251    Round(e, f, g, h, a, b, c, d, 0x391c0cb3ul + (w4 += sigma1(w2) + w13 + sigma0(w5)));
252    Round(d, e, f, g, h, a, b, c, 0x4ed8aa4aul + (w5 += sigma1(w3) + w14 + sigma0(w6)));
253    Round(c, d, e, f, g, h, a, b, 0x5b9cca4ful + (w6 += sigma1(w4) + w15 + sigma0(w7)));
254    Round(b, c, d, e, f, g, h, a, 0x682e6ff3ul + (w7 += sigma1(w5) + w0 + sigma0(w8)));
255    Round(a, b, c, d, e, f, g, h, 0x748f82eeul + (w8 += sigma1(w6) + w1 + sigma0(w9)));
256    Round(h, a, b, c, d, e, f, g, 0x78a5636ful + (w9 += sigma1(w7) + w2 + sigma0(w10)));
257    Round(g, h, a, b, c, d, e, f, 0x84c87814ul + (w10 += sigma1(w8) + w3 + sigma0(w11)));
258    Round(f, g, h, a, b, c, d, e, 0x8cc70208ul + (w11 += sigma1(w9) + w4 + sigma0(w12)));
259    Round(e, f, g, h, a, b, c, d, 0x90befffaul + (w12 += sigma1(w10) + w5 + sigma0(w13)));
260    Round(d, e, f, g, h, a, b, c, 0xa4506cebul + (w13 += sigma1(w11) + w6 + sigma0(w14)));
261    Round(c, d, e, f, g, h, a, b, 0xbef9a3f7ul + (w14 + sigma1(w12) + w7 + sigma0(w15)));
262    Round(b, c, d, e, f, g, h, a, 0xc67178f2ul + (w15 + sigma1(w13) + w8 + sigma0(w0)));
263
264    a += 0x6a09e667ul;
265    b += 0xbb67ae85ul;
266    c += 0x3c6ef372ul;
267    d += 0xa54ff53aul;
268    e += 0x510e527ful;
269    f += 0x9b05688cul;
270    g += 0x1f83d9abul;
271    h += 0x5be0cd19ul;
272
273    uint32_t t0 = a, t1 = b, t2 = c, t3 = d, t4 = e, t5 = f, t6 = g, t7 = h;
274
275    // Transform 2
276    Round(a, b, c, d, e, f, g, h, 0xc28a2f98ul);
277    Round(h, a, b, c, d, e, f, g, 0x71374491ul);
278    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcful);
279    Round(f, g, h, a, b, c, d, e, 0xe9b5dba5ul);
280    Round(e, f, g, h, a, b, c, d, 0x3956c25bul);
281    Round(d, e, f, g, h, a, b, c, 0x59f111f1ul);
282    Round(c, d, e, f, g, h, a, b, 0x923f82a4ul);
283    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5ul);
284    Round(a, b, c, d, e, f, g, h, 0xd807aa98ul);
285    Round(h, a, b, c, d, e, f, g, 0x12835b01ul);
286    Round(g, h, a, b, c, d, e, f, 0x243185beul);
287    Round(f, g, h, a, b, c, d, e, 0x550c7dc3ul);
288    Round(e, f, g, h, a, b, c, d, 0x72be5d74ul);
289    Round(d, e, f, g, h, a, b, c, 0x80deb1feul);
290    Round(c, d, e, f, g, h, a, b, 0x9bdc06a7ul);
291    Round(b, c, d, e, f, g, h, a, 0xc19bf374ul);
292    Round(a, b, c, d, e, f, g, h, 0x649b69c1ul);
293    Round(h, a, b, c, d, e, f, g, 0xf0fe4786ul);
294    Round(g, h, a, b, c, d, e, f, 0x0fe1edc6ul);
295    Round(f, g, h, a, b, c, d, e, 0x240cf254ul);
296    Round(e, f, g, h, a, b, c, d, 0x4fe9346ful);
297    Round(d, e, f, g, h, a, b, c, 0x6cc984beul);
298    Round(c, d, e, f, g, h, a, b, 0x61b9411eul);
299    Round(b, c, d, e, f, g, h, a, 0x16f988faul);
300    Round(a, b, c, d, e, f, g, h, 0xf2c65152ul);
