
/*
 * The Initial Developer of the Original Code is International
 * Business Machines Corporation. Portions created by IBM
 * Corporation are Copyright (C) 2005 International Business
 * Machines Corporation. All Rights Reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the Common Public License as published by
 * IBM Corporation; either version 1 of the License, or (at your option)
 * any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * Common Public License for more details.
 *
 * You should have received a copy of the Common Public License
 * along with this program; if not, a copy can be viewed at
 * http://www.opensource.org/licenses/cpl1.0.php.
 */

/* (C) COPYRIGHT International Business Machines Corp. 2001, 2002, 2005 */


// File:  mech_sha.c
//
// Mechanisms for SHA-1 related routines
//
// The following applies to the software SHA implementation:
//    Written 2 September 1992, Peter C. Gutmann.
//    This implementation placed in the public domain.
//
//    Modified 1 June 1993, Colin Plumb.
//    Modified for the new SHS based on Peter Gutmann's work,
//    18 July 1994, Colin Plumb.
//    Gutmann's work.
//    Renamed to SHA and comments updated a bit 1 November 1995, Colin Plumb.
//    These modifications placed in the public domain.
//
//    Comments to pgut1@cs.aukuni.ac.nz
//

//#include <windows.h>

#include <pthread.h>
#include <string.h>            // for memcmp() et al
#include <stdlib.h>
#include <memory.h>

#include "pkcs11/pkcs11types.h"
#include <pkcs11/stdll.h>
#include "defs.h"
#include "host_defs.h"
#include "h_extern.h"
#include "tok_spec_struct.h"

#define SHA_HARDWARE_THRESHHOLD 128000

// The SHA f()-functions.  The f1 and f3 functions can be optimized to
// save one boolean operation each - thanks to Rich Schroeppel,
// rcs@cs.arizona.edu for discovering this
//
#define f1(x,y,z) (z ^ (x & (y ^ z)))        // Rounds  0-19
#define f2(x,y,z) (x ^ y ^ z)                // Rounds 20-39
#define f3(x,y,z) ((x & y) | (z & (x | y)))  // Rounds 40-59
#define f4(x,y,z) (x ^ y ^ z)                // Rounds 60-79

// The SHA Mysterious Constants.
// K1 = floor(sqrt(2)  * 2^30)
// K2 = floor(sqrt(3)  * 2^30)
// K3 = floor(sqrt(5)  * 2^30)
// K4 = floor(sqrt(10) * 2^30)
//
#define K1  0x5A827999L // Rounds  0-19
#define K2  0x6ED9EBA1L // Rounds 20-39
#define K3  0x8F1BBCDCL // Rounds 40-59
#define K4  0xCA62C1D6L // Rounds 60-79

// SHA initial values
//
#define h0init 0x67452301
#define h1init 0xEFCDAB89
#define h2init 0x98BADCFE
#define h3init 0x10325476
#define h4init 0xC3D2E1F0

//
// Note that it may be necessary to add parentheses to these macros
// if they are to be called with expressions as arguments.
//

// 32-bit rotate left - kludged with shifts
//

#define ROTL(n,X)  ((X << n) | (X >> (32-n)))

// The initial expanding function
//
// The hash function is defined over an 80-word expanded input array W,
// where the first 16 are copies of the input data, and the remaining 64
// are defined by W[i] = W[i-16] ^ W[i-14] ^ W[i-8] ^ W[i-3].  This
// implementation generates these values on the fly in a circular buffer.
//

#define expand(W,i) \
   (W[i&15] ^= W[(i-14)&15] ^ W[(i-8)&15] ^ W[(i-3)&15], W[i&15] = ROTL(1, W[i&15]))

// The prototype SHA sub-round
//
// The fundamental sub-round is
// a' = e + ROTL(5,a) + f(b, c, d) + k + data;
// b' = a;
// c' = ROTL(30,b);
// d' = c;
// e' = d;
// ... but this is implemented by unrolling the loop 5 times and renaming
// the variables (e,a,b,c,d) = (a',b',c',d',e') each iteration.
//
#define subRound(a, b, c, d, e, f, k, data)  \
   (e += ROTL(5,a) + f(b, c, d) + k + data, b = ROTL(30, b))


void shaInit( SHA1_CONTEXT *ctx );
void shaUpdate( SHA1_CONTEXT *ctx, CK_BYTE const *buffer, CK_ULONG count);
void shaFinal( SHA1_CONTEXT *ctx, CK_BYTE *hash );
void shaTransform( SHA1_CONTEXT *ctx );

