1 /* SPDX-License-Identifier: GPL-2.0 */ 2 /* 3 * Common values for SHA-2 algorithms 4 */ 5 6 #ifndef _CRYPTO_SHA2_H 7 #define _CRYPTO_SHA2_H 8 9 #include <linux/types.h> 10 #include <linux/string.h> 11 12 #define SHA224_DIGEST_SIZE 28 13 #define SHA224_BLOCK_SIZE 64 14 15 #define SHA256_DIGEST_SIZE 32 16 #define SHA256_BLOCK_SIZE 64 17 #define SHA256_STATE_WORDS 8 18 19 #define SHA384_DIGEST_SIZE 48 20 #define SHA384_BLOCK_SIZE 128 21 22 #define SHA512_DIGEST_SIZE 64 23 #define SHA512_BLOCK_SIZE 128 24 #define SHA512_STATE_SIZE 80 25 26 #define SHA224_H0 0xc1059ed8UL 27 #define SHA224_H1 0x367cd507UL 28 #define SHA224_H2 0x3070dd17UL 29 #define SHA224_H3 0xf70e5939UL 30 #define SHA224_H4 0xffc00b31UL 31 #define SHA224_H5 0x68581511UL 32 #define SHA224_H6 0x64f98fa7UL 33 #define SHA224_H7 0xbefa4fa4UL 34 35 #define SHA256_H0 0x6a09e667UL 36 #define SHA256_H1 0xbb67ae85UL 37 #define SHA256_H2 0x3c6ef372UL 38 #define SHA256_H3 0xa54ff53aUL 39 #define SHA256_H4 0x510e527fUL 40 #define SHA256_H5 0x9b05688cUL 41 #define SHA256_H6 0x1f83d9abUL 42 #define SHA256_H7 0x5be0cd19UL 43 44 #define SHA384_H0 0xcbbb9d5dc1059ed8ULL 45 #define SHA384_H1 0x629a292a367cd507ULL 46 #define SHA384_H2 0x9159015a3070dd17ULL 47 #define SHA384_H3 0x152fecd8f70e5939ULL 48 #define SHA384_H4 0x67332667ffc00b31ULL 49 #define SHA384_H5 0x8eb44a8768581511ULL 50 #define SHA384_H6 0xdb0c2e0d64f98fa7ULL 51 #define SHA384_H7 0x47b5481dbefa4fa4ULL 52 53 #define SHA512_H0 0x6a09e667f3bcc908ULL 54 #define SHA512_H1 0xbb67ae8584caa73bULL 55 #define SHA512_H2 0x3c6ef372fe94f82bULL 56 #define SHA512_H3 0xa54ff53a5f1d36f1ULL 57 #define SHA512_H4 0x510e527fade682d1ULL 58 #define SHA512_H5 0x9b05688c2b3e6c1fULL 59 #define SHA512_H6 0x1f83d9abfb41bd6bULL 60 #define SHA512_H7 0x5be0cd19137e2179ULL 61 62 extern const u8 sha224_zero_message_hash[SHA224_DIGEST_SIZE]; 63 64 extern const u8 sha256_zero_message_hash[SHA256_DIGEST_SIZE]; 65 66 extern const u8 sha384_zero_message_hash[SHA384_DIGEST_SIZE]; 67 68 extern const u8 sha512_zero_message_hash[SHA512_DIGEST_SIZE]; 69 70 struct crypto_sha256_state { 71 u32 state[SHA256_STATE_WORDS]; 72 u64 count; 73 }; 74 75 static inline void sha224_block_init(struct crypto_sha256_state *sctx) 76 { 77 sctx->state[0] = SHA224_H0; 78 sctx->state[1] = SHA224_H1; 79 sctx->state[2] = SHA224_H2; 80 sctx->state[3] = SHA224_H3; 81 sctx->state[4] = SHA224_H4; 82 sctx->state[5] = SHA224_H5; 83 sctx->state[6] = SHA224_H6; 84 sctx->state[7] = SHA224_H7; 85 sctx->count = 0; 86 } 87 88 static inline void sha256_block_init(struct crypto_sha256_state *sctx) 89 { 90 sctx->state[0] = SHA256_H0; 91 sctx->state[1] = SHA256_H1; 92 sctx->state[2] = SHA256_H2; 93 sctx->state[3] = SHA256_H3; 94 sctx->state[4] = SHA256_H4; 95 sctx->state[5] = SHA256_H5; 96 sctx->state[6] = SHA256_H6; 97 sctx->state[7] = SHA256_H7; 98 sctx->count = 0; 99 } 100 101 struct sha256_state { 102 union { 103 struct crypto_sha256_state ctx; 104 struct { 105 u32 state[SHA256_STATE_WORDS]; 106 u64 count; 107 }; 108 }; 109 u8 buf[SHA256_BLOCK_SIZE]; 110 }; 111 112 struct sha512_state { 113 u64 state[SHA512_DIGEST_SIZE / 8]; 114 u64 count[2]; 115 u8 buf[SHA512_BLOCK_SIZE]; 116 }; 117 118 /* State for the SHA-256 (and SHA-224) compression function */ 119 struct sha256_block_state { 120 u32 h[SHA256_STATE_WORDS]; 121 }; 122 123 /* 124 * Context structure, shared by SHA-224 and SHA-256. The sha224_ctx and 125 * sha256_ctx structs wrap this one so that the API has proper typing and 126 * doesn't allow mixing the SHA-224 and SHA-256 functions arbitrarily. 127 */ 128 struct __sha256_ctx { 129 struct sha256_block_state state; 130 u64 bytecount; 131 u8 buf[SHA256_BLOCK_SIZE] __aligned(__alignof__(__be64)); 132 }; 133 void __sha256_update(struct __sha256_ctx *ctx, const u8 *data, size_t len); 134 135 /* 136 * HMAC key and message context structs, shared by HMAC-SHA224 and HMAC-SHA256. 