301    Round(h, a, b, c, d, e, f, g, 0xa88e5a6dul);
302    Round(g, h, a, b, c, d, e, f, 0xb019fc65ul);
303    Round(f, g, h, a, b, c, d, e, 0xb9d99ec7ul);
304    Round(e, f, g, h, a, b, c, d, 0x9a1231c3ul);
305    Round(d, e, f, g, h, a, b, c, 0xe70eeaa0ul);
306    Round(c, d, e, f, g, h, a, b, 0xfdb1232bul);
307    Round(b, c, d, e, f, g, h, a, 0xc7353eb0ul);
308    Round(a, b, c, d, e, f, g, h, 0x3069bad5ul);
309    Round(h, a, b, c, d, e, f, g, 0xcb976d5ful);
310    Round(g, h, a, b, c, d, e, f, 0x5a0f118ful);
311    Round(f, g, h, a, b, c, d, e, 0xdc1eeefdul);
312    Round(e, f, g, h, a, b, c, d, 0x0a35b689ul);
313    Round(d, e, f, g, h, a, b, c, 0xde0b7a04ul);
314    Round(c, d, e, f, g, h, a, b, 0x58f4ca9dul);
315    Round(b, c, d, e, f, g, h, a, 0xe15d5b16ul);
316    Round(a, b, c, d, e, f, g, h, 0x007f3e86ul);
317    Round(h, a, b, c, d, e, f, g, 0x37088980ul);
318    Round(g, h, a, b, c, d, e, f, 0xa507ea32ul);
319    Round(f, g, h, a, b, c, d, e, 0x6fab9537ul);
320    Round(e, f, g, h, a, b, c, d, 0x17406110ul);
321    Round(d, e, f, g, h, a, b, c, 0x0d8cd6f1ul);
322    Round(c, d, e, f, g, h, a, b, 0xcdaa3b6dul);
323    Round(b, c, d, e, f, g, h, a, 0xc0bbbe37ul);
324    Round(a, b, c, d, e, f, g, h, 0x83613bdaul);
325    Round(h, a, b, c, d, e, f, g, 0xdb48a363ul);
326    Round(g, h, a, b, c, d, e, f, 0x0b02e931ul);
327    Round(f, g, h, a, b, c, d, e, 0x6fd15ca7ul);
328    Round(e, f, g, h, a, b, c, d, 0x521afacaul);
329    Round(d, e, f, g, h, a, b, c, 0x31338431ul);
330    Round(c, d, e, f, g, h, a, b, 0x6ed41a95ul);
331    Round(b, c, d, e, f, g, h, a, 0x6d437890ul);
332    Round(a, b, c, d, e, f, g, h, 0xc39c91f2ul);
333    Round(h, a, b, c, d, e, f, g, 0x9eccabbdul);
334    Round(g, h, a, b, c, d, e, f, 0xb5c9a0e6ul);
335    Round(f, g, h, a, b, c, d, e, 0x532fb63cul);
336    Round(e, f, g, h, a, b, c, d, 0xd2c741c6ul);
337    Round(d, e, f, g, h, a, b, c, 0x07237ea3ul);
338    Round(c, d, e, f, g, h, a, b, 0xa4954b68ul);
339    Round(b, c, d, e, f, g, h, a, 0x4c191d76ul);
340
341    w0 = t0 + a;
342    w1 = t1 + b;
343    w2 = t2 + c;
344    w3 = t3 + d;
345    w4 = t4 + e;
346    w5 = t5 + f;
347    w6 = t6 + g;
348    w7 = t7 + h;
349
350    // Transform 3
351    a = 0x6a09e667ul;
352    b = 0xbb67ae85ul;
353    c = 0x3c6ef372ul;
354    d = 0xa54ff53aul;
355    e = 0x510e527ful;
356    f = 0x9b05688cul;
357    g = 0x1f83d9abul;
358    h = 0x5be0cd19ul;
359
360    Round(a, b, c, d, e, f, g, h, 0x428a2f98ul + w0);
361    Round(h, a, b, c, d, e, f, g, 0x71374491ul + w1);
362    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcful + w2);
363    Round(f, g, h, a, b, c, d, e, 0xe9b5dba5ul + w3);
364    Round(e, f, g, h, a, b, c, d, 0x3956c25bul + w4);