//
//
CK_RV
sha1_hash( SESSION         *sess,
           CK_BBOOL         length_only,
           DIGEST_CONTEXT  *ctx,
           CK_BYTE         *in_data,
           CK_ULONG         in_data_len,
           CK_BYTE         *out_data,
           CK_ULONG        *out_data_len )
{
   CK_RV rv;
   
   if (!sess || !ctx || !out_data_len){
      st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
      return CKR_FUNCTION_FAILED;
   }
   if (length_only == TRUE) {
      *out_data_len = SHA1_HASH_SIZE;
      return CKR_OK;
   }

   if(ctx->context == NULL)
	   return CKR_HOST_MEMORY;

   if((rv = (ckm_sha1_update(ctx, in_data, in_data_len))))
	   return rv;
   
   return ckm_sha1_final(  ctx, out_data, out_data_len );
}


//
//
CK_RV
sha1_hash_update( SESSION        * sess,
                  DIGEST_CONTEXT * ctx,
                  CK_BYTE        * in_data,
                  CK_ULONG         in_data_len )
{
   if (!sess || !in_data){
      st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
      return CKR_FUNCTION_FAILED;
   }
   return ckm_sha1_update( ctx, in_data, in_data_len );
}


//
//
CK_RV
sha1_hash_final( SESSION         * sess,
                 CK_BYTE           length_only,
                 DIGEST_CONTEXT  * ctx,
                 CK_BYTE         * out_data,
                 CK_ULONG        * out_data_len )
{
   if (!sess || !ctx || !out_data_len){
      st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
      return CKR_FUNCTION_FAILED;
   }
   if (length_only == TRUE) {
      *out_data_len = SHA1_HASH_SIZE;
      return CKR_OK;
   }

   return ckm_sha1_final( ctx, out_data, out_data_len );
}


// this routine gets called for two mechanisms actually:
//    CKM_SHA_1_HMAC
//    CKM_SHA_1_HMAC_GENERAL
//
CK_RV
sha1_hmac_sign( SESSION              * sess,
                CK_BBOOL               length_only,
                SIGN_VERIFY_CONTEXT  * ctx,
                CK_BYTE              * in_data,
                CK_ULONG               in_data_len,
                CK_BYTE              * out_data,
                CK_ULONG             * out_data_len )
{
   OBJECT          * key_obj = NULL;
   CK_ATTRIBUTE    * attr    = NULL;
   CK_BYTE           hash[SHA1_HASH_SIZE];
   DIGEST_CONTEXT    digest_ctx;
   CK_MECHANISM      digest_mech;
   CK_BYTE           k_ipad[SHA1_BLOCK_SIZE];
   CK_BYTE           k_opad[SHA1_BLOCK_SIZE];
   CK_ULONG          key_bytes, hash_len, hmac_len;
   CK_ULONG          i;
   CK_RV             rc;


   if (!sess || !ctx || !out_data_len){
      st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
      return CKR_FUNCTION_FAILED;
   }

   if (ctx->mech.mechanism == CKM_SHA_1_HMAC_GENERAL) {
      hmac_len = *(CK_ULONG *)ctx->mech.pParameter;

      if (hmac_len == 0) {
         *out_data_len = 0;
         return CKR_OK;
      }
   }
   else
      hmac_len = SHA1_HASH_SIZE;


   if (length_only == TRUE) {
      *out_data_len = hmac_len;
      return CKR_OK;
   }

   memset( &digest_ctx, 0x0, sizeof(DIGEST_CONTEXT) );

   rc = object_mgr_find_in_map1( ctx->key, &key_obj );
   if (rc != CKR_OK){
      st_err_log(110, __FILE__, __LINE__);
      return rc;
   }
   rc = template_attribute_find( key_obj->template, CKA_VALUE, &attr );
   if (rc == FALSE){
      st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
      return CKR_FUNCTION_FAILED;
   }
   else
      key_bytes = attr->ulValueLen;


