3 This file is part of the AVR-Crypto-Lib.
4 Copyright (C) 2008 Daniel Otte (daniel.otte@rub.de)
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 * License: GPLv3 or later
24 ; SHA1 implementation in assembler for AVR
29 /* push r18 - r27, r30 - r31*/
108 /* X points to Block */
109 .macro dbg_hexdump length
129 ; [h0][h1][h2][h3][h4][length]
130 ; hn is 32 bit large, length is 64 bit large
132 ;###########################################################
134 .global sha1_ctx2hash
135 ; === sha1_ctx2hash ===
136 ; this function converts a state into a normal hash (bytestring)
137 ; param1: the 16-bit destination pointer
138 ; given in r25,r24 (r25 is most significant)
139 ; param2: the 16-bit pointer to sha1_ctx structure
160 ;###########################################################
164 ; this function calculates SHA-1 hashes from messages in RAM
165 ; param1: the 16-bit hash destination pointer
166 ; given in r25,r24 (r25 is most significant)
167 ; param2: the 16-bit pointer to message
169 ; param3: 32-bit length value (length of message in bits)
170 ; given in r21,r20,r19,r18
196 movw r8, r18 /* backup of length*/
199 movw r12, r22 /* backup pf msg-ptr */
203 /* if length >= 512 */
256 ;###########################################################
259 ; block MUST NOT be larger than 64 bytes
261 .global sha1_lastBlock
262 ; === sha1_lastBlock ===
263 ; this function does padding & Co. for calculating SHA-1 hashes
264 ; param1: the 16-bit pointer to sha1_ctx structure
265 ; given in r25,r24 (r25 is most significant)
266 ; param2: an 16-bit pointer to 64 byte block to hash
268 ; param3: an 16-bit integer specifing length of block in bits
270 sha1_lastBlock_localSpace = (SHA1_BLOCK_BITS/8+1)
275 brlo sha1_lastBlock_prolog
292 sha1_lastBlock_prolog:
293 /* allocate space on stack */
298 sbci r31, hi8(64) /* ??? */
304 adiw r30, 1 /* SP points to next free byte on stack */
305 mov r18, r20 /* r20 = LSB(length) */
309 bst r21, 0 /* may be we should explain this ... */
310 bld r18, 5 /* now: r18 == length/8 (aka. length in bytes) */
313 movw r26, r22 /* X points to begin of msg */
315 breq sha1_lastBlock_post_copy
317 sha1_lastBlock_copy_loop:
321 brne sha1_lastBlock_copy_loop
322 sha1_lastBlock_post_copy:
323 sha1_lastBlock_insert_stuffing_bit:
327 and r19, r20 /* if we are in bitmode */
328 breq 2f /* no bitmode */
334 /* maybe we should do some ANDing here, just for safety */
340 /* checking stuff here */
343 rjmp sha1_lastBlock_insert_zeros
345 /* oh shit, we landed here */
346 /* first we have to fill it up with zeros */
373 /* now we should subtract 512 from length */
375 adiw r26, 4*5+1 /* we can skip the lowest byte */
387 ; clr r18 /* not neccessary ;-) */
388 /* reset Z pointer to begin of block */
390 sha1_lastBlock_insert_zeros:
393 breq sha1_lastBlock_insert_length
396 st Z+, r1 /* r1 is still zero */
400 ; rjmp sha1_lastBlock_epilog
401 sha1_lastBlock_insert_length:
402 movw r26, r24 /* X points to state */
403 adiw r26, 5*4 /* X points to (state.length) */
404 adiw r30, 8 /* Z points one after the last byte of block */
423 sha1_lastBlock_epilog:
427 adiw r30, 63 ; lo8(64)
428 adiw r30, 1 ; hi8(64)
438 ;###########################################################
440 .global sha1_nextBlock
441 ; === sha1_nextBlock ===
442 ; this is the core function for calculating SHA-1 hashes
443 ; param1: the 16-bit pointer to sha1_ctx structure
444 ; given in r25,r24 (r25 is most significant)
445 ; param2: an 16-bit pointer to 64 byte block to hash
447 sha1_nextBlock_localSpace = (16+5+1)*4 ; 16 32-bit values for w array and 5 32-bit values for a array (total 84 byte)
468 /* byteorder: high number <--> high significance */
470 ; initial, let's make some space ready for local vars
471 /* replace push & pop by mem ops? */
