sha1_sse2.cpp

Go to the documentation of this file.

/*
* SHA-1 using SSE2
* Based on public domain code by Dean Gaudet
*    (http://arctic.org/~dean/crypto/sha1.html)
* (C) 2009-2011,2023 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
 
#include <botan/internal/sha1.h>
 
#include <botan/internal/bit_ops.h>
#include <botan/internal/rotate.h>
#include <botan/internal/simd_32.h>
#include <botan/internal/stl_util.h>
#include <emmintrin.h>
 
namespace Botan {
 
namespace SHA1_SSE2_F {
 
namespace {
 
/*
For each multiple of 4, t, we want to calculate this:
 
W[t+0] = rol(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16], 1);
W[t+1] = rol(W[t-2] ^ W[t-7] ^ W[t-13] ^ W[t-15], 1);
W[t+2] = rol(W[t-1] ^ W[t-6] ^ W[t-12] ^ W[t-14], 1);
W[t+3] = rol(W[t]   ^ W[t-5] ^ W[t-11] ^ W[t-13], 1);
 
we'll actually calculate this:
 
W[t+0] = rol(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16], 1);
W[t+1] = rol(W[t-2] ^ W[t-7] ^ W[t-13] ^ W[t-15], 1);
W[t+2] = rol(W[t-1] ^ W[t-6] ^ W[t-12] ^ W[t-14], 1);
W[t+3] = rol(  0    ^ W[t-5] ^ W[t-11] ^ W[t-13], 1);
W[t+3] ^= rol(W[t+0], 1);
 
the parameters are:
 
W0 = &W[t-16];
W1 = &W[t-12];
W2 = &W[t- 8];
W3 = &W[t- 4];
 
and on output:
prepared = W0 + K
W0 = W[t]..W[t+3]
*/
BOTAN_FORCE_INLINE SIMD_4x32 prep(SIMD_4x32& XW0, SIMD_4x32 XW1, SIMD_4x32 XW2, SIMD_4x32 XW3, SIMD_4x32 K) {
   SIMD_4x32 T0 = XW0;
   /* load W[t-4] 16-byte aligned, and shift */
   SIMD_4x32 T2 = XW3.shift_elems_right<1>();
   /* get high 64-bits of XW0 into low 64-bits */
   SIMD_4x32 T1 = SIMD_4x32(_mm_shuffle_epi32(XW0.raw(), _MM_SHUFFLE(1, 0, 3, 2)));
   /* load high 64-bits of T1 */
   T1 = SIMD_4x32(_mm_unpacklo_epi64(T1.raw(), XW1.raw()));
 
   T0 ^= T1;
   T2 ^= XW2;
   T0 ^= T2;
   /* unrotated W[t]..W[t+2] in T0 ... still need W[t+3] */
 
   T2 = T0.shift_elems_left<3>();
   T0 = T0.rotl<1>();
   T2 = T2.rotl<2>();
 
   T0 ^= T2; /* T0 now has W[t+3] */
 
   XW0 = T0;
   return T0 + K;
}
 
/*
* SHA-1 F1 Function
*/
inline void F1(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   E += choose(B, C, D) + msg + rotl<5>(A);
   B = rotl<30>(B);
}
 
/*
* SHA-1 F2 Function
*/
inline void F2(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   E += (B ^ C ^ D) + msg + rotl<5>(A);
   B = rotl<30>(B);
}
 
/*
* SHA-1 F3 Function
*/
inline void F3(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   E += majority(B, C, D) + msg + rotl<5>(A);
   B = rotl<30>(B);
}
 
/*
* SHA-1 F4 Function
*/
inline void F4(uint32_t A, uint32_t& B, uint32_t C, uint32_t D, uint32_t& E, uint32_t msg) {
   E += (B ^ C ^ D) + msg + rotl<5>(A);
   B = rotl<30>(B);
}
 
