xref: /illumos-gate/usr/src/common/crypto/sha1/sha1.c (revision 7a6d80f1660abd4755c68cbd094d4a914681d26e)
1 /*
2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * The basic framework for this code came from the reference
8  * implementation for MD5.  That implementation is Copyright (C)
9  * 1991-2, RSA Data Security, Inc. Created 1991. All rights reserved.
10  *
11  * License to copy and use this software is granted provided that it
12  * is identified as the "RSA Data Security, Inc. MD5 Message-Digest
13  * Algorithm" in all material mentioning or referencing this software
14  * or this function.
15  *
16  * License is also granted to make and use derivative works provided
17  * that such works are identified as "derived from the RSA Data
18  * Security, Inc. MD5 Message-Digest Algorithm" in all material
19  * mentioning or referencing the derived work.
20  *
21  * RSA Data Security, Inc. makes no representations concerning either
22  * the merchantability of this software or the suitability of this
23  * software for any particular purpose. It is provided "as is"
24  * without express or implied warranty of any kind.
25  *
26  * These notices must be retained in any copies of any part of this
27  * documentation and/or software.
28  *
29  * NOTE: Cleaned-up and optimized, version of SHA1, based on the FIPS 180-1
30  * standard, available at http://www.itl.nist.gov/fipspubs/fip180-1.htm
31  * Not as fast as one would like -- further optimizations are encouraged
32  * and appreciated.
33  */
34 
35 #if defined(_STANDALONE)
36 #include <sys/cdefs.h>
37 #define	_RESTRICT_KYWD	restrict
38 #else
39 #if !defined(_KERNEL) && !defined(_BOOT)
40 #include <stdint.h>
41 #include <strings.h>
42 #include <stdlib.h>
43 #include <errno.h>
44 #include <sys/systeminfo.h>
45 #endif  /* !_KERNEL && !_BOOT */
46 #endif	/* _STANDALONE */
47 
48 #include <sys/types.h>
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/sysmacros.h>
52 #include <sys/sha1.h>
53 #include <sys/sha1_consts.h>
54 
55 #if defined(_STANDALONE)
56 #include <sys/endian.h>
57 #define	HAVE_HTONL
58 #if _BYTE_ORDER == _LITTLE_ENDIAN
59 #undef _BIG_ENDIAN
60 #else
61 #undef _LITTLE_ENDIAN
62 #endif
63 #else
64 #ifdef _LITTLE_ENDIAN
65 #include <sys/byteorder.h>
66 #define	HAVE_HTONL
67 #endif
68 #endif /* _STANDALONE */
69 
70 #ifdef	_BOOT
71 #define	bcopy(_s, _d, _l)	((void) memcpy((_d), (_s), (_l)))
72 #define	bzero(_m, _l)		((void) memset((_m), 0, (_l)))
73 #endif
74 
75 static void Encode(uint8_t *, const uint32_t *, size_t);
76 
77 #if	defined(__sparc)
78 
79 #define	SHA1_TRANSFORM(ctx, in) \
80 	SHA1Transform((ctx)->state[0], (ctx)->state[1], (ctx)->state[2], \
81 		(ctx)->state[3], (ctx)->state[4], (ctx), (in))
82 
83 static void SHA1Transform(uint32_t, uint32_t, uint32_t, uint32_t, uint32_t,
84     SHA1_CTX *, const uint8_t [64]);
85 
86 #elif	defined(__amd64)
87 
88 #define	SHA1_TRANSFORM(ctx, in) sha1_block_data_order((ctx), (in), 1)
89 #define	SHA1_TRANSFORM_BLOCKS(ctx, in, num) sha1_block_data_order((ctx), \
90 		(in), (num))
91 
92 void sha1_block_data_order(SHA1_CTX *ctx, const void *inpp, size_t num_blocks);
93 
94 #else
95 
96 #define	SHA1_TRANSFORM(ctx, in) SHA1Transform((ctx), (in))
97 
98 static void SHA1Transform(SHA1_CTX *, const uint8_t [64]);
99 
100 #endif
101 
102 
103 static uint8_t PADDING[64] = { 0x80, /* all zeros */ };
104 
105 /*
106  * F, G, and H are the basic SHA1 functions.
107  */
108 #define	F(b, c, d)	(((b) & (c)) | ((~b) & (d)))
109 #define	G(b, c, d)	((b) ^ (c) ^ (d))
110 #define	H(b, c, d)	(((b) & (c)) | (((b)|(c)) & (d)))
111 
112 /*
113  * SHA1Init()
114  *
115  * purpose: initializes the sha1 context and begins and sha1 digest operation
116  *   input: SHA1_CTX *	: the context to initializes.
117  *  output: void
118  */
119 
120 void
121 SHA1Init(SHA1_CTX *ctx)
122 {
123 	ctx->count[0] = ctx->count[1] = 0;
124 
125 	/*
126 	 * load magic initialization constants. Tell lint
127 	 * that these constants are unsigned by using U.