365    Round(d, e, f, g, h, a, b, c, 0x59f111f1ul + w5);
366    Round(c, d, e, f, g, h, a, b, 0x923f82a4ul + w6);
367    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5ul + w7);
368    Round(a, b, c, d, e, f, g, h, 0x5807aa98ul);
369    Round(h, a, b, c, d, e, f, g, 0x12835b01ul);
370    Round(g, h, a, b, c, d, e, f, 0x243185beul);
371    Round(f, g, h, a, b, c, d, e, 0x550c7dc3ul);
372    Round(e, f, g, h, a, b, c, d, 0x72be5d74ul);
373    Round(d, e, f, g, h, a, b, c, 0x80deb1feul);
374    Round(c, d, e, f, g, h, a, b, 0x9bdc06a7ul);
375    Round(b, c, d, e, f, g, h, a, 0xc19bf274ul);
376    Round(a, b, c, d, e, f, g, h, 0xe49b69c1ul + (w0 += sigma0(w1)));
377    Round(h, a, b, c, d, e, f, g, 0xefbe4786ul + (w1 += 0xa00000ul + sigma0(w2)));
378    Round(g, h, a, b, c, d, e, f, 0x0fc19dc6ul + (w2 += sigma1(w0) + sigma0(w3)));
379    Round(f, g, h, a, b, c, d, e, 0x240ca1ccul + (w3 += sigma1(w1) + sigma0(w4)));
380    Round(e, f, g, h, a, b, c, d, 0x2de92c6ful + (w4 += sigma1(w2) + sigma0(w5)));
381    Round(d, e, f, g, h, a, b, c, 0x4a7484aaul + (w5 += sigma1(w3) + sigma0(w6)));
382    Round(c, d, e, f, g, h, a, b, 0x5cb0a9dcul + (w6 += sigma1(w4) + 0x100ul + sigma0(w7)));
383    Round(b, c, d, e, f, g, h, a, 0x76f988daul + (w7 += sigma1(w5) + w0 + 0x11002000ul));
384    Round(a, b, c, d, e, f, g, h, 0x983e5152ul + (w8 = 0x80000000ul + sigma1(w6) + w1));
385    Round(h, a, b, c, d, e, f, g, 0xa831c66dul + (w9 = sigma1(w7) + w2));
386    Round(g, h, a, b, c, d, e, f, 0xb00327c8ul + (w10 = sigma1(w8) + w3));
387    Round(f, g, h, a, b, c, d, e, 0xbf597fc7ul + (w11 = sigma1(w9) + w4));
388    Round(e, f, g, h, a, b, c, d, 0xc6e00bf3ul + (w12 = sigma1(w10) + w5));
389    Round(d, e, f, g, h, a, b, c, 0xd5a79147ul + (w13 = sigma1(w11) + w6));
390    Round(c, d, e, f, g, h, a, b, 0x06ca6351ul + (w14 = sigma1(w12) + w7 + 0x400022ul));
391    Round(b, c, d, e, f, g, h, a, 0x14292967ul + (w15 = 0x100ul + sigma1(w13) + w8 + sigma0(w0)));
392    Round(a, b, c, d, e, f, g, h, 0x27b70a85ul + (w0 += sigma1(w14) + w9 + sigma0(w1)));
393    Round(h, a, b, c, d, e, f, g, 0x2e1b2138ul + (w1 += sigma1(w15) + w10 + sigma0(w2)));
394    Round(g, h, a, b, c, d, e, f, 0x4d2c6dfcul + (w2 += sigma1(w0) + w11 + sigma0(w3)));
395    Round(f, g, h, a, b, c, d, e, 0x53380d13ul + (w3 += sigma1(w1) + w12 + sigma0(w4)));
396    Round(e, f, g, h, a, b, c, d, 0x650a7354ul + (w4 += sigma1(w2) + w13 + sigma0(w5)));
397    Round(d, e, f, g, h, a, b, c, 0x766a0abbul + (w5 += sigma1(w3) + w14 + sigma0(w6)));
398    Round(c, d, e, f, g, h, a, b, 0x81c2c92eul + (w6 += sigma1(w4) + w15 + sigma0(w7)));
399    Round(b, c, d, e, f, g, h, a, 0x92722c85ul + (w7 += sigma1(w5) + w0 + sigma0(w8)));
400    Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1ul + (w8 += sigma1(w6) + w1 + sigma0(w9)));
