ssh-agent: add rsa-sha2-256 and rsa-sha2-512 support

Modern OpenSSH servers reject ssh-rsa (SHA-1) signatures.
Import SHA-2 support to libsec from Plan 9, teach factotum
to sign with SHA256 and SHA512, and handle the
SSH_AGENT_RSA_SHA2_256/512 flags in ssh-agent.

Strip role and hash from factotum RSA key lookups so a
single key can serve both sign and decrypt operations.

Increase _attrfmt buffer from 1024 to 8192 so large RSA
key attributes are not truncated during factotum ctl reads.

The following files were imported from Plan 9 :

 - src/libsec/port/sha2block64.c
 - src/libsec/port/sha2block128.c
 - src/libsec/port/sha2_64.c
 - src/libsec/port/sha2_128.c

include/libsec.h

@@ -135,6 +135,10 @@ void	des3ECBdecrypt(uchar*, int, DES3state*);
 enum
 {
 	SHA1dlen=	20,	/* SHA digest length */
+	SHA2_224dlen=	28,	/* SHA-224 digest length */
+	SHA2_256dlen=	32,	/* SHA-256 digest length */
+	SHA2_384dlen=	48,	/* SHA-384 digest length */
+	SHA2_512dlen=	64,	/* SHA-512 digest length */
 	MD4dlen=	16,	/* MD4 digest length */
 	MD5dlen=	16	/* MD5 digest length */
 };
@@ -143,22 +147,39 @@ typedef struct DigestState DigestState;
 struct DigestState
 {
 	ulong len;
-	u32int state[5];
+	union {
-	uchar buf[128];
+		u32int	state[8];
+		u64int	bstate[8];
+	};
+	uchar buf[256];
 	int blen;
 	char malloced;
 	char seeded;
 };
 typedef struct DigestState SHAstate;	/* obsolete name */
 typedef struct DigestState SHA1state;
+typedef struct DigestState SHA2_224state;
+typedef struct DigestState SHA2_256state;
+typedef struct DigestState SHA2_384state;
+typedef struct DigestState SHA2_512state;
 typedef struct DigestState MD5state;
 typedef struct DigestState MD4state;
 
 DigestState* md4(uchar*, ulong, uchar*, DigestState*);
 DigestState* md5(uchar*, ulong, uchar*, DigestState*);
 DigestState* sha1(uchar*, ulong, uchar*, DigestState*);
+DigestState* sha2_224(uchar*, ulong, uchar*, DigestState*);
+DigestState* sha2_256(uchar*, ulong, uchar*, DigestState*);
+DigestState* sha2_384(uchar*, ulong, uchar*, DigestState*);
+DigestState* sha2_512(uchar*, ulong, uchar*, DigestState*);
 DigestState* hmac_md5(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
 DigestState* hmac_sha1(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
+DigestState* hmac_sha2_224(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
+DigestState* hmac_sha2_256(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
+DigestState* hmac_sha2_384(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
+DigestState* hmac_sha2_512(uchar*, ulong, uchar*, ulong, uchar*, DigestState*);
+DigestState* hmac_x(uchar*, ulong, uchar*, ulong, uchar*, DigestState*,
+	DigestState*(*)(uchar*, ulong, uchar*, DigestState*), int);
 char* sha1pickle(SHA1state*);
 SHA1state* sha1unpickle(char*);
 

src/cmd/auth/factotum/pkcs1.c

@@ -142,6 +142,8 @@ mptoberjust(mpint *b, uchar *buf, uint len)
 uchar oidsha1[] = { O0(1, 3), 14, 3, 2, 26 };
 uchar oidmd2[] = { O0(1, 2), O2(840), O3(113549), 2, 2 };
 uchar oidmd5[] = { O0(1, 2), O2(840), O3(113549), 2, 5 };
+uchar oidsha256[] = { O0(2, 16), O2(840), 1, 101, 3, 4, 2, 1 };
+uchar oidsha512[] = { O0(2, 16), O2(840), 1, 101, 3, 4, 2, 3 };
 