128 	 */
129 
130 	ctx->state[0] = 0x67452301U;
131 	ctx->state[1] = 0xefcdab89U;
132 	ctx->state[2] = 0x98badcfeU;
133 	ctx->state[3] = 0x10325476U;
134 	ctx->state[4] = 0xc3d2e1f0U;
135 }
136 
137 #ifdef VIS_SHA1
138 #ifdef _KERNEL
139 
140 #include <sys/regset.h>
141 #include <sys/vis.h>
142 #include <sys/fpu/fpusystm.h>
143 
144 /* the alignment for block stores to save fp registers */
145 #define	VIS_ALIGN	(64)
146 
147 extern int sha1_savefp(kfpu_t *, int);
148 extern void sha1_restorefp(kfpu_t *);
149 
150 uint32_t	vis_sha1_svfp_threshold = 128;
151 
152 #endif /* _KERNEL */
153 
154 /*
155  * VIS SHA-1 consts.
156  */
157 static uint64_t VIS[] = {
158 	0x8000000080000000ULL,
159 	0x0002000200020002ULL,
160 	0x5a8279996ed9eba1ULL,
161 	0x8f1bbcdcca62c1d6ULL,
162 	0x012389ab456789abULL};
163 
164 extern void SHA1TransformVIS(uint64_t *, uint32_t *, uint32_t *, uint64_t *);
165 
166 
167 /*
168  * SHA1Update()
169  *
170  * purpose: continues an sha1 digest operation, using the message block
171  *          to update the context.
172  *   input: SHA1_CTX *	: the context to update
173  *          void *	: the message block
174  *          size_t    : the length of the message block in bytes
175  *  output: void
176  */
177 
178 void
179 SHA1Update(SHA1_CTX *ctx, const void *inptr, size_t input_len)
180 {
181 	uint32_t i, buf_index, buf_len;
182 	uint64_t X0[40], input64[8];
183 	const uint8_t *input = inptr;
184 #ifdef _KERNEL
185 	int usevis = 0;
186 #else
187 	int usevis = 1;
188 #endif /* _KERNEL */
189 
190 	/* check for noop */
191 	if (input_len == 0)
192 		return;
193 
194 	/* compute number of bytes mod 64 */
195 	buf_index = (ctx->count[1] >> 3) & 0x3F;
196 
197 	/* update number of bits */
198 	if ((ctx->count[1] += (input_len << 3)) < (input_len << 3))
199 		ctx->count[0]++;
200 
201 	ctx->count[0] += (input_len >> 29);
202 
203 	buf_len = 64 - buf_index;
204 
205 	/* transform as many times as possible */
206 	i = 0;
207 	if (input_len >= buf_len) {
208 #ifdef _KERNEL
209 		kfpu_t *fpu;
210 		if (fpu_exists) {
211 			uint8_t fpua[sizeof (kfpu_t) + GSR_SIZE + VIS_ALIGN];
212 			uint32_t len = (input_len + buf_index) & ~0x3f;
213 			int svfp_ok;
214 
215 			fpu = (kfpu_t *)P2ROUNDUP((uintptr_t)fpua, 64);
216 			svfp_ok = ((len >= vis_sha1_svfp_threshold) ? 1 : 0);
217 			usevis = fpu_exists && sha1_savefp(fpu, svfp_ok);
218 		} else {
219 			usevis = 0;
220 		}
221 #endif /* _KERNEL */
222 
223 		/*
224 		 * general optimization:
225 		 *
226 		 * only do initial bcopy() and SHA1Transform() if
227 		 * buf_index != 0.  if buf_index == 0, we're just
228 		 * wasting our time doing the bcopy() since there
229 		 * wasn't any data left over from a previous call to
230 		 * SHA1Update().
231 		 */
232 
233 		if (buf_index) {
234 			bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
235 			if (usevis) {
236 				SHA1TransformVIS(X0,
237 				    ctx->buf_un.buf32,
238 				    &ctx->state[0], VIS);
239 			} else {
240 				SHA1_TRANSFORM(ctx, ctx->buf_un.buf8);
241 			}
242 			i = buf_len;
243 		}
244 
245 		/*
246 		 * VIS SHA-1: uses the VIS 1.0 instructions to accelerate
247 		 * SHA-1 processing. This is achieved by "offloading" the
248 		 * computation of the message schedule (MS) to the VIS units.
249 		 * This allows the VIS computation of the message schedule
250 		 * to be performed in parallel with the standard integer
251 		 * processing of the remainder of the SHA-1 computation.
252 		 * performance by up to around 1.37X, compared to an optimized
253 		 * integer-only implementation.
254 		 *
255 		 * The VIS implementation of SHA1Transform has a different API
256 		 * to the standard integer version:
257 		 *
258 		 * void SHA1TransformVIS(
259 		 *	 uint64_t *, // Pointer to MS for ith block
260 		 *	 uint32_t *, // Pointer to ith block of message data
261 		 *	 uint32_t *, // Pointer to SHA state i.e ctx->state
262 		 *	 uint64_t *, // Pointer to various VIS constants
263 		 * )
264 		 *
265 		 * Note: the message data must by 4-byte aligned.
266 		 *
267 		 * Function requires VIS 1.0 support.
268 		 *
269 		 * Handling is provided to deal with arbitrary byte alingment
270 		 * of the input data but the performance gains are reduced
271 		 * for alignments other than 4-bytes.
