@swiftbrowser/swift 0.1.0 → 0.2.0

package/Sources/CryptoKit/ChaChaPoly.swift

@@ -0,0 +1,258 @@
+// ChaCha20-Poly1305 (RFC 8439), CryptoKit's `ChaChaPoly`, with the
+// `SymmetricKey` it takes, in plain Swift. A sealed box is the 12-byte
+// nonce, the ciphertext and the 16-byte tag; `combined` joins them in that
+// order, as CryptoKit does. Opening checks the tag before decrypting and
+// fails with `CryptoKitError.authenticationFailure`.
+
+import struct Foundation.Data
+import protocol Foundation.ContiguousBytes
+import protocol Foundation.DataProtocol
+
+// MARK: - Symmetric keys
+
+/// A key's size in bits.
+public struct SymmetricKeySize: Sendable {
+    public let bitCount: Int
+
+    public init(bitCount: Int) {
+        precondition(bitCount > 0 && bitCount % 8 == 0, "a key's size is a positive number of bytes")
+        self.bitCount = bitCount
+    }
+
+    public static let bits128 = SymmetricKeySize(bitCount: 128)
+    public static let bits192 = SymmetricKeySize(bitCount: 192)
+    public static let bits256 = SymmetricKeySize(bitCount: 256)
+}
+
+/// A symmetric key: its bytes.
+public struct SymmetricKey: ContiguousBytes, Sendable {
+    let bytes: [UInt8]
+
+    /// A new random key of `size`.
+    public init(size: SymmetricKeySize) {
+        var generator = SystemRandomNumberGenerator()
+        bytes = (0..<size.bitCount / 8).map { _ in UInt8.random(in: .min ... .max, using: &generator) }
+    }
+
+    public init<D: ContiguousBytes>(data: D) {
+        bytes = data.withUnsafeBytes { Array($0) }
+    }
+
+    public var bitCount: Int { bytes.count * 8 }
+
+    public func withUnsafeBytes<R>(_ body: (UnsafeRawBufferPointer) throws -> R) rethrows -> R {
+        try bytes.withUnsafeBytes(body)
+    }
+}
+
+// MARK: - ChaChaPoly
+
+public enum ChaChaPoly {
+    /// A 12-byte nonce; a new one is random.
+    public struct Nonce: ContiguousBytes, Sequence, Sendable {
+        let bytes: [UInt8]
+
+        public init() {
+            var generator = SystemRandomNumberGenerator()
+            bytes = (0..<12).map { _ in UInt8.random(in: .min ... .max, using: &generator) }
+        }
+
+        public init<D: DataProtocol>(data: D) throws {
+            let bytes = Array(data)
+            guard bytes.count == 12 else { throw CryptoKitError.incorrectParameterSize }
+            self.bytes = bytes
+        }
+
+        public func makeIterator() -> Array<UInt8>.Iterator { bytes.makeIterator() }
+
+        public func withUnsafeBytes<R>(_ body: (UnsafeRawBufferPointer) throws -> R) rethrows -> R {
+            try bytes.withUnsafeBytes(body)
+        }
+    }
+
+    /// A message sealed with a key: nonce, ciphertext and tag.
+    public struct SealedBox: Sendable {
+        public let nonce: Nonce
+        public let ciphertext: Data
+        public let tag: Data
+
+        /// `nonce ‖ ciphertext ‖ tag`.
+        public var combined: Data { Data(nonce.bytes) + ciphertext + tag }
+
+        public init<D: DataProtocol>(combined data: D) throws {
+            let bytes = Array(data)
+            guard bytes.count >= 28 else { throw CryptoKitError.incorrectParameterSize }
+            nonce = try Nonce(data: bytes[0..<12])
+            ciphertext = Data(bytes[12..<(bytes.count - 16)])
+            tag = Data(bytes[(bytes.count - 16)...])