   // build (K XOR ipad), (K XOR opad)
   //
   if (key_bytes > SHA1_BLOCK_SIZE) {
      digest_mech.mechanism      = CKM_SHA_1;
      digest_mech.ulParameterLen = 0;
      digest_mech.pParameter     = NULL;

      rc = digest_mgr_init( sess, &digest_ctx, &digest_mech );
      if (rc != CKR_OK) {
         digest_mgr_cleanup( &digest_ctx );
         st_err_log(123, __FILE__, __LINE__);
         return rc;
      }

      hash_len = sizeof(hash);
      rc = digest_mgr_digest( sess, FALSE, &digest_ctx,
                              attr->pValue,
                              attr->ulValueLen,
                              hash,  &hash_len );
      if (rc != CKR_OK) {
         digest_mgr_cleanup( &digest_ctx );
         st_err_log(124, __FILE__, __LINE__);
         return rc;
      }

      digest_mgr_cleanup( &digest_ctx );
      memset( &digest_ctx, 0x0, sizeof(DIGEST_CONTEXT) );

      for (i=0; i < hash_len; i++) {
         k_ipad[i] = hash[i] ^ 0x36;
         k_opad[i] = hash[i] ^ 0x5C;
      }

      memset( &k_ipad[i], 0x36, SHA1_BLOCK_SIZE - i);
      memset( &k_opad[i], 0x5C, SHA1_BLOCK_SIZE - i);
   }
   else {
      CK_BYTE *key = attr->pValue;

      for (i=0; i < key_bytes; i++) {
         k_ipad[i] = key[i] ^ 0x36;
         k_opad[i] = key[i] ^ 0x5C;
      }

      memset( &k_ipad[i], 0x36, SHA1_BLOCK_SIZE - key_bytes );
      memset( &k_opad[i], 0x5C, SHA1_BLOCK_SIZE - key_bytes );
   }

   digest_mech.mechanism      = CKM_SHA_1;
   digest_mech.ulParameterLen = 0;
   digest_mech.pParameter     = NULL;

   // inner hash
   //
   rc = digest_mgr_init( sess, &digest_ctx, &digest_mech );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(123, __FILE__, __LINE__);
      return rc;
   }

   rc = digest_mgr_digest_update( sess, &digest_ctx, k_ipad, SHA1_BLOCK_SIZE );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(123, __FILE__, __LINE__);
      return rc;
   }

   rc = digest_mgr_digest_update( sess, &digest_ctx, in_data, in_data_len );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(123, __FILE__, __LINE__);
      return rc;
   }

   hash_len = sizeof(hash);
   rc = digest_mgr_digest_final( sess, FALSE, &digest_ctx, hash, &hash_len );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(126, __FILE__, __LINE__);
      return rc;
   }

   digest_mgr_cleanup( &digest_ctx );
   memset( &digest_ctx, 0x0, sizeof(DIGEST_CONTEXT) );


   // outer hash
   //
   rc = digest_mgr_init( sess, &digest_ctx, &digest_mech );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(123, __FILE__, __LINE__);
      return rc;
   }

   rc = digest_mgr_digest_update( sess, &digest_ctx, k_opad, SHA1_BLOCK_SIZE );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(123, __FILE__, __LINE__);
      return rc;
   }

   rc = digest_mgr_digest_update( sess, &digest_ctx, hash, hash_len );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(123, __FILE__, __LINE__);
      return rc;
   }

   hash_len = sizeof(hash);
   rc = digest_mgr_digest_final( sess, FALSE, &digest_ctx, hash, &hash_len );
   if (rc != CKR_OK) {
      digest_mgr_cleanup( &digest_ctx );
      st_err_log(126, __FILE__, __LINE__);
      return rc;
   }

   memcpy( out_data, hash, hmac_len );
   *out_data_len = hmac_len;

   digest_mgr_cleanup( &digest_ctx );

   return CKR_OK;
}


//
//
CK_RV
sha1_hmac_verify( SESSION              * sess,
                  SIGN_VERIFY_CONTEXT  * ctx,
                  CK_BYTE              * in_data,
                  CK_ULONG               in_data_len,
                  CK_BYTE              * signature,
                  CK_ULONG               sig_len )
{
   CK_BYTE              hmac[SHA1_HASH_SIZE];
   SIGN_VERIFY_CONTEXT  hmac_ctx;
   CK_ULONG             hmac_len, len;
   CK_RV                rc;

