xref: /illumos-gate/usr/src/common/crypto/skein/skein.c (revision 9d1587b49e4692b8d6652e6c0b113a53b1af5313)
1 /*
2  * Implementation of the Skein hash function.
3  * Source code author: Doug Whiting, 2008.
4  * This algorithm and source code is released to the public domain.
5  */
6 /* Copyright 2013 Doug Whiting. This code is released to the public domain. */
7 
8 #define	SKEIN_PORT_CODE		/* instantiate any code in skein_port.h */
9 
10 #include <sys/types.h>
11 #include <sys/note.h>
12 #include <sys/skein.h>		/* get the Skein API definitions   */
13 #include "skein_impl.h"		/* get internal definitions */
14 
15 /* External function to process blkCnt (nonzero) full block(s) of data. */
16 void Skein_256_Process_Block(Skein_256_Ctxt_t *ctx, const uint8_t *blkPtr,
17     size_t blkCnt, size_t byteCntAdd);
18 void Skein_512_Process_Block(Skein_512_Ctxt_t *ctx, const uint8_t *blkPtr,
19     size_t blkCnt, size_t byteCntAdd);
20 void Skein1024_Process_Block(Skein1024_Ctxt_t *ctx, const uint8_t *blkPtr,
21     size_t blkCnt, size_t byteCntAdd);
22 
23 /* 256-bit Skein */
24 /* init the context for a straight hashing operation  */
25 int
26 Skein_256_Init(Skein_256_Ctxt_t *ctx, size_t hashBitLen)
27 {
28 	union {
29 		uint8_t b[SKEIN_256_STATE_BYTES];
30 		uint64_t w[SKEIN_256_STATE_WORDS];
31 	} cfg;			/* config block */
32 
33 	Skein_Assert(hashBitLen > 0, SKEIN_BAD_HASHLEN);
34 	ctx->h.hashBitLen = hashBitLen;	/* output hash bit count */
35 
36 	switch (hashBitLen) {	/* use pre-computed values, where available */
37 #ifndef	SKEIN_NO_PRECOMP
38 	case 256:
39 		bcopy(SKEIN_256_IV_256, ctx->X, sizeof (ctx->X));
40 		break;
41 	case 224:
42 		bcopy(SKEIN_256_IV_224, ctx->X, sizeof (ctx->X));
43 		break;
44 	case 160:
45 		bcopy(SKEIN_256_IV_160, ctx->X, sizeof (ctx->X));
46 		break;
47 	case 128:
48 		bcopy(SKEIN_256_IV_128, ctx->X, sizeof (ctx->X));
49 		break;
50 #endif
51 	default:
52 		/* here if there is no precomputed IV value available */
53 		/*
54 		 * build/process the config block, type == CONFIG (could be
55 		 * precomputed)
56 		 */
57 		/* set tweaks: T0=0; T1=CFG | FINAL */
58 		Skein_Start_New_Type(ctx, CFG_FINAL);
59 
60 		/* set the schema, version */
61 		cfg.w[0] = Skein_Swap64(SKEIN_SCHEMA_VER);
62 		/* hash result length in bits */
63 		cfg.w[1] = Skein_Swap64(hashBitLen);
64 		cfg.w[2] = Skein_Swap64(SKEIN_CFG_TREE_INFO_SEQUENTIAL);
65 		/* zero pad config block */
66 		bzero(&cfg.w[3], sizeof (cfg) - 3 * sizeof (cfg.w[0]));
67 
68 		/* compute the initial chaining values from config block */
69 		/* zero the chaining variables */
70 		bzero(ctx->X, sizeof (ctx->X));
71 		Skein_256_Process_Block(ctx, cfg.b, 1, SKEIN_CFG_STR_LEN);
72 		break;
73 	}
74 	/*
75 	 * The chaining vars ctx->X are now initialized for the given
76 	 * hashBitLen.
77 	 * Set up to process the data message portion of the hash (default)
78 	 */
79 	Skein_Start_New_Type(ctx, MSG);	/* T0=0, T1= MSG type */
80 
81 	return (SKEIN_SUCCESS);
82 }
83 
84 /* init the context for a MAC and/or tree hash operation */
85 /*
86  * [identical to Skein_256_Init() when keyBytes == 0 &&
87  * treeInfo == SKEIN_CFG_TREE_INFO_SEQUENTIAL]
88  */
89 int
90 Skein_256_InitExt(Skein_256_Ctxt_t *ctx, size_t hashBitLen, uint64_t treeInfo,
91     const uint8_t *key, size_t keyBytes)
92 {
93 	union {
94 		uint8_t b[SKEIN_256_STATE_BYTES];
95 		uint64_t w[SKEIN_256_STATE_WORDS];
96 	} cfg;			/* config block */
97 
98 	Skein_Assert(hashBitLen > 0, SKEIN_BAD_HASHLEN);
99 	Skein_Assert(keyBytes == 0 || key != NULL, SKEIN_FAIL);
100 
101 	/* compute the initial chaining values ctx->X[], based on key */
102 	if (keyBytes == 0) {	/* is there a key? */
103 		/* no key: use all zeroes as key for config block */
104 		bzero(ctx->X, sizeof (ctx->X));
105 	} else {		/* here to pre-process a key */
106 
107 		Skein_assert(sizeof (cfg.b) >= sizeof (ctx->X));
108 		/* do a mini-Init right here */
109 		/* set output hash bit count = state size */
110 		ctx->h.hashBitLen = 8 * sizeof (ctx->X);
111 		/* set tweaks: T0 = 0; T1 = KEY type */