272 		 */
273 		if (usevis) {
274 			if (!IS_P2ALIGNED(&input[i], sizeof (uint32_t))) {
275 				/*
276 				 * Main processing loop - input misaligned
277 				 */
278 				for (; i + 63 < input_len; i += 64) {
279 					bcopy(&input[i], input64, 64);
280 					SHA1TransformVIS(X0,
281 					    (uint32_t *)input64,
282 					    &ctx->state[0], VIS);
283 				}
284 			} else {
285 				/*
286 				 * Main processing loop - input 8-byte aligned
287 				 */
288 				for (; i + 63 < input_len; i += 64) {
289 					SHA1TransformVIS(X0,
290 					    /* LINTED E_BAD_PTR_CAST_ALIGN */
291 					    (uint32_t *)&input[i], /* CSTYLED */
292 					    &ctx->state[0], VIS);
293 				}
294 
295 			}
296 #ifdef _KERNEL
297 			sha1_restorefp(fpu);
298 #endif /* _KERNEL */
299 		} else {
300 			for (; i + 63 < input_len; i += 64) {
301 				SHA1_TRANSFORM(ctx, &input[i]);
302 			}
303 		}
304 
305 		/*
306 		 * general optimization:
307 		 *
308 		 * if i and input_len are the same, return now instead
309 		 * of calling bcopy(), since the bcopy() in this case
310 		 * will be an expensive nop.
311 		 */
312 
313 		if (input_len == i)
314 			return;
315 
316 		buf_index = 0;
317 	}
318 
319 	/* buffer remaining input */
320 	bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
321 }
322 
323 #else /* VIS_SHA1 */
324 
325 void
326 SHA1Update(SHA1_CTX *ctx, const void *inptr, size_t input_len)
327 {
328 	uint32_t i, buf_index, buf_len;
329 	const uint8_t *input = inptr;
330 #if defined(__amd64)
331 	uint32_t	block_count;
332 #endif	/* __amd64 */
333 
334 	/* check for noop */
335 	if (input_len == 0)
336 		return;
337 
338 	/* compute number of bytes mod 64 */
339 	buf_index = (ctx->count[1] >> 3) & 0x3F;
340 
341 	/* update number of bits */
342 	if ((ctx->count[1] += (input_len << 3)) < (input_len << 3))
343 		ctx->count[0]++;
344 
345 	ctx->count[0] += (input_len >> 29);
346 
347 	buf_len = 64 - buf_index;
348 
349 	/* transform as many times as possible */
350 	i = 0;
351 	if (input_len >= buf_len) {
352 
353 		/*
354 		 * general optimization:
355 		 *
356 		 * only do initial bcopy() and SHA1Transform() if
357 		 * buf_index != 0.  if buf_index == 0, we're just
358 		 * wasting our time doing the bcopy() since there
359 		 * wasn't any data left over from a previous call to
360 		 * SHA1Update().
361 		 */
362 
363 		if (buf_index) {
364 			bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
365 			SHA1_TRANSFORM(ctx, ctx->buf_un.buf8);
366 			i = buf_len;
367 		}
368 
369 #if !defined(__amd64)
370 		for (; i + 63 < input_len; i += 64)
371 			SHA1_TRANSFORM(ctx, &input[i]);
372 #else
373 		block_count = (input_len - i) >> 6;
374 		if (block_count > 0) {
375 			SHA1_TRANSFORM_BLOCKS(ctx, &input[i], block_count);
376 			i += block_count << 6;
377 		}
378 #endif	/* !__amd64 */
379 
380 		/*
381 		 * general optimization:
382 		 *
383 		 * if i and input_len are the same, return now instead
384 		 * of calling bcopy(), since the bcopy() in this case
385 		 * will be an expensive nop.
386 		 */
387 
388 		if (input_len == i)
389 			return;
390 
391 		buf_index = 0;
392 	}
393 
394 	/* buffer remaining input */
395 	bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
396 }
397 
398 #endif /* VIS_SHA1 */
399 
400 /*
401  * SHA1Final()
402  *
403  * purpose: ends an sha1 digest operation, finalizing the message digest and
404  *          zeroing the context.
405  *   input: uchar_t *	: A buffer to store the digest.
406  *			: The function actually uses void* because many
407  *			: callers pass things other than uchar_t here.
408  *          SHA1_CTX *  : the context to finalize, save, and zero
409  *  output: void
410  */
411 
412 void
413 SHA1Final(void *digest, SHA1_CTX *ctx)
414 {
415 	uint8_t		bitcount_be[sizeof (ctx->count)];
416 	uint32_t	index = (ctx->count[1] >> 3) & 0x3f;
417 
418 	/* store bit count, big endian */
419 	Encode(bitcount_be, ctx->count, sizeof (bitcount_be));
420 
421 	/* pad out to 56 mod 64 */
422 	SHA1Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
423 
424 	/* append length (before padding) */
425 	SHA1Update(ctx, bitcount_be, sizeof (bitcount_be));
426 
427 	/* store state in digest */
428 	Encode(digest, ctx->state, sizeof (ctx->state));
429 
430 	/* zeroize sensitive information */
431 	bzero(ctx, sizeof (*ctx));
432 }
433 
434 
435 #if !defined(__amd64)
436 
437 /*
438  * ROTATE_LEFT rotates x left n bits.