484 movw r18, r20 ;backup SP
485 ; movw r26, r20 ; X points to free space on stack /* maybe removeable? */
486 movw r30, r22 ; Z points to message
487 subi r20, lo8(sha1_nextBlock_localSpace) ;sbiw can do only up to 63
488 sbci r21, hi8(sha1_nextBlock_localSpace)
489 movw r26, r20 ; X points to free space on stack
491 cli ; we want to be uninterrupted while updating SP
497 push r19 /* push old SP on new stack */
499 push r25 /* param1 will be needed later */
501 /* load a[] with state */
502 movw 28, r24 /* load pointer to state in Y */
511 movw W1, r26 /* save pointer to w[0] */
512 /* load w[] with endian fixed message */
513 /* we might also use the changeendian32() function at bottom */
514 movw r30, r22 /* mv param2 (ponter to msg) to Z */
529 ;clr LoopC /* LoopC is named t in FIPS 180-2 */
531 sha1_nextBlock_mainloop:
535 andi S, 0x3C /* S is a bytepointer so *4 */
538 add r26, S /* X points at w[s] */
565 brlt sha1_nextBlock_mainloop_core
574 1: /* this might be "outsourced" to save the jump above */
589 2: /* now we just hav to do a ROTL(T) and save T back */
604 sha1_nextBlock_mainloop_core: /* ther core function; T=ROTL5(a) ....*/
605 /* T already contains w[s] */
607 sbiw r26, 4*1 /* X points at a[4] aka e */
615 adc T4, tmp1 /* T = w[s]+e */
616 sbiw r26, 4*5 /* X points at a[0] aka a */
621 mov tmp1, F4 /* X points at a[1] aka b */
635 adc T4, F4 /* T = ROTL(a,5) + e + w[s] */
637 /* now we have to do this fucking conditional stuff */
638 ldi r30, lo8(sha1_nextBlock_xTable)
639 ldi r31, hi8(sha1_nextBlock_xTable)
646 1: ldi r30, lo8(sha1_nextBlock_KTable)
647 ldi r31, hi8(sha1_nextBlock_KTable)
663 /* T = ROTL(a,5) + e + kt + w[s] */
665 /* Z-4 is just pointing to kt ... */
666 movw r28, r26 /* copy X in Y */
667 adiw r30, 3*4 /* now Z points to the rigth locatin in our jump-vector-table */
682 adc T4, tmp1 /* T = ROTL5(a) + f_t(b,c,d) + e + k_t + w[s] */
683 /* X points still at a[1] aka b, Y points at a[2] aka c */
685 sha1_nextBlock_update_a:
686 /*first we move all vars in a[] "one up" e=d, d=c, c=b, b=a*/
687 //adiw r28, 3*4 /* Y should point at a[4] aka e */
697 /* Y points at a[0] aka a*/
701 /* store T in a[0] aka a */
706 /* Y points at a[1] aka b*/
738 rjmp sha1_nextBlock_mainloop
739 /**************************************/
744 /* add a[] to state and inc length */
746 pop r26 /* now X points to state (and Y still at a[0]) */
759 /* now length += 512 */
760 adiw r26, 1 /* we skip the least significant byte */
762 ldi tmp2, hi8(512) /* 2 */
774 sha1_nextBlock_epilog:
775 /* now we should clean up the stack */
779 cli ; we want to be uninterrupted while updating SP
797 sha1_nextBlock_xTable:
799 sha1_nextBlock_KTable:
804 sha1_nextBlock_JumpTable:
805 rjmp sha1_nextBlock_Ch
807 rjmp sha1_nextBlock_Parity
809 rjmp sha1_nextBlock_Maj
811 rjmp sha1_nextBlock_Parity
813 /* X and Y still point at a[1] aka b ; return value in tmp1 */
818 ldd tmp3, Y+3 /* load from c */
820 ldd tmp3, Y+7 /* load from d */
828 ldd tmp3, Y+3 /* load from c */
830 ldd tmp4, Y+7 /* load from d */
837 sha1_nextBlock_Parity:
839 ldd tmp2, Y+3 /* load from c */
841 ldd tmp2, Y+7 /* load from d */
845 ch_str: .asciz "\r\nCh"
846 maj_str: .asciz "\r\nMaj"
847 parity_str: .asciz "\r\nParity"
849 ;###########################################################
852 ;void sha1_init(sha1_ctx_t *state){
853 ; DEBUG_S("\r\nSHA1_INIT");
854 ; state->h[0] = 0x67452301;
855 ; state->h[1] = 0xefcdab89;
856 ; state->h[2] = 0x98badcfe;
857 ; state->h[3] = 0x10325476;
858 ; state->h[4] = 0xc3d2e1f0;
861 ; param1: (Func3,r24) 16-bit pointer to sha1_ctx_t struct in ram
862 ; modifys: Z(r30,r31), Func1, r22
864 movw r26, r24 ; (24,25) --> (26,27) load X with param1
865 ldi r30, lo8((sha1_init_vector))
866 ldi r31, hi8((sha1_init_vector))
867 ldi r22, 5*4 /* bytes to copy */