112 		Skein_Start_New_Type(ctx, KEY);
113 		/* zero the initial chaining variables */
114 		bzero(ctx->X, sizeof (ctx->X));
115 		/* hash the key */
116 		(void) Skein_256_Update(ctx, key, keyBytes);
117 		/* put result into cfg.b[] */
118 		(void) Skein_256_Final_Pad(ctx, cfg.b);
119 		/* copy over into ctx->X[] */
120 		bcopy(cfg.b, ctx->X, sizeof (cfg.b));
121 #if	SKEIN_NEED_SWAP
122 		{
123 			uint_t i;
124 			/* convert key bytes to context words */
125 			for (i = 0; i < SKEIN_256_STATE_WORDS; i++)
126 				ctx->X[i] = Skein_Swap64(ctx->X[i]);
127 		}
128 #endif
129 	}
130 	/*
131 	 * build/process the config block, type == CONFIG (could be
132 	 * precomputed for each key)
133 	 */
134 	ctx->h.hashBitLen = hashBitLen;	/* output hash bit count */
135 	Skein_Start_New_Type(ctx, CFG_FINAL);
136 
137 	bzero(&cfg.w, sizeof (cfg.w));	/* pre-pad cfg.w[] with zeroes */
138 	cfg.w[0] = Skein_Swap64(SKEIN_SCHEMA_VER);
139 	cfg.w[1] = Skein_Swap64(hashBitLen);	/* hash result length in bits */
140 	/* tree hash config info (or SKEIN_CFG_TREE_INFO_SEQUENTIAL) */
141 	cfg.w[2] = Skein_Swap64(treeInfo);
142 
143 	Skein_Show_Key(256, &ctx->h, key, keyBytes);
144 
145 	/* compute the initial chaining values from config block */
146 	Skein_256_Process_Block(ctx, cfg.b, 1, SKEIN_CFG_STR_LEN);
147 
148 	/* The chaining vars ctx->X are now initialized */
149 	/* Set up to process the data message portion of the hash (default) */
150 	ctx->h.bCnt = 0;	/* buffer b[] starts out empty */
151 	Skein_Start_New_Type(ctx, MSG);
152 
153 	return (SKEIN_SUCCESS);
154 }
155 
156 /* process the input bytes */
157 int
158 Skein_256_Update(Skein_256_Ctxt_t *ctx, const uint8_t *msg, size_t msgByteCnt)
159 {
160 	size_t n;
161 
162 	/* catch uninitialized context */
163 	Skein_Assert(ctx->h.bCnt <= SKEIN_256_BLOCK_BYTES, SKEIN_FAIL);
164 
165 	/* process full blocks, if any */
166 	if (msgByteCnt + ctx->h.bCnt > SKEIN_256_BLOCK_BYTES) {
167 		/* finish up any buffered message data */
168 		if (ctx->h.bCnt) {
169 			/* # bytes free in buffer b[] */
170 			n = SKEIN_256_BLOCK_BYTES - ctx->h.bCnt;
171 			if (n) {
172 				/* check on our logic here */
173 				Skein_assert(n < msgByteCnt);
174 				bcopy(msg, &ctx->b[ctx->h.bCnt], n);
175 				msgByteCnt -= n;
176 				msg += n;
177 				ctx->h.bCnt += n;
178 			}
179 			Skein_assert(ctx->h.bCnt == SKEIN_256_BLOCK_BYTES);
180 			Skein_256_Process_Block(ctx, ctx->b, 1,
181 			    SKEIN_256_BLOCK_BYTES);
182 			ctx->h.bCnt = 0;
183 		}
184 		/*
185 		 * now process any remaining full blocks, directly from input
186 		 * message data
187 		 */
188 		if (msgByteCnt > SKEIN_256_BLOCK_BYTES) {
189 			/* number of full blocks to process */
190 			n = (msgByteCnt - 1) / SKEIN_256_BLOCK_BYTES;
191 			Skein_256_Process_Block(ctx, msg, n,
192 			    SKEIN_256_BLOCK_BYTES);
193 			msgByteCnt -= n * SKEIN_256_BLOCK_BYTES;
194 			msg += n * SKEIN_256_BLOCK_BYTES;
195 		}
196 		Skein_assert(ctx->h.bCnt == 0);
197 	}
198 
199 	/* copy any remaining source message data bytes into b[] */
200 	if (msgByteCnt) {
201 		Skein_assert(msgByteCnt + ctx->h.bCnt <= SKEIN_256_BLOCK_BYTES);
202 		bcopy(msg, &ctx->b[ctx->h.bCnt], msgByteCnt);
203 		ctx->h.bCnt += msgByteCnt;
204 	}
205 
206 	return (SKEIN_SUCCESS);
207 }
208 
209 /* finalize the hash computation and output the result */
210 int
211 Skein_256_Final(Skein_256_Ctxt_t *ctx, uint8_t *hashVal)
212 {
213 	size_t i, n, byteCnt;
214 	uint64_t X[SKEIN_256_STATE_WORDS];
215 
216 	/* catch uninitialized context */
217 	Skein_Assert(ctx->h.bCnt <= SKEIN_256_BLOCK_BYTES, SKEIN_FAIL);
218 
219 	ctx->h.T[1] |= SKEIN_T1_FLAG_FINAL;	/* tag as the final block */
220 	/* zero pad b[] if necessary */
221 	if (ctx->h.bCnt < SKEIN_256_BLOCK_BYTES)
222 		bzero(&ctx->b[ctx->h.bCnt],
223 		    SKEIN_256_BLOCK_BYTES - ctx->h.bCnt);
224 
225 	/* process the final block */
226 	Skein_256_Process_Block(ctx, ctx->b, 1, ctx->h.bCnt);
227 
228 	/* now output the result */
229 	/* total number of output bytes */
230 	byteCnt = (ctx->h.hashBitLen + 7) >> 3;