   if (!sess || !ctx || !in_data || !signature){
      st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
      return CKR_FUNCTION_FAILED;
   }
   if (ctx->mech.mechanism == CKM_SHA_1_HMAC_GENERAL)
      hmac_len = *(CK_ULONG *)ctx->mech.pParameter;
   else
      hmac_len = SHA1_HASH_SIZE;

   memset( &hmac_ctx, 0, sizeof(SIGN_VERIFY_CONTEXT) );

   rc = sign_mgr_init( sess, &hmac_ctx, &ctx->mech, FALSE, ctx->key );
   if (rc != CKR_OK){
      st_err_log(127, __FILE__, __LINE__);
      goto done;
   }
   len = sizeof(hmac);
   rc = sign_mgr_sign( sess, FALSE, &hmac_ctx,
                       in_data, in_data_len,
                       hmac,   &len );
   if (rc != CKR_OK){
      st_err_log(128, __FILE__, __LINE__);
      goto done;
   }
   if ((len != hmac_len) || (len != sig_len)) {
      st_err_log(46, __FILE__, __LINE__);
      rc = CKR_SIGNATURE_LEN_RANGE;
      goto done;
   }

   if (memcmp(hmac, signature, hmac_len) != 0){
      st_err_log(47, __FILE__, __LINE__);
      rc = CKR_SIGNATURE_INVALID;
   }
done:
   sign_mgr_cleanup( &hmac_ctx );
   return rc;
}


//
// CKM routines
//

//
//
CK_RV
ckm_sha1_update( DIGEST_CONTEXT * ctx,
                 CK_BYTE        * in_data,
                 CK_ULONG         in_data_len )
{
    if( token_specific.t_sha_update == NULL ){
	if (!ctx || !in_data){
	    st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
	    return CKR_FUNCTION_FAILED;
	}
	shaUpdate( (SHA1_CONTEXT *)ctx->context, in_data, in_data_len );
	return CKR_OK;
    }

    return token_specific.t_sha_update(ctx, in_data, in_data_len);
}


//
//
CK_RV
ckm_sha1_final( DIGEST_CONTEXT * ctx,
                CK_BYTE        * out_data,
                CK_ULONG       * out_data_len )
{
    if (token_specific.t_sha_final  == NULL ){
	if (!ctx || !out_data || !out_data_len){
	    st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
	    return CKR_FUNCTION_FAILED;
	}
	if (*out_data_len < SHA1_HASH_SIZE){
	    st_err_log(4, __FILE__, __LINE__, __FUNCTION__);
	    return CKR_FUNCTION_FAILED;
	}
	shaFinal( (SHA1_CONTEXT *)ctx->context, out_data );
	*out_data_len = SHA1_HASH_SIZE;

	return CKR_OK;
    } 
    
    return token_specific.t_sha_final(ctx, out_data, out_data_len);
}


//
// Software SHA-1 implementation
//
void
ckm_sha1_init( DIGEST_CONTEXT * ctx)
{
    // Set the h-vars to their initial values
    if (token_specific.t_sha_init  == NULL ) {
	SHA1_CONTEXT *sha1_ctx;
	/* Allocate the context */
	ctx->context_len = sizeof(SHA1_CONTEXT);
	ctx->context = (CK_BYTE *)malloc(sizeof(SHA1_CONTEXT));
	if( ctx->context == NULL )
		return;
    
	sha1_ctx = (SHA1_CONTEXT *)ctx->context;
	sha1_ctx->hash_value[0]  = h0init;
	sha1_ctx->hash_value[1]  = h1init;
	sha1_ctx->hash_value[2]  = h2init;
	sha1_ctx->hash_value[3]  = h3init;
	sha1_ctx->hash_value[4]  = h4init;

	// Initialise bit count
    	sha1_ctx->bits_lo = sha1_ctx->bits_hi = 0;
    } else {
	// SAB XXX call token specific init... the init MUST allocate it's context
	token_specific.t_sha_init(ctx);
    }
}


