xref: /illumos-gate/usr/src/common/crypto/sha1/sha1.c (revision d63d22e3)
1 /*
2  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 /*
9  * The basic framework for this code came from the reference
10  * implementation for MD5.  That implementation is Copyright (C)
11  * 1991-2, RSA Data Security, Inc. Created 1991. All rights reserved.
12  *
13  * License to copy and use this software is granted provided that it
14  * is identified as the "RSA Data Security, Inc. MD5 Message-Digest
15  * Algorithm" in all material mentioning or referencing this software
16  * or this function.
17  *
18  * License is also granted to make and use derivative works provided
19  * that such works are identified as "derived from the RSA Data
20  * Security, Inc. MD5 Message-Digest Algorithm" in all material
21  * mentioning or referencing the derived work.
22  *
23  * RSA Data Security, Inc. makes no representations concerning either
24  * the merchantability of this software or the suitability of this
25  * software for any particular purpose. It is provided "as is"
26  * without express or implied warranty of any kind.
27  *
28  * These notices must be retained in any copies of any part of this
29  * documentation and/or software.
30  *
31  * NOTE: Cleaned-up and optimized, version of SHA1, based on the FIPS 180-1
32  * standard, available at http://www.itl.nist.gov/div897/pubs/fip180-1.htm
33  * Not as fast as one would like -- further optimizations are encouraged
34  * and appreciated.
35  */
36 
37 #include <sys/types.h>
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/sysmacros.h>
41 #include <sys/sha1.h>
42 #include <sys/sha1_consts.h>
43 
44 #ifndef	_KERNEL
45 #include <strings.h>
46 #include <stdlib.h>
47 #include <errno.h>
48 #include <sys/systeminfo.h>
49 #endif  /* !_KERNEL */
50 
51 static void Encode(uint8_t *, const uint32_t *, size_t);
52 
53 #if	defined(__sparc)
54 
55 #define	SHA1_TRANSFORM(ctx, in) \
56 	SHA1Transform((ctx)->state[0], (ctx)->state[1], (ctx)->state[2], \
57 		(ctx)->state[3], (ctx)->state[4], (ctx), (in))
58 
59 static void SHA1Transform(uint32_t, uint32_t, uint32_t, uint32_t, uint32_t,
60     SHA1_CTX *, const uint8_t *);
61 
62 #else
63 
64 #define	SHA1_TRANSFORM(ctx, in) SHA1Transform((ctx), (in))
65 
66 static void SHA1Transform(SHA1_CTX *, const uint8_t *);
67 
68 #endif
69 
70 
71 static uint8_t PADDING[64] = { 0x80, /* all zeros */ };
72 
73 /*
74  * F, G, and H are the basic SHA1 functions.
75  */
76 #define	F(b, c, d)	(((b) & (c)) | ((~b) & (d)))
77 #define	G(b, c, d)	((b) ^ (c) ^ (d))
78 #define	H(b, c, d)	(((b) & (c)) | (((b)|(c)) & (d)))
79 
80 /*
81  * ROTATE_LEFT rotates x left n bits.
82  */
83 
84 #if	defined(__GNUC__) && defined(_LP64)
85 static __inline__ uint64_t
86 ROTATE_LEFT(uint64_t value, uint32_t n)
87 {
88 	uint32_t t32;
89 
90 	t32 = (uint32_t)value;
91 	return ((t32 << n) | (t32 >> (32 - n)));
92 }
93 
94 #else
95 
96 #define	ROTATE_LEFT(x, n)	\
97 	(((x) << (n)) | ((x) >> ((sizeof (x) * NBBY)-(n))))
98 
99 #endif
100 
101 #if	defined(__GNUC__) && (defined(__i386) || defined(__amd64))
102 
103 #define	HAVE_BSWAP
104 
105 extern __inline__ uint32_t bswap(uint32_t value)
106 {
107 	__asm__("bswap %0" : "+r" (value));
108 	return (value);
109 }
110 
111 #endif
112 
113 /*
114  * SHA1Init()
115  *
116  * purpose: initializes the sha1 context and begins and sha1 digest operation
117  *   input: SHA1_CTX *	: the context to initializes.
118  *  output: void
119  */
120 
121 void
122 SHA1Init(SHA1_CTX *ctx)
123 {
124 	ctx->count[0] = ctx->count[1] = 0;
125 
126 	/*
127 	 * load magic initialization constants. Tell lint
128 	 * that these constants are unsigned by using U.
129 	 */
130 
131 	ctx->state[0] = 0x67452301U;
132 	ctx->state[1] = 0xefcdab89U;
133 	ctx->state[2] = 0x98badcfeU;
134 	ctx->state[3] = 0x10325476U;
135 	ctx->state[4] = 0xc3d2e1f0U;
136 }
137 
138 #ifdef VIS_SHA1
139 #ifdef _KERNEL
140 
141 #include <sys/regset.h>
142 #include <sys/vis.h>
143 #include <sys/fpu/fpusystm.h>
144 
145 /* the alignment for block stores to save fp registers */
146 #define	VIS_ALIGN	(64)
147 
148 extern int sha1_savefp(kfpu_t *, int);
149 extern void sha1_restorefp(kfpu_t *);
150 
151 uint32_t	vis_sha1_svfp_threshold = 128;
152 
153 #endif /* _KERNEL */
154 
155 /*
156  * VIS SHA-1 consts.
