projects/linux·blob master · refs

986 lines · 28.1 KiB

1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * Common values for SHA-2 algorithms
4 */
5
6#ifndef _CRYPTO_SHA2_H
7#define _CRYPTO_SHA2_H
8
9#include <linux/types.h>
10#include <linux/string.h>
11
12#define SHA224_DIGEST_SIZE 28
13#define SHA224_BLOCK_SIZE 64
14
15#define SHA256_DIGEST_SIZE 32
16#define SHA256_BLOCK_SIZE 64
17#define SHA256_STATE_WORDS 8
18
19#define SHA384_DIGEST_SIZE 48
20#define SHA384_BLOCK_SIZE 128
21
22#define SHA512_DIGEST_SIZE 64
23#define SHA512_BLOCK_SIZE 128
24#define SHA512_STATE_SIZE 80
25
26#define SHA224_H0 0xc1059ed8UL
27#define SHA224_H1 0x367cd507UL
28#define SHA224_H2 0x3070dd17UL
29#define SHA224_H3 0xf70e5939UL
30#define SHA224_H4 0xffc00b31UL
31#define SHA224_H5 0x68581511UL
32#define SHA224_H6 0x64f98fa7UL
33#define SHA224_H7 0xbefa4fa4UL
34
35#define SHA256_H0 0x6a09e667UL
36#define SHA256_H1 0xbb67ae85UL
37#define SHA256_H2 0x3c6ef372UL
38#define SHA256_H3 0xa54ff53aUL
39#define SHA256_H4 0x510e527fUL
40#define SHA256_H5 0x9b05688cUL
41#define SHA256_H6 0x1f83d9abUL
42#define SHA256_H7 0x5be0cd19UL
43
44#define SHA384_H0 0xcbbb9d5dc1059ed8ULL
45#define SHA384_H1 0x629a292a367cd507ULL
46#define SHA384_H2 0x9159015a3070dd17ULL
47#define SHA384_H3 0x152fecd8f70e5939ULL
48#define SHA384_H4 0x67332667ffc00b31ULL
49#define SHA384_H5 0x8eb44a8768581511ULL
50#define SHA384_H6 0xdb0c2e0d64f98fa7ULL
51#define SHA384_H7 0x47b5481dbefa4fa4ULL
52
53#define SHA512_H0 0x6a09e667f3bcc908ULL
54#define SHA512_H1 0xbb67ae8584caa73bULL
55#define SHA512_H2 0x3c6ef372fe94f82bULL
56#define SHA512_H3 0xa54ff53a5f1d36f1ULL
57#define SHA512_H4 0x510e527fade682d1ULL
58#define SHA512_H5 0x9b05688c2b3e6c1fULL
59#define SHA512_H6 0x1f83d9abfb41bd6bULL
60#define SHA512_H7 0x5be0cd19137e2179ULL
61
62extern const u8 sha224_zero_message_hash[SHA224_DIGEST_SIZE];
63
64extern const u8 sha256_zero_message_hash[SHA256_DIGEST_SIZE];
65
66extern const u8 sha384_zero_message_hash[SHA384_DIGEST_SIZE];
67
68extern const u8 sha512_zero_message_hash[SHA512_DIGEST_SIZE];
69
70struct crypto_sha256_state {
71 u32 state[SHA256_STATE_WORDS];
72 u64 count;
73};
74
75static inline void sha224_block_init(struct crypto_sha256_state *sctx)
76{
77 sctx->state[0] = SHA224_H0;
78 sctx->state[1] = SHA224_H1;
79 sctx->state[2] = SHA224_H2;
80 sctx->state[3] = SHA224_H3;
81 sctx->state[4] = SHA224_H4;
82 sctx->state[5] = SHA224_H5;
83 sctx->state[6] = SHA224_H6;
84 sctx->state[7] = SHA224_H7;
85 sctx->count = 0;
86}
87
88static inline void sha256_block_init(struct crypto_sha256_state *sctx)
89{
90 sctx->state[0] = SHA256_H0;
91 sctx->state[1] = SHA256_H1;
92 sctx->state[2] = SHA256_H2;
93 sctx->state[3] = SHA256_H3;
94 sctx->state[4] = SHA256_H4;
95 sctx->state[5] = SHA256_H5;
96 sctx->state[6] = SHA256_H6;
97 sctx->state[7] = SHA256_H7;
98 sctx->count = 0;
99}
100
101struct sha256_state {
102 union {
103 struct crypto_sha256_state ctx;
104 struct {
105 u32 state[SHA256_STATE_WORDS];
106 u64 count;
107 };
108 };
109 u8 buf[SHA256_BLOCK_SIZE];
110};
111
112struct sha512_state {
113 u64 state[SHA512_DIGEST_SIZE / 8];
114 u64 count[2];
115 u8 buf[SHA512_BLOCK_SIZE];
116};
117
118/* State for the SHA-256 (and SHA-224) compression function */
119struct sha256_block_state {
120 u32 h[SHA256_STATE_WORDS];
121};
122
123/*
124 * Context structure, shared by SHA-224 and SHA-256. The sha224_ctx and
125 * sha256_ctx structs wrap this one so that the API has proper typing and
126 * doesn't allow mixing the SHA-224 and SHA-256 functions arbitrarily.
