d1aa7614b2f6bab444b0cd4d98c23330b82aaf68
[openssl.git] / crypto / sha / sha512.c
1 /* crypto/sha/sha512.c */
2 /* ====================================================================
3  * Copyright (c) 2004 The OpenSSL Project.  All rights reserved
4  * according to the OpenSSL license [found in ../../LICENSE].
5  * ====================================================================
6  */
7 #include <openssl/opensslconf.h>
8 #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA512)
9 /*
10  * IMPLEMENTATION NOTES.
11  *
12  * As you might have noticed 32-bit hash algorithms:
13  *
14  * - permit SHA_LONG to be wider than 32-bit (case on CRAY);
15  * - optimized versions implement two transform functions: one operating
16  *   on [aligned] data in host byte order and one - on data in input
17  *   stream byte order;
18  * - share common byte-order neutral collector and padding function
19  *   implementations, ../md32_common.h;
20  *
21  * Neither of the above applies to this SHA-512 implementations. Reasons
22  * [in reverse order] are:
23  *
24  * - it's the only 64-bit hash algorithm for the moment of this writing,
25  *   there is no need for common collector/padding implementation [yet];
26  * - by supporting only one transform function [which operates on
27  *   *aligned* data in input stream byte order, big-endian in this case]
28  *   we minimize burden of maintenance in two ways: a) collector/padding
29  *   function is simpler; b) only one transform function to stare at;
30  * - SHA_LONG64 is required to be exactly 64-bit in order to be able to
31  *   apply a number of optimizations to mitigate potential performance
32  *   penalties caused by previous design decision;
33  *
34  * Caveat lector.
35  *
36  * Implementation relies on the fact that "long long" is 64-bit on
37  * both 32- and 64-bit platforms. If some compiler vendor comes up
38  * with 128-bit long long, adjustment to sha.h would be required.
39  * As this implementation relies on 64-bit integer type, it's totally
40  * inappropriate for platforms which don't support it, most notably
41  * 16-bit platforms.
42  *                                      <appro@fy.chalmers.se>
43  */
44 #include <stdlib.h>
45 #include <string.h>
46
47 #include <openssl/crypto.h>
48 #include <openssl/sha.h>
49 #include <openssl/opensslv.h>
50
51 #include "cryptlib.h"
52
53 const char SHA512_version[]="SHA-512" OPENSSL_VERSION_PTEXT;
54
55 #if defined(__i386) || defined(__i386__) || defined(_M_IX86) || \
56     defined(__x86_64) || defined(_M_AMD64) || defined(_M_X64) || \
57     defined(__s390__) || defined(__s390x__) || \
58     defined(SHA512_ASM)
59 #define SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA
60 #endif
61
62 int SHA384_Init (SHA512_CTX *c)
63         {
64 #if defined(SHA512_ASM) && (defined(__arm__) || defined(__arm))
65         /* maintain dword order required by assembler module */
66         unsigned int *h = (unsigned int *)c->h;
67
68         h[0]  = 0xcbbb9d5d; h[1]  = 0xc1059ed8;
69         h[2]  = 0x629a292a; h[3]  = 0x367cd507;
70         h[4]  = 0x9159015a; h[5]  = 0x3070dd17;
71         h[6]  = 0x152fecd8; h[7]  = 0xf70e5939;
72         h[8]  = 0x67332667; h[9]  = 0xffc00b31;
73         h[10] = 0x8eb44a87; h[11] = 0x68581511;
74         h[12] = 0xdb0c2e0d; h[13] = 0x64f98fa7;
75         h[14] = 0x47b5481d; h[15] = 0xbefa4fa4;
76 #else
77         c->h[0]=U64(0xcbbb9d5dc1059ed8);
78         c->h[1]=U64(0x629a292a367cd507);