439  */
440 
441 #if	defined(__GNUC__) && defined(_LP64)
442 static __inline__ uint64_t
443 ROTATE_LEFT(uint64_t value, uint32_t n)
444 {
445 	uint32_t t32;
446 
447 	t32 = (uint32_t)value;
448 	return ((t32 << n) | (t32 >> (32 - n)));
449 }
450 
451 #else
452 #define	ROTATE_LEFT(x, n)	\
453 	(((x) << (n)) | ((x) >> ((sizeof (x) * NBBY)-(n))))
454 #endif
455 
456 typedef uint32_t sha1word;
457 
458 /*
459  * sparc optimization:
460  *
461  * on the sparc, we can load big endian 32-bit data easily.  note that
462  * special care must be taken to ensure the address is 32-bit aligned.
463  * in the interest of speed, we don't check to make sure, since
464  * careful programming can guarantee this for us.
465  */
466 
467 #if	defined(_BIG_ENDIAN)
468 #define	LOAD_BIG_32(addr)	(*(uint32_t *)(addr))
469 
470 #elif	defined(HAVE_HTONL)
471 #define	LOAD_BIG_32(addr) htonl(*((uint32_t *)(addr)))
472 
473 #else
474 /* little endian -- will work on big endian, but slowly */
475 #define	LOAD_BIG_32(addr)	\
476 	(((addr)[0] << 24) | ((addr)[1] << 16) | ((addr)[2] << 8) | (addr)[3])
477 #endif	/* _BIG_ENDIAN */
478 
479 /*
480  * SHA1Transform()
481  */
482 #if	defined(W_ARRAY)
483 #define	W(n) w[n]
484 #else	/* !defined(W_ARRAY) */
485 #define	W(n) w_ ## n
486 #endif	/* !defined(W_ARRAY) */
487 
488 
489 #if	defined(__sparc)
490 
491 /*
492  * sparc register window optimization:
493  *
494  * `a', `b', `c', `d', and `e' are passed into SHA1Transform
495  * explicitly since it increases the number of registers available to
496  * the compiler.  under this scheme, these variables can be held in
497  * %i0 - %i4, which leaves more local and out registers available.
498  *
499  * purpose: sha1 transformation -- updates the digest based on `block'
500  *   input: uint32_t	: bytes  1 -  4 of the digest
501  *          uint32_t	: bytes  5 -  8 of the digest
502  *          uint32_t	: bytes  9 - 12 of the digest
503  *          uint32_t	: bytes 12 - 16 of the digest
504  *          uint32_t	: bytes 16 - 20 of the digest
505  *          SHA1_CTX *	: the context to update
506  *          uint8_t [64]: the block to use to update the digest
507  *  output: void
508  */
509 
510 void
511 SHA1Transform(uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e,
512     SHA1_CTX *ctx, const uint8_t blk[64])
513 {
514 	/*
515 	 * sparc optimization:
516 	 *
517 	 * while it is somewhat counter-intuitive, on sparc, it is
518 	 * more efficient to place all the constants used in this
519 	 * function in an array and load the values out of the array
520 	 * than to manually load the constants.  this is because
521 	 * setting a register to a 32-bit value takes two ops in most
522 	 * cases: a `sethi' and an `or', but loading a 32-bit value
523 	 * from memory only takes one `ld' (or `lduw' on v9).  while
524 	 * this increases memory usage, the compiler can find enough
525 	 * other things to do while waiting to keep the pipeline does
526 	 * not stall.  additionally, it is likely that many of these
527 	 * constants are cached so that later accesses do not even go
528 	 * out to the bus.
529 	 *
530 	 * this array is declared `static' to keep the compiler from
531 	 * having to bcopy() this array onto the stack frame of
532 	 * SHA1Transform() each time it is called -- which is
533 	 * unacceptably expensive.
534 	 *
535 	 * the `const' is to ensure that callers are good citizens and
536 	 * do not try to munge the array.  since these routines are
537 	 * going to be called from inside multithreaded kernelland,
538 	 * this is a good safety check. -- `sha1_consts' will end up in
539 	 * .rodata.
540 	 *
541 	 * unfortunately, loading from an array in this manner hurts
542 	 * performance under Intel.  So, there is a macro,
543 	 * SHA1_CONST(), used in SHA1Transform(), that either expands to
544 	 * a reference to this array, or to the actual constant,
545 	 * depending on what platform this code is compiled for.
546 	 */
547 
548 	static const uint32_t sha1_consts[] = {
549 		SHA1_CONST_0, SHA1_CONST_1, SHA1_CONST_2, SHA1_CONST_3
550 	};
551 
552 	/*
553 	 * general optimization:
554 	 *
555 	 * use individual integers instead of using an array.  this is a
556 	 * win, although the amount it wins by seems to vary quite a bit.