127 */
128struct __sha256_ctx {
129 struct sha256_block_state state;
130 u64 bytecount;
131 u8 buf[SHA256_BLOCK_SIZE] __aligned(__alignof__(__be64));
132};
133void __sha256_update(struct __sha256_ctx *ctx, const u8 *data, size_t len);
134
135/*
136 * HMAC key and message context structs, shared by HMAC-SHA224 and HMAC-SHA256.
137 * The hmac_sha224_* and hmac_sha256_* structs wrap this one so that the API has
138 * proper typing and doesn't allow mixing the functions arbitrarily.
139 */
140struct __hmac_sha256_key {
141 struct sha256_block_state istate;
142 struct sha256_block_state ostate;
143};
144struct __hmac_sha256_ctx {
145 struct __sha256_ctx sha_ctx;
146 struct sha256_block_state ostate;
147};
148void __hmac_sha256_init(struct __hmac_sha256_ctx *ctx,
149 const struct __hmac_sha256_key *key);
150
151/**
152 * struct sha224_ctx - Context for hashing a message with SHA-224
153 * @ctx: private
154 */
155struct sha224_ctx {
156 struct __sha256_ctx ctx;
157};
158
159/**
160 * sha224_init() - Initialize a SHA-224 context for a new message
161 * @ctx: the context to initialize
162 *
163 * If you don't need incremental computation, consider sha224() instead.
164 *
165 * Context: Any context.
166 */
167void sha224_init(struct sha224_ctx *ctx);
168
169/**
170 * sha224_update() - Update a SHA-224 context with message data
171 * @ctx: the context to update; must have been initialized
172 * @data: the message data
173 * @len: the data length in bytes
174 *
175 * This can be called any number of times.
176 *
177 * Context: Any context.
178 */
179static inline void sha224_update(struct sha224_ctx *ctx,
180 const u8 *data, size_t len)
181{
182 __sha256_update(&ctx->ctx, data, len);
183}
184
185/**
186 * sha224_final() - Finish computing a SHA-224 message digest
187 * @ctx: the context to finalize; must have been initialized
188 * @out: (output) the resulting SHA-224 message digest
189 *
190 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
191 *
192 * Context: Any context.
193 */
194void sha224_final(struct sha224_ctx *ctx, u8 out[at_least SHA224_DIGEST_SIZE]);
195
196/**
197 * sha224() - Compute SHA-224 message digest in one shot
198 * @data: the message data
199 * @len: the data length in bytes
200 * @out: (output) the resulting SHA-224 message digest
201 *
202 * Context: Any context.
203 */
204void sha224(const u8 *data, size_t len, u8 out[at_least SHA224_DIGEST_SIZE]);
205
206/**
207 * struct hmac_sha224_key - Prepared key for HMAC-SHA224
208 * @key: private
209 */
210struct hmac_sha224_key {
211 struct __hmac_sha256_key key;
212};
213
214/**
215 * hmac_sha224_zeroize_key() - Zeroize an hmac_sha224_key structure
216 * @key: The hmac_sha224_key to zeroize
217 */
218static inline void hmac_sha224_zeroize_key(struct hmac_sha224_key *key)
219{
220 memzero_explicit(key, sizeof(*key));
221}
222
223/**
224 * struct hmac_sha224_ctx - Context for computing HMAC-SHA224 of a message
225 * @ctx: private
226 */
227struct hmac_sha224_ctx {
228 struct __hmac_sha256_ctx ctx;
229};
230
231/**
232 * hmac_sha224_zeroize_ctx() - Zeroize an hmac_sha224_ctx structure
233 * @ctx: The hmac_sha224_ctx context to zeroize
234 */
235static inline void hmac_sha224_zeroize_ctx(struct hmac_sha224_ctx *ctx)
236{
237 memzero_explicit(ctx, sizeof(*ctx));
238}
239
240/**
241 * hmac_sha224_preparekey() - Prepare a key for HMAC-SHA224
242 * @key: (output) the key structure to initialize
243 * @raw_key: the raw HMAC-SHA224 key
244 * @raw_key_len: the key length in bytes. All key lengths are supported.