 /*
  *	DigestInfo ::= SEQUENCE {
@@ -170,6 +172,12 @@ mkasn1(uchar *asn1, DigestAlg *alg, uchar *d, uint dlen)
 	}else if(alg == md5){
 		obj = oidmd5;
 		olen = sizeof(oidmd5);
+	}else if(alg == sha2_256){
+		obj = oidsha256;
+		olen = sizeof(oidsha256);
+	}else if(alg == sha2_512){
+		obj = oidsha512;
+		olen = sizeof(oidsha512);
 	}else{
 		sysfatal("bad alg in mkasn1");
 		return -1;

src/cmd/auth/factotum/rsa.c

@@ -30,6 +30,7 @@ xrsadecrypt(Conv *c)
 	char *txt, buf[4096], *role;
 	int n, ret;
 	mpint *m, *mm;
+	Attr *a;
 	Key *k;
 	RSApriv *key;
 
@@ -40,7 +41,9 @@ xrsadecrypt(Conv *c)
 
 	/* fetch key */
 	c->state = "keylookup";
-	k = keylookup("%A", c->attr);
+	a = delattr(delattr(copyattr(c->attr), "role"), "hash");
+	k = keylookup("%A", a);
+	freeattr(a);
 	if(k == nil)
 		goto out;
 	key = k->priv;
@@ -92,6 +95,7 @@ xrsasign(Conv *c)
 	char *hash, *role;
 	int dlen, n, ret;
 	DigestAlg *hashfn;
+	Attr *a;
 	Key *k;
 	RSApriv *key;
 	uchar sig[1024], digest[64];
@@ -101,7 +105,9 @@ xrsasign(Conv *c)
 
 	/* fetch key */
 	c->state = "keylookup";
-	k = keylookup("%A", c->attr);
+	a = delattr(delattr(copyattr(c->attr), "role"), "hash");
+	k = keylookup("%A", a);
+	freeattr(a);
 	if(k == nil)
 		goto out;
 
@@ -113,13 +119,21 @@ xrsasign(Conv *c)
 		goto out;
 	}
 
-	/* get hash type from key */
+	/* get hash type */
-	hash = strfindattr(k->attr, "hash");
+	hash = strfindattr(c->attr, "hash");
+	if(hash == nil)
+		hash = strfindattr(k->attr, "hash");
 	if(hash == nil)
 		hash = "sha1";
 	if(strcmp(hash, "sha1") == 0){
 		hashfn = sha1;
 		dlen = SHA1dlen;
+	}else if(strcmp(hash, "sha256") == 0){
+		hashfn = sha2_256;
+		dlen = SHA2_256dlen;
+	}else if(strcmp(hash, "sha512") == 0){
+		hashfn = sha2_512;
+		dlen = SHA2_512dlen;
 	}else if(strcmp(hash, "md5") == 0){
 		hashfn = md5;
 		dlen = MD5dlen;

src/cmd/auth/ssh-agent.c

@@ -49,7 +49,9 @@ enum		/* agent protocol packet types */
 	SSH2_AGENT_FAILURE = 30,
 
 	SSH_COM_AGENT2_FAILURE = 102,
-	SSH_AGENT_OLD_SIGNATURE = 0x01
+	SSH_AGENT_OLD_SIGNATURE = 0x01,
+	SSH_AGENT_RSA_SHA2_256 = 0x02,
+	SSH_AGENT_RSA_SHA2_512 = 0x04
 };
 
 typedef struct Aconn Aconn;
@@ -82,6 +84,7 @@ void*	erealloc(void *v, int n);
 void		listenproc(void *v);
 int		runmsg(Aconn *a);
 void		listkeystext(void);
+int		keysign(Msg*, Msg*, Msg*, uint);
 
 void
 usage(void)
@@ -872,7 +875,60 @@ dorsa(Aconn *a, mpint *mod, mpint *exp, mpint *chal, uchar chalbuf[32])
 }
 