231 
232 	/* run Threefish in "counter mode" to generate output */
233 	/* zero out b[], so it can hold the counter */
234 	bzero(ctx->b, sizeof (ctx->b));
235 	/* keep a local copy of counter mode "key" */
236 	bcopy(ctx->X, X, sizeof (X));
237 	for (i = 0; i * SKEIN_256_BLOCK_BYTES < byteCnt; i++) {
238 		/* build the counter block */
239 		uint64_t tmp = Skein_Swap64((uint64_t)i);
240 		bcopy(&tmp, ctx->b, sizeof (tmp));
241 		Skein_Start_New_Type(ctx, OUT_FINAL);
242 		/* run "counter mode" */
243 		Skein_256_Process_Block(ctx, ctx->b, 1, sizeof (uint64_t));
244 		/* number of output bytes left to go */
245 		n = byteCnt - i * SKEIN_256_BLOCK_BYTES;
246 		if (n >= SKEIN_256_BLOCK_BYTES)
247 			n = SKEIN_256_BLOCK_BYTES;
248 		Skein_Put64_LSB_First(hashVal + i * SKEIN_256_BLOCK_BYTES,
249 		    ctx->X, n);	/* "output" the ctr mode bytes */
250 		Skein_Show_Final(256, &ctx->h, n,
251 		    hashVal + i * SKEIN_256_BLOCK_BYTES);
252 		/* restore the counter mode key for next time */
253 		bcopy(X, ctx->X, sizeof (X));
254 	}
255 	return (SKEIN_SUCCESS);
256 }
257 
258 /* 512-bit Skein */
259 
260 /* init the context for a straight hashing operation  */
261 int
262 Skein_512_Init(Skein_512_Ctxt_t *ctx, size_t hashBitLen)
263 {
264 	union {
265 		uint8_t b[SKEIN_512_STATE_BYTES];
266 		uint64_t w[SKEIN_512_STATE_WORDS];
267 	} cfg;			/* config block */
268 
269 	Skein_Assert(hashBitLen > 0, SKEIN_BAD_HASHLEN);
270 	ctx->h.hashBitLen = hashBitLen;	/* output hash bit count */
271 
272 	switch (hashBitLen) {	/* use pre-computed values, where available */
273 #ifndef	SKEIN_NO_PRECOMP
274 	case 512:
275 		bcopy(SKEIN_512_IV_512, ctx->X, sizeof (ctx->X));
276 		break;
277 	case 384:
278 		bcopy(SKEIN_512_IV_384, ctx->X, sizeof (ctx->X));
279 		break;
280 	case 256:
281 		bcopy(SKEIN_512_IV_256, ctx->X, sizeof (ctx->X));
282 		break;
283 	case 224:
284 		bcopy(SKEIN_512_IV_224, ctx->X, sizeof (ctx->X));
285 		break;
286 #endif
287 	default:
288 		/*
289 		 * here if there is no precomputed IV value available
290 		 * build/process the config block, type == CONFIG (could be
291 		 * precomputed)
292 		 */
293 		/* set tweaks: T0=0; T1=CFG | FINAL */
294 		Skein_Start_New_Type(ctx, CFG_FINAL);
295 
296 		/* set the schema, version */
297 		cfg.w[0] = Skein_Swap64(SKEIN_SCHEMA_VER);
298 		/* hash result length in bits */
299 		cfg.w[1] = Skein_Swap64(hashBitLen);
300 		cfg.w[2] = Skein_Swap64(SKEIN_CFG_TREE_INFO_SEQUENTIAL);
301 		/* zero pad config block */
302 		bzero(&cfg.w[3], sizeof (cfg) - 3 * sizeof (cfg.w[0]));
303 
304 		/* compute the initial chaining values from config block */
305 		/* zero the chaining variables */
306 		bzero(ctx->X, sizeof (ctx->X));
307 		Skein_512_Process_Block(ctx, cfg.b, 1, SKEIN_CFG_STR_LEN);
308 		break;
309 	}
310 
311 	/*
312 	 * The chaining vars ctx->X are now initialized for the given
313 	 * hashBitLen. Set up to process the data message portion of the
314 	 * hash (default)
315 	 */
316 	Skein_Start_New_Type(ctx, MSG);	/* T0=0, T1= MSG type */
317 
318 	return (SKEIN_SUCCESS);
319 }
320 
321 /* init the context for a MAC and/or tree hash operation */
322 /*
323  * [identical to Skein_512_Init() when keyBytes == 0 &&
324  * treeInfo == SKEIN_CFG_TREE_INFO_SEQUENTIAL]
325  */
326 int
327 Skein_512_InitExt(Skein_512_Ctxt_t *ctx, size_t hashBitLen, uint64_t treeInfo,
328     const uint8_t *key, size_t keyBytes)
329 {
330 	union {
331 		uint8_t b[SKEIN_512_STATE_BYTES];
332 		uint64_t w[SKEIN_512_STATE_WORDS];
333 	} cfg;			/* config block */
334 
335 	Skein_Assert(hashBitLen > 0, SKEIN_BAD_HASHLEN);
336 	Skein_Assert(keyBytes == 0 || key != NULL, SKEIN_FAIL);
337 
338 	/* compute the initial chaining values ctx->X[], based on key */
339 	if (keyBytes == 0) {	/* is there a key? */
340 		/* no key: use all zeroes as key for config block */
341 		bzero(ctx->X, sizeof (ctx->X));
342 	} else {		/* here to pre-process a key */
343 
344 		Skein_assert(sizeof (cfg.b) >= sizeof (ctx->X));
345 		/* do a mini-Init right here */
346 		/* set output hash bit count = state size */