157  */
158 static uint64_t VIS[] = {
159 	0x8000000080000000ULL,
160 	0x0002000200020002ULL,
161 	0x5a8279996ed9eba1ULL,
162 	0x8f1bbcdcca62c1d6ULL,
163 	0x012389ab456789abULL};
164 
165 extern void SHA1TransformVIS(uint64_t *, uint32_t *, uint32_t *, uint64_t *);
166 
167 
168 /*
169  * SHA1Update()
170  *
171  * purpose: continues an sha1 digest operation, using the message block
172  *          to update the context.
173  *   input: SHA1_CTX *	: the context to update
174  *          void *	: the message block
175  *          size_t    : the length of the message block in bytes
176  *  output: void
177  */
178 
179 void
180 SHA1Update(SHA1_CTX *ctx, const void *inptr, size_t input_len)
181 {
182 	uint32_t i, buf_index, buf_len;
183 	uint64_t X0[40], input64[8];
184 	const uint8_t *input = inptr;
185 #ifdef _KERNEL
186 	int usevis = 0;
187 #else
188 	int usevis = 1;
189 #endif /* _KERNEL */
190 
191 	/* check for noop */
192 	if (input_len == 0)
193 		return;
194 
195 	/* compute number of bytes mod 64 */
196 	buf_index = (ctx->count[1] >> 3) & 0x3F;
197 
198 	/* update number of bits */
199 	if ((ctx->count[1] += (input_len << 3)) < (input_len << 3))
200 		ctx->count[0]++;
201 
202 	ctx->count[0] += (input_len >> 29);
203 
204 	buf_len = 64 - buf_index;
205 
206 	/* transform as many times as possible */
207 	i = 0;
208 	if (input_len >= buf_len) {
209 #ifdef _KERNEL
210 		kfpu_t *fpu;
211 		if (fpu_exists) {
212 			uint8_t fpua[sizeof (kfpu_t) + GSR_SIZE + VIS_ALIGN];
213 			uint32_t len = (input_len + buf_index) & ~0x3f;
214 			int svfp_ok;
215 
216 			fpu = (kfpu_t *)P2ROUNDUP((uintptr_t)fpua, 64);
217 			svfp_ok = ((len >= vis_sha1_svfp_threshold) ? 1 : 0);
218 			usevis = fpu_exists && sha1_savefp(fpu, svfp_ok);
219 		} else {
220 			usevis = 0;
221 		}
222 #endif /* _KERNEL */
223 
224 		/*
225 		 * general optimization:
226 		 *
227 		 * only do initial bcopy() and SHA1Transform() if
228 		 * buf_index != 0.  if buf_index == 0, we're just
229 		 * wasting our time doing the bcopy() since there
230 		 * wasn't any data left over from a previous call to
231 		 * SHA1Update().
232 		 */
233 
234 		if (buf_index) {
235 			bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
236 			if (usevis) {
237 				SHA1TransformVIS(X0,
238 				    ctx->buf_un.buf32,
239 				    &ctx->state[0], VIS);
240 			} else {
241 				SHA1_TRANSFORM(ctx, ctx->buf_un.buf8);
242 			}
243 			i = buf_len;
244 		}
245 
246 		/*
247 		 * VIS SHA-1: uses the VIS 1.0 instructions to accelerate
248 		 * SHA-1 processing. This is achieved by "offloading" the
249 		 * computation of the message schedule (MS) to the VIS units.
250 		 * This allows the VIS computation of the message schedule
251 		 * to be performed in parallel with the standard integer
252 		 * processing of the remainder of the SHA-1 computation.
253 		 * performance by up to around 1.37X, compared to an optimized
254 		 * integer-only implementation.
255 		 *
256 		 * The VIS implementation of SHA1Transform has a different API
257 		 * to the standard integer version:
258 		 *
259 		 * void SHA1TransformVIS(
260 		 *	 uint64_t *, // Pointer to MS for ith block
261 		 *	 uint32_t *, // Pointer to ith block of message data
262 		 *	 uint32_t *, // Pointer to SHA state i.e ctx->state
263 		 *	 uint64_t *, // Pointer to various VIS constants
264 		 * )
265 		 *
266 		 * Note: the message data must by 4-byte aligned.
267 		 *
268 		 * Function requires VIS 1.0 support.
269 		 *
270 		 * Handling is provided to deal with arbitrary byte alingment
271 		 * of the input data but the performance gains are reduced
272 		 * for alignments other than 4-bytes.