245 *
246 * Note: the caller is responsible for zeroizing both the struct hmac_sha224_key
247 * and the raw key once they are no longer needed.
248 *
249 * Context: Any context.
250 */
251void hmac_sha224_preparekey(struct hmac_sha224_key *key,
252 const u8 *raw_key, size_t raw_key_len);
253
254/**
255 * hmac_sha224_init() - Initialize an HMAC-SHA224 context for a new message
256 * @ctx: (output) the HMAC context to initialize
257 * @key: the prepared HMAC key
258 *
259 * If you don't need incremental computation, consider hmac_sha224() instead.
260 *
261 * Context: Any context.
262 */
263static inline void hmac_sha224_init(struct hmac_sha224_ctx *ctx,
264 const struct hmac_sha224_key *key)
265{
266 __hmac_sha256_init(&ctx->ctx, &key->key);
267}
268
269/**
270 * hmac_sha224_init_usingrawkey() - Initialize an HMAC-SHA224 context for a new
271 * message, using a raw key
272 * @ctx: (output) the HMAC context to initialize
273 * @raw_key: the raw HMAC-SHA224 key
274 * @raw_key_len: the key length in bytes. All key lengths are supported.
275 *
276 * If you don't need incremental computation, consider hmac_sha224_usingrawkey()
277 * instead.
278 *
279 * Context: Any context.
280 */
281void hmac_sha224_init_usingrawkey(struct hmac_sha224_ctx *ctx,
282 const u8 *raw_key, size_t raw_key_len);
283
284/**
285 * hmac_sha224_update() - Update an HMAC-SHA224 context with message data
286 * @ctx: the HMAC context to update; must have been initialized
287 * @data: the message data
288 * @data_len: the data length in bytes
289 *
290 * This can be called any number of times.
291 *
292 * Context: Any context.
293 */
294static inline void hmac_sha224_update(struct hmac_sha224_ctx *ctx,
295 const u8 *data, size_t data_len)
296{
297 __sha256_update(&ctx->ctx.sha_ctx, data, data_len);
298}
299
300/**
301 * hmac_sha224_final() - Finish computing an HMAC-SHA224 value
302 * @ctx: the HMAC context to finalize; must have been initialized
303 * @out: (output) the resulting HMAC-SHA224 value
304 *
305 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
306 *
307 * Context: Any context.
308 */
309void hmac_sha224_final(struct hmac_sha224_ctx *ctx,
310 u8 out[at_least SHA224_DIGEST_SIZE]);
311
312/**
313 * hmac_sha224() - Compute HMAC-SHA224 in one shot, using a prepared key
314 * @key: the prepared HMAC key
315 * @data: the message data
316 * @data_len: the data length in bytes
317 * @out: (output) the resulting HMAC-SHA224 value
318 *
319 * If you're using the key only once, consider using hmac_sha224_usingrawkey().
320 *
321 * Context: Any context.
322 */
323void hmac_sha224(const struct hmac_sha224_key *key,
324 const u8 *data, size_t data_len,
325 u8 out[at_least SHA224_DIGEST_SIZE]);
326
327/**
328 * hmac_sha224_usingrawkey() - Compute HMAC-SHA224 in one shot, using a raw key
329 * @raw_key: the raw HMAC-SHA224 key
330 * @raw_key_len: the key length in bytes. All key lengths are supported.
331 * @data: the message data
332 * @data_len: the data length in bytes
333 * @out: (output) the resulting HMAC-SHA224 value
334 *
335 * If you're using the key multiple times, prefer to use
336 * hmac_sha224_preparekey() followed by multiple calls to hmac_sha224() instead.
337 *
338 * Context: Any context.
339 */
340void hmac_sha224_usingrawkey(const u8 *raw_key, size_t raw_key_len,
341 const u8 *data, size_t data_len,
342 u8 out[at_least SHA224_DIGEST_SIZE]);
343
344/**
345 * struct sha256_ctx - Context for hashing a message with SHA-256
346 * @ctx: private
347 */
348struct sha256_ctx {
349 struct __sha256_ctx ctx;
350};
351
352/**
353 * sha256_init() - Initialize a SHA-256 context for a new message
354 * @ctx: the context to initialize
355 *
356 * If you don't need incremental computation, consider sha256() instead.
357 *
358 * Context: Any context.
359 */
360void sha256_init(struct sha256_ctx *ctx);
361
362/**
363 * sha256_update() - Update a SHA-256 context with message data
364 * @ctx: the context to update; must have been initialized
365 * @data: the message data
366 * @len: the data length in bytes
367 *
368 * This can be called any number of times.