+        }
+
+        public init<C: DataProtocol, T: DataProtocol>(nonce: Nonce, ciphertext: C, tag: T) throws {
+            guard tag.count == 16 else { throw CryptoKitError.incorrectParameterSize }
+            self.nonce = nonce
+            self.ciphertext = Data(ciphertext)
+            self.tag = Data(tag)
+        }
+    }
+
+    public static func seal<Plaintext: DataProtocol>(_ message: Plaintext, using key: SymmetricKey, nonce: Nonce? = nil) throws -> SealedBox {
+        try seal(message, using: key, nonce: nonce, authenticating: [UInt8]())
+    }
+
+    public static func seal<Plaintext: DataProtocol, AuthenticatedData: DataProtocol>(
+        _ message: Plaintext, using key: SymmetricKey, nonce: Nonce? = nil, authenticating authenticatedData: AuthenticatedData
+    ) throws -> SealedBox {
+        guard key.bytes.count == 32 else { throw CryptoKitError.incorrectKeySize }
+        let nonce = nonce ?? Nonce()
+        let ciphertext = _ChaCha20.xor(Array(message), key: key.bytes, nonce: nonce.bytes, counter: 1)
+        let tag = _ChaCha20.tag(key: key.bytes, nonce: nonce.bytes, authenticatedData: Array(authenticatedData), ciphertext: ciphertext)
+        return try SealedBox(nonce: nonce, ciphertext: ciphertext, tag: tag)
+    }
+
+    public static func open(_ sealedBox: SealedBox, using key: SymmetricKey) throws -> Data {
+        try open(sealedBox, using: key, authenticating: [UInt8]())
+    }
+
+    public static func open<AuthenticatedData: DataProtocol>(
+        _ sealedBox: SealedBox, using key: SymmetricKey, authenticating authenticatedData: AuthenticatedData
+    ) throws -> Data {
+        guard key.bytes.count == 32 else { throw CryptoKitError.incorrectKeySize }
+        let ciphertext = Array(sealedBox.ciphertext)
+        let expected = _ChaCha20.tag(key: key.bytes, nonce: sealedBox.nonce.bytes, authenticatedData: Array(authenticatedData), ciphertext: ciphertext)
+        // Compared in full, whatever differs.
+        guard zip(expected, sealedBox.tag).reduce(UInt8(0), { $0 | ($1.0 ^ $1.1) }) == 0 else {
+            throw CryptoKitError.authenticationFailure
+        }
+        return Data(_ChaCha20.xor(ciphertext, key: key.bytes, nonce: sealedBox.nonce.bytes, counter: 1))
+    }
+}
+
+// MARK: - ChaCha20 and Poly1305
+
+enum _ChaCha20 {
+    /// The 64-byte keystream block for `counter`.
+    static func block(key: [UInt8], nonce: [UInt8], counter: UInt32) -> [UInt8] {
+        func word(_ bytes: [UInt8], _ index: Int) -> UInt32 {
+            (0..<4).reduce(UInt32(0)) { $0 | UInt32(bytes[index * 4 + $1]) << (8 * $1) }
+        }
+        var state: [UInt32] = [0x6170_7865, 0x3320_646E, 0x7962_2D32, 0x6B20_6574]
+        state += (0..<8).map { word(key, $0) }
+        state.append(counter)
+        state += (0..<3).map { word(nonce, $0) }
+        var working = state
+        func quarterRound(_ a: Int, _ b: Int, _ c: Int, _ d: Int) {
+            working[a] &+= working[b]; working[d] ^= working[a]; working[d] = working[d].rotatedLeft(16)
+            working[c] &+= working[d]; working[b] ^= working[c]; working[b] = working[b].rotatedLeft(12)
+            working[a] &+= working[b]; working[d] ^= working[a]; working[d] = working[d].rotatedLeft(8)
+            working[c] &+= working[d]; working[b] ^= working[c]; working[b] = working[b].rotatedLeft(7)
+        }
+        for _ in 0..<10 {
+            quarterRound(0, 4, 8, 12); quarterRound(1, 5, 9, 13); quarterRound(2, 6, 10, 14); quarterRound(3, 7, 11, 15)
+            quarterRound(0, 5, 10, 15); quarterRound(1, 6, 11, 12); quarterRound(2, 7, 8, 13); quarterRound(3, 4, 9, 14)
+        }
+        return (0..<16).flatMap { i -> [UInt8] in
+            let value = working[i] &+ state[i]
+            return (0..<4).map { UInt8(truncatingIfNeeded: value >> (8 * $0)) }
+        }
+    }
+
+    /// `bytes` XORed with the keystream from block `counter` on.
