//! SHA-256 (single block).

//! Implement the SHA-256 compression function for a single 512-bit block.

//! Verify against a known hash of a short message.

/// SHA-256 mutable state: hash values and message schedule.

record Sha256 {

    h: [u32; 8],

    w: [u32; 64],

}

/// SHA-256 initial hash values (first 32 bits of fractional parts of square

/// roots of the first 8 primes).

const INIT_H: [u32; 8] = [

    0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,

    0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19

];

/// Right-rotate a 32-bit value by `n` bits.

fn rotr(x: u32, n: u32) -> u32 {

    return (x >> n) | (x << (32 - n));

}

/// SHA-256 Ch function: Ch(e, f, g) = (e AND f) XOR (NOT e AND g).

fn ch(e: u32, f: u32, g: u32) -> u32 {

    return (e & f) ^ (~e & g);

}

/// SHA-256 Maj function: Maj(a, b, c) = (a AND b) XOR (a AND c) XOR (b AND c).

fn maj(a: u32, b: u32, c: u32) -> u32 {

    return (a & b) ^ (a & c) ^ (b & c);

}

/// SHA-256 big sigma 0: rotr(a, 2) XOR rotr(a, 13) XOR rotr(a, 22).

fn bsig0(a: u32) -> u32 {

    return rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);

}

/// SHA-256 big sigma 1: rotr(e, 6) XOR rotr(e, 11) XOR rotr(e, 25).

fn bsig1(e: u32) -> u32 {

    return rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);

}

/// SHA-256 small sigma 0: rotr(x, 7) XOR rotr(x, 18) XOR (x >> 3).

fn ssig0(x: u32) -> u32 {

    return rotr(x, 7) ^ rotr(x, 18) ^ (x >> 3);

}

/// SHA-256 small sigma 1: rotr(x, 17) XOR rotr(x, 19) XOR (x >> 10).

fn ssig1(x: u32) -> u32 {

    return rotr(x, 17) ^ rotr(x, 19) ^ (x >> 10);

}

/// Prepare the message schedule from a 16-word (512-bit) block.

fn prepareSchedule(s: *mut Sha256, block: *[u32]) {

    // Copy the first 16 words directly.

    let mut i: u32 = 0;

    while i < 16 {

        s.w[i] = block[i];

        i += 1;

    }

    // Extend to 64 words.

    while i < 64 {

        s.w[i] = ssig1(s.w[i - 2]) + s.w[i - 7] + ssig0(s.w[i - 15]) + s.w[i - 16];

        i += 1;

    }

}

/// Run the 64-round compression function.

fn compress(s: *mut Sha256, k: *[u32]) {

    let mut a: u32 = s.h[0];

    let mut b: u32 = s.h[1];

    let mut c: u32 = s.h[2];

    let mut d: u32 = s.h[3];

    let mut e: u32 = s.h[4];

    let mut f: u32 = s.h[5];

    let mut g: u32 = s.h[6];

    let mut hh: u32 = s.h[7];

    let mut i: u32 = 0;

    while i < 64 {

        let t1 = hh + bsig1(e) + ch(e, f, g) + k[i] + s.w[i];

        let t2 = bsig0(a) + maj(a, b, c);

        hh = g;

        g = f;

        f = e;

        e = d + t1;

        d = c;

        c = b;

        b = a;

        a = t1 + t2;

        i += 1;

    }

    s.h[0] += a;

    s.h[1] += b;

    s.h[2] += c;

    s.h[3] += d;

    s.h[4] += e;

    s.h[5] += f;

    s.h[6] += g;

    s.h[7] += hh;

}

/// Reset hash state to initial values.

fn resetHash(s: *mut Sha256) {

    let mut i: u32 = 0;

    while i < 8 {

        s.h[i] = INIT_H[i];

        i += 1;

    }

}

/// Pad and hash a short message (up to 55 bytes, fits in one 512-bit block).

fn hashMessage(s: *mut Sha256, k: *[u32], msg: *[u8]) -> i32 {

    // The message must fit in a single block (max 55 bytes for 1-block padding).

    if msg.len > 55 {

        return -1;

    }

    // Build the 64-byte (512-bit) padded block.

    let mut blockBytes: [u8; 64] = [0; 64];

    // Copy message.

    let mut i: u32 = 0;

    while i < msg.len {

        blockBytes[i] = msg[i];

        i += 1;