137 * The hmac_sha224_* and hmac_sha256_* structs wrap this one so that the API has 138 * proper typing and doesn't allow mixing the functions arbitrarily. 139 */ 140 struct __hmac_sha256_key { 141 struct sha256_block_state istate; 142 struct sha256_block_state ostate; 143 }; 144 struct __hmac_sha256_ctx { 145 struct __sha256_ctx sha_ctx; 146 struct sha256_block_state ostate; 147 }; 148 void __hmac_sha256_init(struct __hmac_sha256_ctx *ctx, 149 const struct __hmac_sha256_key *key); 150 151 /** 152 * struct sha224_ctx - Context for hashing a message with SHA-224 153 * @ctx: private 154 */ 155 struct sha224_ctx { 156 struct __sha256_ctx ctx; 157 }; 158 159 /** 160 * sha224_init() - Initialize a SHA-224 context for a new message 161 * @ctx: the context to initialize 162 * 163 * If you don't need incremental computation, consider sha224() instead. 164 * 165 * Context: Any context. 166 */ 167 void sha224_init(struct sha224_ctx *ctx); 168 169 /** 170 * sha224_update() - Update a SHA-224 context with message data 171 * @ctx: the context to update; must have been initialized 172 * @data: the message data 173 * @len: the data length in bytes 174 * 175 * This can be called any number of times. 176 * 177 * Context: Any context. 178 */ 179 static inline void sha224_update(struct sha224_ctx *ctx, 180 const u8 *data, size_t len) 181 { 182 __sha256_update(&ctx->ctx, data, len); 183 } 184 185 /** 186 * sha224_final() - Finish computing a SHA-224 message digest 187 * @ctx: the context to finalize; must have been initialized 188 * @out: (output) the resulting SHA-224 message digest 189 * 190 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 191 * 192 * Context: Any context. 193 */ 194 void sha224_final(struct sha224_ctx *ctx, u8 out[at_least SHA224_DIGEST_SIZE]); 195 196 /** 197 * sha224() - Compute SHA-224 message digest in one shot 198 * @data: the message data 199 * @len: the data length in bytes 200 * @out: (output) the resulting SHA-224 message digest 201 * 202 * Context: Any context. 203 */ 204 void sha224(const u8 *data, size_t len, u8 out[at_least SHA224_DIGEST_SIZE]); 205 206 /** 207 * struct hmac_sha224_key - Prepared key for HMAC-SHA224 208 * @key: private 209 */ 210 struct hmac_sha224_key { 211 struct __hmac_sha256_key key; 212 }; 213 214 /** 215 * hmac_sha224_zeroize_key() - Zeroize an hmac_sha224_key structure 216 * @key: The hmac_sha224_key to zeroize 217 */ 218 static inline void hmac_sha224_zeroize_key(struct hmac_sha224_key *key) 219 { 220 memzero_explicit(key, sizeof(*key)); 221 } 222 223 /** 224 * struct hmac_sha224_ctx - Context for computing HMAC-SHA224 of a message 225 * @ctx: private 226 */ 227 struct hmac_sha224_ctx { 228 struct __hmac_sha256_ctx ctx; 229 }; 230 231 /** 232 * hmac_sha224_zeroize_ctx() - Zeroize an hmac_sha224_ctx structure 233 * @ctx: The hmac_sha224_ctx context to zeroize 234 */ 235 static inline void hmac_sha224_zeroize_ctx(struct hmac_sha224_ctx *ctx) 236 { 237 memzero_explicit(ctx, sizeof(*ctx)); 238 } 239 240 /** 241 * hmac_sha224_preparekey() - Prepare a key for HMAC-SHA224 242 * @key: (output) the key structure to initialize 243 * @raw_key: the raw HMAC-SHA224 key 244 * @raw_key_len: the key length in bytes. All key lengths are supported. 245 * 246 * Note: the caller is responsible for zeroizing both the struct hmac_sha224_key 247 * and the raw key once they are no longer needed. 248 * 249 * Context: Any context. 250 */ 251 void hmac_sha224_preparekey(struct hmac_sha224_key *key, 252 const u8 *raw_key, size_t raw_key_len); 253 254 /** 255 * hmac_sha224_init() - Initialize an HMAC-SHA224 context for a new message 256 * @ctx: (output) the HMAC context to initialize 257 * @key: the prepared HMAC key 258 * 259 * If you don't need incremental computation, consider hmac_sha224() instead. 260 * 261 * Context: Any context. 