369 *
370 * Context: Any context.
371 */
372static inline void sha256_update(struct sha256_ctx *ctx,
373 const u8 *data, size_t len)
374{
375 __sha256_update(&ctx->ctx, data, len);
376}
377
378/**
379 * sha256_final() - Finish computing a SHA-256 message digest
380 * @ctx: the context to finalize; must have been initialized
381 * @out: (output) the resulting SHA-256 message digest
382 *
383 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
384 *
385 * Context: Any context.
386 */
387void sha256_final(struct sha256_ctx *ctx, u8 out[at_least SHA256_DIGEST_SIZE]);
388
389/**
390 * sha256() - Compute SHA-256 message digest in one shot
391 * @data: the message data
392 * @len: the data length in bytes
393 * @out: (output) the resulting SHA-256 message digest
394 *
395 * Context: Any context.
396 */
397void sha256(const u8 *data, size_t len, u8 out[at_least SHA256_DIGEST_SIZE]);
398
399/**
400 * sha256_finup_2x() - Compute two SHA-256 digests from a common initial
401 * context. On some CPUs, this is faster than sequentially
402 * computing each digest.
403 * @ctx: an optional initial context, which may have already processed data. If
404 * NULL, a default initial context is used (equivalent to sha256_init()).
405 * @data1: data for the first message
406 * @data2: data for the second message
407 * @len: the length of each of @data1 and @data2, in bytes
408 * @out1: (output) the first SHA-256 message digest
409 * @out2: (output) the second SHA-256 message digest
410 *
411 * Context: Any context.
412 */
413void sha256_finup_2x(const struct sha256_ctx *ctx, const u8 *data1,
414 const u8 *data2, size_t len,
415 u8 out1[at_least SHA256_DIGEST_SIZE],
416 u8 out2[at_least SHA256_DIGEST_SIZE]);
417
418/**
419 * sha256_finup_2x_is_optimized() - Check if sha256_finup_2x() is using a real
420 * interleaved implementation, as opposed to a
421 * sequential fallback
422 * @return: true if optimized
423 *
424 * Context: Any context.
425 */
426bool sha256_finup_2x_is_optimized(void);
427
428/**
429 * struct hmac_sha256_key - Prepared key for HMAC-SHA256
430 * @key: private
431 */
432struct hmac_sha256_key {
433 struct __hmac_sha256_key key;
434};
435
436/**
437 * hmac_sha256_zeroize_key() - Zeroize an hmac_sha256_key structure
438 * @key: The hmac_sha256_key to zeroize
439 */
440static inline void hmac_sha256_zeroize_key(struct hmac_sha256_key *key)
441{
442 memzero_explicit(key, sizeof(*key));
443}
444
445/**
446 * struct hmac_sha256_ctx - Context for computing HMAC-SHA256 of a message
447 * @ctx: private
448 */
449struct hmac_sha256_ctx {
450 struct __hmac_sha256_ctx ctx;
451};
452
453/**
454 * hmac_sha256_zeroize_ctx() - Zeroize an hmac_sha256_ctx structure
455 * @ctx: The hmac_sha256_ctx context to zeroize
456 */
457static inline void hmac_sha256_zeroize_ctx(struct hmac_sha256_ctx *ctx)
458{
459 memzero_explicit(ctx, sizeof(*ctx));
460}
461
462/**
463 * hmac_sha256_preparekey() - Prepare a key for HMAC-SHA256
464 * @key: (output) the key structure to initialize
465 * @raw_key: the raw HMAC-SHA256 key
466 * @raw_key_len: the key length in bytes. All key lengths are supported.
467 *
468 * Note: the caller is responsible for zeroizing both the struct hmac_sha256_key
469 * and the raw key once they are no longer needed.
470 *
471 * Context: Any context.
472 */
473void hmac_sha256_preparekey(struct hmac_sha256_key *key,
474 const u8 *raw_key, size_t raw_key_len);
475
476/**
477 * hmac_sha256_init() - Initialize an HMAC-SHA256 context for a new message
478 * @ctx: (output) the HMAC context to initialize
479 * @key: the prepared HMAC key
480 *
481 * If you don't need incremental computation, consider hmac_sha256() instead.
482 *
483 * Context: Any context.
484 */
485static inline void hmac_sha256_init(struct hmac_sha256_ctx *ctx,
486 const struct hmac_sha256_key *key)
487{
488 __hmac_sha256_init(&ctx->ctx, &key->key);
489}
490
491/**
492 * hmac_sha256_init_usingrawkey() - Initialize an HMAC-SHA256 context for a new
493 * message, using a raw key
494 * @ctx: (output) the HMAC context to initialize
495 * @raw_key: the raw HMAC-SHA256 key
496 * @raw_key_len: the key length in bytes. All key lengths are supported.
