4e5a6b6db

Denys Vlasenko

2025-07-06

SOURCE BUG Duration: 74s

Subject

libbb/yescrypt: remove extra sha256 implementation

SOURCE BUG

This commit was genuinely broken at the time (not related to our build system): libbb/yescrypt eklenirken (2025-07-06 - 2025-07-07 arasi) once unutulan kaynak dosyalari (pw_encrypt_yes.c, hash_sha256_block.c, pw_ascii64.c), ardindan 64-bit'te derlenmeyen bir 'buflen' degiskeni (alg-yescrypt-kdf.c) vardi - busybox'in kendi kodundaki gercek hatalar (e5d3a8763 ile duzeltildi)

→ Bu hatanin tam hikayesini ve duzeltme diffini gor

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

libbb/yescrypt/alg-sha256.c +37 -461 libbb/yescrypt/alg-sha256.h +2 -60

libbb/yescrypt/alg-sha256.c+37 -461

@@ -25,281 +25,6 @@
	* SUCH DAMAGE.
	*/

-	#if defined(__GNUC__)
-	#define restrict __restrict
-	#else
-	#define restrict
-	#endif
-
-	/* SHA256 round constants. */
-	static const uint32_t Krnd[64] = {
-	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
-	0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-	0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
-	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-	0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
-	0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
-	0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-	0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
-	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-	0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
-	0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
-	0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-	0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
-	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-	};
-
-	/* Elementary functions used by SHA256 */
-	#define Ch(x, y, z) ((x & (y ^ z)) ^ z)
-	#if 1 /* Explicit caching/reuse of common subexpression between rounds */
-	#define Maj(x, y, z) (y ^ ((x_xor_y = x ^ y) & y_xor_z))
-	#else /* Let the compiler cache/reuse or not */
-	#define Maj(x, y, z) (y ^ ((x ^ y) & (y ^ z)))
-	#endif
-	#define SHR(x, n) (x >> n)
-	#define ROTR(x, n) ((x >> n) \| (x << (32 - n)))
-	#define S0(x) (ROTR(x, 2) ^ ROTR(x, 13) ^ ROTR(x, 22))
-	#define S1(x) (ROTR(x, 6) ^ ROTR(x, 11) ^ ROTR(x, 25))
-	#define s0(x) (ROTR(x, 7) ^ ROTR(x, 18) ^ SHR(x, 3))
-	#define s1(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHR(x, 10))
-
-	/* SHA256 round function */
-	#define RND(a, b, c, d, e, f, g, h, k) \
-	h += S1(e) + Ch(e, f, g) + k; \
-	d += h; \
-	h += S0(a) + Maj(a, b, c); \
-	y_xor_z = x_xor_y;
-
-	/* Adjusted round function for rotating state */
-	#define RNDr(S, W, i, ii) \
-	RND(S[(64 - i) % 8], S[(65 - i) % 8], \
-	S[(66 - i) % 8], S[(67 - i) % 8], \
-	S[(68 - i) % 8], S[(69 - i) % 8], \
-	S[(70 - i) % 8], S[(71 - i) % 8], \
-	W[i + ii] + Krnd[i + ii])
-