347 		ctx->h.hashBitLen = 8 * sizeof (ctx->X);
348 		/* set tweaks: T0 = 0; T1 = KEY type */
349 		Skein_Start_New_Type(ctx, KEY);
350 		/* zero the initial chaining variables */
351 		bzero(ctx->X, sizeof (ctx->X));
352 		(void) Skein_512_Update(ctx, key, keyBytes); /* hash the key */
353 		/* put result into cfg.b[] */
354 		(void) Skein_512_Final_Pad(ctx, cfg.b);
355 		/* copy over into ctx->X[] */
356 		bcopy(cfg.b, ctx->X, sizeof (cfg.b));
357 #if	SKEIN_NEED_SWAP
358 		{
359 			uint_t i;
360 			/* convert key bytes to context words */
361 			for (i = 0; i < SKEIN_512_STATE_WORDS; i++)
362 				ctx->X[i] = Skein_Swap64(ctx->X[i]);
363 		}
364 #endif
365 	}
366 	/*
367 	 * build/process the config block, type == CONFIG (could be
368 	 * precomputed for each key)
369 	 */
370 	ctx->h.hashBitLen = hashBitLen;	/* output hash bit count */
371 	Skein_Start_New_Type(ctx, CFG_FINAL);
372 
373 	bzero(&cfg.w, sizeof (cfg.w));	/* pre-pad cfg.w[] with zeroes */
374 	cfg.w[0] = Skein_Swap64(SKEIN_SCHEMA_VER);
375 	cfg.w[1] = Skein_Swap64(hashBitLen);	/* hash result length in bits */
376 	/* tree hash config info (or SKEIN_CFG_TREE_INFO_SEQUENTIAL) */
377 	cfg.w[2] = Skein_Swap64(treeInfo);
378 
379 	Skein_Show_Key(512, &ctx->h, key, keyBytes);
380 
381 	/* compute the initial chaining values from config block */
382 	Skein_512_Process_Block(ctx, cfg.b, 1, SKEIN_CFG_STR_LEN);
383 
384 	/* The chaining vars ctx->X are now initialized */
385 	/* Set up to process the data message portion of the hash (default) */
386 	ctx->h.bCnt = 0;	/* buffer b[] starts out empty */
387 	Skein_Start_New_Type(ctx, MSG);
388 
389 	return (SKEIN_SUCCESS);
390 }
391 
392 /* process the input bytes */
393 int
394 Skein_512_Update(Skein_512_Ctxt_t *ctx, const uint8_t *msg, size_t msgByteCnt)
395 {
396 	size_t n;
397 
398 	/* catch uninitialized context */
399 	Skein_Assert(ctx->h.bCnt <= SKEIN_512_BLOCK_BYTES, SKEIN_FAIL);
400 
401 	/* process full blocks, if any */
402 	if (msgByteCnt + ctx->h.bCnt > SKEIN_512_BLOCK_BYTES) {
403 		/* finish up any buffered message data */
404 		if (ctx->h.bCnt) {
405 			/* # bytes free in buffer b[] */
406 			n = SKEIN_512_BLOCK_BYTES - ctx->h.bCnt;
407 			if (n) {
408 				/* check on our logic here */
409 				Skein_assert(n < msgByteCnt);
410 				bcopy(msg, &ctx->b[ctx->h.bCnt], n);
411 				msgByteCnt -= n;
412 				msg += n;
413 				ctx->h.bCnt += n;
414 			}
415 			Skein_assert(ctx->h.bCnt == SKEIN_512_BLOCK_BYTES);
416 			Skein_512_Process_Block(ctx, ctx->b, 1,
417 			    SKEIN_512_BLOCK_BYTES);
418 			ctx->h.bCnt = 0;
419 		}
420 		/*
421 		 * now process any remaining full blocks, directly from input
422 		 * message data
423 		 */
424 		if (msgByteCnt > SKEIN_512_BLOCK_BYTES) {
425 			/* number of full blocks to process */
426 			n = (msgByteCnt - 1) / SKEIN_512_BLOCK_BYTES;
427 			Skein_512_Process_Block(ctx, msg, n,
428 			    SKEIN_512_BLOCK_BYTES);
429 			msgByteCnt -= n * SKEIN_512_BLOCK_BYTES;
430 			msg += n * SKEIN_512_BLOCK_BYTES;
431 		}
432 		Skein_assert(ctx->h.bCnt == 0);
433 	}
434 
435 	/* copy any remaining source message data bytes into b[] */
436 	if (msgByteCnt) {
437 		Skein_assert(msgByteCnt + ctx->h.bCnt <= SKEIN_512_BLOCK_BYTES);
438 		bcopy(msg, &ctx->b[ctx->h.bCnt], msgByteCnt);
439 		ctx->h.bCnt += msgByteCnt;
440 	}
441 
442 	return (SKEIN_SUCCESS);
443 }
444 
445 /* finalize the hash computation and output the result */
446 int
447 Skein_512_Final(Skein_512_Ctxt_t *ctx, uint8_t *hashVal)
448 {
449 	size_t i, n, byteCnt;
450 	uint64_t X[SKEIN_512_STATE_WORDS];
451 
452 	/* catch uninitialized context */
453 	Skein_Assert(ctx->h.bCnt <= SKEIN_512_BLOCK_BYTES, SKEIN_FAIL);
454 
455 	ctx->h.T[1] |= SKEIN_T1_FLAG_FINAL;	/* tag as the final block */
456 	/* zero pad b[] if necessary */
457 	if (ctx->h.bCnt < SKEIN_512_BLOCK_BYTES)
458 		bzero(&ctx->b[ctx->h.bCnt],
459 		    SKEIN_512_BLOCK_BYTES - ctx->h.bCnt);
460 
461 	/* process the final block */
462 	Skein_512_Process_Block(ctx, ctx->b, 1, ctx->h.bCnt);
463 
464 	/* now output the result */