273 		 */
274 		if (usevis) {
275 			if (!IS_P2ALIGNED(&input[i], sizeof (uint32_t))) {
276 				/*
277 				 * Main processing loop - input misaligned
278 				 */
279 				for (; i + 63 < input_len; i += 64) {
280 				    bcopy(&input[i], input64, 64);
281 				    SHA1TransformVIS(X0, (uint32_t *)input64,
282 					&ctx->state[0], VIS);
283 				}
284 			} else {
285 				/*
286 				 * Main processing loop - input 8-byte aligned
287 				 */
288 				for (; i + 63 < input_len; i += 64) {
289 					SHA1TransformVIS(X0,
290 					    /* LINTED E_BAD_PTR_CAST_ALIGN */
291 					    (uint32_t *)&input[i],
292 					    &ctx->state[0], VIS);
293 				}
294 
295 			}
296 #ifdef _KERNEL
297 			sha1_restorefp(fpu);
298 #endif /* _KERNEL */
299 		} else {
300 			for (; i + 63 < input_len; i += 64) {
301 			    SHA1_TRANSFORM(ctx, &input[i]);
302 			}
303 		}
304 
305 		/*
306 		 * general optimization:
307 		 *
308 		 * if i and input_len are the same, return now instead
309 		 * of calling bcopy(), since the bcopy() in this case
310 		 * will be an expensive nop.
311 		 */
312 
313 		if (input_len == i)
314 			return;
315 
316 		buf_index = 0;
317 	}
318 
319 	/* buffer remaining input */
320 	bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
321 }
322 
323 #else /* VIS_SHA1 */
324 
325 void
326 SHA1Update(SHA1_CTX *ctx, const void *inptr, size_t input_len)
327 {
328 	uint32_t i, buf_index, buf_len;
329 	const uint8_t *input = inptr;
330 
331 	/* check for noop */
332 	if (input_len == 0)
333 		return;
334 
335 	/* compute number of bytes mod 64 */
336 	buf_index = (ctx->count[1] >> 3) & 0x3F;
337 
338 	/* update number of bits */
339 	if ((ctx->count[1] += (input_len << 3)) < (input_len << 3))
340 		ctx->count[0]++;
341 
342 	ctx->count[0] += (input_len >> 29);
343 
344 	buf_len = 64 - buf_index;
345 
346 	/* transform as many times as possible */
347 	i = 0;
348 	if (input_len >= buf_len) {
349 
350 		/*
351 		 * general optimization:
352 		 *
353 		 * only do initial bcopy() and SHA1Transform() if
354 		 * buf_index != 0.  if buf_index == 0, we're just
355 		 * wasting our time doing the bcopy() since there
356 		 * wasn't any data left over from a previous call to
357 		 * SHA1Update().
358 		 */
359 
360 		if (buf_index) {
361 			bcopy(input, &ctx->buf_un.buf8[buf_index], buf_len);
362 			SHA1_TRANSFORM(ctx, ctx->buf_un.buf8);
363 			i = buf_len;
364 		}
365 
366 		for (; i + 63 < input_len; i += 64)
367 			SHA1_TRANSFORM(ctx, &input[i]);
368 
369 		/*
370 		 * general optimization:
371 		 *
372 		 * if i and input_len are the same, return now instead
373 		 * of calling bcopy(), since the bcopy() in this case
374 		 * will be an expensive nop.
375 		 */
376 
377 		if (input_len == i)
378 			return;
379 
380 		buf_index = 0;
381 	}
382 
383 	/* buffer remaining input */
384 	bcopy(&input[i], &ctx->buf_un.buf8[buf_index], input_len - i);
385 }
386 
387 #endif /* VIS_SHA1 */
388 
389 /*
390  * SHA1Final()
391  *
392  * purpose: ends an sha1 digest operation, finalizing the message digest and
393  *          zeroing the context.
394  *   input: uint8_t *	: a buffer to store the digest in
395  *          SHA1_CTX *  : the context to finalize, save, and zero
396  *  output: void
397  */
398 
399 void
400 SHA1Final(void *digest, SHA1_CTX *ctx)
401 {
402 	uint8_t		bitcount_be[sizeof (ctx->count)];
403 	uint32_t	index = (ctx->count[1] >> 3) & 0x3f;
404 
405 	/* store bit count, big endian */
406 	Encode(bitcount_be, ctx->count, sizeof (bitcount_be));
407 
408 	/* pad out to 56 mod 64 */
409 	SHA1Update(ctx, PADDING, ((index < 56) ? 56 : 120) - index);
410 
411 	/* append length (before padding) */
412 	SHA1Update(ctx, bitcount_be, sizeof (bitcount_be));
413 
414 	/* store state in digest */
415 	Encode(digest, ctx->state, sizeof (ctx->state));
416 
417 	/* zeroize sensitive information */
418 	bzero(ctx, sizeof (*ctx));
419 }
420 
421 typedef uint32_t sha1word;
422 
423 /*
424  * sparc optimization:
425  *
426  * on the sparc, we can load big endian 32-bit data easily.  note that
427  * special care must be taken to ensure the address is 32-bit aligned.
428  * in the interest of speed, we don't check to make sure, since
429  * careful programming can guarantee this for us.