-	/* Message schedule computation */
-	#define MSCH(W, ii, i) \
-	W[i + ii + 16] = s1(W[i + ii + 14]) + W[i + ii + 9] + s0(W[i + ii + 1]) + W[i + ii]
-
-	/*
-	* SHA256 block compression function. The 256-bit state is transformed via
-	* the 512-bit input block to produce a new state.
-	*/
-	static void
-	SHA256_Transform(uint32_t state[static restrict 8],
-	const uint8_t block[static restrict 64],
-	uint32_t W[static restrict 64], uint32_t S[static restrict 8])
-	{
-	int i;
-
-	/* 1. Prepare the first part of the message schedule W. */
-	be32dec_vect(W, block, 16);
-
-	/* 2. Initialize working variables. */
-	memcpy(S, state, 32);
-
-	/* 3. Mix. */
-	for (i = 0; i <= 48; i += 16) {
-	uint32_t x_xor_y, y_xor_z = S[(65 - i) % 8] ^ S[(66 - i) % 8];
-	RNDr(S, W, 0, i);
-	RNDr(S, W, 1, i);
-	RNDr(S, W, 2, i);
-	RNDr(S, W, 3, i);
-	RNDr(S, W, 4, i);
-	RNDr(S, W, 5, i);
-	RNDr(S, W, 6, i);
-	RNDr(S, W, 7, i);
-	RNDr(S, W, 8, i);
-	RNDr(S, W, 9, i);
-	RNDr(S, W, 10, i);
-	RNDr(S, W, 11, i);
-	RNDr(S, W, 12, i);
-	RNDr(S, W, 13, i);
-	RNDr(S, W, 14, i);
-	RNDr(S, W, 15, i);
-
-	if (i == 48)
-	break;
-
-	MSCH(W, 0, i);
-	MSCH(W, 1, i);
-	MSCH(W, 2, i);
-	MSCH(W, 3, i);
-	MSCH(W, 4, i);
-	MSCH(W, 5, i);
-	MSCH(W, 6, i);
-	MSCH(W, 7, i);
-	MSCH(W, 8, i);
-	MSCH(W, 9, i);
-	MSCH(W, 10, i);
-	MSCH(W, 11, i);
-	MSCH(W, 12, i);
-	MSCH(W, 13, i);
-	MSCH(W, 14, i);
-	MSCH(W, 15, i);
-	}
-
-	/* 4. Mix local working variables into global state. */
-	state[0] += S[0];
-	state[1] += S[1];
-	state[2] += S[2];
-	state[3] += S[3];
-	state[4] += S[4];
-	state[5] += S[5];
-	state[6] += S[6];
-	state[7] += S[7];
-	}
-
-	static const uint8_t PAD[64] = {
-	0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
-	};
-
-	/* Add padding and terminating bit-count. */
-	static void
-	SHA256_Pad(SHA256_CTX * ctx, uint32_t tmp32[static restrict 72])
-	{
-	size_t r;
-
-	/* Figure out how many bytes we have buffered. */
-	r = (ctx->count >> 3) & 0x3f;
-
-	/* Pad to 56 mod 64, transforming if we finish a block en route. */
-	if (r < 56) {
-	/* Pad to 56 mod 64. */
-	memcpy(&ctx->buf[r], PAD, 56 - r);
-	} else {
-	/* Finish the current block and mix. */
-	memcpy(&ctx->buf[r], PAD, 64 - r);
-	SHA256_Transform(ctx->state, ctx->buf, &tmp32[0], &tmp32[64]);
-
-	/* The start of the final block is all zeroes. */
-	memset(&ctx->buf[0], 0, 56);
-	}
-
-	/* Add the terminating bit-count. */
-	be64enc(&ctx->buf[56], ctx->count);
-
-	/* Mix in the final block. */
-	SHA256_Transform(ctx->state, ctx->buf, &tmp32[0], &tmp32[64]);
-	}
-
-	/* Magic initialization constants. */
-	static const uint32_t initial_state[8] = {
-	0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
-	0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
-	};
-
-	/**
-	* SHA256_Init(ctx):
-	* Initialize the SHA256 context ${ctx}.
-	*/
-	void
-	SHA256_Init(SHA256_CTX * ctx)
-	{
-
