radiance · Radiance self-hosting compiler

test/tests/prog.sha256.rad 7.2 KiB raw

//! returns: 0
//! SHA-256 (single block).
//! Implement the SHA-256 compression function for a single 512-bit block.
//! Verify against a known hash of a short message.

/// SHA-256 mutable state: hash values and message schedule.
record Sha256 {
    h: [u32; 8],
    w: [u32; 64],
}

/// SHA-256 initial hash values (first 32 bits of fractional parts of square
/// roots of the first 8 primes).
constant INIT_H: [u32; 8] = [
    0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
    0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
];

/// Right-rotate a 32-bit value by `n` bits.
fn rotr(x: u32, n: u32) -> u32 {
    return (x >> n) | (x << (32 - n));
}

/// SHA-256 Ch function: Ch(e, f, g) = (e AND f) XOR (NOT e AND g).
fn ch(e: u32, f: u32, g: u32) -> u32 {
    return (e & f) ^ (~e & g);
}

/// SHA-256 Maj function: Maj(a, b, c) = (a AND b) XOR (a AND c) XOR (b AND c).
fn maj(a: u32, b: u32, c: u32) -> u32 {
    return (a & b) ^ (a & c) ^ (b & c);
}

/// SHA-256 big sigma 0: rotr(a, 2) XOR rotr(a, 13) XOR rotr(a, 22).
fn bsig0(a: u32) -> u32 {
    return rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
}

/// SHA-256 big sigma 1: rotr(e, 6) XOR rotr(e, 11) XOR rotr(e, 25).
fn bsig1(e: u32) -> u32 {
    return rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
}

/// SHA-256 small sigma 0: rotr(x, 7) XOR rotr(x, 18) XOR (x >> 3).
fn ssig0(x: u32) -> u32 {
    return rotr(x, 7) ^ rotr(x, 18) ^ (x >> 3);
}

/// SHA-256 small sigma 1: rotr(x, 17) XOR rotr(x, 19) XOR (x >> 10).
fn ssig1(x: u32) -> u32 {
    return rotr(x, 17) ^ rotr(x, 19) ^ (x >> 10);
}

/// Prepare the message schedule from a 16-word (512-bit) block.
unsafe fn prepareSchedule(s: *mut Sha256, block: *[u32]) {
    // Copy the first 16 words directly.
    let mut i: u32 = 0;
    while i < 16 {
        set s.w[i] = block[i];
        set i += 1;
    }
    // Extend to 64 words.
    while i < 64 {
        set s.w[i] = ssig1(s.w[i - 2]) + s.w[i - 7] + ssig0(s.w[i - 15]) + s.w[i - 16];
        set i += 1;
    }
}

/// Run the 64-round compression function.
unsafe fn compress(s: *mut Sha256, k: *[u32]) {
    let mut a: u32 = s.h[0];
    let mut b: u32 = s.h[1];
    let mut c: u32 = s.h[2];
    let mut d: u32 = s.h[3];
    let mut e: u32 = s.h[4];
    let mut f: u32 = s.h[5];
    let mut g: u32 = s.h[6];
    let mut hh: u32 = s.h[7];

    let mut i: u32 = 0;
    while i < 64 {
        let t1 = hh + bsig1(e) + ch(e, f, g) + k[i] + s.w[i];
        let t2 = bsig0(a) + maj(a, b, c);
        set hh = g;
        set g = f;
        set f = e;
        set e = d + t1;
        set d = c;
        set c = b;
        set b = a;
        set a = t1 + t2;
        set i += 1;
    }

    set s.h[0] += a;
    set s.h[1] += b;
    set s.h[2] += c;
    set s.h[3] += d;
    set s.h[4] += e;
    set s.h[5] += f;
    set s.h[6] += g;
    set s.h[7] += hh;
}

/// Reset hash state to initial values.
unsafe fn resetHash(s: *mut Sha256) {
    let mut i: u32 = 0;
    while i < 8 {
        set s.h[i] = INIT_H[i];
        set i += 1;
    }
}

/// Pad and hash a short message (up to 55 bytes, fits in one 512-bit block).
unsafe fn hashMessage(s: *mut Sha256, k: *[u32], msg: *[u8]) -> i32 {
    // The message must fit in a single block (max 55 bytes for 1-block padding).
    if msg.len > 55 {
        return -1;
    }

    // Build the 64-byte (512-bit) padded block.
    let mut blockBytes: [u8; 64] = [0; 64];

    // Copy message.
    let mut i: u32 = 0;
    while i < msg.len {
        set blockBytes[i] = msg[i];
        set i += 1;
    }

    // Append the 1-bit (0x80).
    set blockBytes[msg.len] = 0x80;