79         c->h[2]=U64(0x9159015a3070dd17);
80         c->h[3]=U64(0x152fecd8f70e5939);
81         c->h[4]=U64(0x67332667ffc00b31);
82         c->h[5]=U64(0x8eb44a8768581511);
83         c->h[6]=U64(0xdb0c2e0d64f98fa7);
84         c->h[7]=U64(0x47b5481dbefa4fa4);
85 #endif
86         c->Nl=0;        c->Nh=0;
87         c->num=0;       c->md_len=SHA384_DIGEST_LENGTH;
88         return 1;
89         }
90
91 int SHA512_Init (SHA512_CTX *c)
92         {
93 #if defined(SHA512_ASM) && (defined(__arm__) || defined(__arm))
94         /* maintain dword order required by assembler module */
95         unsigned int *h = (unsigned int *)c->h;
96
97         h[0]  = 0x6a09e667; h[1]  = 0xf3bcc908;
98         h[2]  = 0xbb67ae85; h[3]  = 0x84caa73b;
99         h[4]  = 0x3c6ef372; h[5]  = 0xfe94f82b;
100         h[6]  = 0xa54ff53a; h[7]  = 0x5f1d36f1;
101         h[8]  = 0x510e527f; h[9]  = 0xade682d1;
102         h[10] = 0x9b05688c; h[11] = 0x2b3e6c1f;
103         h[12] = 0x1f83d9ab; h[13] = 0xfb41bd6b;
104         h[14] = 0x5be0cd19; h[15] = 0x137e2179;
105 #else
106         c->h[0]=U64(0x6a09e667f3bcc908);
107         c->h[1]=U64(0xbb67ae8584caa73b);
108         c->h[2]=U64(0x3c6ef372fe94f82b);
109         c->h[3]=U64(0xa54ff53a5f1d36f1);
110         c->h[4]=U64(0x510e527fade682d1);
111         c->h[5]=U64(0x9b05688c2b3e6c1f);
112         c->h[6]=U64(0x1f83d9abfb41bd6b);
113         c->h[7]=U64(0x5be0cd19137e2179);
114 #endif
115         c->Nl=0;        c->Nh=0;
116         c->num=0;       c->md_len=SHA512_DIGEST_LENGTH;
117         return 1;
118         }
119
120 #ifndef SHA512_ASM
121 static
122 #endif
123 void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num);
124
125 int SHA512_Final (unsigned char *md, SHA512_CTX *c)
126         {
127         unsigned char *p=(unsigned char *)c->u.p;
128         size_t n=c->num;
129
130         p[n]=0x80;      /* There always is a room for one */
131         n++;
132         if (n > (sizeof(c->u)-16))
133                 memset (p+n,0,sizeof(c->u)-n), n=0,
134                 sha512_block_data_order (c,p,1);
135
136         memset (p+n,0,sizeof(c->u)-16-n);
137 #ifdef  B_ENDIAN
138         c->u.d[SHA_LBLOCK-2] = c->Nh;
139         c->u.d[SHA_LBLOCK-1] = c->Nl;
140 #else
141         p[sizeof(c->u)-1]  = (unsigned char)(c->Nl);
142         p[sizeof(c->u)-2]  = (unsigned char)(c->Nl>>8);
143         p[sizeof(c->u)-3]  = (unsigned char)(c->Nl>>16);
144         p[sizeof(c->u)-4]  = (unsigned char)(c->Nl>>24);
145         p[sizeof(c->u)-5]  = (unsigned char)(c->Nl>>32);
146         p[sizeof(c->u)-6]  = (unsigned char)(c->Nl>>40);
147         p[sizeof(c->u)-7]  = (unsigned char)(c->Nl>>48);
148         p[sizeof(c->u)-8]  = (unsigned char)(c->Nl>>56);
149         p[sizeof(c->u)-9]  = (unsigned char)(c->Nh);
150         p[sizeof(c->u)-10] = (unsigned char)(c->Nh>>8);
151         p[sizeof(c->u)-11] = (unsigned char)(c->Nh>>16);
152         p[sizeof(c->u)-12] = (unsigned char)(c->Nh>>24);
153         p[sizeof(c->u)-13] = (unsigned char)(c->Nh>>32);
154         p[sizeof(c->u)-14] = (unsigned char)(c->Nh>>40);
155         p[sizeof(c->u)-15] = (unsigned char)(c->Nh>>48);
156         p[sizeof(c->u)-16] = (unsigned char)(c->Nh>>56);
157 #endif
158
159         sha512_block_data_order (c,p,1);
160
161         if (md==0) return 0;
162
163 #if defined(SHA512_ASM) && (defined(__arm__) || defined(__arm))
164         /* recall assembler dword order... */
165         n = c->md_len;