 int
-keysign(Msg *mkey, Msg *mdata, Msg *msig)
+rsasha2sign(RSApub *rsa, Msg *mdata, Msg *msig, uint flags)
+{
+	AuthRpc *rpc;
+	char buf[4096];
+	uchar digest[SHA2_512dlen];
+	int dlen;
+	char *sigtype, *hashname;
+
+	if(flags & SSH_AGENT_RSA_SHA2_512){
+		sha2_512(mdata->bp, mdata->ep - mdata->bp, digest, nil);
+		dlen = SHA2_512dlen;
+		sigtype = "rsa-sha2-512";
+		hashname = "sha512";
+	}else{
+		sha2_256(mdata->bp, mdata->ep - mdata->bp, digest, nil);
+		dlen = SHA2_256dlen;
+		sigtype = "rsa-sha2-256";
+		hashname = "sha256";
+	}
+
+	snprint(buf, sizeof buf, "proto=rsa service=ssh-rsa role=sign hash=%s n=%lB ek=%lB",
+		hashname, rsa->n, rsa->ek);
+	if((rpc = auth_allocrpc()) == nil){
+		fprint(2, "ssh-agent: auth_allocrpc: %r\n");
+		return -1;
+	}
+	if(chatty)
+		fprint(2, "ssh-agent: start %s\n", buf);
+	if(auth_rpc(rpc, "start", buf, strlen(buf)) != ARok){
+		fprint(2, "ssh-agent: auth 'start' failed: %r\n");
+		auth_freerpc(rpc);
+		return -1;
+	}
+	if(auth_rpc(rpc, "write", digest, dlen) != ARok){
+		fprint(2, "ssh-agent: auth 'write' failed: %r\n");
+		auth_freerpc(rpc);
+		return -1;
+	}
+	if(auth_rpc(rpc, "read", nil, 0) != ARok){
+		fprint(2, "ssh-agent: auth 'read' failed: %r\n");
+		auth_freerpc(rpc);
+		return -1;
+	}
+
+	newmsg(msig);
+	putstr(msig, sigtype);
+	put4(msig, rpc->narg);
+	putn(msig, rpc->arg, rpc->narg);
+	auth_freerpc(rpc);
+	return 0;
+}
+
+int
+keysign(Msg *mkey, Msg *mdata, Msg *msig, uint flags)
 {
 	char *s;
 	AuthRpc *rpc;
@@ -886,6 +942,11 @@ keysign(Msg *mkey, Msg *mdata, Msg *msig)
 		rsa = getrsapub(mkey);
 		if(rsa == nil)
 			return -1;
+		if(flags & (SSH_AGENT_RSA_SHA2_256|SSH_AGENT_RSA_SHA2_512)){
+			int ret = rsasha2sign(rsa, mdata, msig, flags);
+			rsapubfree(rsa);
+			return ret;
+		}
 		snprint(buf, sizeof buf, "proto=rsa service=ssh-rsa role=sign n=%lB ek=%lB",
 			rsa->n, rsa->ek);
 		rsapubfree(rsa);
@@ -1016,7 +1077,7 @@ runmsg(Aconn *a)
 		flags = get4(&m);
 		if(flags & SSH_AGENT_OLD_SIGNATURE)
 			goto Failure;
-		if(keysign(&mkey, &mdata, &msig) < 0)
+		if(keysign(&mkey, &mdata, &msig, flags) < 0)
 			goto Failure;
 		if(chatty)
 			fprint(2, "signature: %.*H\n",

src/libauth/attr.c

@@ -5,7 +5,7 @@
 int
 _attrfmt(Fmt *fmt)
 {
-	char *b, buf[1024], *ebuf;
+	char *b, buf[8192], *ebuf;
 	Attr *a;
 
 	ebuf = buf+sizeof buf;

src/libsec/port/hmac.c

@@ -2,7 +2,7 @@
 #include <libsec.h>
 
 /* rfc2104 */
-static DigestState*
+DigestState*
 hmac_x(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest, DigestState *s,
 	DigestState*(*x)(uchar*, ulong, uchar*, DigestState*), int xlen)
 {

src/libsec/port/mkfile

@@ -49,6 +49,10 @@ ALLOFILES=\
 	sha1.$O\
 	sha1block.$O\
 	sha1pickle.$O\
+	sha2_64.$O\
+	sha2_128.$O\
+	sha2block64.$O\
+	sha2block128.$O\
 	smallprimetest.$O\
 	thumb.$O\
 	tlshand.$O\