497 *
498 * If you don't need incremental computation, consider hmac_sha256_usingrawkey()
499 * instead.
500 *
501 * Context: Any context.
502 */
503void hmac_sha256_init_usingrawkey(struct hmac_sha256_ctx *ctx,
504 const u8 *raw_key, size_t raw_key_len);
505
506/**
507 * hmac_sha256_update() - Update an HMAC-SHA256 context with message data
508 * @ctx: the HMAC context to update; must have been initialized
509 * @data: the message data
510 * @data_len: the data length in bytes
511 *
512 * This can be called any number of times.
513 *
514 * Context: Any context.
515 */
516static inline void hmac_sha256_update(struct hmac_sha256_ctx *ctx,
517 const u8 *data, size_t data_len)
518{
519 __sha256_update(&ctx->ctx.sha_ctx, data, data_len);
520}
521
522/**
523 * hmac_sha256_final() - Finish computing an HMAC-SHA256 value
524 * @ctx: the HMAC context to finalize; must have been initialized
525 * @out: (output) the resulting HMAC-SHA256 value
526 *
527 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
528 *
529 * Context: Any context.
530 */
531void hmac_sha256_final(struct hmac_sha256_ctx *ctx,
532 u8 out[at_least SHA256_DIGEST_SIZE]);
533
534/**
535 * hmac_sha256() - Compute HMAC-SHA256 in one shot, using a prepared key
536 * @key: the prepared HMAC key
537 * @data: the message data
538 * @data_len: the data length in bytes
539 * @out: (output) the resulting HMAC-SHA256 value
540 *
541 * If you're using the key only once, consider using hmac_sha256_usingrawkey().
542 *
543 * Context: Any context.
544 */
545void hmac_sha256(const struct hmac_sha256_key *key,
546 const u8 *data, size_t data_len,
547 u8 out[at_least SHA256_DIGEST_SIZE]);
548
549/**
550 * hmac_sha256_usingrawkey() - Compute HMAC-SHA256 in one shot, using a raw key
551 * @raw_key: the raw HMAC-SHA256 key
552 * @raw_key_len: the key length in bytes. All key lengths are supported.
553 * @data: the message data
554 * @data_len: the data length in bytes
555 * @out: (output) the resulting HMAC-SHA256 value
556 *
557 * If you're using the key multiple times, prefer to use
558 * hmac_sha256_preparekey() followed by multiple calls to hmac_sha256() instead.
559 *
560 * Context: Any context.
561 */
562void hmac_sha256_usingrawkey(const u8 *raw_key, size_t raw_key_len,
563 const u8 *data, size_t data_len,
564 u8 out[at_least SHA256_DIGEST_SIZE]);
565
566/* State for the SHA-512 (and SHA-384) compression function */
567struct sha512_block_state {
568 u64 h[8];
569};
570
571/*
572 * Context structure, shared by SHA-384 and SHA-512. The sha384_ctx and
573 * sha512_ctx structs wrap this one so that the API has proper typing and
574 * doesn't allow mixing the SHA-384 and SHA-512 functions arbitrarily.
575 */
576struct __sha512_ctx {
577 struct sha512_block_state state;
578 u64 bytecount_lo;
579 u64 bytecount_hi;
580 u8 buf[SHA512_BLOCK_SIZE] __aligned(__alignof__(__be64));
581};
582void __sha512_update(struct __sha512_ctx *ctx, const u8 *data, size_t len);
583
584/*
585 * HMAC key and message context structs, shared by HMAC-SHA384 and HMAC-SHA512.
586 * The hmac_sha384_* and hmac_sha512_* structs wrap this one so that the API has
587 * proper typing and doesn't allow mixing the functions arbitrarily.
588 */
589struct __hmac_sha512_key {
590 struct sha512_block_state istate;
591 struct sha512_block_state ostate;
592};
593struct __hmac_sha512_ctx {
594 struct __sha512_ctx sha_ctx;
595 struct sha512_block_state ostate;
596};
597void __hmac_sha512_init(struct __hmac_sha512_ctx *ctx,
598 const struct __hmac_sha512_key *key);
599
600/**
601 * struct sha384_ctx - Context for hashing a message with SHA-384
602 * @ctx: private
603 */
604struct sha384_ctx {
605 struct __sha512_ctx ctx;
606};
607
608/**
609 * sha384_init() - Initialize a SHA-384 context for a new message
610 * @ctx: the context to initialize
611 *
612 * If you don't need incremental computation, consider sha384() instead.