262 */ 263 static inline void hmac_sha224_init(struct hmac_sha224_ctx *ctx, 264 const struct hmac_sha224_key *key) 265 { 266 __hmac_sha256_init(&ctx->ctx, &key->key); 267 } 268 269 /** 270 * hmac_sha224_init_usingrawkey() - Initialize an HMAC-SHA224 context for a new 271 * message, using a raw key 272 * @ctx: (output) the HMAC context to initialize 273 * @raw_key: the raw HMAC-SHA224 key 274 * @raw_key_len: the key length in bytes. All key lengths are supported. 275 * 276 * If you don't need incremental computation, consider hmac_sha224_usingrawkey() 277 * instead. 278 * 279 * Context: Any context. 280 */ 281 void hmac_sha224_init_usingrawkey(struct hmac_sha224_ctx *ctx, 282 const u8 *raw_key, size_t raw_key_len); 283 284 /** 285 * hmac_sha224_update() - Update an HMAC-SHA224 context with message data 286 * @ctx: the HMAC context to update; must have been initialized 287 * @data: the message data 288 * @data_len: the data length in bytes 289 * 290 * This can be called any number of times. 291 * 292 * Context: Any context. 293 */ 294 static inline void hmac_sha224_update(struct hmac_sha224_ctx *ctx, 295 const u8 *data, size_t data_len) 296 { 297 __sha256_update(&ctx->ctx.sha_ctx, data, data_len); 298 } 299 300 /** 301 * hmac_sha224_final() - Finish computing an HMAC-SHA224 value 302 * @ctx: the HMAC context to finalize; must have been initialized 303 * @out: (output) the resulting HMAC-SHA224 value 304 * 305 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 306 * 307 * Context: Any context. 308 */ 309 void hmac_sha224_final(struct hmac_sha224_ctx *ctx, 310 u8 out[at_least SHA224_DIGEST_SIZE]); 311 312 /** 313 * hmac_sha224() - Compute HMAC-SHA224 in one shot, using a prepared key 314 * @key: the prepared HMAC key 315 * @data: the message data 316 * @data_len: the data length in bytes 317 * @out: (output) the resulting HMAC-SHA224 value 318 * 319 * If you're using the key only once, consider using hmac_sha224_usingrawkey(). 320 * 321 * Context: Any context. 322 */ 323 void hmac_sha224(const struct hmac_sha224_key *key, 324 const u8 *data, size_t data_len, 325 u8 out[at_least SHA224_DIGEST_SIZE]); 326 327 /** 328 * hmac_sha224_usingrawkey() - Compute HMAC-SHA224 in one shot, using a raw key 329 * @raw_key: the raw HMAC-SHA224 key 330 * @raw_key_len: the key length in bytes. All key lengths are supported. 331 * @data: the message data 332 * @data_len: the data length in bytes 333 * @out: (output) the resulting HMAC-SHA224 value 334 * 335 * If you're using the key multiple times, prefer to use 336 * hmac_sha224_preparekey() followed by multiple calls to hmac_sha224() instead. 337 * 338 * Context: Any context. 339 */ 340 void hmac_sha224_usingrawkey(const u8 *raw_key, size_t raw_key_len, 341 const u8 *data, size_t data_len, 342 u8 out[at_least SHA224_DIGEST_SIZE]); 343 344 /** 345 * struct sha256_ctx - Context for hashing a message with SHA-256 346 * @ctx: private 347 */ 348 struct sha256_ctx { 349 struct __sha256_ctx ctx; 350 }; 351 352 /** 353 * sha256_init() - Initialize a SHA-256 context for a new message 354 * @ctx: the context to initialize 355 * 356 * If you don't need incremental computation, consider sha256() instead. 357 * 358 * Context: Any context. 359 */ 360 void sha256_init(struct sha256_ctx *ctx); 361 362 /** 363 * sha256_update() - Update a SHA-256 context with message data 364 * @ctx: the context to update; must have been initialized 365 * @data: the message data 366 * @len: the data length in bytes 367 * 368 * This can be called any number of times. 369 * 370 * Context: Any context. 371 */ 372 static inline void sha256_update(struct sha256_ctx *ctx, 373 const u8 *data, size_t len) 374 { 375 __sha256_update(&ctx->ctx, data, len); 376 } 377 378 /** 379 * sha256_final() - Finish computing a SHA-256 message digest 380 * @ctx: the context to finalize; must have been initialized 381 * @out: (output) the resulting SHA-256 message digest 382 * 383 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 384 * 385 * Context: Any context. 