-	/* Zero bits processed so far. */
-	ctx->count = 0;
-
-	/* Initialize state. */
-	memcpy(ctx->state, initial_state, sizeof(initial_state));
-	}
-
-	/**
-	* SHA256_Update(ctx, in, len):
-	* Input ${len} bytes from ${in} into the SHA256 context ${ctx}.
-	*/
-	static void
-	_SHA256_Update(SHA256_CTX * ctx, const void * in, size_t len,
-	uint32_t tmp32[static restrict 72])
-	{
-	uint32_t r;
-	const uint8_t * src = in;
-
-	/* Return immediately if we have nothing to do. */
-	if (len == 0)
-	return;
-
-	/* Number of bytes left in the buffer from previous updates. */
-	r = (ctx->count >> 3) & 0x3f;
-
-	/* Update number of bits. */
-	ctx->count += (uint64_t)(len) << 3;
-
-	/* Handle the case where we don't need to perform any transforms. */
-	if (len < 64 - r) {
-	memcpy(&ctx->buf[r], src, len);
-	return;
-	}
-
-	/* Finish the current block. */
-	memcpy(&ctx->buf[r], src, 64 - r);
-	SHA256_Transform(ctx->state, ctx->buf, &tmp32[0], &tmp32[64]);
-	src += 64 - r;
-	len -= 64 - r;
-
-	/* Perform complete blocks. */
-	while (len >= 64) {
-	SHA256_Transform(ctx->state, src, &tmp32[0], &tmp32[64]);
-	src += 64;
-	len -= 64;
-	}
-
-	/* Copy left over data into buffer. */
-	memcpy(ctx->buf, src, len);
-	}
-
-	/* Wrapper function for intermediate-values sanitization. */
-	void
-	SHA256_Update(SHA256_CTX * ctx, const void * in, size_t len)
-	{
-	uint32_t tmp32[72];
-
-	/* Call the real function. */
-	_SHA256_Update(ctx, in, len, tmp32);
-
-	/* Clean the stack. */
-	explicit_bzero(tmp32, 288);
-	}
-
-	/**
-	* SHA256_Final(digest, ctx):
-	* Output the SHA256 hash of the data input to the context ${ctx} into the
-	* buffer ${digest}.
-	*/
-	static void
-	_SHA256_Final(uint8_t digest[32], SHA256_CTX * ctx,
-	uint32_t tmp32[static restrict 72])
-	{
-
-	/* Add padding. */
-	SHA256_Pad(ctx, tmp32);
-
-	/* Write the hash. */
-	be32enc_vect(digest, ctx->state, 8);
-	}
-
-	/* Wrapper function for intermediate-values sanitization. */
-	void
-	SHA256_Final(uint8_t digest[32], SHA256_CTX * ctx)
-	{
-	uint32_t tmp32[72];
-
-	/* Call the real function. */
-	_SHA256_Final(digest, ctx, tmp32);
-
-	/* Clear the context state. */
-	explicit_bzero(ctx, sizeof(SHA256_CTX));
-
-	/* Clean the stack. */
-	explicit_bzero(tmp32, 288);
-	}
-
	/**
	* SHA256_Buf(in, len, digest):
	* Compute the SHA256 hash of ${len} bytes from ${in} and write it to ${digest}.
@@ -307,16 +32,10 @@ SHA256_Final(uint8_t digest[32], SHA256_CTX * ctx)
	void
	SHA256_Buf(const void * in, size_t len, uint8_t digest[32])
	{
-	SHA256_CTX ctx;
-	uint32_t tmp32[72];
-
-	SHA256_Init(&ctx);
-	_SHA256_Update(&ctx, in, len, tmp32);
-	_SHA256_Final(digest, &ctx, tmp32);
-
-	/* Clean the stack. */
-	explicit_bzero(&ctx, sizeof(SHA256_CTX));
-	explicit_bzero(tmp32, 288);
+	sha256_ctx_t ctx;
+	sha256_begin(&ctx);
+	sha256_hash(&ctx, in, len);
+	sha256_end(&ctx, digest);
	}