430  */
431 
432 #if	defined(_BIG_ENDIAN)
433 
434 #define	LOAD_BIG_32(addr)	(*(uint32_t *)(addr))
435 
436 #else	/* !defined(_BIG_ENDIAN) */
437 
438 #if	defined(HAVE_BSWAP)
439 
440 #define	LOAD_BIG_32(addr) bswap(*((uint32_t *)(addr)))
441 
442 #else	/* !defined(HAVE_BSWAP) */
443 
444 /* little endian -- will work on big endian, but slowly */
445 #define	LOAD_BIG_32(addr)	\
446 	(((addr)[0] << 24) | ((addr)[1] << 16) | ((addr)[2] << 8) | (addr)[3])
447 
448 #endif	/* !defined(HAVE_BSWAP) */
449 
450 #endif	/* !defined(_BIG_ENDIAN) */
451 
452 /*
453  * SHA1Transform()
454  */
455 #if	defined(W_ARRAY)
456 #define	W(n) w[n]
457 #else	/* !defined(W_ARRAY) */
458 #define	W(n) w_ ## n
459 #endif	/* !defined(W_ARRAY) */
460 
461 
462 #if	defined(__sparc)
463 
464 /*
465  * sparc register window optimization:
466  *
467  * `a', `b', `c', `d', and `e' are passed into SHA1Transform
468  * explicitly since it increases the number of registers available to
469  * the compiler.  under this scheme, these variables can be held in
470  * %i0 - %i4, which leaves more local and out registers available.
471  *
472  * purpose: sha1 transformation -- updates the digest based on `block'
473  *   input: uint32_t	: bytes  1 -  4 of the digest
474  *          uint32_t	: bytes  5 -  8 of the digest
475  *          uint32_t	: bytes  9 - 12 of the digest
476  *          uint32_t	: bytes 12 - 16 of the digest
477  *          uint32_t	: bytes 16 - 20 of the digest
478  *          SHA1_CTX *	: the context to update
479  *          uint8_t [64]: the block to use to update the digest
480  *  output: void
481  */
482 
483 void
484 SHA1Transform(uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e,
485     SHA1_CTX *ctx, const uint8_t blk[64])
486 {
487 	/*
488 	 * sparc optimization:
489 	 *
490 	 * while it is somewhat counter-intuitive, on sparc, it is
491 	 * more efficient to place all the constants used in this
492 	 * function in an array and load the values out of the array
493 	 * than to manually load the constants.  this is because
494 	 * setting a register to a 32-bit value takes two ops in most
495 	 * cases: a `sethi' and an `or', but loading a 32-bit value
496 	 * from memory only takes one `ld' (or `lduw' on v9).  while
497 	 * this increases memory usage, the compiler can find enough
498 	 * other things to do while waiting to keep the pipeline does
499 	 * not stall.  additionally, it is likely that many of these
500 	 * constants are cached so that later accesses do not even go
501 	 * out to the bus.
502 	 *
503 	 * this array is declared `static' to keep the compiler from
504 	 * having to bcopy() this array onto the stack frame of
505 	 * SHA1Transform() each time it is called -- which is
506 	 * unacceptably expensive.
507 	 *
508 	 * the `const' is to ensure that callers are good citizens and
509 	 * do not try to munge the array.  since these routines are
510 	 * going to be called from inside multithreaded kernelland,
511 	 * this is a good safety check. -- `sha1_consts' will end up in
512 	 * .rodata.
513 	 *
514 	 * unfortunately, loading from an array in this manner hurts
515 	 * performance under intel.  so, there is a macro,
516 	 * SHA1_CONST(), used in SHA1Transform(), that either expands to
517 	 * a reference to this array, or to the actual constant,
518 	 * depending on what platform this code is compiled for.
519 	 */
520 
521 	static const uint32_t sha1_consts[] = {
522 		SHA1_CONST_0,	SHA1_CONST_1,	SHA1_CONST_2,	SHA1_CONST_3,
523 	};
524 
525 	/*
526 	 * general optimization:
527 	 *
528 	 * use individual integers instead of using an array.  this is a
529 	 * win, although the amount it wins by seems to vary quite a bit.
530 	 */
531 
532 	uint32_t	w_0, w_1, w_2,  w_3,  w_4,  w_5,  w_6,  w_7;
533 	uint32_t	w_8, w_9, w_10, w_11, w_12, w_13, w_14, w_15;
534 
535 	/*
536 	 * sparc optimization:
537 	 *
538 	 * if `block' is already aligned on a 4-byte boundary, use
539 	 * LOAD_BIG_32() directly.  otherwise, bcopy() into a
540 	 * buffer that *is* aligned on a 4-byte boundary and then do
541 	 * the LOAD_BIG_32() on that buffer.  benchmarks have shown
542 	 * that using the bcopy() is better than loading the bytes
543 	 * individually and doing the endian-swap by hand.
544 	 *
545 	 * even though it's quite tempting to assign to do:
546 	 *
547 	 * blk = bcopy(ctx->buf_un.buf32, blk, sizeof (ctx->buf_un.buf32));
548 	 *
549 	 * and only have one set of LOAD_BIG_32()'s, the compiler
550 	 * *does not* like that, so please resist the urge.