    // Append length in bits as big-endian 64-bit integer at the end.
    let bitLen: u32 = msg.len * 8;
    set blockBytes[60] = (bitLen >> 24) as u8;
    set blockBytes[61] = (bitLen >> 16) as u8;
    set blockBytes[62] = (bitLen >> 8) as u8;
    set blockBytes[63] = bitLen as u8;

    // Convert bytes to 16 big-endian 32-bit words.
    let mut block: [u32; 16] = [0; 16];
    let mut w: u32 = 0;
    while w < 16 {
        let base = w * 4;
        set block[w] = (blockBytes[base] as u32 << 24)
                     | (blockBytes[base + 1] as u32 << 16)
                     | (blockBytes[base + 2] as u32 << 8)
                     | (blockBytes[base + 3] as u32);
        set w += 1;
    }

    resetHash(s);
    prepareSchedule(s, &block[..]);
    compress(s, k);

    return 0;
}

/// Test SHA-256 of the empty string "".
/// Expected: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unsafe fn testEmpty(s: *mut Sha256, k: *[u32]) -> i32 {
    assert hashMessage(s, k, &[]) == 0;

    assert s.h[0] == 0xE3B0C442;
    assert s.h[1] == 0x98FC1C14;
    assert s.h[2] == 0x9AFBF4C8;
    assert s.h[3] == 0x996FB924;
    assert s.h[4] == 0x27AE41E4;
    assert s.h[5] == 0x649B934C;
    assert s.h[6] == 0xA495991B;
    assert s.h[7] == 0x7852B855;
    return 0;
}

/// Test SHA-256 of "abc".
/// Expected: ba7816bf 8f01cfea 414140de 5dae2223 b00361a3 96177a9c b410ff61 f20015ad
unsafe fn testAbc(s: *mut Sha256, k: *[u32]) -> i32 {
    let msg: [u8; 3] = [0x61, 0x62, 0x63];
    assert hashMessage(s, k, &msg[..]) == 0;

    assert s.h[0] == 0xBA7816BF;
    assert s.h[1] == 0x8F01CFEA;
    assert s.h[2] == 0x414140DE;
    assert s.h[3] == 0x5DAE2223;
    assert s.h[4] == 0xB00361A3;
    assert s.h[5] == 0x96177A9C;
    assert s.h[6] == 0xB410FF61;
    assert s.h[7] == 0xF20015AD;
    return 0;
}

/// Test the helper functions directly.
fn testHelpers() -> i32 {
    // rotr(1, 1) should be 0x80000000
    assert rotr(1, 1) == 0x80000000;
    // rotr(0xFF000000, 8) should be 0x00FF0000
    assert rotr(0xFF000000, 8) == 0x00FF0000;
    // ch(0xFF, 0x0F, 0xF0):
    //   0xFF & 0x0F = 0x0F
    //   ~0xFF = 0xFFFFFF00, & 0xF0 = 0x00
    //   result = 0x0F ^ 0x00 = 0x0F
    assert ch(0xFF, 0x0F, 0xF0) == 0x0F;
    // maj(0xFF, 0x0F, 0xF0):
    //   0xFF & 0x0F = 0x0F
    //   0xFF & 0xF0 = 0xF0
    //   0x0F & 0xF0 = 0x00
    //   result = 0x0F ^ 0xF0 ^ 0x00 = 0xFF
    assert maj(0xFF, 0x0F, 0xF0) == 0xFF;
    return 0;
}

@default unsafe fn main() -> i32 {
    // SHA-256 round constants (first 32 bits of fractional parts of cube roots
    // of the first 64 primes).
    let k: [u32; 64] = [
        0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5,
        0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
        0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3,
        0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
        0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC,
        0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
        0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7,
        0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
        0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13,
        0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
        0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3,
        0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
        0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5,
        0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
        0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208,
        0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2
    ];

    let mut s: Sha256 = Sha256 { h: INIT_H, w: [0; 64] };

    let r1 = testHelpers();
    if r1 <> 0 {
        return 10 + r1;
    }

    let r2 = testEmpty(&mut s, &k[..]);
    if r2 <> 0 {
        return 20 + r2;
    }

    let r3 = testAbc(&mut s, &k[..]);
    if r3 <> 0 {
        return 30 + r3;
    }
    return 0;
}