401    Round(h, a, b, c, d, e, f, g, 0xa81a664bul + (w9 += sigma1(w7) + w2 + sigma0(w10)));
402    Round(g, h, a, b, c, d, e, f, 0xc24b8b70ul + (w10 += sigma1(w8) + w3 + sigma0(w11)));
403    Round(f, g, h, a, b, c, d, e, 0xc76c51a3ul + (w11 += sigma1(w9) + w4 + sigma0(w12)));
404    Round(e, f, g, h, a, b, c, d, 0xd192e819ul + (w12 += sigma1(w10) + w5 + sigma0(w13)));
405    Round(d, e, f, g, h, a, b, c, 0xd6990624ul + (w13 += sigma1(w11) + w6 + sigma0(w14)));
406    Round(c, d, e, f, g, h, a, b, 0xf40e3585ul + (w14 += sigma1(w12) + w7 + sigma0(w15)));
407    Round(b, c, d, e, f, g, h, a, 0x106aa070ul + (w15 += sigma1(w13) + w8 + sigma0(w0)));
408    Round(a, b, c, d, e, f, g, h, 0x19a4c116ul + (w0 += sigma1(w14) + w9 + sigma0(w1)));
409    Round(h, a, b, c, d, e, f, g, 0x1e376c08ul + (w1 += sigma1(w15) + w10 + sigma0(w2)));
410    Round(g, h, a, b, c, d, e, f, 0x2748774cul + (w2 += sigma1(w0) + w11 + sigma0(w3)));
411    Round(f, g, h, a, b, c, d, e, 0x34b0bcb5ul + (w3 += sigma1(w1) + w12 + sigma0(w4)));
412    Round(e, f, g, h, a, b, c, d, 0x391c0cb3ul + (w4 += sigma1(w2) + w13 + sigma0(w5)));
413    Round(d, e, f, g, h, a, b, c, 0x4ed8aa4aul + (w5 += sigma1(w3) + w14 + sigma0(w6)));
414    Round(c, d, e, f, g, h, a, b, 0x5b9cca4ful + (w6 += sigma1(w4) + w15 + sigma0(w7)));
415    Round(b, c, d, e, f, g, h, a, 0x682e6ff3ul + (w7 += sigma1(w5) + w0 + sigma0(w8)));
416    Round(a, b, c, d, e, f, g, h, 0x748f82eeul + (w8 += sigma1(w6) + w1 + sigma0(w9)));
417    Round(h, a, b, c, d, e, f, g, 0x78a5636ful + (w9 += sigma1(w7) + w2 + sigma0(w10)));
418    Round(g, h, a, b, c, d, e, f, 0x84c87814ul + (w10 += sigma1(w8) + w3 + sigma0(w11)));
419    Round(f, g, h, a, b, c, d, e, 0x8cc70208ul + (w11 += sigma1(w9) + w4 + sigma0(w12)));
420    Round(e, f, g, h, a, b, c, d, 0x90befffaul + (w12 += sigma1(w10) + w5 + sigma0(w13)));
421    Round(d, e, f, g, h, a, b, c, 0xa4506cebul + (w13 += sigma1(w11) + w6 + sigma0(w14)));
422    Round(c, d, e, f, g, h, a, b, 0xbef9a3f7ul + (w14 + sigma1(w12) + w7 + sigma0(w15)));
423    Round(b, c, d, e, f, g, h, a, 0xc67178f2ul + (w15 + sigma1(w13) + w8 + sigma0(w0)));
424
425    // Output
426    WriteBE32(out + 0, a + 0x6a09e667ul);
427    WriteBE32(out + 4, b + 0xbb67ae85ul);
428    WriteBE32(out + 8, c + 0x3c6ef372ul);
429    WriteBE32(out + 12, d + 0xa54ff53aul);
430    WriteBE32(out + 16, e + 0x510e527ful);
431    WriteBE32(out + 20, f + 0x9b05688cul);
432    WriteBE32(out + 24, g + 0x1f83d9abul);
433    WriteBE32(out + 28, h + 0x5be0cd19ul);
434}
435
436} // namespace sha256
437
438typedef void (*TransformType)(uint32_t*, const unsigned char*, size_t);
439typedef void (*TransformD64Type)(unsigned char*, const unsigned char*);