}  // namespace
 
}  // namespace SHA1_SSE2_F
 
/*
* SHA-1 Compression Function using SSE for message expansion
*/
//static
BOTAN_FUNC_ISA("sse2") void SHA_1::sse2_compress_n(digest_type& digest, std::span<const uint8_t> input, size_t blocks) {
   using namespace SHA1_SSE2_F;
 
   const SIMD_4x32 K00_19 = SIMD_4x32::splat(0x5A827999);
   const SIMD_4x32 K20_39 = SIMD_4x32::splat(0x6ED9EBA1);
   const SIMD_4x32 K40_59 = SIMD_4x32::splat(0x8F1BBCDC);
   const SIMD_4x32 K60_79 = SIMD_4x32::splat(0xCA62C1D6);
 
   uint32_t A = digest[0], B = digest[1], C = digest[2], D = digest[3], E = digest[4];
 
   BufferSlicer in(input);
 
   for(size_t i = 0; i != blocks; ++i) {
      uint32_t PT[4];
 
      const auto block = in.take(block_bytes);
 
      SIMD_4x32 W0 = SIMD_4x32::load_be(&block[0]);
      SIMD_4x32 W1 = SIMD_4x32::load_be(&block[16]);
      SIMD_4x32 W2 = SIMD_4x32::load_be(&block[32]);
      SIMD_4x32 W3 = SIMD_4x32::load_be(&block[48]);
 
      SIMD_4x32 P0 = W0 + K00_19;
      SIMD_4x32 P1 = W1 + K00_19;
      SIMD_4x32 P2 = W2 + K00_19;
      SIMD_4x32 P3 = W3 + K00_19;
 
      SIMD_4x32(P0).store_le(PT);
      F1(A, B, C, D, E, PT[0]);
      F1(E, A, B, C, D, PT[1]);
      F1(D, E, A, B, C, PT[2]);
      F1(C, D, E, A, B, PT[3]);
      P0 = prep(W0, W1, W2, W3, K00_19);
 
      SIMD_4x32(P1).store_le(PT);
      F1(B, C, D, E, A, PT[0]);
      F1(A, B, C, D, E, PT[1]);
      F1(E, A, B, C, D, PT[2]);
      F1(D, E, A, B, C, PT[3]);
      P1 = prep(W1, W2, W3, W0, K20_39);
 
      SIMD_4x32(P2).store_le(PT);
      F1(C, D, E, A, B, PT[0]);
      F1(B, C, D, E, A, PT[1]);
      F1(A, B, C, D, E, PT[2]);
      F1(E, A, B, C, D, PT[3]);
      P2 = prep(W2, W3, W0, W1, K20_39);
 
      SIMD_4x32(P3).store_le(PT);
      F1(D, E, A, B, C, PT[0]);
      F1(C, D, E, A, B, PT[1]);
      F1(B, C, D, E, A, PT[2]);
      F1(A, B, C, D, E, PT[3]);
      P3 = prep(W3, W0, W1, W2, K20_39);
 
      SIMD_4x32(P0).store_le(PT);
      F1(E, A, B, C, D, PT[0]);
      F1(D, E, A, B, C, PT[1]);
      F1(C, D, E, A, B, PT[2]);
      F1(B, C, D, E, A, PT[3]);
      P0 = prep(W0, W1, W2, W3, K20_39);
 
      SIMD_4x32(P1).store_le(PT);
      F2(A, B, C, D, E, PT[0]);
      F2(E, A, B, C, D, PT[1]);
      F2(D, E, A, B, C, PT[2]);
      F2(C, D, E, A, B, PT[3]);
      P1 = prep(W1, W2, W3, W0, K20_39);
 
      SIMD_4x32(P2).store_le(PT);
      F2(B, C, D, E, A, PT[0]);
      F2(A, B, C, D, E, PT[1]);
      F2(E, A, B, C, D, PT[2]);
      F2(D, E, A, B, C, PT[3]);
      P2 = prep(W2, W3, W0, W1, K40_59);
 
      SIMD_4x32(P3).store_le(PT);
      F2(C, D, E, A, B, PT[0]);
      F2(B, C, D, E, A, PT[1]);
      F2(A, B, C, D, E, PT[2]);
      F2(E, A, B, C, D, PT[3]);
      P3 = prep(W3, W0, W1, W2, K40_59);
 