166         if (n == SHA384_DIGEST_LENGTH || n == SHA512_DIGEST_LENGTH)
167                 {
168                 unsigned int *h = (unsigned int *)c->h, t;
169
170                 for (n/=4;n;n--)
171                         {
172                         t = *(h++);
173                         *(md++) = (unsigned char)(t>>24);
174                         *(md++) = (unsigned char)(t>>16);
175                         *(md++) = (unsigned char)(t>>8);
176                         *(md++) = (unsigned char)(t);
177                         }
178                 }
179         else    return 0;
180 #else
181         switch (c->md_len)
182                 {
183                 /* Let compiler decide if it's appropriate to unroll... */
184                 case SHA384_DIGEST_LENGTH:
185                         for (n=0;n<SHA384_DIGEST_LENGTH/8;n++)
186                                 {
187                                 SHA_LONG64 t = c->h[n];
188
189                                 *(md++) = (unsigned char)(t>>56);
190                                 *(md++) = (unsigned char)(t>>48);
191                                 *(md++) = (unsigned char)(t>>40);
192                                 *(md++) = (unsigned char)(t>>32);
193                                 *(md++) = (unsigned char)(t>>24);
194                                 *(md++) = (unsigned char)(t>>16);
195                                 *(md++) = (unsigned char)(t>>8);
196                                 *(md++) = (unsigned char)(t);
197                                 }
198                         break;
199                 case SHA512_DIGEST_LENGTH:
200                         for (n=0;n<SHA512_DIGEST_LENGTH/8;n++)
201                                 {
202                                 SHA_LONG64 t = c->h[n];
203
204                                 *(md++) = (unsigned char)(t>>56);
205                                 *(md++) = (unsigned char)(t>>48);
206                                 *(md++) = (unsigned char)(t>>40);
207                                 *(md++) = (unsigned char)(t>>32);
208                                 *(md++) = (unsigned char)(t>>24);
209                                 *(md++) = (unsigned char)(t>>16);
210                                 *(md++) = (unsigned char)(t>>8);
211                                 *(md++) = (unsigned char)(t);
212                                 }
213                         break;
214                 /* ... as well as make sure md_len is not abused. */
215                 default:        return 0;
216                 }
217 #endif
218         return 1;
219         }
220
221 int SHA384_Final (unsigned char *md,SHA512_CTX *c)
222 {   return SHA512_Final (md,c);   }
223
224 int SHA512_Update (SHA512_CTX *c, const void *_data, size_t len)
225         {
226         SHA_LONG64      l;
227         unsigned char  *p=c->u.p;
228         const unsigned char *data=(const unsigned char *)_data;
229
230         if (len==0) return  1;
231
232         l = (c->Nl+(((SHA_LONG64)len)<<3))&U64(0xffffffffffffffff);
233         if (l < c->Nl)          c->Nh++;
234         if (sizeof(len)>=8)     c->Nh+=(((SHA_LONG64)len)>>61);
235         c->Nl=l;
236
237         if (c->num != 0)
238                 {
239                 size_t n = sizeof(c->u) - c->num;
240
241                 if (len < n)
242                         {
243                         memcpy (p+c->num,data,len), c->num += (unsigned int)len;
244                         return 1;