	/**
@@ -325,52 +44,36 @@ SHA256_Buf(const void * in, size_t len, uint8_t digest[32])
	* ${K}.
	*/
	static void
-	_HMAC_SHA256_Init(HMAC_SHA256_CTX * ctx, const void * _K, size_t Klen,
-	uint32_t tmp32[static restrict 72], uint8_t pad[static restrict 64],
-	uint8_t khash[static restrict 32])
+	HMAC_SHA256_Init(HMAC_SHA256_CTX * ctx, const void * _K, size_t Klen)
	{
+	uint8_t pad[64];
+	uint8_t khash[32];
	const uint8_t * K = _K;
	size_t i;

	/* If Klen > 64, the key is really SHA256(K). */
	if (Klen > 64) {
-	SHA256_Init(&ctx->ictx);
-	_SHA256_Update(&ctx->ictx, K, Klen, tmp32);
-	_SHA256_Final(khash, &ctx->ictx, tmp32);
+	// SHA256_Init(&ctx->ictx);
+	// _SHA256_Update(&ctx->ictx, K, Klen, tmp32);
+	// _SHA256_Final(khash, &ctx->ictx, tmp32);
+	SHA256_Buf(K, Klen, khash);
	K = khash;
	Klen = 32;
	}

	/* Inner SHA256 operation is SHA256(K xor [block of 0x36] \|\| data). */
-	SHA256_Init(&ctx->ictx);
+	sha256_begin(&ctx->ictx);
	memset(pad, 0x36, 64);
	for (i = 0; i < Klen; i++)
	pad[i] ^= K[i];
-	_SHA256_Update(&ctx->ictx, pad, 64, tmp32);
+	sha256_hash(&ctx->ictx, pad, 64);

	/* Outer SHA256 operation is SHA256(K xor [block of 0x5c] \|\| hash). */
-	SHA256_Init(&ctx->octx);
+	sha256_begin(&ctx->octx);
	memset(pad, 0x5c, 64);
	for (i = 0; i < Klen; i++)
	pad[i] ^= K[i];
-	_SHA256_Update(&ctx->octx, pad, 64, tmp32);
-	}
-
-	/* Wrapper function for intermediate-values sanitization. */
-	void
-	HMAC_SHA256_Init(HMAC_SHA256_CTX * ctx, const void * _K, size_t Klen)
-	{
-	uint32_t tmp32[72];
-	uint8_t pad[64];
-	uint8_t khash[32];
-
-	/* Call the real function. */
-	_HMAC_SHA256_Init(ctx, _K, Klen, tmp32, pad, khash);
-
-	/* Clean the stack. */
-	explicit_bzero(tmp32, 288);
-	explicit_bzero(khash, 32);
-	explicit_bzero(pad, 64);
+	sha256_hash(&ctx->octx, pad, 64);
	}

	/**
@@ -378,25 +81,10 @@ HMAC_SHA256_Init(HMAC_SHA256_CTX * ctx, const void * _K, size_t Klen)
	* Input ${len} bytes from ${in} into the HMAC-SHA256 context ${ctx}.
	*/
	static void
-	_HMAC_SHA256_Update(HMAC_SHA256_CTX * ctx, const void * in, size_t len,
-	uint32_t tmp32[static restrict 72])
-	{
-
-	/* Feed data to the inner SHA256 operation. */
-	_SHA256_Update(&ctx->ictx, in, len, tmp32);
-	}
-
-	/* Wrapper function for intermediate-values sanitization. */
-	void
	HMAC_SHA256_Update(HMAC_SHA256_CTX * ctx, const void * in, size_t len)
	{
-	uint32_t tmp32[72];
-
-	/* Call the real function. */
-	_HMAC_SHA256_Update(ctx, in, len, tmp32);
-
-	/* Clean the stack. */
-	explicit_bzero(tmp32, 288);
+	/* Feed data to the inner SHA256 operation. */
+	sha256_hash(&ctx->ictx, in, len);
	}

	/**
@@ -405,36 +93,16 @@ HMAC_SHA256_Update(HMAC_SHA256_CTX * ctx, const void * in, size_t len)
	* buffer ${digest}.
	*/
	static void
-	_HMAC_SHA256_Final(uint8_t digest[32], HMAC_SHA256_CTX * ctx,
-	uint32_t tmp32[static restrict 72], uint8_t ihash[static restrict 32])
+	HMAC_SHA256_Final(uint8_t digest[32], HMAC_SHA256_CTX * ctx)
	{
+	uint8_t ihash[32];

	/* Finish the inner SHA256 operation. */
-	_SHA256_Final(ihash, &ctx->ictx, tmp32);
-
+	sha256_end(&ctx->ictx, ihash);
	/* Feed the inner hash to the outer SHA256 operation. */
-	_SHA256_Update(&ctx->octx, ihash, 32, tmp32);
-
+	sha256_hash(&ctx->octx, ihash, 32);
	/* Finish the outer SHA256 operation. */
-	_SHA256_Final(digest, &ctx->octx, tmp32);
-	}
-
-	/* Wrapper function for intermediate-values sanitization. */
-	void
-	HMAC_SHA256_Final(uint8_t digest[32], HMAC_SHA256_CTX * ctx)
-	{
-	uint32_t tmp32[72];
-	uint8_t ihash[32];
-
-	/* Call the real function. */
-	_HMAC_SHA256_Final(digest, ctx, tmp32, ihash);
-
-	/* Clear the context state. */
-	explicit_bzero(ctx, sizeof(HMAC_SHA256_CTX));
-
-	/* Clean the stack. */
-	explicit_bzero(tmp32, 288);
-	explicit_bzero(ihash, 32);
+	sha256_end(&ctx->octx, digest);
	}