386 */ 387 void sha256_final(struct sha256_ctx *ctx, u8 out[at_least SHA256_DIGEST_SIZE]); 388 389 /** 390 * sha256() - Compute SHA-256 message digest in one shot 391 * @data: the message data 392 * @len: the data length in bytes 393 * @out: (output) the resulting SHA-256 message digest 394 * 395 * Context: Any context. 396 */ 397 void sha256(const u8 *data, size_t len, u8 out[at_least SHA256_DIGEST_SIZE]); 398 399 /** 400 * sha256_finup_2x() - Compute two SHA-256 digests from a common initial 401 * context. On some CPUs, this is faster than sequentially 402 * computing each digest. 403 * @ctx: an optional initial context, which may have already processed data. If 404 * NULL, a default initial context is used (equivalent to sha256_init()). 405 * @data1: data for the first message 406 * @data2: data for the second message 407 * @len: the length of each of @data1 and @data2, in bytes 408 * @out1: (output) the first SHA-256 message digest 409 * @out2: (output) the second SHA-256 message digest 410 * 411 * Context: Any context. 412 */ 413 void sha256_finup_2x(const struct sha256_ctx *ctx, const u8 *data1, 414 const u8 *data2, size_t len, 415 u8 out1[at_least SHA256_DIGEST_SIZE], 416 u8 out2[at_least SHA256_DIGEST_SIZE]); 417 418 /** 419 * sha256_finup_2x_is_optimized() - Check if sha256_finup_2x() is using a real 420 * interleaved implementation, as opposed to a 421 * sequential fallback 422 * @return: true if optimized 423 * 424 * Context: Any context. 425 */ 426 bool sha256_finup_2x_is_optimized(void); 427 428 /** 429 * struct hmac_sha256_key - Prepared key for HMAC-SHA256 430 * @key: private 431 */ 432 struct hmac_sha256_key { 433 struct __hmac_sha256_key key; 434 }; 435 436 /** 437 * hmac_sha256_zeroize_key() - Zeroize an hmac_sha256_key structure 438 * @key: The hmac_sha256_key to zeroize 439 */ 440 static inline void hmac_sha256_zeroize_key(struct hmac_sha256_key *key) 441 { 442 memzero_explicit(key, sizeof(*key)); 443 } 444 445 /** 446 * struct hmac_sha256_ctx - Context for computing HMAC-SHA256 of a message 447 * @ctx: private 448 */ 449 struct hmac_sha256_ctx { 450 struct __hmac_sha256_ctx ctx; 451 }; 452 453 /** 454 * hmac_sha256_zeroize_ctx() - Zeroize an hmac_sha256_ctx structure 455 * @ctx: The hmac_sha256_ctx context to zeroize 456 */ 457 static inline void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx) 458 { 459 memzero_explicit(ctx, sizeof(*ctx)); 460 } 461 462 /** 463 * hmac_sha256_preparekey() - Prepare a key for HMAC-SHA256 464 * @key: (output) the key structure to initialize 465 * @raw_key: the raw HMAC-SHA256 key 466 * @raw_key_len: the key length in bytes. All key lengths are supported. 467 * 468 * Note: the caller is responsible for zeroizing both the struct hmac_sha256_key 469 * and the raw key once they are no longer needed. 470 * 471 * Context: Any context. 472 */ 473 void hmac_sha256_preparekey(struct hmac_sha256_key *key, 474 const u8 *raw_key, size_t raw_key_len); 475 476 /** 477 * hmac_sha256_init() - Initialize an HMAC-SHA256 context for a new message 478 * @ctx: (output) the HMAC context to initialize 479 * @key: the prepared HMAC key 480 * 481 * If you don't need incremental computation, consider hmac_sha256() instead. 482 * 483 * Context: Any context. 484 */ 485 static inline void hmac_sha256_init(struct hmac_sha256_ctx *ctx, 486 const struct hmac_sha256_key *key) 487 { 488 __hmac_sha256_init(&ctx->ctx, &key->key); 489 } 490 491 /** 492 * hmac_sha256_init_usingrawkey() - Initialize an HMAC-SHA256 context for a new 493 * message, using a raw key 494 * @ctx: (output) the HMAC context to initialize 495 * @raw_key: the raw HMAC-SHA256 key 496 * @raw_key_len: the key length in bytes. All key lengths are supported. 497 * 498 * If you don't need incremental computation, consider hmac_sha256_usingrawkey() 499 * instead. 500 * 501 * Context: Any context. 