gosthash2012: Make `add512' to work in-place

[openssl-gost/engine.git] / gosthash2012.c

diff --git a/gosthash2012.c b/gosthash2012.c
index 6a89237e1d9ba7ba35f0924780cd0c147385df22..68ee0901875aaf782a3214ce4119eb631f2af44b 100644 (file)
--- a/gosthash2012.c
+++ b/gosthash2012.c
@@ -32,63 +32,69 @@
 void init_gost2012_hash_ctx(gost2012_hash_ctx * CTX,
                             const unsigned int digest_size)
 {
-    unsigned int i;
-
     memset(CTX, 0, sizeof(gost2012_hash_ctx));
 
     CTX->digest_size = digest_size;
+    /*
+     * IV for 512-bit hash should be 0^512
+     * IV for 256-bit hash should be (00000001)^64
+     *
+     * It's already zeroed when CTX is cleared above, so we only
+     * need to set it to 0x01-s for 256-bit hash.
+     */
     if (digest_size == 256)
         memset(&CTX->h, 0x01, sizeof(uint512_u));
-    else
-        memset(&CTX->h, 0x00, sizeof(uint512_u));
 }
 
 static INLINE void pad(gost2012_hash_ctx * CTX)
 {
-    unsigned char buf[64];
-
-    if (CTX->bufsize > 63)
-        return;
+    memset(&(CTX->buffer[CTX->bufsize]), 0, sizeof(CTX->buffer) - CTX->bufsize);
+    CTX->buffer[CTX->bufsize] = 1;
 
-    memset(&buf, 0x00, sizeof buf);
-    memcpy(&buf, CTX->buffer, CTX->bufsize);
-
-    buf[CTX->bufsize] = 0x01;
-    memcpy(CTX->buffer, &buf, sizeof buf);
 }
 
-static INLINE void add512(const union uint512_u *x,
-                          const union uint512_u *y, union uint512_u *r)
+static INLINE void add512(union uint512_u * RESTRICT x,
+                          const union uint512_u * RESTRICT y)
 {
 #ifndef __GOST3411_BIG_ENDIAN__
-    unsigned int CF, OF;
+    unsigned int CF;
     unsigned int i;
 
     CF = 0;
     for (i = 0; i < 8; i++) {
-        r->QWORD[i] = x->QWORD[i] + y->QWORD[i];
-        if (r->QWORD[i] < y->QWORD[i] || r->QWORD[i] < x->QWORD[i])
-            OF = 1;
-        else
-            OF = 0;
-
-        r->QWORD[i] += CF;
-        CF = OF;
+       const unsigned long long left = x->QWORD[i];
+       unsigned long long sum;
+
+       sum = left + y->QWORD[i] + CF;
+       /*
+        * (sum == left): is noop, because it's possible only
+        * when `left' is added with `0 + 0' or with `ULLONG_MAX + 1',
+        * in that case `CF' (carry) retain previous value, which is correct,
+        * because when `left + 0 + 0' there was no overflow (thus no carry),
+        * and when `left + ULLONG_MAX + 1' value is wrapped back to
+        * itself with overflow, thus creating carry.
+        *
+        * (sum != left):
+        * if `sum' is not wrapped (sum > left) there should not be carry,
+        * if `sum' is wrapped (sum < left) there should be carry.
+        */
+       if (sum != left)
+           CF = (sum < left);
+       x->QWORD[i] = sum;
     }
 #else
-    const unsigned char *xp, *yp;
-    unsigned char *rp;
+    const unsigned char *yp;
+    unsigned char *xp;
     unsigned int i;
     int buf;
 
-    xp = (const unsigned char *)&x[0];
+    xp = (unsigned char *)&x[0];
     yp = (const unsigned char *)&y[0];
-    rp = (unsigned char *)&r[0];
 
     buf = 0;
     for (i = 0; i < 64; i++) {
         buf = xp[i] + yp[i] + (buf >> 8);
-        rp[i] = (unsigned char)buf & 0xFF;
+        xp[i] = (unsigned char)buf & 0xFF;
     }
 #endif
 }
@@ -144,10 +150,13 @@ static void g(union uint512_u *h, const union uint512_u *N,
 
 static INLINE void stage2(gost2012_hash_ctx * CTX, const unsigned char *data)
 {
-    g(&(CTX->h), &(CTX->N), data);
+    union uint512_u m;
+
+    memcpy(&m, data, sizeof(m));
+    g(&(CTX->h), &(CTX->N), (const unsigned char *)&m);
 
-    add512(&(CTX->N), &buffer512, &(CTX->N));
-    add512(&(CTX->Sigma), (const union uint512_u *)data, &(CTX->Sigma));
+    add512(&(CTX->N), &buffer512);
+    add512(&(CTX->Sigma), &m);
 }
 
 static INLINE void stage3(gost2012_hash_ctx * CTX)
@@ -169,14 +178,12 @@ static INLINE void stage3(gost2012_hash_ctx * CTX)
 
     g(&(CTX->h), &(CTX->N), (const unsigned char *)&(CTX->buffer));
 
-    add512(&(CTX->N), &buf, &(CTX->N));
-    add512(&(CTX->Sigma), (const union uint512_u *)&CTX->buffer[0],
-           &(CTX->Sigma));
+    add512(&(CTX->N), &buf);
+    add512(&(CTX->Sigma), (const union uint512_u *)&CTX->buffer[0]);
 
     g(&(CTX->h), &buffer0, (const unsigned char *)&(CTX->N));
 
     g(&(CTX->h), &buffer0, (const unsigned char *)&(CTX->Sigma));
-    memcpy(&(CTX->hash), &(CTX->h), sizeof(uint512_u));
 }
 
 /*
@@ -226,7 +233,7 @@ void gost2012_finish_hash(gost2012_hash_ctx * CTX, unsigned char *digest)
     CTX->bufsize = 0;
 
     if (CTX->digest_size == 256)
-        memcpy(digest, &(CTX->hash.QWORD[4]), 32);
+        memcpy(digest, &(CTX->h.QWORD[4]), 32);
     else
-        memcpy(digest, &(CTX->hash.QWORD[0]), 64);
+        memcpy(digest, &(CTX->h.QWORD[0]), 64);
 }