u64init (0x2e1b2138, 0x5c26c926),
441 u64init (0x4d2c6dfc, 0x5ac42aed), u64init (0x53380d13, 0x9d95b3df),
442 u64init (0x650a7354, 0x8baf63de), u64init (0x766a0abb, 0x3c77b2a8),
443 u64init (0x81c2c92e, 0x47edaee6), u64init (0x92722c85, 0x1482353b),
444 u64init (0xa2bfe8a1, 0x4cf10364), u64init (0xa81a664b, 0xbc423001),
445 u64init (0xc24b8b70, 0xd0f89791), u64init (0xc76c51a3, 0x0654be30),
446 u64init (0xd192e819, 0xd6ef5218), u64init (0xd6990624, 0x5565a910),
447 u64init (0xf40e3585, 0x5771202a), u64init (0x106aa070, 0x32bbd1b8),
448 u64init (0x19a4c116, 0xb8d2d0c8), u64init (0x1e376c08, 0x5141ab53),
449 u64init (0x2748774c, 0xdf8eeb99), u64init (0x34b0bcb5, 0xe19b48a8),
450 u64init (0x391c0cb3, 0xc5c95a63), u64init (0x4ed8aa4a, 0xe3418acb),
451 u64init (0x5b9cca4f, 0x7763e373), u64init (0x682e6ff3, 0xd6b2b8a3),
452 u64init (0x748f82ee, 0x5defb2fc), u64init (0x78a5636f, 0x43172f60),
453 u64init (0x84c87814, 0xa1f0ab72), u64init (0x8cc70208, 0x1a6439ec),
454 u64init (0x90befffa, 0x23631e28), u64init (0xa4506ceb, 0xde82bde9),
455 u64init (0xbef9a3f7, 0xb2c67915), u64init (0xc67178f2, 0xe372532b),
456 u64init (0xca273ece, 0xea26619c), u64init (0xd186b8c7, 0x21c0c207),
457 u64init (0xeada7dd6, 0xcde0eb1e), u64init (0xf57d4f7f, 0xee6ed178),
458 u64init (0x06f067aa, 0x72176fba), u64init (0x0a637dc5, 0xa2c898a6),
459 u64init (0x113f9804, 0xbef90dae), u64init (0x1b710b35, 0x131c471b),
460 u64init (0x28db77f5, 0x23047d84), u64init (0x32caab7b, 0x40c72493),
461 u64init (0x3c9ebe0a, 0x15c9bebc), u64init (0x431d67c4, 0x9c100d4c),
462 u64init (0x4cc5d4be, 0xcb3e42b6), u64init (0x597f299c, 0xfc657e2a),
463 u64init (0x5fcb6fab, 0x3ad6faec), u64init (0x6c44198c, 0x4a475817),
464};
465
466/* Round functions. */
467#define F2(A, B, C) u64or (u64and (A, B), u64and (C, u64or (A, B)))
468#define F1(E, F, G) u64xor (G, u64and (E, u64xor (F, G)))
469
470/* Process LEN bytes of BUFFER, accumulating context into CTX.