245                         }
246                 else    {
247                         memcpy (p+c->num,data,n), c->num = 0;
248                         len-=n, data+=n;
249                         sha512_block_data_order (c,p,1);
250                         }
251                 }
252
253         if (len >= sizeof(c->u))
254                 {
255 #ifndef SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA
256                 if ((size_t)data%sizeof(c->u.d[0]) != 0)
257                         while (len >= sizeof(c->u))
258                                 memcpy (p,data,sizeof(c->u)),
259                                 sha512_block_data_order (c,p,1),
260                                 len  -= sizeof(c->u),
261                                 data += sizeof(c->u);
262                 else
263 #endif
264                         sha512_block_data_order (c,data,len/sizeof(c->u)),
265                         data += len,
266                         len  %= sizeof(c->u),
267                         data -= len;
268                 }
269
270         if (len != 0)   memcpy (p,data,len), c->num = (int)len;
271
272         return 1;
273         }
274
275 int SHA384_Update (SHA512_CTX *c, const void *data, size_t len)
276 {   return SHA512_Update (c,data,len);   }
277
278 void SHA512_Transform (SHA512_CTX *c, const unsigned char *data)
279 {   sha512_block_data_order (c,data,1);  }
280
281 unsigned char *SHA384(const unsigned char *d, size_t n, unsigned char *md)
282         {
283         SHA512_CTX c;
284         static unsigned char m[SHA384_DIGEST_LENGTH];
285
286         if (md == NULL) md=m;
287         SHA384_Init(&c);
288         SHA512_Update(&c,d,n);
289         SHA512_Final(md,&c);
290         OPENSSL_cleanse(&c,sizeof(c));
291         return(md);
292         }
293
294 unsigned char *SHA512(const unsigned char *d, size_t n, unsigned char *md)
295         {
296         SHA512_CTX c;
297         static unsigned char m[SHA512_DIGEST_LENGTH];
298
299         if (md == NULL) md=m;
300         SHA512_Init(&c);
301         SHA512_Update(&c,d,n);
302         SHA512_Final(md,&c);
303         OPENSSL_cleanse(&c,sizeof(c));
304         return(md);
305         }
306
307 #ifndef SHA512_ASM
308 static const SHA_LONG64 K512[80] = {
309         U64(0x428a2f98d728ae22),U64(0x7137449123ef65cd),
310         U64(0xb5c0fbcfec4d3b2f),U64(0xe9b5dba58189dbbc),
311         U64(0x3956c25bf348b538),U64(0x59f111f1b605d019),
312         U64(0x923f82a4af194f9b),U64(0xab1c5ed5da6d8118),
313         U64(0xd807aa98a3030242),U64(0x12835b0145706fbe),
314         U64(0x243185be4ee4b28c),U64(0x550c7dc3d5ffb4e2),
315         U64(0x72be5d74f27b896f),U64(0x80deb1fe3b1696b1),
316         U64(0x9bdc06a725c71235),U64(0xc19bf174cf692694),
317         U64(0xe49b69c19ef14ad2),U64(0xefbe4786384f25e3),
318         U64(0x0fc19dc68b8cd5b5),U64(0x240ca1cc77ac9c65),
319         U64(0x2de92c6f592b0275),U64(0x4a7484aa6ea6e483),
320         U64(0x5cb0a9dcbd41fbd4),U64(0x76f988da831153b5),
321         U64(0x983e5152ee66dfab),U64(0xa831c66d2db43210),
322         U64(0xb00327c898fb213f),U64(0xbf597fc7beef0ee4),
323         U64(0xc6e00bf33da88fc2),U64(0xd5a79147930aa725),
324         U64(0x06ca6351e003826f),U64(0x142929670a0e6e70),
325         U64(0x27b70a8546d22ffc),U64(0x2e1b21385c26c926),
326         U64(0x4d2c6dfc5ac42aed),U64(0x53380d139d95b3df),
327         U64(0x650a73548baf63de),U64(0x766a0abb3c77b2a8),
328         U64(0x81c2c92e47edaee6),U64(0x92722c851482353b),