	/**
@@ -442,49 +110,14 @@ HMAC_SHA256_Final(uint8_t digest[32], HMAC_SHA256_CTX * ctx)
	* Compute the HMAC-SHA256 of ${len} bytes from ${in} using the key ${K} of
	* length ${Klen}, and write the result to ${digest}.
	*/
-	void
-	HMAC_SHA256_Buf(const void * K, size_t Klen, const void * in, size_t len,
-	uint8_t digest[32])
+	static void
+	HMAC_SHA256_Buf(const void K, size_t Klen, const void in, size_t len,
+	uint8_t digest[32])
	{
	HMAC_SHA256_CTX ctx;
-	uint32_t tmp32[72];
-	uint8_t tmp8[96];
-
-	_HMAC_SHA256_Init(&ctx, K, Klen, tmp32, &tmp8[0], &tmp8[64]);
-	_HMAC_SHA256_Update(&ctx, in, len, tmp32);
-	_HMAC_SHA256_Final(digest, &ctx, tmp32, &tmp8[0]);
-
-	/* Clean the stack. */
-	explicit_bzero(&ctx, sizeof(HMAC_SHA256_CTX));
-	explicit_bzero(tmp32, 288);
-	explicit_bzero(tmp8, 96);
-	}
-
-	/* Add padding and terminating bit-count, but don't invoke Transform yet. */
-	static int
-	SHA256_Pad_Almost(SHA256_CTX * ctx, uint8_t len[static restrict 8],
-	uint32_t tmp32[static restrict 72])
-	{
-	uint32_t r;
-
-	r = (ctx->count >> 3) & 0x3f;
-	if (r >= 56)
-	return -1;
-
-	/*
-	* Convert length to a vector of bytes -- we do this now rather
-	* than later because the length will change after we pad.
-	*/
-	be64enc(len, ctx->count);
-
-	/* Add 1--56 bytes so that the resulting length is 56 mod 64. */
-	_SHA256_Update(ctx, PAD, 56 - r, tmp32);
-
-	/* Add the terminating bit-count. */
-	ctx->buf[63] = len[7];
-	_SHA256_Update(ctx, len, 7, tmp32);
-
-	return 0;
+	HMAC_SHA256_Init(&ctx, K, Klen);
+	HMAC_SHA256_Update(&ctx, in, len);
+	HMAC_SHA256_Final(digest, &ctx);
	}

	/**
@@ -493,15 +126,11 @@ SHA256_Pad_Almost(SHA256_CTX * ctx, uint8_t len[static restrict 8],
	* write the output to buf. The value dkLen must be at most 32 * (2^32 - 1).
	*/
	void
-	PBKDF2_SHA256(const uint8_t * passwd, size_t passwdlen, const uint8_t * salt,
-	size_t saltlen, uint64_t c, uint8_t * buf, size_t dkLen)
+	PBKDF2_SHA256(const uint8_t *passwd, size_t passwdlen,
+	const uint8_t *salt, size_t saltlen,
+	uint64_t c, uint8_t *buf, size_t dkLen)
	{
	HMAC_SHA256_CTX Phctx, PShctx, hctx;
-	uint32_t tmp32[72];
-	union {
-	uint8_t tmp8[96];
-	uint32_t state[8];
-	} u;
	size_t i;
	uint8_t ivec[4];
	uint8_t U[32];
@@ -513,54 +142,12 @@ PBKDF2_SHA256(const uint8_t * passwd, size_t passwdlen, const uint8_t * salt,
	/* Sanity-check. */
	assert(dkLen <= 32 * (size_t)(UINT32_MAX));