557 	 */
558 
559 	uint32_t	w_0, w_1, w_2,  w_3,  w_4,  w_5,  w_6,  w_7;
560 	uint32_t	w_8, w_9, w_10, w_11, w_12, w_13, w_14, w_15;
561 
562 	/*
563 	 * sparc optimization:
564 	 *
565 	 * if `block' is already aligned on a 4-byte boundary, use
566 	 * LOAD_BIG_32() directly.  otherwise, bcopy() into a
567 	 * buffer that *is* aligned on a 4-byte boundary and then do
568 	 * the LOAD_BIG_32() on that buffer.  benchmarks have shown
569 	 * that using the bcopy() is better than loading the bytes
570 	 * individually and doing the endian-swap by hand.
571 	 *
572 	 * even though it's quite tempting to assign to do:
573 	 *
574 	 * blk = bcopy(ctx->buf_un.buf32, blk, sizeof (ctx->buf_un.buf32));
575 	 *
576 	 * and only have one set of LOAD_BIG_32()'s, the compiler
577 	 * *does not* like that, so please resist the urge.
578 	 */
579 
580 	if ((uintptr_t)blk & 0x3) {		/* not 4-byte aligned? */
581 		bcopy(blk, ctx->buf_un.buf32,  sizeof (ctx->buf_un.buf32));
582 		w_15 = LOAD_BIG_32(ctx->buf_un.buf32 + 15);
583 		w_14 = LOAD_BIG_32(ctx->buf_un.buf32 + 14);
584 		w_13 = LOAD_BIG_32(ctx->buf_un.buf32 + 13);
585 		w_12 = LOAD_BIG_32(ctx->buf_un.buf32 + 12);
586 		w_11 = LOAD_BIG_32(ctx->buf_un.buf32 + 11);
587 		w_10 = LOAD_BIG_32(ctx->buf_un.buf32 + 10);
588 		w_9  = LOAD_BIG_32(ctx->buf_un.buf32 +  9);
589 		w_8  = LOAD_BIG_32(ctx->buf_un.buf32 +  8);
590 		w_7  = LOAD_BIG_32(ctx->buf_un.buf32 +  7);
591 		w_6  = LOAD_BIG_32(ctx->buf_un.buf32 +  6);
592 		w_5  = LOAD_BIG_32(ctx->buf_un.buf32 +  5);
593 		w_4  = LOAD_BIG_32(ctx->buf_un.buf32 +  4);
594 		w_3  = LOAD_BIG_32(ctx->buf_un.buf32 +  3);
595 		w_2  = LOAD_BIG_32(ctx->buf_un.buf32 +  2);
596 		w_1  = LOAD_BIG_32(ctx->buf_un.buf32 +  1);
597 		w_0  = LOAD_BIG_32(ctx->buf_un.buf32 +  0);
598 	} else {
599 		/* LINTED E_BAD_PTR_CAST_ALIGN */
600 		w_15 = LOAD_BIG_32(blk + 60);
601 		/* LINTED E_BAD_PTR_CAST_ALIGN */
602 		w_14 = LOAD_BIG_32(blk + 56);
603 		/* LINTED E_BAD_PTR_CAST_ALIGN */
604 		w_13 = LOAD_BIG_32(blk + 52);
605 		/* LINTED E_BAD_PTR_CAST_ALIGN */
606 		w_12 = LOAD_BIG_32(blk + 48);
607 		/* LINTED E_BAD_PTR_CAST_ALIGN */
608 		w_11 = LOAD_BIG_32(blk + 44);
609 		/* LINTED E_BAD_PTR_CAST_ALIGN */
610 		w_10 = LOAD_BIG_32(blk + 40);
611 		/* LINTED E_BAD_PTR_CAST_ALIGN */
612 		w_9  = LOAD_BIG_32(blk + 36);
613 		/* LINTED E_BAD_PTR_CAST_ALIGN */
614 		w_8  = LOAD_BIG_32(blk + 32);
615 		/* LINTED E_BAD_PTR_CAST_ALIGN */
616 		w_7  = LOAD_BIG_32(blk + 28);
617 		/* LINTED E_BAD_PTR_CAST_ALIGN */
618 		w_6  = LOAD_BIG_32(blk + 24);
619 		/* LINTED E_BAD_PTR_CAST_ALIGN */
620 		w_5  = LOAD_BIG_32(blk + 20);
621 		/* LINTED E_BAD_PTR_CAST_ALIGN */
622 		w_4  = LOAD_BIG_32(blk + 16);
623 		/* LINTED E_BAD_PTR_CAST_ALIGN */
624 		w_3  = LOAD_BIG_32(blk + 12);
625 		/* LINTED E_BAD_PTR_CAST_ALIGN */
626 		w_2  = LOAD_BIG_32(blk +  8);
627 		/* LINTED E_BAD_PTR_CAST_ALIGN */
628 		w_1  = LOAD_BIG_32(blk +  4);
629 		/* LINTED E_BAD_PTR_CAST_ALIGN */
630 		w_0  = LOAD_BIG_32(blk +  0);
631 	}
632 #else	/* !defined(__sparc) */
633 
634 void /* CSTYLED */
635 SHA1Transform(SHA1_CTX *ctx, const uint8_t blk[64])
636 {
637 	/* CSTYLED */
638 	sha1word a = ctx->state[0];
639 	sha1word b = ctx->state[1];
640 	sha1word c = ctx->state[2];
641 	sha1word d = ctx->state[3];
642 	sha1word e = ctx->state[4];
643 
644 #if	defined(W_ARRAY)
645 	sha1word	w[16];
646 #else	/* !defined(W_ARRAY) */
647 	sha1word	w_0, w_1, w_2,  w_3,  w_4,  w_5,  w_6,  w_7;
648 	sha1word	w_8, w_9, w_10, w_11, w_12, w_13, w_14, w_15;
649 #endif	/* !defined(W_ARRAY) */
650 
651 	W(0)  = LOAD_BIG_32((void *)(blk +  0));
652 	W(1)  = LOAD_BIG_32((void *)(blk +  4));
653 	W(2)  = LOAD_BIG_32((void *)(blk +  8));
654 	W(3)  = LOAD_BIG_32((void *)(blk + 12));
655 	W(4)  = LOAD_BIG_32((void *)(blk + 16));
656 	W(5)  = LOAD_BIG_32((void *)(blk + 20));
657 	W(6)  = LOAD_BIG_32((void *)(blk + 24));
658 	W(7)  = LOAD_BIG_32((void *)(blk + 28));
659 	W(8)  = LOAD_BIG_32((void *)(blk + 32));
660 	W(9)  = LOAD_BIG_32((void *)(blk + 36));
661 	W(10) = LOAD_BIG_32((void *)(blk + 40));
662 	W(11) = LOAD_BIG_32((void *)(blk + 44));
663 	W(12) = LOAD_BIG_32((void *)(blk + 48));
664 	W(13) = LOAD_BIG_32((void *)(blk + 52));
665 	W(14) = LOAD_BIG_32((void *)(blk + 56));
666 	W(15) = LOAD_BIG_32((void *)(blk + 60));
667 
668 #endif	/* !defined(__sparc) */
669 
670 	/*
671 	 * general optimization:
672 	 *
673 	 * even though this approach is described in the standard as
674 	 * being slower algorithmically, it is 30-40% faster than the
675 	 * "faster" version under SPARC, because this version has more
676 	 * of the constraints specified at compile-time and uses fewer
677 	 * variables (and therefore has better register utilization)
678 	 * than its "speedier" brother.  (i've tried both, trust me)
679 	 *
680 	 * for either method given in the spec, there is an "assignment"
681 	 * phase where the following takes place:
682 	 *
683 	 *	tmp = (main_computation);
684 	 *	e = d; d = c; c = rotate_left(b, 30); b = a; a = tmp;
685 	 *