613 *
614 * Context: Any context.
615 */
616void sha384_init(struct sha384_ctx *ctx);
617
618/**
619 * sha384_update() - Update a SHA-384 context with message data
620 * @ctx: the context to update; must have been initialized
621 * @data: the message data
622 * @len: the data length in bytes
623 *
624 * This can be called any number of times.
625 *
626 * Context: Any context.
627 */
628static inline void sha384_update(struct sha384_ctx *ctx,
629 const u8 *data, size_t len)
630{
631 __sha512_update(&ctx->ctx, data, len);
632}
633
634/**
635 * sha384_final() - Finish computing a SHA-384 message digest
636 * @ctx: the context to finalize; must have been initialized
637 * @out: (output) the resulting SHA-384 message digest
638 *
639 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
640 *
641 * Context: Any context.
642 */
643void sha384_final(struct sha384_ctx *ctx, u8 out[at_least SHA384_DIGEST_SIZE]);
644
645/**
646 * sha384() - Compute SHA-384 message digest in one shot
647 * @data: the message data
648 * @len: the data length in bytes
649 * @out: (output) the resulting SHA-384 message digest
650 *
651 * Context: Any context.
652 */
653void sha384(const u8 *data, size_t len, u8 out[at_least SHA384_DIGEST_SIZE]);
654
655/**
656 * struct hmac_sha384_key - Prepared key for HMAC-SHA384
657 * @key: private
658 */
659struct hmac_sha384_key {
660 struct __hmac_sha512_key key;
661};
662
663/**
664 * hmac_sha384_zeroize_key() - Zeroize an hmac_sha384_key structure
665 * @key: The hmac_sha384_key to zeroize
666 */
667static inline void hmac_sha384_zeroize_key(struct hmac_sha384_key *key)
668{
669 memzero_explicit(key, sizeof(*key));
670}
671
672/**
673 * struct hmac_sha384_ctx - Context for computing HMAC-SHA384 of a message
674 * @ctx: private
675 */
676struct hmac_sha384_ctx {
677 struct __hmac_sha512_ctx ctx;
678};
679
680/**
681 * hmac_sha384_zeroize_ctx() - Zeroize an hmac_sha384_ctx structure
682 * @ctx: The hmac_sha384_ctx context to zeroize
683 */
684static inline void hmac_sha384_zeroize_ctx(struct hmac_sha384_ctx *ctx)
685{
686 memzero_explicit(ctx, sizeof(*ctx));
687}
688
689/**
690 * hmac_sha384_preparekey() - Prepare a key for HMAC-SHA384
691 * @key: (output) the key structure to initialize
692 * @raw_key: the raw HMAC-SHA384 key
693 * @raw_key_len: the key length in bytes. All key lengths are supported.
694 *
695 * Note: the caller is responsible for zeroizing both the struct hmac_sha384_key
696 * and the raw key once they are no longer needed.
697 *
698 * Context: Any context.
699 */
700void hmac_sha384_preparekey(struct hmac_sha384_key *key,
701 const u8 *raw_key, size_t raw_key_len);
702
703/**
704 * hmac_sha384_init() - Initialize an HMAC-SHA384 context for a new message
705 * @ctx: (output) the HMAC context to initialize
706 * @key: the prepared HMAC key
707 *
708 * If you don't need incremental computation, consider hmac_sha384() instead.
709 *
710 * Context: Any context.
711 */
712static inline void hmac_sha384_init(struct hmac_sha384_ctx *ctx,
713 const struct hmac_sha384_key *key)
714{
715 __hmac_sha512_init(&ctx->ctx, &key->key);
716}
717
718/**
719 * hmac_sha384_init_usingrawkey() - Initialize an HMAC-SHA384 context for a new
720 * message, using a raw key
721 * @ctx: (output) the HMAC context to initialize
722 * @raw_key: the raw HMAC-SHA384 key
723 * @raw_key_len: the key length in bytes. All key lengths are supported.
724 *
725 * If you don't need incremental computation, consider hmac_sha384_usingrawkey()
726 * instead.
727 *
728 * Context: Any context.
729 */
730void hmac_sha384_init_usingrawkey(struct hmac_sha384_ctx *ctx,
731 const u8 *raw_key, size_t raw_key_len);
732
733/**
734 * hmac_sha384_update() - Update an HMAC-SHA384 context with message data
735 * @ctx: the HMAC context to update; must have been initialized
736 * @data: the message data
737 * @data_len: the data length in bytes
738 *
739 * This can be called any number of times.