329         U64(0xa2bfe8a14cf10364),U64(0xa81a664bbc423001),
330         U64(0xc24b8b70d0f89791),U64(0xc76c51a30654be30),
331         U64(0xd192e819d6ef5218),U64(0xd69906245565a910),
332         U64(0xf40e35855771202a),U64(0x106aa07032bbd1b8),
333         U64(0x19a4c116b8d2d0c8),U64(0x1e376c085141ab53),
334         U64(0x2748774cdf8eeb99),U64(0x34b0bcb5e19b48a8),
335         U64(0x391c0cb3c5c95a63),U64(0x4ed8aa4ae3418acb),
336         U64(0x5b9cca4f7763e373),U64(0x682e6ff3d6b2b8a3),
337         U64(0x748f82ee5defb2fc),U64(0x78a5636f43172f60),
338         U64(0x84c87814a1f0ab72),U64(0x8cc702081a6439ec),
339         U64(0x90befffa23631e28),U64(0xa4506cebde82bde9),
340         U64(0xbef9a3f7b2c67915),U64(0xc67178f2e372532b),
341         U64(0xca273eceea26619c),U64(0xd186b8c721c0c207),
342         U64(0xeada7dd6cde0eb1e),U64(0xf57d4f7fee6ed178),
343         U64(0x06f067aa72176fba),U64(0x0a637dc5a2c898a6),
344         U64(0x113f9804bef90dae),U64(0x1b710b35131c471b),
345         U64(0x28db77f523047d84),U64(0x32caab7b40c72493),
346         U64(0x3c9ebe0a15c9bebc),U64(0x431d67c49c100d4c),
347         U64(0x4cc5d4becb3e42b6),U64(0x597f299cfc657e2a),
348         U64(0x5fcb6fab3ad6faec),U64(0x6c44198c4a475817) };
349
350 #ifndef PEDANTIC
351 # if defined(__GNUC__) && __GNUC__>=2 && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
352 #  if defined(__x86_64) || defined(__x86_64__)
353 #   define ROTR(a,n)    ({ SHA_LONG64 ret;              \
354                                 asm ("rorq %1,%0"       \
355                                 : "=r"(ret)             \
356                                 : "J"(n),"0"(a)         \
357                                 : "cc"); ret;           })
358 #   if !defined(B_ENDIAN)
359 #    define PULL64(x) ({ SHA_LONG64 ret=*((const SHA_LONG64 *)(&(x)));  \
360                                 asm ("bswapq    %0"             \
361                                 : "=r"(ret)                     \
362                                 : "0"(ret)); ret;               })
363 #   endif
364 #  elif (defined(__i386) || defined(__i386__)) && !defined(B_ENDIAN)
365 #   if defined(I386_ONLY)
366 #    define PULL64(x) ({ const unsigned int *p=(const unsigned int *)(&(x));\
367                          unsigned int hi=p[0],lo=p[1];          \
368                                 asm("xchgb %%ah,%%al;xchgb %%dh,%%dl;"\
369                                     "roll $16,%%eax; roll $16,%%edx; "\
370                                     "xchgb %%ah,%%al;xchgb %%dh,%%dl;" \
371                                 : "=a"(lo),"=d"(hi)             \
372                                 : "0"(lo),"1"(hi) : "cc");      \
373                                 ((SHA_LONG64)hi)<<32|lo;        })
374 #   else
375 #    define PULL64(x) ({ const unsigned int *p=(const unsigned int *)(&(x));\
376                          unsigned int hi=p[0],lo=p[1];          \
377                                 asm ("bswapl %0; bswapl %1;"    \
378                                 : "=r"(lo),"=r"(hi)             \
379                                 : "0"(lo),"1"(hi));             \
380                                 ((SHA_LONG64)hi)<<32|lo;        })
381 #   endif
382 #  elif (defined(_ARCH_PPC) && defined(__64BIT__)) || defined(_ARCH_PPC64)
383 #   define ROTR(a,n)    ({ unsigned long ret;           \
384                                 asm ("rotrdi %0,%1,%2"  \
385                                 : "=r"(ret)             \