686 	 * we can make the algorithm go faster by not doing this work,
687 	 * but just pretending that `d' is now `e', etc. this works
688 	 * really well and obviates the need for a temporary variable.
689 	 * however, we still explicitly perform the rotate action,
690 	 * since it is cheaper on SPARC to do it once than to have to
691 	 * do it over and over again.
692 	 */
693 
694 	/* round 1 */
695 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(0) + SHA1_CONST(0); /* 0 */
696 	b = ROTATE_LEFT(b, 30);
697 
698 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(1) + SHA1_CONST(0); /* 1 */
699 	a = ROTATE_LEFT(a, 30);
700 
701 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(2) + SHA1_CONST(0); /* 2 */
702 	e = ROTATE_LEFT(e, 30);
703 
704 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(3) + SHA1_CONST(0); /* 3 */
705 	d = ROTATE_LEFT(d, 30);
706 
707 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(4) + SHA1_CONST(0); /* 4 */
708 	c = ROTATE_LEFT(c, 30);
709 
710 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(5) + SHA1_CONST(0); /* 5 */
711 	b = ROTATE_LEFT(b, 30);
712 
713 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(6) + SHA1_CONST(0); /* 6 */
714 	a = ROTATE_LEFT(a, 30);
715 
716 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(7) + SHA1_CONST(0); /* 7 */
717 	e = ROTATE_LEFT(e, 30);
718 
719 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(8) + SHA1_CONST(0); /* 8 */
720 	d = ROTATE_LEFT(d, 30);
721 
722 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(9) + SHA1_CONST(0); /* 9 */
723 	c = ROTATE_LEFT(c, 30);
724 
725 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(10) + SHA1_CONST(0); /* 10 */
726 	b = ROTATE_LEFT(b, 30);
727 
728 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(11) + SHA1_CONST(0); /* 11 */
729 	a = ROTATE_LEFT(a, 30);
730 
731 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(12) + SHA1_CONST(0); /* 12 */
732 	e = ROTATE_LEFT(e, 30);
733 
734 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(13) + SHA1_CONST(0); /* 13 */
735 	d = ROTATE_LEFT(d, 30);
736 
737 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(14) + SHA1_CONST(0); /* 14 */
738 	c = ROTATE_LEFT(c, 30);
739 
740 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(15) + SHA1_CONST(0); /* 15 */
741 	b = ROTATE_LEFT(b, 30);
742 
743 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 16 */
744 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(0) + SHA1_CONST(0);
745 	a = ROTATE_LEFT(a, 30);
746 
747 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 17 */
748 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(1) + SHA1_CONST(0);
749 	e = ROTATE_LEFT(e, 30);
750 
751 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 18 */
752 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(2) + SHA1_CONST(0);
753 	d = ROTATE_LEFT(d, 30);
754 
755 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 19 */
756 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(3) + SHA1_CONST(0);
757 	c = ROTATE_LEFT(c, 30);
758 
759 	/* round 2 */
760 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 20 */
761 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(4) + SHA1_CONST(1);
762 	b = ROTATE_LEFT(b, 30);
763 
764 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 21 */
765 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(5) + SHA1_CONST(1);
766 	a = ROTATE_LEFT(a, 30);
767 
768 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 22 */
769 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(6) + SHA1_CONST(1);
770 	e = ROTATE_LEFT(e, 30);
771 
772 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 23 */
773 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(7) + SHA1_CONST(1);
774 	d = ROTATE_LEFT(d, 30);
775 
776 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 24 */
777 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(8) + SHA1_CONST(1);
778 	c = ROTATE_LEFT(c, 30);
779 
780 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 25 */
781 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(9) + SHA1_CONST(1);
782 	b = ROTATE_LEFT(b, 30);
783 
784 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 26 */
785 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(10) + SHA1_CONST(1);
786 	a = ROTATE_LEFT(a, 30);
787 
788 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 27 */
789 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(11) + SHA1_CONST(1);
790 	e = ROTATE_LEFT(e, 30);
791 
792 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 28 */
793 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(12) + SHA1_CONST(1);
794 	d = ROTATE_LEFT(d, 30);
795 
796 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 29 */
797 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(13) + SHA1_CONST(1);
798 	c = ROTATE_LEFT(c, 30);
799 
800 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 30 */
801 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(14) + SHA1_CONST(1);
802 	b = ROTATE_LEFT(b, 30);
803 
804 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 31 */