740 *
741 * Context: Any context.
742 */
743static inline void hmac_sha384_update(struct hmac_sha384_ctx *ctx,
744 const u8 *data, size_t data_len)
745{
746 __sha512_update(&ctx->ctx.sha_ctx, data, data_len);
747}
748
749/**
750 * hmac_sha384_final() - Finish computing an HMAC-SHA384 value
751 * @ctx: the HMAC context to finalize; must have been initialized
752 * @out: (output) the resulting HMAC-SHA384 value
753 *
754 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
755 *
756 * Context: Any context.
757 */
758void hmac_sha384_final(struct hmac_sha384_ctx *ctx,
759 u8 out[at_least SHA384_DIGEST_SIZE]);
760
761/**
762 * hmac_sha384() - Compute HMAC-SHA384 in one shot, using a prepared key
763 * @key: the prepared HMAC key
764 * @data: the message data
765 * @data_len: the data length in bytes
766 * @out: (output) the resulting HMAC-SHA384 value
767 *
768 * If you're using the key only once, consider using hmac_sha384_usingrawkey().
769 *
770 * Context: Any context.
771 */
772void hmac_sha384(const struct hmac_sha384_key *key,
773 const u8 *data, size_t data_len,
774 u8 out[at_least SHA384_DIGEST_SIZE]);
775
776/**
777 * hmac_sha384_usingrawkey() - Compute HMAC-SHA384 in one shot, using a raw key
778 * @raw_key: the raw HMAC-SHA384 key
779 * @raw_key_len: the key length in bytes. All key lengths are supported.
780 * @data: the message data
781 * @data_len: the data length in bytes
782 * @out: (output) the resulting HMAC-SHA384 value
783 *
784 * If you're using the key multiple times, prefer to use
785 * hmac_sha384_preparekey() followed by multiple calls to hmac_sha384() instead.
786 *
787 * Context: Any context.
788 */
789void hmac_sha384_usingrawkey(const u8 *raw_key, size_t raw_key_len,
790 const u8 *data, size_t data_len,
791 u8 out[at_least SHA384_DIGEST_SIZE]);
792
793/**
794 * struct sha512_ctx - Context for hashing a message with SHA-512
795 * @ctx: private
796 */
797struct sha512_ctx {
798 struct __sha512_ctx ctx;
799};
800
801/**
802 * sha512_init() - Initialize a SHA-512 context for a new message
803 * @ctx: the context to initialize
804 *
805 * If you don't need incremental computation, consider sha512() instead.
806 *
807 * Context: Any context.
808 */
809void sha512_init(struct sha512_ctx *ctx);
810
811/**
812 * sha512_update() - Update a SHA-512 context with message data
813 * @ctx: the context to update; must have been initialized
814 * @data: the message data
815 * @len: the data length in bytes
816 *
817 * This can be called any number of times.
818 *
819 * Context: Any context.
820 */
821static inline void sha512_update(struct sha512_ctx *ctx,
822 const u8 *data, size_t len)
823{
824 __sha512_update(&ctx->ctx, data, len);
825}
826
827/**
828 * sha512_final() - Finish computing a SHA-512 message digest
829 * @ctx: the context to finalize; must have been initialized
830 * @out: (output) the resulting SHA-512 message digest
831 *
832 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
833 *
834 * Context: Any context.
835 */
836void sha512_final(struct sha512_ctx *ctx, u8 out[at_least SHA512_DIGEST_SIZE]);
837
838/**
839 * sha512() - Compute SHA-512 message digest in one shot
840 * @data: the message data
841 * @len: the data length in bytes
842 * @out: (output) the resulting SHA-512 message digest
843 *
844 * Context: Any context.
845 */
846void sha512(const u8 *data, size_t len, u8 out[at_least SHA512_DIGEST_SIZE]);
847
848/**
849 * struct hmac_sha512_key - Prepared key for HMAC-SHA512
850 * @key: private
851 */
852struct hmac_sha512_key {
853 struct __hmac_sha512_key key;
854};
855
856/**
857 * hmac_sha512_zeroize_key() - Zeroize an hmac_sha512_key structure
858 * @key: The hmac_sha512_key to zeroize
859 */
860static inline void hmac_sha512_zeroize_key(struct hmac_sha512_key *key)
861{
862 memzero_explicit(key, sizeof(*key));
863}
864
865/**
866 * struct hmac_sha512_ctx - Context for computing HMAC-SHA512 of a message
867 * @ctx: private
868 */
869struct hmac_sha512_ctx {
870 struct __hmac_sha512_ctx ctx;
871};
872
873/**
874 * hmac_sha512_zeroize_ctx() - Zeroize an hmac_sha512_ctx structure
875 * @ctx: The hmac_sha512_ctx context to zeroize
876 */
877static inline void hmac_sha512_zeroize_ctx(struct hmac_sha512_ctx *ctx)
878{
879 memzero_explicit(ctx, sizeof(*ctx));
880}
881
882/**
883 * hmac_sha512_preparekey() - Prepare a key for HMAC-SHA512
884 * @key: (output) the key structure to initialize
885 * @raw_key: the raw HMAC-SHA512 key
886 * @raw_key_len: the key length in bytes. All key lengths are supported.