386                                 : "r"(a),"K"(n)); ret;  })
387 #  endif
388 # elif defined(_MSC_VER)
389 #  if defined(_WIN64)   /* applies to both IA-64 and AMD64 */
390 #   pragma intrinsic(_rotr64)
391 #   define ROTR(a,n)    _rotr64((a),n)
392 #  endif
393 #  if defined(_M_IX86) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM)
394 #   if defined(I386_ONLY)
395     static SHA_LONG64 __fastcall __pull64be(const void *x)
396     {   _asm    mov     edx, [ecx + 0]
397         _asm    mov     eax, [ecx + 4]
398         _asm    xchg    dh,dl
399         _asm    xchg    ah,al
400         _asm    rol     edx,16
401         _asm    rol     eax,16
402         _asm    xchg    dh,dl
403         _asm    xchg    ah,al
404     }
405 #   else
406     static SHA_LONG64 __fastcall __pull64be(const void *x)
407     {   _asm    mov     edx, [ecx + 0]
408         _asm    mov     eax, [ecx + 4]
409         _asm    bswap   edx
410         _asm    bswap   eax
411     }
412 #   endif
413 #   define PULL64(x) __pull64be(&(x))
414 #   if _MSC_VER<=1200
415 #    pragma inline_depth(0)
416 #   endif
417 #  endif
418 # endif
419 #endif
420
421 #ifndef PULL64
422 #define B(x,j)    (((SHA_LONG64)(*(((const unsigned char *)(&x))+j)))<<((7-j)*8))
423 #define PULL64(x) (B(x,0)|B(x,1)|B(x,2)|B(x,3)|B(x,4)|B(x,5)|B(x,6)|B(x,7))
424 #endif
425
426 #ifndef ROTR
427 #define ROTR(x,s)       (((x)>>s) | (x)<<(64-s))
428 #endif
429
430 #define Sigma0(x)       (ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39))
431 #define Sigma1(x)       (ROTR((x),14) ^ ROTR((x),18) ^ ROTR((x),41))
432 #define sigma0(x)       (ROTR((x),1)  ^ ROTR((x),8)  ^ ((x)>>7))
433 #define sigma1(x)       (ROTR((x),19) ^ ROTR((x),61) ^ ((x)>>6))
434
435 #define Ch(x,y,z)       (((x) & (y)) ^ ((~(x)) & (z)))
436 #define Maj(x,y,z)      (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
437
438
439 #if defined(__i386) || defined(__i386__) || defined(_M_IX86)
440 /*
441  * This code should give better results on 32-bit CPU with less than
442  * ~24 registers, both size and performance wise...
443  */
444 static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num)
445         {
446         const SHA_LONG64 *W=in;
447         SHA_LONG64      A,E,T;
448         SHA_LONG64      X[9+80],*F;
449         int i;
450
451                         while (num--) {
452
453         F    = X+80;
454         A    = ctx->h[0];       F[1] = ctx->h[1];
455         F[2] = ctx->h[2];       F[3] = ctx->h[3];
456         E    = ctx->h[4];       F[5] = ctx->h[5];
457         F[6] = ctx->h[6];       F[7] = ctx->h[7];
458
459         for (i=0;i<16;i++,F--)
460                 {
461 #ifdef B_ENDIAN
462                 T = W[i];
463 #else
464                 T = PULL64(W[i]);
465 #endif
466                 F[0] = A;
467                 F[4] = E;
468                 F[8] = T;
469                 T   += F[7] + Sigma1(E) + Ch(E,F[5],F[6]) + K512[i];
470                 E    = F[3] + T;
471                 A    = T + Sigma0(A) + Maj(A,F[1],F[2]);
472                 }
473
474         for (;i<80;i++,F--)
475                 {
476                 T    = sigma0(F[8+16-1]);
477                 T   += sigma1(F[8+16-14]);
478                 T   += F[8+16] + F[8+16-9];
479
480                 F[0] = A;
481                 F[4] = E;
482                 F[8] = T;
483                 T   += F[7] + Sigma1(E) + Ch(E,F[5],F[6]) + K512[i];
484                 E    = F[3] + T;