471 It is assumed that LEN % 128 == 0.
472 Most of this code comes from GnuPG's cipher/sha1.c. */
473
474void
475sha512_process_block (const void *buffer, size_t len, struct sha512_ctx *ctx)
476{
477 u64 const *words = buffer;
478 u64 const *endp = words + len / sizeof (u64);
479 u64 x[16];
480 u64 a = ctx->state[0];
481 u64 b = ctx->state[1];
482 u64 c = ctx->state[2];
483 u64 d = ctx->state[3];
484 u64 e = ctx->state[4];
485 u64 f = ctx->state[5];
486 u64 g = ctx->state[6];
487 u64 h = ctx->state[7];
488
489 /* First increment the byte count. FIPS PUB 180-2 specifies the possible
490 length of the file up to 2^128 bits. Here we only compute the
491 number of bytes. Do a double word increment. */
492 ctx->total[0] = u64plus (ctx->total[0], u64lo (len));
493 if (u64lt (ctx->total[0], u64lo (len)))
494 ctx->total[1] = u64plus (ctx->total[1], u64lo (1));
495
496#define S0(x) u64xor (u64rol(x, 63), u64xor (u64rol (x, 56), u64shr (x, 7)))
497#define S1(x) u64xor (u64rol (x, 45), u64xor (u64rol (x, 3), u64shr (x, 6)))
498#define SS0(x) u64xor (u64rol (x, 36), u64xor (u64rol (x, 30), u64rol (x, 25)))
499#define SS1(x) u64xor (u64rol(x, 50), u64xor (u64rol (x, 46), u64rol (x, 23)))
500
501#define M(I) (x[(I) & 15] \
502 = u64plus (x[(I) & 15], \
503 u64plus (S1 (x[((I) - 2) & 15]), \
504 u64plus (x[((I) - 7) & 15], \
505 S0 (x[((I) - 15) & 15])))))
506
507#define R(A, B, C, D, E, F, G, H, K, M) \
508 do \
509 { \
510 u64 t0 = u64plus (SS0 (A), F2 (A, B, C)); \
511 u64 t1 = \
512 u64plus (H, u64plus (SS1 (E), \
513 u64plus (F1 (E, F, G), u64plus (K, M)))); \
514 D = u64plus (D, t1); \
515 H = u64plus (t0, t1); \
516 } \
517 while (0)
518
519 while (words < endp)
520 {
521 int t;
522 /* FIXME: see sha1.c for a better implementation. */
523 for (t = 0; t < 16; t++)
524 {
525 x[t] = SWAP (*words);
526 words++;
527 }
528
529 R( a, b, c, d, e, f, g, h, K( 0), x[ 0] );
530 R( h, a, b, c, d, e, f, g, K( 1), x[ 1] );
531 R( g, h, a, b, c, d, e, f, K( 2), x[ 2] );
532 R( f, g, h, a, b, c, d, e, K( 3), x[ 3] );
533 R( e, f, g, h, a, b, c, d, K( 4), x[ 4] );
534 R( d, e, f, g, h, a, b, c, K( 5), x[ 5] );
535 R( c, d, e, f, g, h, a, b, K( 6), x[ 6] );
536 R( b, c, d, e, f, g, h, a, K( 7), x[ 7] );
537 R( a, b, c, d, e, f, g, h, K( 8), x[ 8] );
538 R( h, a, b, c, d, e, f, g, K( 9), x[ 9] );
539 R( g, h, a, b, c, d, e, f, K(10), x[10] );
540 R( f, g, h, a, b, c, d, e, K(11), x[11] );
541 R( e, f, g, h, a, b, c, d, K(12), x[12] );
542 R( d, e, f, g, h, a, b, c, K(13), x[13] );
543 R( c, d, e, f, g, h, a, b, K(14), x[14] );
544 R( b, c, d, e, f, g, h, a, K(15), x[15] );
545 R( a, b, c, d, e, f, g, h, K(16), M(16) );
546 R( h, a, b, c, d, e, f, g, K(17), M(17) );
547 R( g, h, a, b, c, d, e, f, K(18), M(18) );
548 R( f, g, h, a, b, c, d, e, K(19), M(19) );
549 R( e, f, g, h, a, b, c, d, K(20), M(20) );
550 R( d, e, f, g, h, a, b, c, K(21), M(21) );
551 R( c, d, e, f, g, h, a, b, K(22), M(22) );
552 R( b, c, d, e, f, g, h, a, K(23), M(23) );
553 R( a, b, c, d, e, f, g, h, K(24), M(24) );