887 *
888 * Note: the caller is responsible for zeroizing both the struct hmac_sha512_key
889 * and the raw key once they are no longer needed.
890 *
891 * Context: Any context.
892 */
893void hmac_sha512_preparekey(struct hmac_sha512_key *key,
894 const u8 *raw_key, size_t raw_key_len);
895
896/**
897 * hmac_sha512_init() - Initialize an HMAC-SHA512 context for a new message
898 * @ctx: (output) the HMAC context to initialize
899 * @key: the prepared HMAC key
900 *
901 * If you don't need incremental computation, consider hmac_sha512() instead.
902 *
903 * Context: Any context.
904 */
905static inline void hmac_sha512_init(struct hmac_sha512_ctx *ctx,
906 const struct hmac_sha512_key *key)
907{
908 __hmac_sha512_init(&ctx->ctx, &key->key);
909}
910
911/**
912 * hmac_sha512_init_usingrawkey() - Initialize an HMAC-SHA512 context for a new
913 * message, using a raw key
914 * @ctx: (output) the HMAC context to initialize
915 * @raw_key: the raw HMAC-SHA512 key
916 * @raw_key_len: the key length in bytes. All key lengths are supported.
917 *
918 * If you don't need incremental computation, consider hmac_sha512_usingrawkey()
919 * instead.
920 *
921 * Context: Any context.
922 */
923void hmac_sha512_init_usingrawkey(struct hmac_sha512_ctx *ctx,
924 const u8 *raw_key, size_t raw_key_len);
925
926/**
927 * hmac_sha512_update() - Update an HMAC-SHA512 context with message data
928 * @ctx: the HMAC context to update; must have been initialized
929 * @data: the message data
930 * @data_len: the data length in bytes
931 *
932 * This can be called any number of times.
933 *
934 * Context: Any context.
935 */
936static inline void hmac_sha512_update(struct hmac_sha512_ctx *ctx,
937 const u8 *data, size_t data_len)
938{
939 __sha512_update(&ctx->ctx.sha_ctx, data, data_len);
940}
941
942/**
943 * hmac_sha512_final() - Finish computing an HMAC-SHA512 value
944 * @ctx: the HMAC context to finalize; must have been initialized
945 * @out: (output) the resulting HMAC-SHA512 value
946 *
947 * After finishing, this zeroizes @ctx. So the caller does not need to do it.
948 *
949 * Context: Any context.
950 */
951void hmac_sha512_final(struct hmac_sha512_ctx *ctx,
952 u8 out[at_least SHA512_DIGEST_SIZE]);
953
954/**
955 * hmac_sha512() - Compute HMAC-SHA512 in one shot, using a prepared key
956 * @key: the prepared HMAC key
957 * @data: the message data
958 * @data_len: the data length in bytes
959 * @out: (output) the resulting HMAC-SHA512 value
960 *
961 * If you're using the key only once, consider using hmac_sha512_usingrawkey().
962 *
963 * Context: Any context.
964 */
965void hmac_sha512(const struct hmac_sha512_key *key,
966 const u8 *data, size_t data_len,
967 u8 out[at_least SHA512_DIGEST_SIZE]);
968
969/**
970 * hmac_sha512_usingrawkey() - Compute HMAC-SHA512 in one shot, using a raw key
971 * @raw_key: the raw HMAC-SHA512 key
972 * @raw_key_len: the key length in bytes. All key lengths are supported.
973 * @data: the message data
974 * @data_len: the data length in bytes
975 * @out: (output) the resulting HMAC-SHA512 value
976 *
977 * If you're using the key multiple times, prefer to use
978 * hmac_sha512_preparekey() followed by multiple calls to hmac_sha512() instead.
979 *
980 * Context: Any context.
981 */
982void hmac_sha512_usingrawkey(const u8 *raw_key, size_t raw_key_len,
983 const u8 *data, size_t data_len,
984 u8 out[at_least SHA512_DIGEST_SIZE]);
985
986#endif /* _CRYPTO_SHA2_H */