// Perform the SHA transformation.  Note that this code, like MD5, seems to
// break some optimizing compilers due to the complexity of the expressions
// and the size of the basic block.  It may be necessary to split it into
// sections, e.g. based on the four subrounds
//
// Note that this corrupts the sha->data area
//
void
shaTransform( SHA1_CONTEXT *ctx )
{
   register unsigned int A, B, C, D, E;

   // Set up first buffer
   //
   A = ctx->hash_value[0];
   B = ctx->hash_value[1];
   C = ctx->hash_value[2];
   D = ctx->hash_value[3];
   E = ctx->hash_value[4];

   // Heavy mangling, in 4 sub-rounds of 20 interations each.
   //
   subRound( A, B, C, D, E, f1, K1, ctx->buf[ 0] );
   subRound( E, A, B, C, D, f1, K1, ctx->buf[ 1] );
   subRound( D, E, A, B, C, f1, K1, ctx->buf[ 2] );
   subRound( C, D, E, A, B, f1, K1, ctx->buf[ 3] );
   subRound( B, C, D, E, A, f1, K1, ctx->buf[ 4] );
   subRound( A, B, C, D, E, f1, K1, ctx->buf[ 5] );
   subRound( E, A, B, C, D, f1, K1, ctx->buf[ 6] );
   subRound( D, E, A, B, C, f1, K1, ctx->buf[ 7] );
   subRound( C, D, E, A, B, f1, K1, ctx->buf[ 8] );
   subRound( B, C, D, E, A, f1, K1, ctx->buf[ 9] );
   subRound( A, B, C, D, E, f1, K1, ctx->buf[10] );
   subRound( E, A, B, C, D, f1, K1, ctx->buf[11] );
   subRound( D, E, A, B, C, f1, K1, ctx->buf[12] );
   subRound( C, D, E, A, B, f1, K1, ctx->buf[13] );
   subRound( B, C, D, E, A, f1, K1, ctx->buf[14] );
   subRound( A, B, C, D, E, f1, K1, ctx->buf[15] );
   subRound( E, A, B, C, D, f1, K1, expand(ctx->buf, 16) );
   subRound( D, E, A, B, C, f1, K1, expand(ctx->buf, 17) );
   subRound( C, D, E, A, B, f1, K1, expand(ctx->buf, 18) );
   subRound( B, C, D, E, A, f1, K1, expand(ctx->buf, 19) );

   subRound( A, B, C, D, E, f2, K2, expand(ctx->buf, 20) );
   subRound( E, A, B, C, D, f2, K2, expand(ctx->buf, 21) );
   subRound( D, E, A, B, C, f2, K2, expand(ctx->buf, 22) );
   subRound( C, D, E, A, B, f2, K2, expand(ctx->buf, 23) );
   subRound( B, C, D, E, A, f2, K2, expand(ctx->buf, 24) );
   subRound( A, B, C, D, E, f2, K2, expand(ctx->buf, 25) );
   subRound( E, A, B, C, D, f2, K2, expand(ctx->buf, 26) );
   subRound( D, E, A, B, C, f2, K2, expand(ctx->buf, 27) );
   subRound( C, D, E, A, B, f2, K2, expand(ctx->buf, 28) );
   subRound( B, C, D, E, A, f2, K2, expand(ctx->buf, 29) );
   subRound( A, B, C, D, E, f2, K2, expand(ctx->buf, 30) );
   subRound( E, A, B, C, D, f2, K2, expand(ctx->buf, 31) );
   subRound( D, E, A, B, C, f2, K2, expand(ctx->buf, 32) );
   subRound( C, D, E, A, B, f2, K2, expand(ctx->buf, 33) );
   subRound( B, C, D, E, A, f2, K2, expand(ctx->buf, 34) );
   subRound( A, B, C, D, E, f2, K2, expand(ctx->buf, 35) );
   subRound( E, A, B, C, D, f2, K2, expand(ctx->buf, 36) );
   subRound( D, E, A, B, C, f2, K2, expand(ctx->buf, 37) );
   subRound( C, D, E, A, B, f2, K2, expand(ctx->buf, 38) );
   subRound( B, C, D, E, A, f2, K2, expand(ctx->buf, 39) );