551 	 */
552 
553 	if ((uintptr_t)blk & 0x3) {		/* not 4-byte aligned? */
554 		bcopy(blk, ctx->buf_un.buf32,  sizeof (ctx->buf_un.buf32));
555 		w_15 = LOAD_BIG_32(ctx->buf_un.buf32 + 15);
556 		w_14 = LOAD_BIG_32(ctx->buf_un.buf32 + 14);
557 		w_13 = LOAD_BIG_32(ctx->buf_un.buf32 + 13);
558 		w_12 = LOAD_BIG_32(ctx->buf_un.buf32 + 12);
559 		w_11 = LOAD_BIG_32(ctx->buf_un.buf32 + 11);
560 		w_10 = LOAD_BIG_32(ctx->buf_un.buf32 + 10);
561 		w_9  = LOAD_BIG_32(ctx->buf_un.buf32 +  9);
562 		w_8  = LOAD_BIG_32(ctx->buf_un.buf32 +  8);
563 		w_7  = LOAD_BIG_32(ctx->buf_un.buf32 +  7);
564 		w_6  = LOAD_BIG_32(ctx->buf_un.buf32 +  6);
565 		w_5  = LOAD_BIG_32(ctx->buf_un.buf32 +  5);
566 		w_4  = LOAD_BIG_32(ctx->buf_un.buf32 +  4);
567 		w_3  = LOAD_BIG_32(ctx->buf_un.buf32 +  3);
568 		w_2  = LOAD_BIG_32(ctx->buf_un.buf32 +  2);
569 		w_1  = LOAD_BIG_32(ctx->buf_un.buf32 +  1);
570 		w_0  = LOAD_BIG_32(ctx->buf_un.buf32 +  0);
571 	} else {
572 		/*LINTED*/
573 		w_15 = LOAD_BIG_32(blk + 60);
574 		/*LINTED*/
575 		w_14 = LOAD_BIG_32(blk + 56);
576 		/*LINTED*/
577 		w_13 = LOAD_BIG_32(blk + 52);
578 		/*LINTED*/
579 		w_12 = LOAD_BIG_32(blk + 48);
580 		/*LINTED*/
581 		w_11 = LOAD_BIG_32(blk + 44);
582 		/*LINTED*/
583 		w_10 = LOAD_BIG_32(blk + 40);
584 		/*LINTED*/
585 		w_9  = LOAD_BIG_32(blk + 36);
586 		/*LINTED*/
587 		w_8  = LOAD_BIG_32(blk + 32);
588 		/*LINTED*/
589 		w_7  = LOAD_BIG_32(blk + 28);
590 		/*LINTED*/
591 		w_6  = LOAD_BIG_32(blk + 24);
592 		/*LINTED*/
593 		w_5  = LOAD_BIG_32(blk + 20);
594 		/*LINTED*/
595 		w_4  = LOAD_BIG_32(blk + 16);
596 		/*LINTED*/
597 		w_3  = LOAD_BIG_32(blk + 12);
598 		/*LINTED*/
599 		w_2  = LOAD_BIG_32(blk +  8);
600 		/*LINTED*/
601 		w_1  = LOAD_BIG_32(blk +  4);
602 		/*LINTED*/
603 		w_0  = LOAD_BIG_32(blk +  0);
604 	}
605 #else	/* !defined(__sparc) */
606 
607 void
608 SHA1Transform(SHA1_CTX *ctx, const uint8_t blk[64])
609 {
610 	sha1word a = ctx->state[0];
611 	sha1word b = ctx->state[1];
612 	sha1word c = ctx->state[2];
613 	sha1word d = ctx->state[3];
614 	sha1word e = ctx->state[4];
615 
616 #if	defined(W_ARRAY)
617 	sha1word	w[16];
618 #else	/* !defined(W_ARRAY) */
619 	sha1word	w_0, w_1, w_2,  w_3,  w_4,  w_5,  w_6,  w_7;
620 	sha1word	w_8, w_9, w_10, w_11, w_12, w_13, w_14, w_15;
621 #endif	/* !defined(W_ARRAY) */
622 
623 	W(0)  = LOAD_BIG_32(blk +  0);
624 	W(1)  = LOAD_BIG_32(blk +  4);
625 	W(2)  = LOAD_BIG_32(blk +  8);
626 	W(3)  = LOAD_BIG_32(blk + 12);
627 	W(4)  = LOAD_BIG_32(blk + 16);
628 	W(5)  = LOAD_BIG_32(blk + 20);
629 	W(6)  = LOAD_BIG_32(blk + 24);
630 	W(7)  = LOAD_BIG_32(blk + 28);
631 	W(8)  = LOAD_BIG_32(blk + 32);
632 	W(9)  = LOAD_BIG_32(blk + 36);
633 	W(10) = LOAD_BIG_32(blk + 40);
634 	W(11) = LOAD_BIG_32(blk + 44);
635 	W(12) = LOAD_BIG_32(blk + 48);
636 	W(13) = LOAD_BIG_32(blk + 52);
637 	W(14) = LOAD_BIG_32(blk + 56);
638 	W(15) = LOAD_BIG_32(blk + 60);
639 
640 #endif	/* !defined(__sparc) */
641 
642 	/*
643 	 * general optimization:
644 	 *
645 	 * even though this approach is described in the standard as
646 	 * being slower algorithmically, it is 30-40% faster than the
647 	 * "faster" version under SPARC, because this version has more
648 	 * of the constraints specified at compile-time and uses fewer
649 	 * variables (and therefore has better register utilization)
650 	 * than its "speedier" brother.  (i've tried both, trust me)
651 	 *
652 	 * for either method given in the spec, there is an "assignment"
653 	 * phase where the following takes place:
654 	 *
655 	 *	tmp = (main_computation);
656 	 *	e = d; d = c; c = rotate_left(b, 30); b = a; a = tmp;
657 	 *
658 	 * we can make the algorithm go faster by not doing this work,
659 	 * but just pretending that `d' is now `e', etc. this works
660 	 * really well and obviates the need for a temporary variable.
