/* $OpenBSD: wp_dgst.c,v 1.4 2014/07/12 11:25:25 miod Exp $ */
/**
 * The Whirlpool hashing function.
 *
 * <P>
 * <b>References</b>
 *
 * <P>
 * The Whirlpool algorithm was developed by
 * <a href="mailto:pbarreto@scopus.com.br">Paulo S. L. M. Barreto</a> and
 * <a href="mailto:vincent.rijmen@cryptomathic.com">Vincent Rijmen</a>.
 *
 * See
 *      P.S.L.M. Barreto, V. Rijmen,
 *      ``The Whirlpool hashing function,''
 *      NESSIE submission, 2000 (tweaked version, 2001),
 *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>
 *
 * Based on "@version 3.0 (2003.03.12)" by Paulo S.L.M. Barreto and
 * Vincent Rijmen. Lookup "reference implementations" on
 * <http://planeta.terra.com.br/informatica/paulobarreto/>
 *
 * =============================================================================
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */

/*
 * OpenSSL-specific implementation notes.
 *
 * WHIRLPOOL_Update as well as one-stroke WHIRLPOOL both expect
 * number of *bytes* as input length argument. Bit-oriented routine
 * as specified by authors is called WHIRLPOOL_BitUpdate[!] and
 * does not have one-stroke counterpart.
 *
 * WHIRLPOOL_BitUpdate implements byte-oriented loop, essentially
 * to serve WHIRLPOOL_Update. This is done for performance.
 *
 * Unlike authors' reference implementation, block processing
 * routine whirlpool_block is designed to operate on multi-block
 * input. This is done for performance.
 */

#include "wp_locl.h"
#include <openssl/crypto.h>
#include <string.h>

int WHIRLPOOL_Init(WHIRLPOOL_CTX *c)
        {
        memset (c,0,sizeof(*c));
        return(1);
        }

int WHIRLPOOL_Update    (WHIRLPOOL_CTX *c,const void *_inp,size_t bytes)
        {
        /* Well, largest suitable chunk size actually is
         * (1<<(sizeof(size_t)*8-3))-64, but below number
         * is large enough for not to care about excessive
         * calls to WHIRLPOOL_BitUpdate... */
        size_t chunk = ((size_t)1)<<(sizeof(size_t)*8-4);
        const unsigned char *inp = _inp;

        while (bytes>=chunk)
                {
                WHIRLPOOL_BitUpdate(c,inp,chunk*8);
                bytes -= chunk;
                inp   += chunk;
                }
        if (bytes)
                WHIRLPOOL_BitUpdate(c,inp,bytes*8);

        return(1);
        }

void WHIRLPOOL_BitUpdate(WHIRLPOOL_CTX *c,const void *_inp,size_t bits)
        {
        size_t          n;
        unsigned int    bitoff = c->bitoff,
                        bitrem = bitoff%8,
                        inpgap = (8-(unsigned int)bits%8)&7;
        const unsigned char *inp=_inp;

        /* This 256-bit increment procedure relies on the size_t
         * being natural size of CPU register, so that we don't
         * have to mask the value in order to detect overflows. */
        c->bitlen[0] += bits;
        if (c->bitlen[0] < bits)        /* overflow */
                {
                n = 1;
                do  {   c->bitlen[n]++;
                    } while(c->bitlen[n]==0
                            && ++n<(WHIRLPOOL_COUNTER/sizeof(size_t)));
                }

#ifndef OPENSSL_SMALL_FOOTPRINT
        reconsider:
        if (inpgap==0 && bitrem==0)     /* byte-oriented loop */
                {
                while (bits)
                        {
                        if (bitoff==0 && (n=bits/WHIRLPOOL_BBLOCK))
                                {
                                whirlpool_block(c,inp,n);
                                inp  += n*WHIRLPOOL_BBLOCK/8;
                                bits %= WHIRLPOOL_BBLOCK;
                                }
                        else
                                {
                                unsigned int byteoff = bitoff/8;

                                bitrem = WHIRLPOOL_BBLOCK - bitoff;/* re-use bitrem */
                                if (bits >= bitrem)
                                        {
                                        bits -= bitrem;
                                        bitrem /= 8;
                                        memcpy(c->data+byteoff,inp,bitrem);
                                        inp  += bitrem;
                                        whirlpool_block(c,c->data,1);
                                        bitoff = 0;
                                        }
                                else
                                        {
                                        memcpy(c->data+byteoff,inp,bits/8);
                                        bitoff += (unsigned int)bits;
                                        bits = 0;
                                        }
                                c->bitoff = bitoff;
                                }
                        }
                }
        else                            /* bit-oriented loop */
#endif
                {
                /*
                           inp
                           |
                           +-------+-------+-------
                              |||||||||||||||||||||
                           +-------+-------+-------
                +-------+-------+-------+-------+-------
                ||||||||||||||                          c->data
                +-------+-------+-------+-------+-------
                        |
                        c->bitoff/8
                */
                while (bits)
                        {
                        unsigned int    byteoff = bitoff/8;
                        unsigned char   b;