   subRound( A, B, C, D, E, f3, K3, expand(ctx->buf, 40) );
   subRound( E, A, B, C, D, f3, K3, expand(ctx->buf, 41) );
   subRound( D, E, A, B, C, f3, K3, expand(ctx->buf, 42) );
   subRound( C, D, E, A, B, f3, K3, expand(ctx->buf, 43) );
   subRound( B, C, D, E, A, f3, K3, expand(ctx->buf, 44) );
   subRound( A, B, C, D, E, f3, K3, expand(ctx->buf, 45) );
   subRound( E, A, B, C, D, f3, K3, expand(ctx->buf, 46) );
   subRound( D, E, A, B, C, f3, K3, expand(ctx->buf, 47) );
   subRound( C, D, E, A, B, f3, K3, expand(ctx->buf, 48) );
   subRound( B, C, D, E, A, f3, K3, expand(ctx->buf, 49) );
   subRound( A, B, C, D, E, f3, K3, expand(ctx->buf, 50) );
   subRound( E, A, B, C, D, f3, K3, expand(ctx->buf, 51) );
   subRound( D, E, A, B, C, f3, K3, expand(ctx->buf, 52) );
   subRound( C, D, E, A, B, f3, K3, expand(ctx->buf, 53) );
   subRound( B, C, D, E, A, f3, K3, expand(ctx->buf, 54) );
   subRound( A, B, C, D, E, f3, K3, expand(ctx->buf, 55) );
   subRound( E, A, B, C, D, f3, K3, expand(ctx->buf, 56) );
   subRound( D, E, A, B, C, f3, K3, expand(ctx->buf, 57) );
   subRound( C, D, E, A, B, f3, K3, expand(ctx->buf, 58) );
   subRound( B, C, D, E, A, f3, K3, expand(ctx->buf, 59) );

   subRound( A, B, C, D, E, f4, K4, expand(ctx->buf, 60) );
   subRound( E, A, B, C, D, f4, K4, expand(ctx->buf, 61) );
   subRound( D, E, A, B, C, f4, K4, expand(ctx->buf, 62) );
   subRound( C, D, E, A, B, f4, K4, expand(ctx->buf, 63) );
   subRound( B, C, D, E, A, f4, K4, expand(ctx->buf, 64) );
   subRound( A, B, C, D, E, f4, K4, expand(ctx->buf, 65) );
   subRound( E, A, B, C, D, f4, K4, expand(ctx->buf, 66) );
   subRound( D, E, A, B, C, f4, K4, expand(ctx->buf, 67) );
   subRound( C, D, E, A, B, f4, K4, expand(ctx->buf, 68) );
   subRound( B, C, D, E, A, f4, K4, expand(ctx->buf, 69) );
   subRound( A, B, C, D, E, f4, K4, expand(ctx->buf, 70) );
   subRound( E, A, B, C, D, f4, K4, expand(ctx->buf, 71) );
   subRound( D, E, A, B, C, f4, K4, expand(ctx->buf, 72) );
   subRound( C, D, E, A, B, f4, K4, expand(ctx->buf, 73) );
   subRound( B, C, D, E, A, f4, K4, expand(ctx->buf, 74) );
   subRound( A, B, C, D, E, f4, K4, expand(ctx->buf, 75) );
   subRound( E, A, B, C, D, f4, K4, expand(ctx->buf, 76) );
   subRound( D, E, A, B, C, f4, K4, expand(ctx->buf, 77) );
   subRound( C, D, E, A, B, f4, K4, expand(ctx->buf, 78) );
   subRound( B, C, D, E, A, f4, K4, expand(ctx->buf, 79) );

   // Build message digest
   //
   ctx->hash_value[0] += A;
   ctx->hash_value[1] += B;
   ctx->hash_value[2] += C;
   ctx->hash_value[3] += D;
   ctx->hash_value[4] += E;
}