661 	 * however, we still explictly perform the rotate action,
662 	 * since it is cheaper on SPARC to do it once than to have to
663 	 * do it over and over again.
664 	 */
665 
666 	/* round 1 */
667 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(0) + SHA1_CONST(0); /* 0 */
668 	b = ROTATE_LEFT(b, 30);
669 
670 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(1) + SHA1_CONST(0); /* 1 */
671 	a = ROTATE_LEFT(a, 30);
672 
673 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(2) + SHA1_CONST(0); /* 2 */
674 	e = ROTATE_LEFT(e, 30);
675 
676 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(3) + SHA1_CONST(0); /* 3 */
677 	d = ROTATE_LEFT(d, 30);
678 
679 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(4) + SHA1_CONST(0); /* 4 */
680 	c = ROTATE_LEFT(c, 30);
681 
682 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(5) + SHA1_CONST(0); /* 5 */
683 	b = ROTATE_LEFT(b, 30);
684 
685 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(6) + SHA1_CONST(0); /* 6 */
686 	a = ROTATE_LEFT(a, 30);
687 
688 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(7) + SHA1_CONST(0); /* 7 */
689 	e = ROTATE_LEFT(e, 30);
690 
691 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(8) + SHA1_CONST(0); /* 8 */
692 	d = ROTATE_LEFT(d, 30);
693 
694 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(9) + SHA1_CONST(0); /* 9 */
695 	c = ROTATE_LEFT(c, 30);
696 
697 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(10) + SHA1_CONST(0); /* 10 */
698 	b = ROTATE_LEFT(b, 30);
699 
700 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(11) + SHA1_CONST(0); /* 11 */
701 	a = ROTATE_LEFT(a, 30);
702 
703 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(12) + SHA1_CONST(0); /* 12 */
704 	e = ROTATE_LEFT(e, 30);
705 
706 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(13) + SHA1_CONST(0); /* 13 */
707 	d = ROTATE_LEFT(d, 30);
708 
709 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(14) + SHA1_CONST(0); /* 14 */
710 	c = ROTATE_LEFT(c, 30);
711 
712 	e = ROTATE_LEFT(a, 5) + F(b, c, d) + e + W(15) + SHA1_CONST(0); /* 15 */
713 	b = ROTATE_LEFT(b, 30);
714 
715 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 16 */
716 	d = ROTATE_LEFT(e, 5) + F(a, b, c) + d + W(0) + SHA1_CONST(0);
717 	a = ROTATE_LEFT(a, 30);
718 
719 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 17 */
720 	c = ROTATE_LEFT(d, 5) + F(e, a, b) + c + W(1) + SHA1_CONST(0);
721 	e = ROTATE_LEFT(e, 30);
722 
723 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 18 */
724 	b = ROTATE_LEFT(c, 5) + F(d, e, a) + b + W(2) + SHA1_CONST(0);
725 	d = ROTATE_LEFT(d, 30);
726 
727 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 19 */
728 	a = ROTATE_LEFT(b, 5) + F(c, d, e) + a + W(3) + SHA1_CONST(0);
729 	c = ROTATE_LEFT(c, 30);
730 
731 	/* round 2 */
732 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 20 */
733 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(4) + SHA1_CONST(1);
734 	b = ROTATE_LEFT(b, 30);
735 
736 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 21 */
737 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(5) + SHA1_CONST(1);
738 	a = ROTATE_LEFT(a, 30);
739 
740 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 22 */
741 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(6) + SHA1_CONST(1);
742 	e = ROTATE_LEFT(e, 30);
743 
744 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 23 */
745 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(7) + SHA1_CONST(1);
746 	d = ROTATE_LEFT(d, 30);
747 
748 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 24 */
749 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(8) + SHA1_CONST(1);
750 	c = ROTATE_LEFT(c, 30);
751 
752 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 25 */
753 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(9) + SHA1_CONST(1);
754 	b = ROTATE_LEFT(b, 30);
755 
756 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 26 */
757 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(10) + SHA1_CONST(1);
758 	a = ROTATE_LEFT(a, 30);
759 
760 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 27 */
761 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(11) + SHA1_CONST(1);
762 	e = ROTATE_LEFT(e, 30);
763 
764 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 28 */
765 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(12) + SHA1_CONST(1);
766 	d = ROTATE_LEFT(d, 30);
767 
768 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 29 */
769 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(13) + SHA1_CONST(1);
770 	c = ROTATE_LEFT(c, 30);
771 
772 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 30 */
773 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(14) + SHA1_CONST(1);
774 	b = ROTATE_LEFT(b, 30);
775 
776 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 31 */
777 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(15) + SHA1_CONST(1);
778 	a = ROTATE_LEFT(a, 30);
779 