485                 A    = T + Sigma0(A) + Maj(A,F[1],F[2]);
486                 }
487
488         ctx->h[0] += A;         ctx->h[1] += F[1];
489         ctx->h[2] += F[2];      ctx->h[3] += F[3];
490         ctx->h[4] += E;         ctx->h[5] += F[5];
491         ctx->h[6] += F[6];      ctx->h[7] += F[7];
492
493                         W+=SHA_LBLOCK;
494                         }
495         }
496
497 #elif defined(OPENSSL_SMALL_FOOTPRINT)
498
499 static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num)
500         {
501         const SHA_LONG64 *W=in;
502         SHA_LONG64      a,b,c,d,e,f,g,h,s0,s1,T1,T2;
503         SHA_LONG64      X[16];
504         int i;
505
506                         while (num--) {
507
508         a = ctx->h[0];  b = ctx->h[1];  c = ctx->h[2];  d = ctx->h[3];
509         e = ctx->h[4];  f = ctx->h[5];  g = ctx->h[6];  h = ctx->h[7];
510
511         for (i=0;i<16;i++)
512                 {
513 #ifdef B_ENDIAN
514                 T1 = X[i] = W[i];
515 #else
516                 T1 = X[i] = PULL64(W[i]);
517 #endif
518                 T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i];
519                 T2 = Sigma0(a) + Maj(a,b,c);
520                 h = g;  g = f;  f = e;  e = d + T1;
521                 d = c;  c = b;  b = a;  a = T1 + T2;
522                 }
523
524         for (;i<80;i++)
525                 {
526                 s0 = X[(i+1)&0x0f];     s0 = sigma0(s0);
527                 s1 = X[(i+14)&0x0f];    s1 = sigma1(s1);
528
529                 T1 = X[i&0xf] += s0 + s1 + X[(i+9)&0xf];
530                 T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i];
531                 T2 = Sigma0(a) + Maj(a,b,c);
532                 h = g;  g = f;  f = e;  e = d + T1;
533                 d = c;  c = b;  b = a;  a = T1 + T2;
534                 }
535
536         ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
537         ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
538
539                         W+=SHA_LBLOCK;
540                         }
541         }
542
543 #else
544
545 #define ROUND_00_15(i,a,b,c,d,e,f,g,h)          do {    \
546         T1 += h + Sigma1(e) + Ch(e,f,g) + K512[i];      \
547         h = Sigma0(a) + Maj(a,b,c);                     \
548         d += T1;        h += T1;                } while (0)
549
550 #define ROUND_16_80(i,j,a,b,c,d,e,f,g,h,X)      do {    \
551         s0 = X[(j+1)&0x0f];     s0 = sigma0(s0);        \
552         s1 = X[(j+14)&0x0f];    s1 = sigma1(s1);        \
553         T1 = X[(j)&0x0f] += s0 + s1 + X[(j+9)&0x0f];    \
554         ROUND_00_15(i+j,a,b,c,d,e,f,g,h);               } while (0)
555
556 static void sha512_block_data_order (SHA512_CTX *ctx, const void *in, size_t num)
557         {
558         const SHA_LONG64 *W=in;
559         SHA_LONG64      a,b,c,d,e,f,g,h,s0,s1,T1;
560         SHA_LONG64      X[16];
561         int i;
562
563                         while (num--) {
564
565         a = ctx->h[0];  b = ctx->h[1];  c = ctx->h[2];  d = ctx->h[3];
566         e = ctx->h[4];  f = ctx->h[5];  g = ctx->h[6];  h = ctx->h[7];
567
568 #ifdef B_ENDIAN
569         T1 = X[0] = W[0];       ROUND_00_15(0,a,b,c,d,e,f,g,h);
570         T1 = X[1] = W[1];       ROUND_00_15(1,h,a,b,c,d,e,f,g);
571         T1 = X[2] = W[2];       ROUND_00_15(2,g,h,a,b,c,d,e,f);
572         T1 = X[3] = W[3];       ROUND_00_15(3,f,g,h,a,b,c,d,e);
573         T1 = X[4] = W[4];       ROUND_00_15(4,e,f,g,h,a,b,c,d);