1	//! returns: 0
2	//! SHA-256 (single block).
3	//! Implement the SHA-256 compression function for a single 512-bit block.
4	//! Verify against a known hash of a short message.
5
6	/// SHA-256 mutable state: hash values and message schedule.
7	record Sha256 {
8	h: [u32; 8],
9	w: [u32; 64],
10	}
11
12	/// SHA-256 initial hash values (first 32 bits of fractional parts of square
13	/// roots of the first 8 primes).
14	constant INIT_H: [u32; 8] = [
15	0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
16	0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
17	];
18
19	/// Right-rotate a 32-bit value by `n` bits.
20	fn rotr(x: u32, n: u32) -> u32 {
21	return (x >> n) \| (x << (32 - n));
22	}
23
24	/// SHA-256 Ch function: Ch(e, f, g) = (e AND f) XOR (NOT e AND g).
25	fn ch(e: u32, f: u32, g: u32) -> u32 {
26	return (e & f) ^ (~e & g);
27	}
28
29	/// SHA-256 Maj function: Maj(a, b, c) = (a AND b) XOR (a AND c) XOR (b AND c).
30	fn maj(a: u32, b: u32, c: u32) -> u32 {
31	return (a & b) ^ (a & c) ^ (b & c);
32	}
33
34	/// SHA-256 big sigma 0: rotr(a, 2) XOR rotr(a, 13) XOR rotr(a, 22).
35	fn bsig0(a: u32) -> u32 {
36	return rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
37	}
38
39	/// SHA-256 big sigma 1: rotr(e, 6) XOR rotr(e, 11) XOR rotr(e, 25).
40	fn bsig1(e: u32) -> u32 {
41	return rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
42	}
43
44	/// SHA-256 small sigma 0: rotr(x, 7) XOR rotr(x, 18) XOR (x >> 3).
45	fn ssig0(x: u32) -> u32 {
46	return rotr(x, 7) ^ rotr(x, 18) ^ (x >> 3);
47	}
48
49	/// SHA-256 small sigma 1: rotr(x, 17) XOR rotr(x, 19) XOR (x >> 10).
50	fn ssig1(x: u32) -> u32 {
51	return rotr(x, 17) ^ rotr(x, 19) ^ (x >> 10);
52	}
53
54	/// Prepare the message schedule from a 16-word (512-bit) block.
55	unsafe fn prepareSchedule(s: mut Sha256, block: [u32]) {
56	// Copy the first 16 words directly.
57	let mut i: u32 = 0;
58	while i < 16 {
59	set s.w[i] = block[i];
60	set i += 1;
61	}
62	// Extend to 64 words.
63	while i < 64 {
64	set s.w[i] = ssig1(s.w[i - 2]) + s.w[i - 7] + ssig0(s.w[i - 15]) + s.w[i - 16];
65	set i += 1;
66	}
67	}
68
69	/// Run the 64-round compression function.
70	unsafe fn compress(s: mut Sha256, k: [u32]) {
71	let mut a: u32 = s.h[0];
72	let mut b: u32 = s.h[1];
73	let mut c: u32 = s.h[2];
74	let mut d: u32 = s.h[3];
75	let mut e: u32 = s.h[4];
76	let mut f: u32 = s.h[5];
77	let mut g: u32 = s.h[6];
78	let mut hh: u32 = s.h[7];
79
80	let mut i: u32 = 0;
81	while i < 64 {
82	let t1 = hh + bsig1(e) + ch(e, f, g) + k[i] + s.w[i];
83	let t2 = bsig0(a) + maj(a, b, c);
84	set hh = g;
85	set g = f;
86	set f = e;
87	set e = d + t1;
88	set d = c;
89	set c = b;
90	set b = a;
91	set a = t1 + t2;
92	set i += 1;
93	}
94
95	set s.h[0] += a;
96	set s.h[1] += b;
97	set s.h[2] += c;
98	set s.h[3] += d;
99	set s.h[4] += e;
100	set s.h[5] += f;
101	set s.h[6] += g;
102	set s.h[7] += hh;
103	}
104
105	/// Reset hash state to initial values.
106	unsafe fn resetHash(s: *mut Sha256) {
107	let mut i: u32 = 0;
108	while i < 8 {
109	set s.h[i] = INIT_H[i];
110	set i += 1;
111	}
112	}
113
114	/// Pad and hash a short message (up to 55 bytes, fits in one 512-bit block).
115	unsafe fn hashMessage(s: mut Sha256, k: [u32], msg: *[u8]) -> i32 {
116	// The message must fit in a single block (max 55 bytes for 1-block padding).
117	if msg.len > 55 {
118	return -1;
119	}
120
121	// Build the 64-byte (512-bit) padded block.
122	let mut blockBytes: [u8; 64] = [0; 64];
123
124	// Copy message.
125	let mut i: u32 = 0;
126	while i < msg.len {
127	set blockBytes[i] = msg[i];
128	set i += 1;
129	}
130
131	// Append the 1-bit (0x80).
132	set blockBytes[msg.len] = 0x80;
133
134	// Append length in bits as big-endian 64-bit integer at the end.
135	let bitLen: u32 = msg.len * 8;
136	set blockBytes[60] = (bitLen >> 24) as u8;