-	if (c == 1 && (dkLen & 31) == 0 && (saltlen & 63) <= 51) {
-	uint32_t oldcount;
-	uint8_t * ivecp;
-
-	/* Compute HMAC state after processing P and S. */
-	_HMAC_SHA256_Init(&hctx, passwd, passwdlen,
-	tmp32, &u.tmp8[0], &u.tmp8[64]);
-	_HMAC_SHA256_Update(&hctx, salt, saltlen, tmp32);
-
-	/* Prepare ictx padding. */
-	oldcount = hctx.ictx.count & (0x3f << 3);
-	_HMAC_SHA256_Update(&hctx, "\0\0\0", 4, tmp32);
-	if ((hctx.ictx.count & (0x3f << 3)) < oldcount \|\|
-	SHA256_Pad_Almost(&hctx.ictx, u.tmp8, tmp32))
-	goto generic; /* Can't happen due to saltlen check */
-	ivecp = hctx.ictx.buf + (oldcount >> 3);
-
-	/* Prepare octx padding. */
-	hctx.octx.count += 32 << 3;
-	SHA256_Pad_Almost(&hctx.octx, u.tmp8, tmp32);
-
-	/* Iterate through the blocks. */
-	for (i = 0; i * 32 < dkLen; i++) {
-	/* Generate INT(i + 1). */
-	be32enc(ivecp, (uint32_t)(i + 1));
-
-	/* Compute U_1 = PRF(P, S \|\| INT(i)). */
-	memcpy(u.state, hctx.ictx.state, sizeof(u.state));
-	SHA256_Transform(u.state, hctx.ictx.buf,
-	&tmp32[0], &tmp32[64]);
-	be32enc_vect(hctx.octx.buf, u.state, 8);
-	memcpy(u.state, hctx.octx.state, sizeof(u.state));
-	SHA256_Transform(u.state, hctx.octx.buf,
-	&tmp32[0], &tmp32[64]);
-	be32enc_vect(&buf[i * 32], u.state, 8);
-	}
-
-	goto cleanup;
-	}
-
-	generic:
	/* Compute HMAC state after processing P. */
-	_HMAC_SHA256_Init(&Phctx, passwd, passwdlen,
-	tmp32, &u.tmp8[0], &u.tmp8[64]);
+	HMAC_SHA256_Init(&Phctx, passwd, passwdlen);

	/* Compute HMAC state after processing P and S. */
	memcpy(&PShctx, &Phctx, sizeof(HMAC_SHA256_CTX));
-	_HMAC_SHA256_Update(&PShctx, salt, saltlen, tmp32);
+	HMAC_SHA256_Update(&PShctx, salt, saltlen);

	/* Iterate through the blocks. */
	for (i = 0; i * 32 < dkLen; i++) {
@@ -569,8 +156,8 @@ generic:

	/* Compute U_1 = PRF(P, S \|\| INT(i)). */
	memcpy(&hctx, &PShctx, sizeof(HMAC_SHA256_CTX));
-	_HMAC_SHA256_Update(&hctx, ivec, 4, tmp32);
-	_HMAC_SHA256_Final(T, &hctx, tmp32, u.tmp8);
+	HMAC_SHA256_Update(&hctx, ivec, 4);
+	HMAC_SHA256_Final(T, &hctx);

	if (c > 1) {
	/* T_i = U_1 ... */
@@ -579,8 +166,8 @@ generic:
	for (j = 2; j <= c; j++) {
	/* Compute U_j. */
	memcpy(&hctx, &Phctx, sizeof(HMAC_SHA256_CTX));
-	_HMAC_SHA256_Update(&hctx, U, 32, tmp32);
-	_HMAC_SHA256_Final(U, &hctx, tmp32, u.tmp8);
+	HMAC_SHA256_Update(&hctx, U, 32);
+	HMAC_SHA256_Final(U, &hctx);