// SHA is defined in big-endian form, so this converts the buffer from
// bytes to words, independent of the machine's native endianness.
//
// Assuming a consistent byte ordering for the machine, this also
// has the magic property of being self-inverse.  It is used as
// such.
//
static void
byteReverse( unsigned int *buffer,
             unsigned int  byteCount )
{
#ifndef __BYTE_ORDER
#error  "Endianess MUST be defined"
#endif
#if  __BYTE_ORDER == __LITTLE_ENDIAN
   CK_ULONG value, val;

   byteCount /= sizeof(CK_ULONG_32);

   while (byteCount--) {
      val = *buffer;
      value = ((0x000000FF & val) << 24) |
              ((0x0000FF00 & val) << 8 ) |
              ((0x00FF0000 & val) >> 8 ) |
              ((0xFF000000 & val) >> 24);

      *buffer++ = value;
   }
#endif

// JRM - this code gives funky results on Linux/Intel.
//       I assume this is a GCC issue since regression tests passed on NT
//
//   byteCount /= sizeof(CK_ULONG);
//   while ( byteCount-- ) {
//      value = (CK_ULONG)((unsigned)((CK_BYTE *)buffer)[0] << 8 | ((CK_BYTE *)buffer)[1]) << 16 |
//                        ((unsigned)((CK_BYTE *)buffer)[2] << 8 | ((CK_BYTE *)buffer)[3]);
//      *buffer++ = value;
//   }
}


void
shaUpdate( SHA1_CONTEXT      * ctx,
           CK_BYTE const     * buffer,
           CK_ULONG            count)
{
   CK_ULONG t;

   // Update bitcount
   //
   t = ctx->bits_lo;
   if ((ctx->bits_lo = t + count) < t)
      ctx->bits_hi++;   // Carry from low to high

   t &= 0x3f;  // Bytes already in ctx->buf

   // Handle any leading odd-sized chunks
   //
   if (t) {
      CK_BYTE *p = (CK_BYTE *)ctx->buf + t;

      t = 64-t;
      if (count < t) {
         memcpy(p, buffer, count);
         return;
      }
      memcpy(p, buffer, t);
      byteReverse(ctx->buf, SHA1_BLOCK_SIZE);
      shaTransform(ctx);
      buffer += t;
      count -= t;
   }

   // Process data in SHA1_BLOCK_SIZE chunks
   //
   while (count >= SHA1_BLOCK_SIZE) {
      memcpy(ctx->buf, buffer, SHA1_BLOCK_SIZE);
      byteReverse(ctx->buf, SHA1_BLOCK_SIZE);
      shaTransform(ctx);
      buffer += SHA1_BLOCK_SIZE;
      count -= SHA1_BLOCK_SIZE;
   }

   // Handle any remaining bytes of data.
   //
   memcpy(ctx->buf, buffer, count);
}


// Final wrapup - pad to 64-byte boundary with the bit pattern
// 1 0* (64-bit count of bits processed, MSB-first)
//
void
shaFinal( SHA1_CONTEXT * ctx,
          CK_BYTE      * hash )
{
   int count;
   CK_BYTE *p;

   // Compute number of bytes mod 64
   //
   count = (int)ctx->bits_lo & 0x3F;

   // Set the first char of padding to 0x80.
   // This is safe since there is always at least one byte free
   //
   p = (CK_BYTE *)ctx->buf + count;
   *p++ = 0x80;

   // Bytes of padding needed to make 64 bytes
   //
   count = SHA1_BLOCK_SIZE - 1 - count;

   // Pad out to 56 mod 64
   //
   if (count < 8) {
      // Two lots of padding:  Pad the first block to 64 bytes
      //
      memset(p, 0, count);
      byteReverse(ctx->buf, SHA1_BLOCK_SIZE);
      shaTransform(ctx);

      // Now fill the next block with 56 bytes
      //
      memset(ctx->buf, 0, SHA1_BLOCK_SIZE-8);
   } else {
      // Pad block to 56 bytes
      //
      memset(p, 0, count-8);
   }
   byteReverse(ctx->buf, SHA1_BLOCK_SIZE-8);

   // Append length in *bits* and transform
   //
   ctx->buf[14] = ctx->bits_hi << 3 | ctx->bits_lo >> 29;
   ctx->buf[15] = ctx->bits_lo << 3;

   shaTransform(ctx);

   // Store output hash in buffer
   //
   byteReverse(ctx->hash_value, SHA1_HASH_SIZE);
   memcpy(hash, ctx->hash_value, SHA1_HASH_SIZE);
}