780 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 32 */
781 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(0) + SHA1_CONST(1);
782 	e = ROTATE_LEFT(e, 30);
783 
784 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 33 */
785 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(1) + SHA1_CONST(1);
786 	d = ROTATE_LEFT(d, 30);
787 
788 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 34 */
789 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(2) + SHA1_CONST(1);
790 	c = ROTATE_LEFT(c, 30);
791 
792 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 35 */
793 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(3) + SHA1_CONST(1);
794 	b = ROTATE_LEFT(b, 30);
795 
796 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 36 */
797 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(4) + SHA1_CONST(1);
798 	a = ROTATE_LEFT(a, 30);
799 
800 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 37 */
801 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(5) + SHA1_CONST(1);
802 	e = ROTATE_LEFT(e, 30);
803 
804 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 38 */
805 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(6) + SHA1_CONST(1);
806 	d = ROTATE_LEFT(d, 30);
807 
808 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 39 */
809 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(7) + SHA1_CONST(1);
810 	c = ROTATE_LEFT(c, 30);
811 
812 	/* round 3 */
813 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 40 */
814 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(8) + SHA1_CONST(2);
815 	b = ROTATE_LEFT(b, 30);
816 
817 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 41 */
818 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(9) + SHA1_CONST(2);
819 	a = ROTATE_LEFT(a, 30);
820 
821 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 42 */
822 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(10) + SHA1_CONST(2);
823 	e = ROTATE_LEFT(e, 30);
824 
825 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 43 */
826 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(11) + SHA1_CONST(2);
827 	d = ROTATE_LEFT(d, 30);
828 
829 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 44 */
830 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(12) + SHA1_CONST(2);
831 	c = ROTATE_LEFT(c, 30);
832 
833 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 45 */
834 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(13) + SHA1_CONST(2);
835 	b = ROTATE_LEFT(b, 30);
836 
837 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 46 */
838 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(14) + SHA1_CONST(2);
839 	a = ROTATE_LEFT(a, 30);
840 
841 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 47 */
842 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(15) + SHA1_CONST(2);
843 	e = ROTATE_LEFT(e, 30);
844 
845 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 48 */
846 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(0) + SHA1_CONST(2);
847 	d = ROTATE_LEFT(d, 30);
848 
849 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 49 */
850 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(1) + SHA1_CONST(2);
851 	c = ROTATE_LEFT(c, 30);
852 
853 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 50 */
854 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(2) + SHA1_CONST(2);
855 	b = ROTATE_LEFT(b, 30);
856 
857 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 51 */
858 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(3) + SHA1_CONST(2);
859 	a = ROTATE_LEFT(a, 30);
860 
861 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 52 */
862 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(4) + SHA1_CONST(2);
863 	e = ROTATE_LEFT(e, 30);
864 
865 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 53 */
866 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(5) + SHA1_CONST(2);
867 	d = ROTATE_LEFT(d, 30);
868 
869 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 54 */
870 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(6) + SHA1_CONST(2);
871 	c = ROTATE_LEFT(c, 30);
872 
873 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 55 */
874 	e = ROTATE_LEFT(a, 5) + H(b, c, d) + e + W(7) + SHA1_CONST(2);
875 	b = ROTATE_LEFT(b, 30);
876 
877 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 56 */
878 	d = ROTATE_LEFT(e, 5) + H(a, b, c) + d + W(8) + SHA1_CONST(2);
879 	a = ROTATE_LEFT(a, 30);
880 
881 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 57 */
882 	c = ROTATE_LEFT(d, 5) + H(e, a, b) + c + W(9) + SHA1_CONST(2);
883 	e = ROTATE_LEFT(e, 30);
884 
885 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 58 */
886 	b = ROTATE_LEFT(c, 5) + H(d, e, a) + b + W(10) + SHA1_CONST(2);
887 	d = ROTATE_LEFT(d, 30);
888 
889 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 59 */
890 	a = ROTATE_LEFT(b, 5) + H(c, d, e) + a + W(11) + SHA1_CONST(2);
891 	c = ROTATE_LEFT(c, 30);
892 
893 	/* round 4 */