	/* ... xor U_j ... */
	for (k = 0; k < 32; k++)
@@ -594,15 +181,4 @@ generic:
	clen = 32;
	memcpy(&buf[i * 32], T, clen);
	}
-
-	/* Clean the stack. */
-	explicit_bzero(&Phctx, sizeof(HMAC_SHA256_CTX));
-	explicit_bzero(&PShctx, sizeof(HMAC_SHA256_CTX));
-	explicit_bzero(U, 32);
-	explicit_bzero(T, 32);
-
-	cleanup:
-	explicit_bzero(&hctx, sizeof(HMAC_SHA256_CTX));
-	explicit_bzero(tmp32, 288);
-	explicit_bzero(&u, sizeof(u));
	}

libbb/yescrypt/alg-sha256.h+2 -60

@@ -28,43 +28,12 @@
	* Use #defines in order to avoid namespace collisions with anyone else's
	* SHA256 code (e.g., the code in OpenSSL).
	*/
-	#define SHA256_Init libcperciva_SHA256_Init
-	#define SHA256_Update libcperciva_SHA256_Update
-	#define SHA256_Final libcperciva_SHA256_Final
-	#define SHA256_Buf libcperciva_SHA256_Buf
-	#define SHA256_CTX libcperciva_SHA256_CTX
	#define HMAC_SHA256_Init libcperciva_HMAC_SHA256_Init
	#define HMAC_SHA256_Update libcperciva_HMAC_SHA256_Update
	#define HMAC_SHA256_Final libcperciva_HMAC_SHA256_Final
	#define HMAC_SHA256_Buf libcperciva_HMAC_SHA256_Buf
	#define HMAC_SHA256_CTX libcperciva_HMAC_SHA256_CTX

-	/* Context structure for SHA256 operations. */
-	typedef struct {
-	uint32_t state[8];
-	uint64_t count;
-	uint8_t buf[64];
-	} SHA256_CTX;
-
-	/**
-	* SHA256_Init(ctx):
-	* Initialize the SHA256 context ${ctx}.
-	*/
-	extern void SHA256_Init(SHA256_CTX *);
-
-	/**
-	* SHA256_Update(ctx, in, len):
-	* Input ${len} bytes from ${in} into the SHA256 context ${ctx}.
-	*/
-	extern void SHA256_Update(SHA256_CTX , const void , size_t);
-
-	/**
-	* SHA256_Final(digest, ctx):
-	* Output the SHA256 hash of the data input to the context ${ctx} into the
-	* buffer ${digest}.
-	*/
-	extern void SHA256_Final(uint8_t[32], SHA256_CTX *);
-
	/**
	* SHA256_Buf(in, len, digest):
	* Compute the SHA256 hash of ${len} bytes from ${in} and write it to ${digest}.
@@ -73,37 +42,10 @@ extern void SHA256_Buf(const void *, size_t, uint8_t[32]);

	/* Context structure for HMAC-SHA256 operations. */
	typedef struct {
-	SHA256_CTX ictx;
-	SHA256_CTX octx;
+	sha256_ctx_t ictx;
+	sha256_ctx_t octx;
	} HMAC_SHA256_CTX;

-	/**
-	* HMAC_SHA256_Init(ctx, K, Klen):
-	* Initialize the HMAC-SHA256 context ${ctx} with ${Klen} bytes of key from
-	* ${K}.
-	*/
-	extern void HMAC_SHA256_Init(HMAC_SHA256_CTX , const void , size_t);
-
-	/**
-	* HMAC_SHA256_Update(ctx, in, len):
-	* Input ${len} bytes from ${in} into the HMAC-SHA256 context ${ctx}.
-	*/
-	extern void HMAC_SHA256_Update(HMAC_SHA256_CTX , const void , size_t);
-
-	/**
-	* HMAC_SHA256_Final(digest, ctx):
-	* Output the HMAC-SHA256 of the data input to the context ${ctx} into the
-	* buffer ${digest}.
-	*/
-	extern void HMAC_SHA256_Final(uint8_t[32], HMAC_SHA256_CTX *);
-
-	/**
-	* HMAC_SHA256_Buf(K, Klen, in, len, digest):
-	* Compute the HMAC-SHA256 of ${len} bytes from ${in} using the key ${K} of
-	* length ${Klen}, and write the result to ${digest}.
-	*/
-	extern void HMAC_SHA256_Buf(const void , size_t, const void , size_t, uint8_t[32]);
-
	/**
	* PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
	* Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and