465 	/* total number of output bytes */
466 	byteCnt = (ctx->h.hashBitLen + 7) >> 3;
467 
468 	/* run Threefish in "counter mode" to generate output */
469 	/* zero out b[], so it can hold the counter */
470 	bzero(ctx->b, sizeof (ctx->b));
471 	/* keep a local copy of counter mode "key" */
472 	bcopy(ctx->X, X, sizeof (X));
473 	for (i = 0; i * SKEIN_512_BLOCK_BYTES < byteCnt; i++) {
474 		/* build the counter block */
475 		uint64_t tmp = Skein_Swap64((uint64_t)i);
476 		bcopy(&tmp, ctx->b, sizeof (tmp));
477 		Skein_Start_New_Type(ctx, OUT_FINAL);
478 		/* run "counter mode" */
479 		Skein_512_Process_Block(ctx, ctx->b, 1, sizeof (uint64_t));
480 		/* number of output bytes left to go */
481 		n = byteCnt - i * SKEIN_512_BLOCK_BYTES;
482 		if (n >= SKEIN_512_BLOCK_BYTES)
483 			n = SKEIN_512_BLOCK_BYTES;
484 		Skein_Put64_LSB_First(hashVal + i * SKEIN_512_BLOCK_BYTES,
485 		    ctx->X, n);	/* "output" the ctr mode bytes */
486 		Skein_Show_Final(512, &ctx->h, n,
487 		    hashVal + i * SKEIN_512_BLOCK_BYTES);
488 		/* restore the counter mode key for next time */
489 		bcopy(X, ctx->X, sizeof (X));
490 	}
491 	return (SKEIN_SUCCESS);
492 }
493 
494 /* 1024-bit Skein */
495 
496 /* init the context for a straight hashing operation  */
497 int
498 Skein1024_Init(Skein1024_Ctxt_t *ctx, size_t hashBitLen)
499 {
500 	union {
501 		uint8_t b[SKEIN1024_STATE_BYTES];
502 		uint64_t w[SKEIN1024_STATE_WORDS];
503 	} cfg;			/* config block */
504 
505 	Skein_Assert(hashBitLen > 0, SKEIN_BAD_HASHLEN);
506 	ctx->h.hashBitLen = hashBitLen;	/* output hash bit count */
507 
508 	switch (hashBitLen) {	/* use pre-computed values, where available */
509 #ifndef	SKEIN_NO_PRECOMP
510 	case 512:
511 		bcopy(SKEIN1024_IV_512, ctx->X, sizeof (ctx->X));
512 		break;
513 	case 384:
514 		bcopy(SKEIN1024_IV_384, ctx->X, sizeof (ctx->X));
515 		break;
516 	case 1024:
517 		bcopy(SKEIN1024_IV_1024, ctx->X, sizeof (ctx->X));
518 		break;
519 #endif
520 	default:
521 		/* here if there is no precomputed IV value available */
522 		/*
523 		 * build/process the config block, type == CONFIG (could be
524 		 * precomputed)
525 		 */
526 		/* set tweaks: T0=0; T1=CFG | FINAL */
527 		Skein_Start_New_Type(ctx, CFG_FINAL);
528 
529 		/* set the schema, version */
530 		cfg.w[0] = Skein_Swap64(SKEIN_SCHEMA_VER);
531 		/* hash result length in bits */
532 		cfg.w[1] = Skein_Swap64(hashBitLen);
533 		cfg.w[2] = Skein_Swap64(SKEIN_CFG_TREE_INFO_SEQUENTIAL);
534 		/* zero pad config block */
535 		bzero(&cfg.w[3], sizeof (cfg) - 3 * sizeof (cfg.w[0]));
536 
537 		/* compute the initial chaining values from config block */
538 		/* zero the chaining variables */
539 		bzero(ctx->X, sizeof (ctx->X));
540 		Skein1024_Process_Block(ctx, cfg.b, 1, SKEIN_CFG_STR_LEN);
541 		break;
542 	}
543 
544 	/*
545 	 * The chaining vars ctx->X are now initialized for the given
546 	 * hashBitLen. Set up to process the data message portion of the hash
547 	 * (default)
548 	 */
549 	Skein_Start_New_Type(ctx, MSG);	/* T0=0, T1= MSG type */
550 
551 	return (SKEIN_SUCCESS);
552 }
553 
554 /* init the context for a MAC and/or tree hash operation */
555 /*
556  * [identical to Skein1024_Init() when keyBytes == 0 &&
557  * treeInfo == SKEIN_CFG_TREE_INFO_SEQUENTIAL]
558  */
559 int
560 Skein1024_InitExt(Skein1024_Ctxt_t *ctx, size_t hashBitLen, uint64_t treeInfo,
561     const uint8_t *key, size_t keyBytes)
562 {
563 	union {
564 		uint8_t b[SKEIN1024_STATE_BYTES];
565 		uint64_t w[SKEIN1024_STATE_WORDS];
566 	} cfg;			/* config block */
567 
568 	Skein_Assert(hashBitLen > 0, SKEIN_BAD_HASHLEN);
569 	Skein_Assert(keyBytes == 0 || key != NULL, SKEIN_FAIL);
570 
571 	/* compute the initial chaining values ctx->X[], based on key */
572 	if (keyBytes == 0) {	/* is there a key? */
573 		/* no key: use all zeroes as key for config block */
574 		bzero(ctx->X, sizeof (ctx->X));
575 	} else {		/* here to pre-process a key */
576 		Skein_assert(sizeof (cfg.b) >= sizeof (ctx->X));
577 		/* do a mini-Init right here */