502 */ 503 void hmac_sha256_init_usingrawkey(struct hmac_sha256_ctx *ctx, 504 const u8 *raw_key, size_t raw_key_len); 505 506 /** 507 * hmac_sha256_update() - Update an HMAC-SHA256 context with message data 508 * @ctx: the HMAC context to update; must have been initialized 509 * @data: the message data 510 * @data_len: the data length in bytes 511 * 512 * This can be called any number of times. 513 * 514 * Context: Any context. 515 */ 516 static inline void hmac_sha256_update(struct hmac_sha256_ctx *ctx, 517 const u8 *data, size_t data_len) 518 { 519 __sha256_update(&ctx->ctx.sha_ctx, data, data_len); 520 } 521 522 /** 523 * hmac_sha256_final() - Finish computing an HMAC-SHA256 value 524 * @ctx: the HMAC context to finalize; must have been initialized 525 * @out: (output) the resulting HMAC-SHA256 value 526 * 527 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 528 * 529 * Context: Any context. 530 */ 531 void hmac_sha256_final(struct hmac_sha256_ctx *ctx, 532 u8 out[at_least SHA256_DIGEST_SIZE]); 533 534 /** 535 * hmac_sha256() - Compute HMAC-SHA256 in one shot, using a prepared key 536 * @key: the prepared HMAC key 537 * @data: the message data 538 * @data_len: the data length in bytes 539 * @out: (output) the resulting HMAC-SHA256 value 540 * 541 * If you're using the key only once, consider using hmac_sha256_usingrawkey(). 542 * 543 * Context: Any context. 544 */ 545 void hmac_sha256(const struct hmac_sha256_key *key, 546 const u8 *data, size_t data_len, 547 u8 out[at_least SHA256_DIGEST_SIZE]); 548 549 /** 550 * hmac_sha256_usingrawkey() - Compute HMAC-SHA256 in one shot, using a raw key 551 * @raw_key: the raw HMAC-SHA256 key 552 * @raw_key_len: the key length in bytes. All key lengths are supported. 553 * @data: the message data 554 * @data_len: the data length in bytes 555 * @out: (output) the resulting HMAC-SHA256 value 556 * 557 * If you're using the key multiple times, prefer to use 558 * hmac_sha256_preparekey() followed by multiple calls to hmac_sha256() instead. 559 * 560 * Context: Any context. 561 */ 562 void hmac_sha256_usingrawkey(const u8 *raw_key, size_t raw_key_len, 563 const u8 *data, size_t data_len, 564 u8 out[at_least SHA256_DIGEST_SIZE]); 565 566 /* State for the SHA-512 (and SHA-384) compression function */ 567 struct sha512_block_state { 568 u64 h[8]; 569 }; 570 571 /* 572 * Context structure, shared by SHA-384 and SHA-512. The sha384_ctx and 573 * sha512_ctx structs wrap this one so that the API has proper typing and 574 * doesn't allow mixing the SHA-384 and SHA-512 functions arbitrarily. 575 */ 576 struct __sha512_ctx { 577 struct sha512_block_state state; 578 u64 bytecount_lo; 579 u64 bytecount_hi; 580 u8 buf[SHA512_BLOCK_SIZE] __aligned(__alignof__(__be64)); 581 }; 582 void __sha512_update(struct __sha512_ctx *ctx, const u8 *data, size_t len); 583 584 /* 585 * HMAC key and message context structs, shared by HMAC-SHA384 and HMAC-SHA512. 586 * The hmac_sha384_* and hmac_sha512_* structs wrap this one so that the API has 587 * proper typing and doesn't allow mixing the functions arbitrarily. 588 */ 589 struct __hmac_sha512_key { 590 struct sha512_block_state istate; 591 struct sha512_block_state ostate; 592 }; 593 struct __hmac_sha512_ctx { 594 struct __sha512_ctx sha_ctx; 595 struct sha512_block_state ostate; 596 }; 597 void __hmac_sha512_init(struct __hmac_sha512_ctx *ctx, 598 const struct __hmac_sha512_key *key); 599 600 /** 601 * struct sha384_ctx - Context for hashing a message with SHA-384 602 * @ctx: private 603 */ 604 struct sha384_ctx { 605 struct __sha512_ctx ctx; 606 }; 607 608 /** 609 * sha384_init() - Initialize a SHA-384 context for a new message 610 * @ctx: the context to initialize 611 * 612 * If you don't need incremental computation, consider sha384() instead. 613 * 614 * Context: Any context. 615 */ 616 void sha384_init(struct sha384_ctx *ctx); 617 618 /** 619 * sha384_update() - Update a SHA-384 context with message data 620 * @ctx: the context to update; must have been initialized 621 * @data: the message data 622 * @len: the data length in bytes 623 * 624 * This can be called any number of times. 