1 /* 2 * SM3 secure hash, as specified by OSCCA GM/T 0004-2012 SM3 and 3 * described at https://tools.ietf.org/html/draft-shen-sm3-hash-01 4 * 5 * Copyright (C) 2017 ARM Limited or its affiliates. 6 * Written by Gilad Ben-Yossef <gilad@benyossef.com> 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License version 2 as 10 * published by the Free Software Foundation. 11 * 12 * This program is distributed in the hope that it will be useful, 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 * GNU General Public License for more details. 16 * 17 * You should have received a copy of the GNU General Public License 18 * along with this program; if not, see <http://www.gnu.org/licenses/>. 19 */ 20 21 #include <crypto/internal/hash.h> 22 #include <linux/init.h> 23 #include <linux/module.h> 24 #include <linux/mm.h> 25 #include <linux/types.h> 26 #include <crypto/sm3.h> 27 #include <crypto/sm3_base.h> 28 #include <linux/bitops.h> 29 #include <asm/byteorder.h> 30 #include <asm/unaligned.h> 31 32 const u8 sm3_zero_message_hash[SM3_DIGEST_SIZE] = { 33 0x1A, 0xB2, 0x1D, 0x83, 0x55, 0xCF, 0xA1, 0x7F, 34 0x8e, 0x61, 0x19, 0x48, 0x31, 0xE8, 0x1A, 0x8F, 35 0x22, 0xBE, 0xC8, 0xC7, 0x28, 0xFE, 0xFB, 0x74, 36 0x7E, 0xD0, 0x35, 0xEB, 0x50, 0x82, 0xAA, 0x2B 37 }; 38 EXPORT_SYMBOL_GPL(sm3_zero_message_hash); 39 40 static inline u32 p0(u32 x) 41 { 42 return x ^ rol32(x, 9) ^ rol32(x, 17); 43 } 44 45 static inline u32 p1(u32 x) 46 { 47 return x ^ rol32(x, 15) ^ rol32(x, 23); 48 } 49 50 static inline u32 ff(unsigned int n, u32 a, u32 b, u32 c) 51 { 52 return (n < 16) ? (a ^ b ^ c) : ((a & b) | (a & c) | (b & c)); 53 } 54 55 static inline u32 gg(unsigned int n, u32 e, u32 f, u32 g) 56 { 57 return (n < 16) ? (e ^ f ^ g) : ((e & f) | ((~e) & g)); 58 } 59 60 static inline u32 t(unsigned int n) 61 { 62 return (n < 16) ? SM3_T1 : SM3_T2; 63 } 64 65 static void sm3_expand(u32 *t, u32 *w, u32 *wt) 66 { 67 int i; 68 unsigned int tmp; 69 70 /* load the input */ 71 for (i = 0; i <= 15; i++) 72 w[i] = get_unaligned_be32((__u32 *)t + i); 73 74 for (i = 16; i <= 67; i++) { 75 tmp = w[i - 16] ^ w[i - 9] ^ rol32(w[i - 3], 15); 76 w[i] = p1(tmp) ^ (rol32(w[i - 13], 7)) ^ w[i - 6]; 77 } 78 79 for (i = 0; i <= 63; i++) 80 wt[i] = w[i] ^ w[i + 4]; 81 } 82 83 static void sm3_compress(u32 *w, u32 *wt, u32 *m) 84 { 85 u32 ss1; 86 u32 ss2; 87 u32 tt1; 88 u32 tt2; 89 u32 a, b, c, d, e, f, g, h; 90 int i; 91 92 a = m[0]; 93 b = m[1]; 94 c = m[2]; 95 d = m[3]; 96 e = m[4]; 97 f = m[5]; 98 g = m[6]; 99 h = m[7]; 100 101 for (i = 0; i <= 63; i++) { 102 103 ss1 = rol32((rol32(a, 12) + e + rol32(t(i), i & 31)), 7); 104 105 ss2 = ss1 ^ rol32(a, 12); 106 107 tt1 = ff(i, a, b, c) + d + ss2 + *wt; 108 wt++; 109 110 tt2 = gg(i, e, f, g) + h + ss1 + *w; 111 w++; 112 113 d = c; 114 c = rol32(b, 9); 115 b = a; 116 a = tt1; 117 h = g; 118 g = rol32(f, 19); 119 f = e; 120 e = p0(tt2); 121 } 122 123 m[0] = a ^ m[0]; 124 m[1] = b ^ m[1]; 125 m[2] = c ^ m[2]; 126 m[3] = d ^ m[3]; 127 m[4] = e ^ m[4]; 128 m[5] = f ^ m[5]; 129 m[6] = g ^ m[6]; 130 m[7] = h ^ m[7]; 131 132 a = b = c = d = e = f = g = h = ss1 = ss2 = tt1 = tt2 = 0; 133 } 134 135 static void sm3_transform(struct sm3_state *sst, u8 const *src) 136 { 137 unsigned int w[68]; 138 unsigned int wt[64]; 139 140 sm3_expand((u32 *)src, w, wt); 141 sm3_compress(w, wt, sst->state); 142 143 memzero_explicit(w, sizeof(w)); 144 memzero_explicit(wt, sizeof(wt)); 145 } 146 147 static void sm3_generic_block_fn(struct sm3_state *sst, u8 const *src, 148 int blocks) 149 { 150 while (blocks--) { 151 sm3_transform(sst, src); 152 src += SM3_BLOCK_SIZE; 153 } 154 } 155 156 int crypto_sm3_update(struct shash_desc *desc, const u8 *data, 157 unsigned int len) 158 { 159 return sm3_base_do_update(desc, data, len, sm3_generic_block_fn); 160 } 161 EXPORT_SYMBOL(crypto_sm3_update); 162 163 static int sm3_final(struct shash_desc *desc, u8 *out) 164 { 165 sm3_base_do_finalize(desc, sm3_generic_block_fn); 166 return sm3_base_finish(desc, out); 167 } 168 169 int crypto_sm3_finup(struct shash_desc *desc, const u8 *data, 170 unsigned int len, u8 *hash) 171 { 172 sm3_base_do_update(desc, data, len, sm3_generic_block_fn); 173 return sm3_final(desc, hash); 174 } 175 EXPORT_SYMBOL(crypto_sm3_finup); 176 177 static struct shash_alg sm3_alg = { 178 .digestsize = SM3_DIGEST_SIZE, 179 .init = sm3_base_init, 180 .update = crypto_sm3_update, 181 .final = sm3_final, 182 .finup = crypto_sm3_finup, 183 .descsize = sizeof(struct sm3_state), 184 .base = { 185 .cra_name = "sm3", 186 .cra_driver_name = "sm3-generic", 187 .cra_blocksize = SM3_BLOCK_SIZE, 188 .cra_module = THIS_MODULE, 189 } 190 }; 191 192 static int __init sm3_generic_mod_init(void) 193 { 194 return crypto_register_shash(&sm3_alg); 195 } 196 197 static void __exit sm3_generic_mod_fini(void) 198 { 199 crypto_unregister_shash(&sm3_alg); 200 } 201 202 subsys_initcall(sm3_generic_mod_init); 203 module_exit(sm3_generic_mod_fini); 204 205 MODULE_LICENSE("GPL v2"); 206 MODULE_DESCRIPTION("SM3 Secure Hash Algorithm"); 207 208 MODULE_ALIAS_CRYPTO("sm3"); 209 MODULE_ALIAS_CRYPTO("sm3-generic"); 210