894 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 60 */
895 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(12) + SHA1_CONST(3);
896 	b = ROTATE_LEFT(b, 30);
897 
898 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 61 */
899 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(13) + SHA1_CONST(3);
900 	a = ROTATE_LEFT(a, 30);
901 
902 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 62 */
903 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(14) + SHA1_CONST(3);
904 	e = ROTATE_LEFT(e, 30);
905 
906 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 63 */
907 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(15) + SHA1_CONST(3);
908 	d = ROTATE_LEFT(d, 30);
909 
910 	W(0) = ROTATE_LEFT((W(13) ^ W(8) ^ W(2) ^ W(0)), 1);		/* 64 */
911 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(0) + SHA1_CONST(3);
912 	c = ROTATE_LEFT(c, 30);
913 
914 	W(1) = ROTATE_LEFT((W(14) ^ W(9) ^ W(3) ^ W(1)), 1);		/* 65 */
915 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(1) + SHA1_CONST(3);
916 	b = ROTATE_LEFT(b, 30);
917 
918 	W(2) = ROTATE_LEFT((W(15) ^ W(10) ^ W(4) ^ W(2)), 1);	/* 66 */
919 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(2) + SHA1_CONST(3);
920 	a = ROTATE_LEFT(a, 30);
921 
922 	W(3) = ROTATE_LEFT((W(0) ^ W(11) ^ W(5) ^ W(3)), 1);		/* 67 */
923 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(3) + SHA1_CONST(3);
924 	e = ROTATE_LEFT(e, 30);
925 
926 	W(4) = ROTATE_LEFT((W(1) ^ W(12) ^ W(6) ^ W(4)), 1);		/* 68 */
927 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(4) + SHA1_CONST(3);
928 	d = ROTATE_LEFT(d, 30);
929 
930 	W(5) = ROTATE_LEFT((W(2) ^ W(13) ^ W(7) ^ W(5)), 1);		/* 69 */
931 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(5) + SHA1_CONST(3);
932 	c = ROTATE_LEFT(c, 30);
933 
934 	W(6) = ROTATE_LEFT((W(3) ^ W(14) ^ W(8) ^ W(6)), 1);		/* 70 */
935 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(6) + SHA1_CONST(3);
936 	b = ROTATE_LEFT(b, 30);
937 
938 	W(7) = ROTATE_LEFT((W(4) ^ W(15) ^ W(9) ^ W(7)), 1);		/* 71 */
939 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(7) + SHA1_CONST(3);
940 	a = ROTATE_LEFT(a, 30);
941 
942 	W(8) = ROTATE_LEFT((W(5) ^ W(0) ^ W(10) ^ W(8)), 1);		/* 72 */
943 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(8) + SHA1_CONST(3);
944 	e = ROTATE_LEFT(e, 30);
945 
946 	W(9) = ROTATE_LEFT((W(6) ^ W(1) ^ W(11) ^ W(9)), 1);		/* 73 */
947 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(9) + SHA1_CONST(3);
948 	d = ROTATE_LEFT(d, 30);
949 
950 	W(10) = ROTATE_LEFT((W(7) ^ W(2) ^ W(12) ^ W(10)), 1);	/* 74 */
951 	a = ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(10) + SHA1_CONST(3);
952 	c = ROTATE_LEFT(c, 30);
953 
954 	W(11) = ROTATE_LEFT((W(8) ^ W(3) ^ W(13) ^ W(11)), 1);	/* 75 */
955 	e = ROTATE_LEFT(a, 5) + G(b, c, d) + e + W(11) + SHA1_CONST(3);
956 	b = ROTATE_LEFT(b, 30);
957 
958 	W(12) = ROTATE_LEFT((W(9) ^ W(4) ^ W(14) ^ W(12)), 1);	/* 76 */
959 	d = ROTATE_LEFT(e, 5) + G(a, b, c) + d + W(12) + SHA1_CONST(3);
960 	a = ROTATE_LEFT(a, 30);
961 
962 	W(13) = ROTATE_LEFT((W(10) ^ W(5) ^ W(15) ^ W(13)), 1);	/* 77 */
963 	c = ROTATE_LEFT(d, 5) + G(e, a, b) + c + W(13) + SHA1_CONST(3);
964 	e = ROTATE_LEFT(e, 30);
965 
966 	W(14) = ROTATE_LEFT((W(11) ^ W(6) ^ W(0) ^ W(14)), 1);	/* 78 */
967 	b = ROTATE_LEFT(c, 5) + G(d, e, a) + b + W(14) + SHA1_CONST(3);
968 	d = ROTATE_LEFT(d, 30);
969 
970 	W(15) = ROTATE_LEFT((W(12) ^ W(7) ^ W(1) ^ W(15)), 1);	/* 79 */
971 
972 	ctx->state[0] += ROTATE_LEFT(b, 5) + G(c, d, e) + a + W(15) +
973 	    SHA1_CONST(3);
974 	ctx->state[1] += b;
975 	ctx->state[2] += ROTATE_LEFT(c, 30);
976 	ctx->state[3] += d;
977 	ctx->state[4] += e;
978 
979 	/* zeroize sensitive information */
980 	W(0) = W(1) = W(2) = W(3) = W(4) = W(5) = W(6) = W(7) = W(8) = 0;
981 	W(9) = W(10) = W(11) = W(12) = W(13) = W(14) = W(15) = 0;
982 }
983 
984 /*
985  * Encode()
986  *
987  * purpose: to convert a list of numbers from little endian to big endian
988  *   input: uint8_t *	: place to store the converted big endian numbers
989  *	    uint32_t *	: place to get numbers to convert from
990  *          size_t	: the length of the input in bytes
991  *  output: void
992  */
993 
994 static void
995 Encode(uint8_t *_RESTRICT_KYWD output, const uint32_t *_RESTRICT_KYWD input,
996     size_t len)
997 {
998 	size_t		i, j;
999 
1000 #if	defined(__sparc)
1001 	if (IS_P2ALIGNED(output, sizeof (uint32_t))) {
1002 		for (i = 0, j = 0; j < len; i++, j += 4) {
1003 			/* LINTED: pointer alignment */
1004 			*((uint32_t *)(output + j)) = input[i];
1005 		}
1006 	} else {
1007 #endif	/* little endian -- will work on big endian, but slowly */
1008 		for (i = 0, j = 0; j < len; i++, j += 4) {
1009 			output[j]	= (input[i] >> 24) & 0xff;
1010 			output[j + 1]	= (input[i] >> 16) & 0xff;
1011 			output[j + 2]	= (input[i] >>  8) & 0xff;
1012 			output[j + 3]	= input[i] & 0xff;
1013 		}
1014 #if	defined(__sparc)
1015 	}
1016 #endif
1017 }
1018