625 * 626 * Context: Any context. 627 */ 628 static inline void sha384_update(struct sha384_ctx *ctx, 629 const u8 *data, size_t len) 630 { 631 __sha512_update(&ctx->ctx, data, len); 632 } 633 634 /** 635 * sha384_final() - Finish computing a SHA-384 message digest 636 * @ctx: the context to finalize; must have been initialized 637 * @out: (output) the resulting SHA-384 message digest 638 * 639 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 640 * 641 * Context: Any context. 642 */ 643 void sha384_final(struct sha384_ctx *ctx, u8 out[at_least SHA384_DIGEST_SIZE]); 644 645 /** 646 * sha384() - Compute SHA-384 message digest in one shot 647 * @data: the message data 648 * @len: the data length in bytes 649 * @out: (output) the resulting SHA-384 message digest 650 * 651 * Context: Any context. 652 */ 653 void sha384(const u8 *data, size_t len, u8 out[at_least SHA384_DIGEST_SIZE]); 654 655 /** 656 * struct hmac_sha384_key - Prepared key for HMAC-SHA384 657 * @key: private 658 */ 659 struct hmac_sha384_key { 660 struct __hmac_sha512_key key; 661 }; 662 663 /** 664 * hmac_sha384_zeroize_key() - Zeroize an hmac_sha384_key structure 665 * @key: The hmac_sha384_key to zeroize 666 */ 667 static inline void hmac_sha384_zeroize_key(struct hmac_sha384_key *key) 668 { 669 memzero_explicit(key, sizeof(*key)); 670 } 671 672 /** 673 * struct hmac_sha384_ctx - Context for computing HMAC-SHA384 of a message 674 * @ctx: private 675 */ 676 struct hmac_sha384_ctx { 677 struct __hmac_sha512_ctx ctx; 678 }; 679 680 /** 681 * hmac_sha384_zeroize_ctx() - Zeroize an hmac_sha384_ctx structure 682 * @ctx: The hmac_sha384_ctx context to zeroize 683 */ 684 static inline void hmac_sha384_zeroize_ctx(struct hmac_sha384_ctx *ctx) 685 { 686 memzero_explicit(ctx, sizeof(*ctx)); 687 } 688 689 /** 690 * hmac_sha384_preparekey() - Prepare a key for HMAC-SHA384 691 * @key: (output) the key structure to initialize 692 * @raw_key: the raw HMAC-SHA384 key 693 * @raw_key_len: the key length in bytes. All key lengths are supported. 694 * 695 * Note: the caller is responsible for zeroizing both the struct hmac_sha384_key 696 * and the raw key once they are no longer needed. 697 * 698 * Context: Any context. 699 */ 700 void hmac_sha384_preparekey(struct hmac_sha384_key *key, 701 const u8 *raw_key, size_t raw_key_len); 702 703 /** 704 * hmac_sha384_init() - Initialize an HMAC-SHA384 context for a new message 705 * @ctx: (output) the HMAC context to initialize 706 * @key: the prepared HMAC key 707 * 708 * If you don't need incremental computation, consider hmac_sha384() instead. 709 * 710 * Context: Any context. 711 */ 712 static inline void hmac_sha384_init(struct hmac_sha384_ctx *ctx, 713 const struct hmac_sha384_key *key) 714 { 715 __hmac_sha512_init(&ctx->ctx, &key->key); 716 } 717 718 /** 719 * hmac_sha384_init_usingrawkey() - Initialize an HMAC-SHA384 context for a new 720 * message, using a raw key 721 * @ctx: (output) the HMAC context to initialize 722 * @raw_key: the raw HMAC-SHA384 key 723 * @raw_key_len: the key length in bytes. All key lengths are supported. 724 * 725 * If you don't need incremental computation, consider hmac_sha384_usingrawkey() 726 * instead. 727 * 728 * Context: Any context. 729 */ 730 void hmac_sha384_init_usingrawkey(struct hmac_sha384_ctx *ctx, 731 const u8 *raw_key, size_t raw_key_len); 732 733 /** 734 * hmac_sha384_update() - Update an HMAC-SHA384 context with message data 735 * @ctx: the HMAC context to update; must have been initialized 736 * @data: the message data 737 * @data_len: the data length in bytes 738 * 739 * This can be called any number of times. 740 * 741 * Context: Any context. 