    }

    // Append the 1-bit (0x80).

    blockBytes[msg.len] = 0x80;

    // Append length in bits as big-endian 64-bit integer at the end.

    let bitLen: u32 = msg.len * 8;

    blockBytes[60] = (bitLen >> 24) as u8;

    blockBytes[61] = (bitLen >> 16) as u8;

    blockBytes[62] = (bitLen >> 8) as u8;

    blockBytes[63] = bitLen as u8;

    // Convert bytes to 16 big-endian 32-bit words.

    let mut block: [u32; 16] = [0; 16];

    let mut w: u32 = 0;

    while w < 16 {

        let base = w * 4;

        block[w] = (blockBytes[base] as u32 << 24)

                  | (blockBytes[base + 1] as u32 << 16)

                  | (blockBytes[base + 2] as u32 << 8)

                  | (blockBytes[base + 3] as u32);

        w += 1;

    }

    resetHash(s);

    prepareSchedule(s, &block[..]);

    compress(s, k);

    return 0;

}

/// Test SHA-256 of the empty string "".

/// Expected: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

fn testEmpty(s: *mut Sha256, k: *[u32]) -> i32 {

    assert hashMessage(s, k, &[]) == 0;

    assert s.h[0] == 0xE3B0C442;

    assert s.h[1] == 0x98FC1C14;

    assert s.h[2] == 0x9AFBF4C8;

    assert s.h[3] == 0x996FB924;

    assert s.h[4] == 0x27AE41E4;

    assert s.h[5] == 0x649B934C;

    assert s.h[6] == 0xA495991B;

    assert s.h[7] == 0x7852B855;

    return 0;

}

/// Test SHA-256 of "abc".

/// Expected: ba7816bf 8f01cfea 414140de 5dae2223 b00361a3 96177a9c b410ff61 f20015ad

fn testAbc(s: *mut Sha256, k: *[u32]) -> i32 {

    let msg: [u8; 3] = [0x61, 0x62, 0x63];

    assert hashMessage(s, k, &msg[..]) == 0;

    assert s.h[0] == 0xBA7816BF;

    assert s.h[1] == 0x8F01CFEA;

    assert s.h[2] == 0x414140DE;

    assert s.h[3] == 0x5DAE2223;

    assert s.h[4] == 0xB00361A3;

    assert s.h[5] == 0x96177A9C;

    assert s.h[6] == 0xB410FF61;

    assert s.h[7] == 0xF20015AD;

    return 0;

}

/// Test the helper functions directly.

fn testHelpers() -> i32 {

    // rotr(1, 1) should be 0x80000000

    assert rotr(1, 1) == 0x80000000;

    // rotr(0xFF000000, 8) should be 0x00FF0000

    assert rotr(0xFF000000, 8) == 0x00FF0000;

    // ch(0xFF, 0x0F, 0xF0):

    //   0xFF & 0x0F = 0x0F

    //   ~0xFF = 0xFFFFFF00, & 0xF0 = 0x00

    //   result = 0x0F ^ 0x00 = 0x0F

    assert ch(0xFF, 0x0F, 0xF0) == 0x0F;

    // maj(0xFF, 0x0F, 0xF0):

    //   0xFF & 0x0F = 0x0F

    //   0xFF & 0xF0 = 0xF0

    //   0x0F & 0xF0 = 0x00

    //   result = 0x0F ^ 0xF0 ^ 0x00 = 0xFF

    assert maj(0xFF, 0x0F, 0xF0) == 0xFF;

    return 0;

}

@default fn main() -> i32 {

    // SHA-256 round constants (first 32 bits of fractional parts of cube roots

    // of the first 64 primes).

    let k: [u32; 64] = [

        0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5,

        0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,

        0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3,

        0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,

        0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC,

        0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,

        0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7,

        0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,

        0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13,

        0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,

        0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3,

        0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,

        0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5,

        0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,

        0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208,

        0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2

    ];

    let mut s: Sha256 = Sha256 { h: INIT_H, w: [0; 64] };

    let r1 = testHelpers();

    if r1 != 0 {

        return 10 + r1;

    }

    let r2 = testEmpty(&mut s, &k[..]);

    if r2 != 0 {

        return 20 + r2;

    }

    let r3 = testAbc(&mut s, &k[..]);

    if r3 != 0 {

        return 30 + r3;

    }

    return 0;

}