440
441template<TransformType tr>
442void TransformD64Wrapper(unsigned char* out, const unsigned char* in)
443{
444    uint32_t s[8];
445    static const unsigned char padding1[64] = {
446        0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
447        0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
448        0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
449        0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0
450    };
451    unsigned char buffer2[64] = {
452        0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
453        0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
454        0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
455        0,    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0
456    };
457    sha256::Initialize(s);
458    tr(s, in, 1);
459    tr(s, padding1, 1);
460    WriteBE32(buffer2 + 0, s[0]);
461    WriteBE32(buffer2 + 4, s[1]);
462    WriteBE32(buffer2 + 8, s[2]);
463    WriteBE32(buffer2 + 12, s[3]);
464    WriteBE32(buffer2 + 16, s[4]);
465    WriteBE32(buffer2 + 20, s[5]);
466    WriteBE32(buffer2 + 24, s[6]);
467    WriteBE32(buffer2 + 28, s[7]);
468    sha256::Initialize(s);
469    tr(s, buffer2, 1);
470    WriteBE32(out + 0, s[0]);
471    WriteBE32(out + 4, s[1]);
472    WriteBE32(out + 8, s[2]);
473    WriteBE32(out + 12, s[3]);
474    WriteBE32(out + 16, s[4]);
475    WriteBE32(out + 20, s[5]);
476    WriteBE32(out + 24, s[6]);
477    WriteBE32(out + 28, s[7]);
478}
479
480TransformType Transform = sha256::Transform;
481TransformD64Type TransformD64 = sha256::TransformD64;
482TransformD64Type TransformD64_2way = nullptr;
483TransformD64Type TransformD64_4way = nullptr;
484TransformD64Type TransformD64_8way = nullptr;
485
486bool SelfTest() {
487    // Input state (equal to the initial SHA256 state)
488    static const uint32_t init[8] = {
489        0x6a09e667ul, 0xbb67ae85ul, 0x3c6ef372ul, 0xa54ff53aul, 0x510e527ful, 0x9b05688cul, 0x1f83d9abul, 0x5be0cd19ul
490    };
491    // Some random input data to test with
492    static const unsigned char data[641] = "-" // Intentionally not aligned
493        "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do "
494        "eiusmod tempor incididunt ut labore et dolore magna aliqua. Et m"
495        "olestie ac feugiat sed lectus vestibulum mattis ullamcorper. Mor"
496        "bi blandit cursus risus at ultrices mi tempus imperdiet nulla. N"
497        "unc congue nisi vita suscipit tellus mauris. Imperdiet proin fer"
498        "mentum leo vel orci. Massa tempor nec feugiat nisl pretium fusce"
499        " id velit. Telus in metus vulputate eu scelerisque felis. Mi tem"
500        "pus imperdiet nulla malesuada pellentesque. Tristique magna sit.";