#ifndef OPENSSL_SMALL_FOOTPRINT
                        if (bitrem==inpgap)
                                {
                                c->data[byteoff++] |= inp[0] & (0xff>>inpgap);
                                inpgap = 8-inpgap;
                                bitoff += inpgap;  bitrem = 0;  /* bitoff%8 */
                                bits   -= inpgap;  inpgap = 0;  /* bits%8   */
                                inp++;
                                if (bitoff==WHIRLPOOL_BBLOCK)
                                        {
                                        whirlpool_block(c,c->data,1);
                                        bitoff = 0;
                                        }
                                c->bitoff = bitoff;
                                goto reconsider;
                                }
                        else
#endif
                        if (bits>=8)
                                {
                                b  = ((inp[0]<<inpgap) | (inp[1]>>(8-inpgap)));
                                b &= 0xff;
                                if (bitrem)     c->data[byteoff++] |= b>>bitrem;
                                else            c->data[byteoff++]  = b;
                                bitoff += 8;
                                bits   -= 8;
                                inp++;
                                if (bitoff>=WHIRLPOOL_BBLOCK)
                                        {
                                        whirlpool_block(c,c->data,1);
                                        byteoff  = 0;
                                        bitoff  %= WHIRLPOOL_BBLOCK;
                                        }
                                if (bitrem)     c->data[byteoff] = b<<(8-bitrem);
                                }
                        else    /* remaining less than 8 bits */
                                {
                                b = (inp[0]<<inpgap)&0xff;
                                if (bitrem)     c->data[byteoff++] |= b>>bitrem;
                                else            c->data[byteoff++]  = b;
                                bitoff += (unsigned int)bits;
                                if (bitoff==WHIRLPOOL_BBLOCK)
                                        {
                                        whirlpool_block(c,c->data,1);
                                        byteoff  = 0;
                                        bitoff  %= WHIRLPOOL_BBLOCK;
                                        }
                                if (bitrem)     c->data[byteoff] = b<<(8-bitrem);
                                bits = 0;
                                }
                        c->bitoff = bitoff;
                        }
                }
        }

int WHIRLPOOL_Final     (unsigned char *md,WHIRLPOOL_CTX *c)
        {
        unsigned int    bitoff  = c->bitoff,
                        byteoff = bitoff/8;
        size_t          i,j,v;
        unsigned char  *p;

        bitoff %= 8;
        if (bitoff)     c->data[byteoff] |= 0x80>>bitoff;
        else            c->data[byteoff]  = 0x80;
        byteoff++;

        /* pad with zeros */
        if (byteoff > (WHIRLPOOL_BBLOCK/8-WHIRLPOOL_COUNTER))
                {
                if (byteoff<WHIRLPOOL_BBLOCK/8)
                        memset(&c->data[byteoff],0,WHIRLPOOL_BBLOCK/8-byteoff);
                whirlpool_block(c,c->data,1);
                byteoff = 0;
                }
        if (byteoff < (WHIRLPOOL_BBLOCK/8-WHIRLPOOL_COUNTER))
                memset(&c->data[byteoff],0,
                        (WHIRLPOOL_BBLOCK/8-WHIRLPOOL_COUNTER)-byteoff);
        /* smash 256-bit c->bitlen in big-endian order */
        p = &c->data[WHIRLPOOL_BBLOCK/8-1];     /* last byte in c->data */
        for(i=0;i<WHIRLPOOL_COUNTER/sizeof(size_t);i++)
                for(v=c->bitlen[i],j=0;j<sizeof(size_t);j++,v>>=8)
                        *p-- = (unsigned char)(v&0xff);

        whirlpool_block(c,c->data,1);

        if (md) {
                memcpy(md,c->H.c,WHIRLPOOL_DIGEST_LENGTH);
                memset(c,0,sizeof(*c));
                return(1);
                }
        return(0);
        }

unsigned char *WHIRLPOOL(const void *inp, size_t bytes,unsigned char *md)
        {
        WHIRLPOOL_CTX ctx;
        static unsigned char m[WHIRLPOOL_DIGEST_LENGTH];

        if (md == NULL) md=m;
        WHIRLPOOL_Init(&ctx);
        WHIRLPOOL_Update(&ctx,inp,bytes);
        WHIRLPOOL_Final(md,&ctx);
        return(md);
        }