578 		/* set output hash bit count = state size */
579 		ctx->h.hashBitLen = 8 * sizeof (ctx->X);
580 		/* set tweaks: T0 = 0; T1 = KEY type */
581 		Skein_Start_New_Type(ctx, KEY);
582 		/* zero the initial chaining variables */
583 		bzero(ctx->X, sizeof (ctx->X));
584 		(void) Skein1024_Update(ctx, key, keyBytes); /* hash the key */
585 		/* put result into cfg.b[] */
586 		(void) Skein1024_Final_Pad(ctx, cfg.b);
587 		/* copy over into ctx->X[] */
588 		bcopy(cfg.b, ctx->X, sizeof (cfg.b));
589 #if	SKEIN_NEED_SWAP
590 		{
591 			uint_t i;
592 			/* convert key bytes to context words */
593 			for (i = 0; i < SKEIN1024_STATE_WORDS; i++)
594 				ctx->X[i] = Skein_Swap64(ctx->X[i]);
595 		}
596 #endif
597 	}
598 	/*
599 	 * build/process the config block, type == CONFIG (could be
600 	 * precomputed for each key)
601 	 */
602 	ctx->h.hashBitLen = hashBitLen;	/* output hash bit count */
603 	Skein_Start_New_Type(ctx, CFG_FINAL);
604 
605 	bzero(&cfg.w, sizeof (cfg.w));	/* pre-pad cfg.w[] with zeroes */
606 	cfg.w[0] = Skein_Swap64(SKEIN_SCHEMA_VER);
607 	/* hash result length in bits */
608 	cfg.w[1] = Skein_Swap64(hashBitLen);
609 	/* tree hash config info (or SKEIN_CFG_TREE_INFO_SEQUENTIAL) */
610 	cfg.w[2] = Skein_Swap64(treeInfo);
611 
612 	Skein_Show_Key(1024, &ctx->h, key, keyBytes);
613 
614 	/* compute the initial chaining values from config block */
615 	Skein1024_Process_Block(ctx, cfg.b, 1, SKEIN_CFG_STR_LEN);
616 
617 	/* The chaining vars ctx->X are now initialized */
618 	/* Set up to process the data message portion of the hash (default) */
619 	ctx->h.bCnt = 0;	/* buffer b[] starts out empty */
620 	Skein_Start_New_Type(ctx, MSG);
621 
622 	return (SKEIN_SUCCESS);
623 }
624 
625 /* process the input bytes */
626 int
627 Skein1024_Update(Skein1024_Ctxt_t *ctx, const uint8_t *msg, size_t msgByteCnt)
628 {
629 	size_t n;
630 
631 	/* catch uninitialized context */
632 	Skein_Assert(ctx->h.bCnt <= SKEIN1024_BLOCK_BYTES, SKEIN_FAIL);
633 
634 	/* process full blocks, if any */
635 	if (msgByteCnt + ctx->h.bCnt > SKEIN1024_BLOCK_BYTES) {
636 		/* finish up any buffered message data */
637 		if (ctx->h.bCnt) {
638 			/* # bytes free in buffer b[] */
639 			n = SKEIN1024_BLOCK_BYTES - ctx->h.bCnt;
640 			if (n) {
641 				/* check on our logic here */
642 				Skein_assert(n < msgByteCnt);
643 				bcopy(msg, &ctx->b[ctx->h.bCnt], n);
644 				msgByteCnt -= n;
645 				msg += n;
646 				ctx->h.bCnt += n;
647 			}
648 			Skein_assert(ctx->h.bCnt == SKEIN1024_BLOCK_BYTES);
649 			Skein1024_Process_Block(ctx, ctx->b, 1,
650 			    SKEIN1024_BLOCK_BYTES);
651 			ctx->h.bCnt = 0;
652 		}
653 		/*
654 		 * now process any remaining full blocks, directly from
655 		 * input message data
656 		 */
657 		if (msgByteCnt > SKEIN1024_BLOCK_BYTES) {
658 			/* number of full blocks to process */
659 			n = (msgByteCnt - 1) / SKEIN1024_BLOCK_BYTES;
660 			Skein1024_Process_Block(ctx, msg, n,
661 			    SKEIN1024_BLOCK_BYTES);
662 			msgByteCnt -= n * SKEIN1024_BLOCK_BYTES;
663 			msg += n * SKEIN1024_BLOCK_BYTES;
664 		}
665 		Skein_assert(ctx->h.bCnt == 0);
666 	}
667 
668 	/* copy any remaining source message data bytes into b[] */
669 	if (msgByteCnt) {
670 		Skein_assert(msgByteCnt + ctx->h.bCnt <= SKEIN1024_BLOCK_BYTES);
671 		bcopy(msg, &ctx->b[ctx->h.bCnt], msgByteCnt);
672 		ctx->h.bCnt += msgByteCnt;
673 	}
674 
675 	return (SKEIN_SUCCESS);
676 }
677 
678 /* finalize the hash computation and output the result */
679 int
680 Skein1024_Final(Skein1024_Ctxt_t *ctx, uint8_t *hashVal)
681 {
682 	size_t i, n, byteCnt;
683 	uint64_t X[SKEIN1024_STATE_WORDS];
684 
685 	/* catch uninitialized context */
686 	Skein_Assert(ctx->h.bCnt <= SKEIN1024_BLOCK_BYTES, SKEIN_FAIL);
687 
688 	ctx->h.T[1] |= SKEIN_T1_FLAG_FINAL;	/* tag as the final block */
689 	/* zero pad b[] if necessary */
690 	if (ctx->h.bCnt < SKEIN1024_BLOCK_BYTES)
691 		bzero(&ctx->b[ctx->h.bCnt],
692 		    SKEIN1024_BLOCK_BYTES - ctx->h.bCnt);
693 
694 	/* process the final block */
695 	Skein1024_Process_Block(ctx, ctx->b, 1, ctx->h.bCnt);
696 