554 R( h, a, b, c, d, e, f, g, K(25), M(25) );
555 R( g, h, a, b, c, d, e, f, K(26), M(26) );
556 R( f, g, h, a, b, c, d, e, K(27), M(27) );
557 R( e, f, g, h, a, b, c, d, K(28), M(28) );
558 R( d, e, f, g, h, a, b, c, K(29), M(29) );
559 R( c, d, e, f, g, h, a, b, K(30), M(30) );
560 R( b, c, d, e, f, g, h, a, K(31), M(31) );
561 R( a, b, c, d, e, f, g, h, K(32), M(32) );
562 R( h, a, b, c, d, e, f, g, K(33), M(33) );
563 R( g, h, a, b, c, d, e, f, K(34), M(34) );
564 R( f, g, h, a, b, c, d, e, K(35), M(35) );
565 R( e, f, g, h, a, b, c, d, K(36), M(36) );
566 R( d, e, f, g, h, a, b, c, K(37), M(37) );
567 R( c, d, e, f, g, h, a, b, K(38), M(38) );
568 R( b, c, d, e, f, g, h, a, K(39), M(39) );
569 R( a, b, c, d, e, f, g, h, K(40), M(40) );
570 R( h, a, b, c, d, e, f, g, K(41), M(41) );
571 R( g, h, a, b, c, d, e, f, K(42), M(42) );
572 R( f, g, h, a, b, c, d, e, K(43), M(43) );
573 R( e, f, g, h, a, b, c, d, K(44), M(44) );
574 R( d, e, f, g, h, a, b, c, K(45), M(45) );
575 R( c, d, e, f, g, h, a, b, K(46), M(46) );
576 R( b, c, d, e, f, g, h, a, K(47), M(47) );
577 R( a, b, c, d, e, f, g, h, K(48), M(48) );
578 R( h, a, b, c, d, e, f, g, K(49), M(49) );
579 R( g, h, a, b, c, d, e, f, K(50), M(50) );
580 R( f, g, h, a, b, c, d, e, K(51), M(51) );
581 R( e, f, g, h, a, b, c, d, K(52), M(52) );
582 R( d, e, f, g, h, a, b, c, K(53), M(53) );
583 R( c, d, e, f, g, h, a, b, K(54), M(54) );
584 R( b, c, d, e, f, g, h, a, K(55), M(55) );
585 R( a, b, c, d, e, f, g, h, K(56), M(56) );
586 R( h, a, b, c, d, e, f, g, K(57), M(57) );
587 R( g, h, a, b, c, d, e, f, K(58), M(58) );
588 R( f, g, h, a, b, c, d, e, K(59), M(59) );
589 R( e, f, g, h, a, b, c, d, K(60), M(60) );
590 R( d, e, f, g, h, a, b, c, K(61), M(61) );
591 R( c, d, e, f, g, h, a, b, K(62), M(62) );
592 R( b, c, d, e, f, g, h, a, K(63), M(63) );
593 R( a, b, c, d, e, f, g, h, K(64), M(64) );
594 R( h, a, b, c, d, e, f, g, K(65), M(65) );
595 R( g, h, a, b, c, d, e, f, K(66), M(66) );
596 R( f, g, h, a, b, c, d, e, K(67), M(67) );
597 R( e, f, g, h, a, b, c, d, K(68), M(68) );
598 R( d, e, f, g, h, a, b, c, K(69), M(69) );
599 R( c, d, e, f, g, h, a, b, K(70), M(70) );
600 R( b, c, d, e, f, g, h, a, K(71), M(71) );
601 R( a, b, c, d, e, f, g, h, K(72), M(72) );
602 R( h, a, b, c, d, e, f, g, K(73), M(73) );
603 R( g, h, a, b, c, d, e, f, K(74), M(74) );
604 R( f, g, h, a, b, c, d, e, K(75), M(75) );
605 R( e, f, g, h, a, b, c, d, K(76), M(76) );
606 R( d, e, f, g, h, a, b, c, K(77), M(77) );
607 R( c, d, e, f, g, h, a, b, K(78), M(78) );
608 R( b, c, d, e, f, g, h, a, K(79), M(79) );
609
610 a = ctx->state[0] = u64plus (ctx->state[0], a);
611 b = ctx->state[1] = u64plus (ctx->state[1], b);
612 c = ctx->state[2] = u64plus (ctx->state[2], c);
613 d = ctx->state[3] = u64plus (ctx->state[3], d);
614 e = ctx->state[4] = u64plus (ctx->state[4], e);
615 f = ctx->state[5] = u64plus (ctx->state[5], f);
616 g = ctx->state[6] = u64plus (ctx->state[6], g);
617 h = ctx->state[7] = u64plus (ctx->state[7], h);
618 }
619}