574         T1 = X[5] = W[5];       ROUND_00_15(5,d,e,f,g,h,a,b,c);
575         T1 = X[6] = W[6];       ROUND_00_15(6,c,d,e,f,g,h,a,b);
576         T1 = X[7] = W[7];       ROUND_00_15(7,b,c,d,e,f,g,h,a);
577         T1 = X[8] = W[8];       ROUND_00_15(8,a,b,c,d,e,f,g,h);
578         T1 = X[9] = W[9];       ROUND_00_15(9,h,a,b,c,d,e,f,g);
579         T1 = X[10] = W[10];     ROUND_00_15(10,g,h,a,b,c,d,e,f);
580         T1 = X[11] = W[11];     ROUND_00_15(11,f,g,h,a,b,c,d,e);
581         T1 = X[12] = W[12];     ROUND_00_15(12,e,f,g,h,a,b,c,d);
582         T1 = X[13] = W[13];     ROUND_00_15(13,d,e,f,g,h,a,b,c);
583         T1 = X[14] = W[14];     ROUND_00_15(14,c,d,e,f,g,h,a,b);
584         T1 = X[15] = W[15];     ROUND_00_15(15,b,c,d,e,f,g,h,a);
585 #else
586         T1 = X[0]  = PULL64(W[0]);      ROUND_00_15(0,a,b,c,d,e,f,g,h);
587         T1 = X[1]  = PULL64(W[1]);      ROUND_00_15(1,h,a,b,c,d,e,f,g);
588         T1 = X[2]  = PULL64(W[2]);      ROUND_00_15(2,g,h,a,b,c,d,e,f);
589         T1 = X[3]  = PULL64(W[3]);      ROUND_00_15(3,f,g,h,a,b,c,d,e);
590         T1 = X[4]  = PULL64(W[4]);      ROUND_00_15(4,e,f,g,h,a,b,c,d);
591         T1 = X[5]  = PULL64(W[5]);      ROUND_00_15(5,d,e,f,g,h,a,b,c);
592         T1 = X[6]  = PULL64(W[6]);      ROUND_00_15(6,c,d,e,f,g,h,a,b);
593         T1 = X[7]  = PULL64(W[7]);      ROUND_00_15(7,b,c,d,e,f,g,h,a);
594         T1 = X[8]  = PULL64(W[8]);      ROUND_00_15(8,a,b,c,d,e,f,g,h);
595         T1 = X[9]  = PULL64(W[9]);      ROUND_00_15(9,h,a,b,c,d,e,f,g);
596         T1 = X[10] = PULL64(W[10]);     ROUND_00_15(10,g,h,a,b,c,d,e,f);
597         T1 = X[11] = PULL64(W[11]);     ROUND_00_15(11,f,g,h,a,b,c,d,e);
598         T1 = X[12] = PULL64(W[12]);     ROUND_00_15(12,e,f,g,h,a,b,c,d);
599         T1 = X[13] = PULL64(W[13]);     ROUND_00_15(13,d,e,f,g,h,a,b,c);
600         T1 = X[14] = PULL64(W[14]);     ROUND_00_15(14,c,d,e,f,g,h,a,b);
601         T1 = X[15] = PULL64(W[15]);     ROUND_00_15(15,b,c,d,e,f,g,h,a);
602 #endif
603
604         for (i=16;i<80;i+=16)
605                 {
606                 ROUND_16_80(i, 0,a,b,c,d,e,f,g,h,X);
607                 ROUND_16_80(i, 1,h,a,b,c,d,e,f,g,X);
608                 ROUND_16_80(i, 2,g,h,a,b,c,d,e,f,X);
609                 ROUND_16_80(i, 3,f,g,h,a,b,c,d,e,X);
610                 ROUND_16_80(i, 4,e,f,g,h,a,b,c,d,X);
611                 ROUND_16_80(i, 5,d,e,f,g,h,a,b,c,X);
612                 ROUND_16_80(i, 6,c,d,e,f,g,h,a,b,X);
613                 ROUND_16_80(i, 7,b,c,d,e,f,g,h,a,X);
614                 ROUND_16_80(i, 8,a,b,c,d,e,f,g,h,X);
615                 ROUND_16_80(i, 9,h,a,b,c,d,e,f,g,X);
616                 ROUND_16_80(i,10,g,h,a,b,c,d,e,f,X);
617                 ROUND_16_80(i,11,f,g,h,a,b,c,d,e,X);
618                 ROUND_16_80(i,12,e,f,g,h,a,b,c,d,X);
619                 ROUND_16_80(i,13,d,e,f,g,h,a,b,c,X);
620                 ROUND_16_80(i,14,c,d,e,f,g,h,a,b,X);
621                 ROUND_16_80(i,15,b,c,d,e,f,g,h,a,X);
622                 }
623
624         ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
625         ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
626
627                         W+=SHA_LBLOCK;
628                         }
629         }
630
631 #endif
632
633 #endif /* SHA512_ASM */
634
635 #else /* !OPENSSL_NO_SHA512 */
636
637 #if defined(PEDANTIC) || defined(__DECC) || defined(OPENSSL_SYS_MACOSX)
638 static void *dummy=&dummy;
639 #endif
640
641 #endif /* !OPENSSL_NO_SHA512 */