697 	/* now output the result */
698 	/* total number of output bytes */
699 	byteCnt = (ctx->h.hashBitLen + 7) >> 3;
700 
701 	/* run Threefish in "counter mode" to generate output */
702 	/* zero out b[], so it can hold the counter */
703 	bzero(ctx->b, sizeof (ctx->b));
704 	/* keep a local copy of counter mode "key" */
705 	bcopy(ctx->X, X, sizeof (X));
706 	for (i = 0; i * SKEIN1024_BLOCK_BYTES < byteCnt; i++) {
707 		/* build the counter block */
708 		uint64_t tmp = Skein_Swap64((uint64_t)i);
709 		bcopy(&tmp, ctx->b, sizeof (tmp));
710 		Skein_Start_New_Type(ctx, OUT_FINAL);
711 		/* run "counter mode" */
712 		Skein1024_Process_Block(ctx, ctx->b, 1, sizeof (uint64_t));
713 		/* number of output bytes left to go */
714 		n = byteCnt - i * SKEIN1024_BLOCK_BYTES;
715 		if (n >= SKEIN1024_BLOCK_BYTES)
716 			n = SKEIN1024_BLOCK_BYTES;
717 		Skein_Put64_LSB_First(hashVal + i * SKEIN1024_BLOCK_BYTES,
718 		    ctx->X, n);	/* "output" the ctr mode bytes */
719 		Skein_Show_Final(1024, &ctx->h, n,
720 		    hashVal + i * SKEIN1024_BLOCK_BYTES);
721 		/* restore the counter mode key for next time */
722 		bcopy(X, ctx->X, sizeof (X));
723 	}
724 	return (SKEIN_SUCCESS);
725 }
726 
727 /* Functions to support MAC/tree hashing */
728 /* (this code is identical for Optimized and Reference versions) */
729 
730 /* finalize the hash computation and output the block, no OUTPUT stage */
731 int
732 Skein_256_Final_Pad(Skein_256_Ctxt_t *ctx, uint8_t *hashVal)
733 {
734 	/* catch uninitialized context */
735 	Skein_Assert(ctx->h.bCnt <= SKEIN_256_BLOCK_BYTES, SKEIN_FAIL);
736 
737 	ctx->h.T[1] |= SKEIN_T1_FLAG_FINAL;	/* tag as the final block */
738 	/* zero pad b[] if necessary */
739 	if (ctx->h.bCnt < SKEIN_256_BLOCK_BYTES)
740 		bzero(&ctx->b[ctx->h.bCnt],
741 		    SKEIN_256_BLOCK_BYTES - ctx->h.bCnt);
742 	/* process the final block */
743 	Skein_256_Process_Block(ctx, ctx->b, 1, ctx->h.bCnt);
744 
745 	/* "output" the state bytes */
746 	Skein_Put64_LSB_First(hashVal, ctx->X, SKEIN_256_BLOCK_BYTES);
747 
748 	return (SKEIN_SUCCESS);
749 }
750 
751 /* finalize the hash computation and output the block, no OUTPUT stage */
752 int
753 Skein_512_Final_Pad(Skein_512_Ctxt_t *ctx, uint8_t *hashVal)
754 {
755 	/* catch uninitialized context */
756 	Skein_Assert(ctx->h.bCnt <= SKEIN_512_BLOCK_BYTES, SKEIN_FAIL);
757 
758 	ctx->h.T[1] |= SKEIN_T1_FLAG_FINAL;	/* tag as the final block */
759 	/* zero pad b[] if necessary */
760 	if (ctx->h.bCnt < SKEIN_512_BLOCK_BYTES)
761 		bzero(&ctx->b[ctx->h.bCnt],
762 		    SKEIN_512_BLOCK_BYTES - ctx->h.bCnt);
763 	/* process the final block */
764 	Skein_512_Process_Block(ctx, ctx->b, 1, ctx->h.bCnt);
765 
766 	/* "output" the state bytes */
767 	Skein_Put64_LSB_First(hashVal, ctx->X, SKEIN_512_BLOCK_BYTES);
768 
769 	return (SKEIN_SUCCESS);
770 }
771 
772 /* finalize the hash computation and output the block, no OUTPUT stage */
773 int
774 Skein1024_Final_Pad(Skein1024_Ctxt_t *ctx, uint8_t *hashVal)
775 {
776 	/* catch uninitialized context */
777 	Skein_Assert(ctx->h.bCnt <= SKEIN1024_BLOCK_BYTES, SKEIN_FAIL);
778 
779 	/* tag as the final block */
780 	ctx->h.T[1] |= SKEIN_T1_FLAG_FINAL;
781 	/* zero pad b[] if necessary */
782 	if (ctx->h.bCnt < SKEIN1024_BLOCK_BYTES)
783 		bzero(&ctx->b[ctx->h.bCnt],
784 		    SKEIN1024_BLOCK_BYTES - ctx->h.bCnt);
785 	/* process the final block */
786 	Skein1024_Process_Block(ctx, ctx->b, 1, ctx->h.bCnt);
787 
788 	/* "output" the state bytes */
789 	Skein_Put64_LSB_First(hashVal, ctx->X, SKEIN1024_BLOCK_BYTES);
790 
791 	return (SKEIN_SUCCESS);
792 }
793 
794 #if	SKEIN_TREE_HASH
795 /* just do the OUTPUT stage */
796 int
797 Skein_256_Output(Skein_256_Ctxt_t *ctx, uint8_t *hashVal)
798 {
799 	size_t i, n, byteCnt;
800 	uint64_t X[SKEIN_256_STATE_WORDS];
801 
802 	/* catch uninitialized context */
803 	Skein_Assert(ctx->h.bCnt <= SKEIN_256_BLOCK_BYTES, SKEIN_FAIL);
804 
805 	/* now output the result */
806 	/* total number of output bytes */
807 	byteCnt = (ctx->h.hashBitLen + 7) >> 3;
808 