src/libsec/port/sha2_128.c

@@ -0,0 +1,191 @@
+/*
+ * sha2 128-bit
+ */
+#include <u.h>
+#include <libc.h>
+#include <libsec.h>
+
+static void encode64(uchar*, u64int*, ulong);
+static DigestState* sha2_128(uchar *, ulong, uchar *, SHA2_256state *, int);
+
+extern void _sha2block128(uchar*, ulong, u64int*);
+
+/*
+ *  for sha2_384 and sha2_512, len must be multiple of 128 for all but
+ *  the last call.  There must be room in the input buffer to pad.
+ *
+ *  Note: sha2_384 calls sha2_512block as sha2_384; it just uses a different
+ *  initial seed to produce a truncated 384b hash result.  otherwise
+ *  it's the same as sha2_512.
+ */
+SHA2_384state*
+sha2_384(uchar *p, ulong len, uchar *digest, SHA2_384state *s)
+{
+	if(s == nil) {
+		s = mallocz(sizeof(*s), 1);
+		if(s == nil)
+			return nil;
+		s->malloced = 1;
+	}
+	if(s->seeded == 0){
+		/*
+		 * seed the state with the first 64 bits of the fractional
+		 * parts of the square roots of the 9th thru 16th primes.
+		 */
+		s->bstate[0] = 0xcbbb9d5dc1059ed8LL;
+		s->bstate[1] = 0x629a292a367cd507LL;
+		s->bstate[2] = 0x9159015a3070dd17LL;
+		s->bstate[3] = 0x152fecd8f70e5939LL;
+		s->bstate[4] = 0x67332667ffc00b31LL;
+		s->bstate[5] = 0x8eb44a8768581511LL;
+		s->bstate[6] = 0xdb0c2e0d64f98fa7LL;
+		s->bstate[7] = 0x47b5481dbefa4fa4LL;
+		s->seeded = 1;
+	}
+	return sha2_128(p, len, digest, s, SHA2_384dlen);
+}
+
+SHA2_512state*
+sha2_512(uchar *p, ulong len, uchar *digest, SHA2_512state *s)
+{
+
+	if(s == nil) {
+		s = mallocz(sizeof(*s), 1);
+		if(s == nil)
+			return nil;
+		s->malloced = 1;
+	}
+	if(s->seeded == 0){
+		/*
+		 * seed the state with the first 64 bits of the fractional
+		 * parts of the square roots of the first 8 primes 2..19).
+		 */
+		s->bstate[0] = 0x6a09e667f3bcc908LL;
+		s->bstate[1] = 0xbb67ae8584caa73bLL;
+		s->bstate[2] = 0x3c6ef372fe94f82bLL;
+		s->bstate[3] = 0xa54ff53a5f1d36f1LL;
+		s->bstate[4] = 0x510e527fade682d1LL;
+		s->bstate[5] = 0x9b05688c2b3e6c1fLL;
+		s->bstate[6] = 0x1f83d9abfb41bd6bLL;
+		s->bstate[7] = 0x5be0cd19137e2179LL;
+		s->seeded = 1;
+	}
+	return sha2_128(p, len, digest, s, SHA2_512dlen);
+}
+
+/* common 128 byte block padding and count code for SHA2_384 and SHA2_512 */
+static DigestState*
+sha2_128(uchar *p, ulong len, uchar *digest, SHA2_512state *s, int dlen)
+{
+	int i;
+	u64int x[16];
+	uchar buf[256];
+	uchar *e;
+
+	/* fill out the partial 128 byte block from previous calls */
+	if(s->blen){
+		i = 128 - s->blen;
+		if(len < i)
+			i = len;
+		memmove(s->buf + s->blen, p, i);
+		len -= i;
+		s->blen += i;
+		p += i;
+		if(s->blen == 128){
+			_sha2block128(s->buf, s->blen, s->bstate);
+			s->len += s->blen;
+			s->blen = 0;
+		}
+	}
+
+	/* do 128 byte blocks */
+	i = len & ~(128-1);
+	if(i){
+		_sha2block128(p, i, s->bstate);
+		s->len += i;
+		len -= i;
+		p += i;
+	}
+
+	/* save the left overs if not last call */
+	if(digest == 0){
+		if(len){
+			memmove(s->buf, p, len);
+			s->blen += len;
+		}
+		return s;
+	}
+
+	/*
+	 *  this is the last time through, pad what's left with 0x80,
+	 *  0's, and the input count to create a multiple of 128 bytes.
+	 */
+	if(s->blen){
+		p = s->buf;
+		len = s->blen;
+	} else {
+		memmove(buf, p, len);
+		p = buf;
+	}
+	s->len += len;
+	e = p + len;
+	if(len < 112)
+		i = 112 - len;
+	else
+		i = 240 - len;
+	memset(e, 0, i);
+	*e = 0x80;
+	len += i;
+
+	/* append the count */
+	x[0] = 0;			/* assume 32b length, i.e. < 4GB */
+	x[1] = s->len<<3;
+	encode64(p+len, x, 16);
+
+	/* digest the last part */
+	_sha2block128(p, len+16, s->bstate);
+	s->len += len+16;
+
+	/* return result and free state */
+	encode64(digest, s->bstate, dlen);
+	if(s->malloced == 1)
+		free(s);
+	return nil;
+}
+
+/*
+ * Encodes input (ulong long) into output (uchar).
+ * Assumes len is a multiple of 8.
+ */
+static void
+encode64(uchar *output, u64int *input, ulong len)
+{
+	u64int x;
+	uchar *e;
+
+	for(e = output + len; output < e;) {
+		x = *input++;
+		*output++ = x >> 56;
+		*output++ = x >> 48;
+		*output++ = x >> 40;
+		*output++ = x >> 32;
+		*output++ = x >> 24;
+		*output++ = x >> 16;
+		*output++ = x >> 8;
+		*output++ = x;
+	}
+}
+
+DigestState*
+hmac_sha2_384(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest,
+	DigestState *s)
+{
+	return hmac_x(p, len, key, klen, digest, s, sha2_384, SHA2_384dlen);
+}
+
+DigestState*
+hmac_sha2_512(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest,
+	DigestState *s)
+{
+	return hmac_x(p, len, key, klen, digest, s, sha2_512, SHA2_512dlen);
+}