805 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(15) + SHA1_CONST(1);
806 	a = ROTATE_LEFT(a, 30);
807 
808 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 32 */
809 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(0) + SHA1_CONST(1);
810 	e = ROTATE_LEFT(e, 30);
811 
812 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 33 */
813 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(1) + SHA1_CONST(1);
814 	d = ROTATE_LEFT(d, 30);
815 
816 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 34 */
817 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(2) + SHA1_CONST(1);
818 	c = ROTATE_LEFT(c, 30);
819 
820 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 35 */
821 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(3) + SHA1_CONST(1);
822 	b = ROTATE_LEFT(b, 30);
823 
824 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 36 */
825 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(4) + SHA1_CONST(1);
826 	a = ROTATE_LEFT(a, 30);
827 
828 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 37 */
829 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(5) + SHA1_CONST(1);
830 	e = ROTATE_LEFT(e, 30);
831 
832 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 38 */
833 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(6) + SHA1_CONST(1);
834 	d = ROTATE_LEFT(d, 30);
835 
836 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 39 */
837 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(7) + SHA1_CONST(1);
838 	c = ROTATE_LEFT(c, 30);
839 
840 	/* round 3 */
841 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 40 */
842 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(8) + SHA1_CONST(2);
843 	b = ROTATE_LEFT(b, 30);
844 
845 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 41 */
846 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(9) + SHA1_CONST(2);
847 	a = ROTATE_LEFT(a, 30);
848 
849 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 42 */
850 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(10) + SHA1_CONST(2);
851 	e = ROTATE_LEFT(e, 30);
852 
853 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 43 */
854 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(11) + SHA1_CONST(2);
855 	d = ROTATE_LEFT(d, 30);
856 
857 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 44 */
858 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(12) + SHA1_CONST(2);
859 	c = ROTATE_LEFT(c, 30);
860 
861 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 45 */
862 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(13) + SHA1_CONST(2);
863 	b = ROTATE_LEFT(b, 30);
864 
865 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 46 */
866 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(14) + SHA1_CONST(2);
867 	a = ROTATE_LEFT(a, 30);
868 
869 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 47 */
870 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(15) + SHA1_CONST(2);
871 	e = ROTATE_LEFT(e, 30);
872 
873 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 48 */
874 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(0) + SHA1_CONST(2);
875 	d = ROTATE_LEFT(d, 30);
876 
877 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 49 */
878 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(1) + SHA1_CONST(2);
879 	c = ROTATE_LEFT(c, 30);
880 
881 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 50 */
882 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(2) + SHA1_CONST(2);
883 	b = ROTATE_LEFT(b, 30);
884 
885 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 51 */
886 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(3) + SHA1_CONST(2);
887 	a = ROTATE_LEFT(a, 30);
888 
889 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 52 */
890 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(4) + SHA1_CONST(2);
891 	e = ROTATE_LEFT(e, 30);
892 
893 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 53 */
894 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(5) + SHA1_CONST(2);
895 	d = ROTATE_LEFT(d, 30);
896 
897 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 54 */
898 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(6) + SHA1_CONST(2);
899 	c = ROTATE_LEFT(c, 30);
900 
901 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 55 */
902 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(7) + SHA1_CONST(2);
903 	b = ROTATE_LEFT(b, 30);
904 
905 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 56 */
906 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(8) + SHA1_CONST(2);
907 	a = ROTATE_LEFT(a, 30);
908 
909 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 57 */
910 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(9) + SHA1_CONST(2);
911 	e = ROTATE_LEFT(e, 30);
912 
913 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 58 */
914 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(10) + SHA1_CONST(2);
915 	d = ROTATE_LEFT(d, 30);
916 
917 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 59 */
918 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(11) + SHA1_CONST(2);