137	set blockBytes[61] = (bitLen >> 16) as u8;
138	set blockBytes[62] = (bitLen >> 8) as u8;
139	set blockBytes[63] = bitLen as u8;
140
141	// Convert bytes to 16 big-endian 32-bit words.
142	let mut block: [u32; 16] = [0; 16];
143	let mut w: u32 = 0;
144	while w < 16 {
145	let base = w * 4;
146	set block[w] = (blockBytes[base] as u32 << 24)
147	\| (blockBytes[base + 1] as u32 << 16)
148	\| (blockBytes[base + 2] as u32 << 8)
149	\| (blockBytes[base + 3] as u32);
150	set w += 1;
151	}
152
153	resetHash(s);
154	prepareSchedule(s, &block[..]);
155	compress(s, k);
156
157	return 0;
158	}
159
160	/// Test SHA-256 of the empty string "".
161	/// Expected: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
162	unsafe fn testEmpty(s: mut Sha256, k: [u32]) -> i32 {
163	assert hashMessage(s, k, &[]) == 0;
164
165	assert s.h[0] == 0xE3B0C442;
166	assert s.h[1] == 0x98FC1C14;
167	assert s.h[2] == 0x9AFBF4C8;
168	assert s.h[3] == 0x996FB924;
169	assert s.h[4] == 0x27AE41E4;
170	assert s.h[5] == 0x649B934C;
171	assert s.h[6] == 0xA495991B;
172	assert s.h[7] == 0x7852B855;
173	return 0;
174	}
175
176	/// Test SHA-256 of "abc".
177	/// Expected: ba7816bf 8f01cfea 414140de 5dae2223 b00361a3 96177a9c b410ff61 f20015ad
178	unsafe fn testAbc(s: mut Sha256, k: [u32]) -> i32 {
179	let msg: [u8; 3] = [0x61, 0x62, 0x63];
180	assert hashMessage(s, k, &msg[..]) == 0;
181
182	assert s.h[0] == 0xBA7816BF;
183	assert s.h[1] == 0x8F01CFEA;
184	assert s.h[2] == 0x414140DE;
185	assert s.h[3] == 0x5DAE2223;
186	assert s.h[4] == 0xB00361A3;
187	assert s.h[5] == 0x96177A9C;
188	assert s.h[6] == 0xB410FF61;
189	assert s.h[7] == 0xF20015AD;
190	return 0;
191	}
192
193	/// Test the helper functions directly.
194	fn testHelpers() -> i32 {
195	// rotr(1, 1) should be 0x80000000
196	assert rotr(1, 1) == 0x80000000;
197	// rotr(0xFF000000, 8) should be 0x00FF0000
198	assert rotr(0xFF000000, 8) == 0x00FF0000;
199	// ch(0xFF, 0x0F, 0xF0):
200	// 0xFF & 0x0F = 0x0F
201	// ~0xFF = 0xFFFFFF00, & 0xF0 = 0x00
202	// result = 0x0F ^ 0x00 = 0x0F
203	assert ch(0xFF, 0x0F, 0xF0) == 0x0F;
204	// maj(0xFF, 0x0F, 0xF0):
205	// 0xFF & 0x0F = 0x0F
206	// 0xFF & 0xF0 = 0xF0
207	// 0x0F & 0xF0 = 0x00
208	// result = 0x0F ^ 0xF0 ^ 0x00 = 0xFF
209	assert maj(0xFF, 0x0F, 0xF0) == 0xFF;
210	return 0;
211	}
212
213	@default unsafe fn main() -> i32 {
214	// SHA-256 round constants (first 32 bits of fractional parts of cube roots
215	// of the first 64 primes).
216	let k: [u32; 64] = [
217	0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5,
218	0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
219	0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3,
220	0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
221	0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC,
222	0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
223	0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7,
224	0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
225	0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13,
226	0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
227	0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3,
228	0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
229	0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5,
230	0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
231	0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208,
232	0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2
233	];
234
235	let mut s: Sha256 = Sha256 { h: INIT_H, w: [0; 64] };
236
237	let r1 = testHelpers();
238	if r1 <> 0 {
239	return 10 + r1;
240	}
241
242	let r2 = testEmpty(&mut s, &k[..]);
243	if r2 <> 0 {
244	return 20 + r2;
245	}
246
247	let r3 = testAbc(&mut s, &k[..]);
248	if r3 <> 0 {
249	return 30 + r3;
250	}
251	return 0;
252	}