809 	/* run Threefish in "counter mode" to generate output */
810 	/* zero out b[], so it can hold the counter */
811 	bzero(ctx->b, sizeof (ctx->b));
812 	/* keep a local copy of counter mode "key" */
813 	bcopy(ctx->X, X, sizeof (X));
814 	for (i = 0; i * SKEIN_256_BLOCK_BYTES < byteCnt; i++) {
815 		/* build the counter block */
816 		uint64_t tmp = Skein_Swap64((uint64_t)i);
817 		bcopy(&tmp, ctx->b, sizeof (tmp));
818 		Skein_Start_New_Type(ctx, OUT_FINAL);
819 		/* run "counter mode" */
820 		Skein_256_Process_Block(ctx, ctx->b, 1, sizeof (uint64_t));
821 		/* number of output bytes left to go */
822 		n = byteCnt - i * SKEIN_256_BLOCK_BYTES;
823 		if (n >= SKEIN_256_BLOCK_BYTES)
824 			n = SKEIN_256_BLOCK_BYTES;
825 		Skein_Put64_LSB_First(hashVal + i * SKEIN_256_BLOCK_BYTES,
826 		    ctx->X, n);	/* "output" the ctr mode bytes */
827 		Skein_Show_Final(256, &ctx->h, n,
828 		    hashVal + i * SKEIN_256_BLOCK_BYTES);
829 		/* restore the counter mode key for next time */
830 		bcopy(X, ctx->X, sizeof (X));
831 	}
832 	return (SKEIN_SUCCESS);
833 }
834 
835 /* just do the OUTPUT stage */
836 int
837 Skein_512_Output(Skein_512_Ctxt_t *ctx, uint8_t *hashVal)
838 {
839 	size_t i, n, byteCnt;
840 	uint64_t X[SKEIN_512_STATE_WORDS];
841 
842 	/* catch uninitialized context */
843 	Skein_Assert(ctx->h.bCnt <= SKEIN_512_BLOCK_BYTES, SKEIN_FAIL);
844 
845 	/* now output the result */
846 	/* total number of output bytes */
847 	byteCnt = (ctx->h.hashBitLen + 7) >> 3;
848 
849 	/* run Threefish in "counter mode" to generate output */
850 	/* zero out b[], so it can hold the counter */
851 	bzero(ctx->b, sizeof (ctx->b));
852 	/* keep a local copy of counter mode "key" */
853 	bcopy(ctx->X, X, sizeof (X));
854 	for (i = 0; i * SKEIN_512_BLOCK_BYTES < byteCnt; i++) {
855 		/* build the counter block */
856 		uint64_t tmp = Skein_Swap64((uint64_t)i);
857 		bcopy(&tmp, ctx->b, sizeof (tmp));
858 		Skein_Start_New_Type(ctx, OUT_FINAL);
859 		/* run "counter mode" */
860 		Skein_512_Process_Block(ctx, ctx->b, 1, sizeof (uint64_t));
861 		/* number of output bytes left to go */
862 		n = byteCnt - i * SKEIN_512_BLOCK_BYTES;
863 		if (n >= SKEIN_512_BLOCK_BYTES)
864 			n = SKEIN_512_BLOCK_BYTES;
865 		Skein_Put64_LSB_First(hashVal + i * SKEIN_512_BLOCK_BYTES,
866 		    ctx->X, n);	/* "output" the ctr mode bytes */
867 		Skein_Show_Final(256, &ctx->h, n,
868 		    hashVal + i * SKEIN_512_BLOCK_BYTES);
869 		/* restore the counter mode key for next time */
870 		bcopy(X, ctx->X, sizeof (X));
871 	}
872 	return (SKEIN_SUCCESS);
873 }
874 
875 /* just do the OUTPUT stage */
876 int
877 Skein1024_Output(Skein1024_Ctxt_t *ctx, uint8_t *hashVal)
878 {
879 	size_t i, n, byteCnt;
880 	uint64_t X[SKEIN1024_STATE_WORDS];
881 
882 	/* catch uninitialized context */
883 	Skein_Assert(ctx->h.bCnt <= SKEIN1024_BLOCK_BYTES, SKEIN_FAIL);
884 
885 	/* now output the result */
886 	/* total number of output bytes */
887 	byteCnt = (ctx->h.hashBitLen + 7) >> 3;
888 
889 	/* run Threefish in "counter mode" to generate output */
890 	/* zero out b[], so it can hold the counter */
891 	bzero(ctx->b, sizeof (ctx->b));
892 	/* keep a local copy of counter mode "key" */
893 	bcopy(ctx->X, X, sizeof (X));
894 	for (i = 0; i * SKEIN1024_BLOCK_BYTES < byteCnt; i++) {
895 		/* build the counter block */
896 		uint64_t tmp = Skein_Swap64((uint64_t)i);
897 		bcopy(&tmp, ctx->b, sizeof (tmp));
898 		Skein_Start_New_Type(ctx, OUT_FINAL);
899 		/* run "counter mode" */
900 		Skein1024_Process_Block(ctx, ctx->b, 1, sizeof (uint64_t));
901 		/* number of output bytes left to go */
902 		n = byteCnt - i * SKEIN1024_BLOCK_BYTES;
903 		if (n >= SKEIN1024_BLOCK_BYTES)
904 			n = SKEIN1024_BLOCK_BYTES;
905 		Skein_Put64_LSB_First(hashVal + i * SKEIN1024_BLOCK_BYTES,
906 		    ctx->X, n);	/* "output" the ctr mode bytes */
907 		Skein_Show_Final(256, &ctx->h, n,
908 		    hashVal + i * SKEIN1024_BLOCK_BYTES);
909 		/* restore the counter mode key for next time */
910 		bcopy(X, ctx->X, sizeof (X));
911 	}
912 	return (SKEIN_SUCCESS);
913 }
914 #endif
915