919 	c = ROTATE_LEFT(c, 30);
920 
921 	/* round 4 */
922 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 60 */
923 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(12) + SHA1_CONST(3);
924 	b = ROTATE_LEFT(b, 30);
925 
926 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 61 */
927 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(13) + SHA1_CONST(3);
928 	a = ROTATE_LEFT(a, 30);
929 
930 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 62 */
931 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(14) + SHA1_CONST(3);
932 	e = ROTATE_LEFT(e, 30);
933 
934 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 63 */
935 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(15) + SHA1_CONST(3);
936 	d = ROTATE_LEFT(d, 30);
937 
938 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 64 */
939 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(0) + SHA1_CONST(3);
940 	c = ROTATE_LEFT(c, 30);
941 
942 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 65 */
943 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(1) + SHA1_CONST(3);
944 	b = ROTATE_LEFT(b, 30);
945 
946 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 66 */
947 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(2) + SHA1_CONST(3);
948 	a = ROTATE_LEFT(a, 30);
949 
950 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 67 */
951 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(3) + SHA1_CONST(3);
952 	e = ROTATE_LEFT(e, 30);
953 
954 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 68 */
955 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(4) + SHA1_CONST(3);
956 	d = ROTATE_LEFT(d, 30);
957 
958 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 69 */
959 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(5) + SHA1_CONST(3);
960 	c = ROTATE_LEFT(c, 30);
961 
962 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 70 */
963 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(6) + SHA1_CONST(3);
964 	b = ROTATE_LEFT(b, 30);
965 
966 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 71 */
967 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(7) + SHA1_CONST(3);
968 	a = ROTATE_LEFT(a, 30);
969 
970 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 72 */
971 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(8) + SHA1_CONST(3);
972 	e = ROTATE_LEFT(e, 30);
973 
974 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 73 */
975 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(9) + SHA1_CONST(3);
976 	d = ROTATE_LEFT(d, 30);
977 
978 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 74 */
979 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(10) + SHA1_CONST(3);
980 	c = ROTATE_LEFT(c, 30);
981 
982 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 75 */
983 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(11) + SHA1_CONST(3);
984 	b = ROTATE_LEFT(b, 30);
985 
986 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 76 */
987 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(12) + SHA1_CONST(3);
988 	a = ROTATE_LEFT(a, 30);
989 
990 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 77 */
991 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(13) + SHA1_CONST(3);
992 	e = ROTATE_LEFT(e, 30);
993 
994 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 78 */
995 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(14) + SHA1_CONST(3);
996 	d = ROTATE_LEFT(d, 30);
997 
998 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 79 */
999 
1000 	ctx->state[0] += ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(15) +
1001 	    SHA1_CONST(3);
1002 	ctx->state[1] += b;
1003 	ctx->state[2] += ROTATE_LEFT(c, 30);
1004 	ctx->state[3] += d;
1005 	ctx->state[4] += e;
1006 
1007 	/* zeroize sensitive information */
1008 	W(0) = W(1) = W(2) = W(3) = W(4) = W(5) = W(6) = W(7) = W(8) = 0;
1009 	W(9) = W(10) = W(11) = W(12) = W(13) = W(14) = W(15) = 0;
1010 }
1011 #endif	/* !__amd64 */
1012 
1013 
1014 /*
1015  * Encode()
1016  *
1017  * purpose: to convert a list of numbers from little endian to big endian
1018  *   input: uint8_t *	: place to store the converted big endian numbers
1019  *	    uint32_t *	: place to get numbers to convert from
1020  *          size_t	: the length of the input in bytes
1021  *  output: void
1022  */
1023 
1024 static void
1025 Encode(uint8_t *_RESTRICT_KYWD output, const uint32_t *_RESTRICT_KYWD input,
1026     size_t len)
1027 {
1028 	size_t		i, j;
1029 
1030 #if	defined(__sparc)
1031 	if (IS_P2ALIGNED(output, sizeof (uint32_t))) {
1032 		for (i = 0, j = 0; j < len; i++, j += 4) {
1033 			/* LINTED E_BAD_PTR_CAST_ALIGN */
1034 			*((uint32_t *)(output + j)) = input[i];
1035 		}
1036 	} else {
1037 #endif	/* little endian -- will work on big endian, but slowly */
1038 		for (i = 0, j = 0; j < len; i++, j += 4) {
1039 			output[j]	= (input[i] >> 24) & 0xff;
1040 			output[j + 1]	= (input[i] >> 16) & 0xff;
1041 			output[j + 2]	= (input[i] >>  8) & 0xff;
1042 			output[j + 3]	= input[i] & 0xff;
1043 		}
1044 #if	defined(__sparc)
1045 	}
1046 #endif
1047 }
1048