src/libsec/port/sha2_64.c

@@ -0,0 +1,187 @@
+/*
+ * sha2 64-bit
+ */
+#include <u.h>
+#include <libc.h>
+#include <libsec.h>
+
+static void encode32(uchar*, u32int*, ulong);
+static DigestState* sha2_64(uchar *, ulong, uchar *, SHA2_256state *, int);
+
+extern void _sha2block64(uchar*, ulong, u32int*);
+
+/*
+ *  for sha2_224 and sha2_256, len must be multiple of 64 for all but
+ *  the last call.  There must be room in the input buffer to pad.
+ *
+ *  Note: sha2_224 calls sha2_256block as sha2_224, just uses different
+ *  initial seed and produces a 224b hash result.  otherwise it's
+ *  the same as sha2_256.
+ */
+
+SHA2_224state*
+sha2_224(uchar *p, ulong len, uchar *digest, SHA2_224state *s)
+{
+	if(s == nil) {
+		s = mallocz(sizeof(*s), 1);
+		if(s == nil)
+			return nil;
+		s->malloced = 1;
+	}
+	if(s->seeded == 0){
+		/*
+		 * seed the state with the first 32 bits of the fractional
+		 * parts of the square roots of the first 8 primes 2..19).
+		 */
+		s->state[0] = 0xc1059ed8;
+		s->state[1] = 0x367cd507;
+		s->state[2] = 0x3070dd17;
+		s->state[3] = 0xf70e5939;
+		s->state[4] = 0xffc00b31;
+		s->state[5] = 0x68581511;
+		s->state[6] = 0x64f98fa7;
+		s->state[7] = 0xbefa4fa4;
+		s->seeded = 1;
+	}
+	return sha2_64(p, len, digest, s, SHA2_224dlen);
+}
+
+SHA2_256state*
+sha2_256(uchar *p, ulong len, uchar *digest, SHA2_256state *s)
+{
+	if(s == nil) {
+		s = mallocz(sizeof(*s), 1);
+		if(s == nil)
+			return nil;
+		s->malloced = 1;
+	}
+	if(s->seeded == 0){
+		/*
+		 * seed the state with the first 32 bits of the fractional
+		 * parts of the square roots of the first 8 primes 2..19).
+		 */
+		s->state[0] = 0x6a09e667;
+		s->state[1] = 0xbb67ae85;
+		s->state[2] = 0x3c6ef372;
+		s->state[3] = 0xa54ff53a;
+		s->state[4] = 0x510e527f;
+		s->state[5] = 0x9b05688c;
+		s->state[6] = 0x1f83d9ab;
+		s->state[7] = 0x5be0cd19;
+		s->seeded = 1;
+	}
+	return sha2_64(p, len, digest, s, SHA2_256dlen);
+}
+
+/* common 64 byte block padding and count code for SHA2_224 and SHA2_256 */
+static DigestState*
+sha2_64(uchar *p, ulong len, uchar *digest, SHA2_256state *s, int dlen)
+{
+	int i;
+	u32int x[16];
+	uchar buf[128];
+	uchar *e;
+
+	/* fill out the partial 64 byte block from previous calls */
+	if(s->blen){
+		i = 64 - s->blen;
+		if(len < i)
+			i = len;
+		memmove(s->buf + s->blen, p, i);
+		len -= i;
+		s->blen += i;
+		p += i;
+		if(s->blen == 64){
+			_sha2block64(s->buf, s->blen, s->state);
+			s->len += s->blen;
+			s->blen = 0;
+		}
+	}
+
+	/* do 64 byte blocks */
+	i = len & ~(64-1);
+	if(i){
+		_sha2block64(p, i, s->state);
+		s->len += i;
+		len -= i;
+		p += i;
+	}
+
+	/* save the left overs if not last call */
+	if(digest == 0){
+		if(len){
+			memmove(s->buf, p, len);
+			s->blen += len;
+		}
+		return s;
+	}
+
+	/*
+	 *  this is the last time through, pad what's left with 0x80,
+	 *  0's, and the input count to create a multiple of 64 bytes.
+	 */
+	if(s->blen){
+		p = s->buf;
+		len = s->blen;
+	} else {
+		memmove(buf, p, len);
+		p = buf;
+	}
+	s->len += len;
+	e = p + len;
+	if(len < 56)
+		i = 56 - len;
+	else
+		i = 120 - len;
+	memset(e, 0, i);
+	*e = 0x80;
+	len += i;
+
+	/* append the count */
+	x[0] = s->len>>29;
+	x[1] = s->len<<3;
+	encode32(p+len, x, 8);
+
+	/* digest the last part */
+	_sha2block64(p, len+8, s->state);
+	s->len += len+8;
+
+	/* return result and free state */
+	encode32(digest, s->state, dlen);
+	if(s->malloced == 1)
+		free(s);
+	return nil;
+}
+
+/*
+ * Encodes input (ulong) into output (uchar).
+ * Assumes len is a multiple of 4.
+ */
+static void
+encode32(uchar *output, u32int *input, ulong len)
+{
+	u32int x;
+	uchar *e;
+
+	for(e = output + len; output < e;) {
+		x = *input++;
+		*output++ = x >> 24;
+		*output++ = x >> 16;
+		*output++ = x >> 8;
+		*output++ = x;
+	}
+}
+
+DigestState*
+hmac_sha2_224(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest,
+	DigestState *s)
+{
+	return hmac_x(p, len, key, klen, digest, s, sha2_224, SHA2_224dlen);
+}
+
+DigestState*
+hmac_sha2_256(uchar *p, ulong len, uchar *key, ulong klen, uchar *digest,
+	DigestState *s)
+{
+	return hmac_x(p, len, key, klen, digest, s, sha2_256, SHA2_256dlen);
+}