742 */ 743 static inline void hmac_sha384_update(struct hmac_sha384_ctx *ctx, 744 const u8 *data, size_t data_len) 745 { 746 __sha512_update(&ctx->ctx.sha_ctx, data, data_len); 747 } 748 749 /** 750 * hmac_sha384_final() - Finish computing an HMAC-SHA384 value 751 * @ctx: the HMAC context to finalize; must have been initialized 752 * @out: (output) the resulting HMAC-SHA384 value 753 * 754 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 755 * 756 * Context: Any context. 757 */ 758 void hmac_sha384_final(struct hmac_sha384_ctx *ctx, 759 u8 out[at_least SHA384_DIGEST_SIZE]); 760 761 /** 762 * hmac_sha384() - Compute HMAC-SHA384 in one shot, using a prepared key 763 * @key: the prepared HMAC key 764 * @data: the message data 765 * @data_len: the data length in bytes 766 * @out: (output) the resulting HMAC-SHA384 value 767 * 768 * If you're using the key only once, consider using hmac_sha384_usingrawkey(). 769 * 770 * Context: Any context. 771 */ 772 void hmac_sha384(const struct hmac_sha384_key *key, 773 const u8 *data, size_t data_len, 774 u8 out[at_least SHA384_DIGEST_SIZE]); 775 776 /** 777 * hmac_sha384_usingrawkey() - Compute HMAC-SHA384 in one shot, using a raw key 778 * @raw_key: the raw HMAC-SHA384 key 779 * @raw_key_len: the key length in bytes. All key lengths are supported. 780 * @data: the message data 781 * @data_len: the data length in bytes 782 * @out: (output) the resulting HMAC-SHA384 value 783 * 784 * If you're using the key multiple times, prefer to use 785 * hmac_sha384_preparekey() followed by multiple calls to hmac_sha384() instead. 786 * 787 * Context: Any context. 788 */ 789 void hmac_sha384_usingrawkey(const u8 *raw_key, size_t raw_key_len, 790 const u8 *data, size_t data_len, 791 u8 out[at_least SHA384_DIGEST_SIZE]); 792 793 /** 794 * struct sha512_ctx - Context for hashing a message with SHA-512 795 * @ctx: private 796 */ 797 struct sha512_ctx { 798 struct __sha512_ctx ctx; 799 }; 800 801 /** 802 * sha512_init() - Initialize a SHA-512 context for a new message 803 * @ctx: the context to initialize 804 * 805 * If you don't need incremental computation, consider sha512() instead. 806 * 807 * Context: Any context. 808 */ 809 void sha512_init(struct sha512_ctx *ctx); 810 811 /** 812 * sha512_update() - Update a SHA-512 context with message data 813 * @ctx: the context to update; must have been initialized 814 * @data: the message data 815 * @len: the data length in bytes 816 * 817 * This can be called any number of times. 818 * 819 * Context: Any context. 820 */ 821 static inline void sha512_update(struct sha512_ctx *ctx, 822 const u8 *data, size_t len) 823 { 824 __sha512_update(&ctx->ctx, data, len); 825 } 826 827 /** 828 * sha512_final() - Finish computing a SHA-512 message digest 829 * @ctx: the context to finalize; must have been initialized 830 * @out: (output) the resulting SHA-512 message digest 831 * 832 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 833 * 834 * Context: Any context. 835 */ 836 void sha512_final(struct sha512_ctx *ctx, u8 out[at_least SHA512_DIGEST_SIZE]); 837 838 /** 839 * sha512() - Compute SHA-512 message digest in one shot 840 * @data: the message data 841 * @len: the data length in bytes 842 * @out: (output) the resulting SHA-512 message digest 843 * 844 * Context: Any context. 845 */ 846 void sha512(const u8 *data, size_t len, u8 out[at_least SHA512_DIGEST_SIZE]); 847 848 /** 849 * struct hmac_sha512_key - Prepared key for HMAC-SHA512 850 * @key: private 851 */ 852 struct hmac_sha512_key { 853 struct __hmac_sha512_key key; 854 }; 855 856 /** 857 * hmac_sha512_zeroize_key() - Zeroize an hmac_sha512_key structure 858 * @key: The hmac_sha512_key to zeroize 859 */ 860 static inline void hmac_sha512_zeroize_key(struct hmac_sha512_key *key) 861 { 862 memzero_explicit(key, sizeof(*key)); 863 } 864 865 /** 866 * struct hmac_sha512_ctx - Context for computing HMAC-SHA512 of a message 867 * @ctx: private 868 */ 869 struct hmac_sha512_ctx { 870 struct __hmac_sha512_ctx ctx; 871 }; 872 873 /** 874 * hmac_sha512_zeroize_ctx() - Zeroize an hmac_sha512_ctx structure 875 * @ctx: The hmac_sha512_ctx context to zeroize 876 */ 877 static inline void hmac_sha512_zeroize_ctx(struct hmac_sha512_ctx *ctx) 878 { 879 memzero_explicit(ctx, sizeof(*ctx)); 880 } 881 882 /** 883 * hmac_sha512_preparekey() - Prepare a key for HMAC-SHA512 884 * @key: (output) the key structure to initialize 885 * @raw_key: the raw HMAC-SHA512 key 886 * @raw_key_len: the key length in bytes. All key lengths are supported. 