      SIMD_4x32(P0).store_le(PT);
      F2(D, E, A, B, C, PT[0]);
      F2(C, D, E, A, B, PT[1]);
      F2(B, C, D, E, A, PT[2]);
      F2(A, B, C, D, E, PT[3]);
      P0 = prep(W0, W1, W2, W3, K40_59);
 
      SIMD_4x32(P1).store_le(PT);
      F2(E, A, B, C, D, PT[0]);
      F2(D, E, A, B, C, PT[1]);
      F2(C, D, E, A, B, PT[2]);
      F2(B, C, D, E, A, PT[3]);
      P1 = prep(W1, W2, W3, W0, K40_59);
 
      SIMD_4x32(P2).store_le(PT);
      F3(A, B, C, D, E, PT[0]);
      F3(E, A, B, C, D, PT[1]);
      F3(D, E, A, B, C, PT[2]);
      F3(C, D, E, A, B, PT[3]);
      P2 = prep(W2, W3, W0, W1, K40_59);
 
      SIMD_4x32(P3).store_le(PT);
      F3(B, C, D, E, A, PT[0]);
      F3(A, B, C, D, E, PT[1]);
      F3(E, A, B, C, D, PT[2]);
      F3(D, E, A, B, C, PT[3]);
      P3 = prep(W3, W0, W1, W2, K60_79);
 
      SIMD_4x32(P0).store_le(PT);
      F3(C, D, E, A, B, PT[0]);
      F3(B, C, D, E, A, PT[1]);
      F3(A, B, C, D, E, PT[2]);
      F3(E, A, B, C, D, PT[3]);
      P0 = prep(W0, W1, W2, W3, K60_79);
 
      SIMD_4x32(P1).store_le(PT);
      F3(D, E, A, B, C, PT[0]);
      F3(C, D, E, A, B, PT[1]);
      F3(B, C, D, E, A, PT[2]);
      F3(A, B, C, D, E, PT[3]);
      P1 = prep(W1, W2, W3, W0, K60_79);
 
      SIMD_4x32(P2).store_le(PT);
      F3(E, A, B, C, D, PT[0]);
      F3(D, E, A, B, C, PT[1]);
      F3(C, D, E, A, B, PT[2]);
      F3(B, C, D, E, A, PT[3]);
      P2 = prep(W2, W3, W0, W1, K60_79);
 
      SIMD_4x32(P3).store_le(PT);
      F4(A, B, C, D, E, PT[0]);
      F4(E, A, B, C, D, PT[1]);
      F4(D, E, A, B, C, PT[2]);
      F4(C, D, E, A, B, PT[3]);
      P3 = prep(W3, W0, W1, W2, K60_79);
 
      SIMD_4x32(P0).store_le(PT);
      F4(B, C, D, E, A, PT[0]);
      F4(A, B, C, D, E, PT[1]);
      F4(E, A, B, C, D, PT[2]);
      F4(D, E, A, B, C, PT[3]);
 
      SIMD_4x32(P1).store_le(PT);
      F4(C, D, E, A, B, PT[0]);
      F4(B, C, D, E, A, PT[1]);
      F4(A, B, C, D, E, PT[2]);
      F4(E, A, B, C, D, PT[3]);
 
      SIMD_4x32(P2).store_le(PT);
      F4(D, E, A, B, C, PT[0]);
      F4(C, D, E, A, B, PT[1]);
      F4(B, C, D, E, A, PT[2]);
      F4(A, B, C, D, E, PT[3]);
 
      SIMD_4x32(P3).store_le(PT);
      F4(E, A, B, C, D, PT[0]);
      F4(D, E, A, B, C, PT[1]);
      F4(C, D, E, A, B, PT[2]);
      F4(B, C, D, E, A, PT[3]);
 
      A = (digest[0] += A);
      B = (digest[1] += B);
      C = (digest[2] += C);
      D = (digest[3] += D);
      E = (digest[4] += E);
   }
}
 
}  // namespace Botan