src/libsec/port/sha2block128.c

@@ -0,0 +1,101 @@
+/*
+ * sha2_512 block cipher
+ *
+ * Implementation straight from Federal Information Processing Standards
+ * publication 180-2 (+Change Notice to include SHA-224) August 1, 2002
+ *   note: the following upper and lower case macro names are distinct
+ *	   and reflect the functions defined in FIPS pub. 180-2.
+ */
+#include <u.h>
+#include <libc.h>
+
+#define ROTR(x,n)	(((x) >> (n)) | ((x) << (64-(n))))
+#define sigma0(x)	(ROTR((x),1) ^ ROTR((x),8) ^ ((x) >> 7))
+#define sigma1(x)	(ROTR((x),19) ^ ROTR((x),61) ^ ((x) >> 6))
+#define SIGMA0(x)	(ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39))
+#define SIGMA1(x)	(ROTR((x),14) ^ ROTR((x),18) ^ ROTR((x),41))
+#define Ch(x,y,z)	(((x) & (y)) ^ ((~(x)) & (z)))
+#define Maj(x,y,z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+
+/*
+ * first 64 bits of the fractional parts of cube roots of
+ * first 80 primes (2..311).
+ */
+static u64int K512[80] = {
+	0x428a2f98d728ae22LL, 0x7137449123ef65cdLL, 0xb5c0fbcfec4d3b2fLL, 0xe9b5dba58189dbbcLL,
+	0x3956c25bf348b538LL, 0x59f111f1b605d019LL, 0x923f82a4af194f9bLL, 0xab1c5ed5da6d8118LL,
+	0xd807aa98a3030242LL, 0x12835b0145706fbeLL, 0x243185be4ee4b28cLL, 0x550c7dc3d5ffb4e2LL,
+	0x72be5d74f27b896fLL, 0x80deb1fe3b1696b1LL, 0x9bdc06a725c71235LL, 0xc19bf174cf692694LL,
+	0xe49b69c19ef14ad2LL, 0xefbe4786384f25e3LL, 0x0fc19dc68b8cd5b5LL, 0x240ca1cc77ac9c65LL,
+	0x2de92c6f592b0275LL, 0x4a7484aa6ea6e483LL, 0x5cb0a9dcbd41fbd4LL, 0x76f988da831153b5LL,
+	0x983e5152ee66dfabLL, 0xa831c66d2db43210LL, 0xb00327c898fb213fLL, 0xbf597fc7beef0ee4LL,
+	0xc6e00bf33da88fc2LL, 0xd5a79147930aa725LL, 0x06ca6351e003826fLL, 0x142929670a0e6e70LL,
+	0x27b70a8546d22ffcLL, 0x2e1b21385c26c926LL, 0x4d2c6dfc5ac42aedLL, 0x53380d139d95b3dfLL,
+	0x650a73548baf63deLL, 0x766a0abb3c77b2a8LL, 0x81c2c92e47edaee6LL, 0x92722c851482353bLL,
+	0xa2bfe8a14cf10364LL, 0xa81a664bbc423001LL, 0xc24b8b70d0f89791LL, 0xc76c51a30654be30LL,