887 * 888 * Note: the caller is responsible for zeroizing both the struct hmac_sha512_key 889 * and the raw key once they are no longer needed. 890 * 891 * Context: Any context. 892 */ 893 void hmac_sha512_preparekey(struct hmac_sha512_key *key, 894 const u8 *raw_key, size_t raw_key_len); 895 896 /** 897 * hmac_sha512_init() - Initialize an HMAC-SHA512 context for a new message 898 * @ctx: (output) the HMAC context to initialize 899 * @key: the prepared HMAC key 900 * 901 * If you don't need incremental computation, consider hmac_sha512() instead. 902 * 903 * Context: Any context. 904 */ 905 static inline void hmac_sha512_init(struct hmac_sha512_ctx *ctx, 906 const struct hmac_sha512_key *key) 907 { 908 __hmac_sha512_init(&ctx->ctx, &key->key); 909 } 910 911 /** 912 * hmac_sha512_init_usingrawkey() - Initialize an HMAC-SHA512 context for a new 913 * message, using a raw key 914 * @ctx: (output) the HMAC context to initialize 915 * @raw_key: the raw HMAC-SHA512 key 916 * @raw_key_len: the key length in bytes. All key lengths are supported. 917 * 918 * If you don't need incremental computation, consider hmac_sha512_usingrawkey() 919 * instead. 920 * 921 * Context: Any context. 922 */ 923 void hmac_sha512_init_usingrawkey(struct hmac_sha512_ctx *ctx, 924 const u8 *raw_key, size_t raw_key_len); 925 926 /** 927 * hmac_sha512_update() - Update an HMAC-SHA512 context with message data 928 * @ctx: the HMAC context to update; must have been initialized 929 * @data: the message data 930 * @data_len: the data length in bytes 931 * 932 * This can be called any number of times. 933 * 934 * Context: Any context. 935 */ 936 static inline void hmac_sha512_update(struct hmac_sha512_ctx *ctx, 937 const u8 *data, size_t data_len) 938 { 939 __sha512_update(&ctx->ctx.sha_ctx, data, data_len); 940 } 941 942 /** 943 * hmac_sha512_final() - Finish computing an HMAC-SHA512 value 944 * @ctx: the HMAC context to finalize; must have been initialized 945 * @out: (output) the resulting HMAC-SHA512 value 946 * 947 * After finishing, this zeroizes @ctx. So the caller does not need to do it. 948 * 949 * Context: Any context. 950 */ 951 void hmac_sha512_final(struct hmac_sha512_ctx *ctx, 952 u8 out[at_least SHA512_DIGEST_SIZE]); 953 954 /** 955 * hmac_sha512() - Compute HMAC-SHA512 in one shot, using a prepared key 956 * @key: the prepared HMAC key 957 * @data: the message data 958 * @data_len: the data length in bytes 959 * @out: (output) the resulting HMAC-SHA512 value 960 * 961 * If you're using the key only once, consider using hmac_sha512_usingrawkey(). 962 * 963 * Context: Any context. 964 */ 965 void hmac_sha512(const struct hmac_sha512_key *key, 966 const u8 *data, size_t data_len, 967 u8 out[at_least SHA512_DIGEST_SIZE]); 968 969 /** 970 * hmac_sha512_usingrawkey() - Compute HMAC-SHA512 in one shot, using a raw key 971 * @raw_key: the raw HMAC-SHA512 key 972 * @raw_key_len: the key length in bytes. All key lengths are supported. 973 * @data: the message data 974 * @data_len: the data length in bytes 975 * @out: (output) the resulting HMAC-SHA512 value 976 * 977 * If you're using the key multiple times, prefer to use 978 * hmac_sha512_preparekey() followed by multiple calls to hmac_sha512() instead. 979 * 980 * Context: Any context. 981 */ 982 void hmac_sha512_usingrawkey(const u8 *raw_key, size_t raw_key_len, 983 const u8 *data, size_t data_len, 984 u8 out[at_least SHA512_DIGEST_SIZE]); 985 986 #endif /* _CRYPTO_SHA2_H */ 987