+	0xd192e819d6ef5218LL, 0xd69906245565a910LL, 0xf40e35855771202aLL, 0x106aa07032bbd1b8LL,
+	0x19a4c116b8d2d0c8LL, 0x1e376c085141ab53LL, 0x2748774cdf8eeb99LL, 0x34b0bcb5e19b48a8LL,
+	0x391c0cb3c5c95a63LL, 0x4ed8aa4ae3418acbLL, 0x5b9cca4f7763e373LL, 0x682e6ff3d6b2b8a3LL,
+	0x748f82ee5defb2fcLL, 0x78a5636f43172f60LL, 0x84c87814a1f0ab72LL, 0x8cc702081a6439ecLL,
+	0x90befffa23631e28LL, 0xa4506cebde82bde9LL, 0xbef9a3f7b2c67915LL, 0xc67178f2e372532bLL,
+	0xca273eceea26619cLL, 0xd186b8c721c0c207LL, 0xeada7dd6cde0eb1eLL, 0xf57d4f7fee6ed178LL,
+	0x06f067aa72176fbaLL, 0x0a637dc5a2c898a6LL, 0x113f9804bef90daeLL, 0x1b710b35131c471bLL,
+	0x28db77f523047d84LL, 0x32caab7b40c72493LL, 0x3c9ebe0a15c9bebcLL, 0x431d67c49c100d4cLL,
+	0x4cc5d4becb3e42b6LL, 0x597f299cfc657e2aLL, 0x5fcb6fab3ad6faecLL, 0x6c44198c4a475817LL };
+
+void
+_sha2block128(uchar *p, ulong len, u64int *s)
+{
+	u64int a, b, c, d, e, f, g, h, t1, t2;
+	u64int *kp, *wp;
+	u64int w[80];
+	uchar *end;
+
+	/* at this point, we have a multiple of 64 bytes */
+	for(end = p+len; p < end;){
+		a = s[0];
+		b = s[1];
+		c = s[2];
+		d = s[3];
+		e = s[4];
+		f = s[5];
+		g = s[6];
+		h = s[7];
+
+		for(wp = w; wp < &w[16]; wp++, p += 8)
+			wp[0] = ((vlong)p[0])<<56 | ((vlong)p[1])<<48 |
+				((vlong)p[2])<<40 | ((vlong)p[3])<<32 |
+				p[4] << 24 | p[5] << 16 | p[6] << 8 | p[7];
+		for(; wp < &w[80]; wp++) {
+			u64int s0, s1;
+
+			s0 = sigma0(wp[-15]);
+			s1 = sigma1(wp[-2]);
+//			wp[0] = sigma1(wp[-2]) + wp[-7] + sigma0(wp[-15]) + wp[-16];
+			wp[0] = s1 + wp[-7] + s0 + wp[-16];
+		}
+
+		for(kp = K512, wp = w; wp < &w[80]; ) {
+			t1 = h + SIGMA1(e) + Ch(e,f,g) + *kp++ + *wp++;
+			t2 = SIGMA0(a) + Maj(a,b,c);
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2;
+		}
+
+		/* save state */
+		s[0] += a;
+		s[1] += b;
+		s[2] += c;
+		s[3] += d;
+		s[4] += e;
+		s[5] += f;
+		s[6] += g;
+		s[7] += h;
+	}
+}

src/libsec/port/sha2block64.c

@@ -0,0 +1,92 @@
+/*
+ * sha2_256 block cipher
+ *
+ * Implementation straight from Federal Information Processing Standards
+ * publication 180-2 (+Change Notice to include SHA-224) August 1, 2002
+ *   note: the following upper and lower case macro names are distinct
+ *	   and reflect the functions defined in FIPS pub. 180-2.
+ */
+
+#include <u.h>
+#include <libc.h>
+
+#define ROTR(x,n)	(((x) >> (n)) | ((x) << (32-(n))))
+#define sigma0(x)	(ROTR((x),7) ^ ROTR((x),18) ^ ((x) >> 3))
+#define sigma1(x)	(ROTR((x),17) ^ ROTR((x),19) ^ ((x) >> 10))
+#define SIGMA0(x)	(ROTR((x),2) ^ ROTR((x),13) ^ ROTR((x),22))
+#define SIGMA1(x)	(ROTR((x),6) ^ ROTR((x),11) ^ ROTR((x),25))
+#define Ch(x,y,z)	(((x) & (y)) ^ ((~(x)) & (z)))
+#define Maj(x,y,z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+
+/*
+ * first 32 bits of the fractional parts of cube roots of
+ * first 64 primes (2..311).
+ */
+static u32int K256[64] = {
+	0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,
+	0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+	0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,
+	0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+	0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,
+	0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+	0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,
+	0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+	0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,
+	0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+	0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,
+	0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+	0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,
+	0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+	0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,
+	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
+};
+
+void
+_sha2block64(uchar *p, ulong len, u32int *s)
+{
+	u32int a, b, c, d, e, f, g, h, t1, t2;
+	u32int *kp, *wp;
+	u32int w[64];
+	uchar *end;
+
+	/* at this point, we have a multiple of 64 bytes */
+	for(end = p+len; p < end;){
+		a = s[0];
+		b = s[1];
+		c = s[2];
+		d = s[3];
+		e = s[4];
+		f = s[5];
+		g = s[6];
+		h = s[7];
+
+		for(wp = w; wp < &w[16]; wp++, p += 4)
+			wp[0] = p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3];
+		for(; wp < &w[64]; wp++)
+			wp[0] = sigma1(wp[-2]) + wp[-7] +
+				sigma0(wp[-15]) + wp[-16];
+
+		for(kp = K256, wp = w; wp < &w[64]; ) {
+			t1 = h + SIGMA1(e) + Ch(e,f,g) + *kp++ + *wp++;
+			t2 = SIGMA0(a) + Maj(a,b,c);
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2;
+		}
+
+		/* save state */
+		s[0] += a;
+		s[1] += b;
+		s[2] += c;
+		s[3] += d;
+		s[4] += e;
+		s[5] += f;
+		s[6] += g;
+		s[7] += h;
+	}
+}