+    static func xor(_ bytes: [UInt8], key: [UInt8], nonce: [UInt8], counter: UInt32) -> [UInt8] {
+        var output = bytes
+        var blockCounter = counter
+        var offset = 0
+        while offset < bytes.count {
+            let stream = block(key: key, nonce: nonce, counter: blockCounter)
+            for i in 0..<min(64, bytes.count - offset) { output[offset + i] ^= stream[i] }
+            offset += 64
+            blockCounter &+= 1
+        }
+        return output
+    }
+
+    /// The AEAD tag: Poly1305, keyed by block 0, over the padded authenticated
+    /// data and ciphertext and their lengths.
+    static func tag(key: [UInt8], nonce: [UInt8], authenticatedData: [UInt8], ciphertext: [UInt8]) -> [UInt8] {
+        let oneTimeKey = Array(block(key: key, nonce: nonce, counter: 0)[0..<32])
+        func padded(_ bytes: [UInt8]) -> [UInt8] { bytes + [UInt8](repeating: 0, count: (16 - bytes.count % 16) % 16) }
+        func length(_ count: Int) -> [UInt8] { (0..<8).map { UInt8(truncatingIfNeeded: UInt64(count) >> (8 * $0)) } }
+        let message = padded(authenticatedData) + padded(ciphertext) + length(authenticatedData.count) + length(ciphertext.count)
+        return _Poly1305.authenticate(message, key: oneTimeKey)
+    }
+}
+
+/// Poly1305 with five 26-bit limbs (as poly1305-donna's 32-bit form).
+enum _Poly1305 {
+    static func authenticate(_ message: [UInt8], key: [UInt8]) -> [UInt8] {
+        func load32(_ bytes: [UInt8], _ index: Int) -> UInt32 {
+            (0..<4).reduce(UInt32(0)) { $0 | UInt32(bytes[index + $1]) << (8 * $1) }
+        }
+        let r0 = load32(key, 0) & 0x3FF_FFFF
+        let r1 = (load32(key, 3) >> 2) & 0x3FF_FF03
+        let r2 = (load32(key, 6) >> 4) & 0x3FF_C0FF
+        let r3 = (load32(key, 9) >> 6) & 0x3F0_3FFF
+        let r4 = (load32(key, 12) >> 8) & 0x00F_FFFF
+        let (s1, s2, s3, s4) = (r1 * 5, r2 * 5, r3 * 5, r4 * 5)
+        var (h0, h1, h2, h3, h4): (UInt32, UInt32, UInt32, UInt32, UInt32) = (0, 0, 0, 0, 0)
+
+        var offset = 0
+        while offset < message.count {
+            var block = [UInt8](repeating: 0, count: 17)
+            let count = min(16, message.count - offset)
+            for i in 0..<count { block[i] = message[offset + i] }
+            block[count] = 1
+            h0 &+= load32(block, 0) & 0x3FF_FFFF
+            h1 &+= (load32(block, 3) >> 2) & 0x3FF_FFFF
+            h2 &+= (load32(block, 6) >> 4) & 0x3FF_FFFF
+            h3 &+= (load32(block, 9) >> 6) & 0x3FF_FFFF
+            h4 &+= (load32(block, 12) >> 8) | (UInt32(block[16]) << 24)
+
+            func m(_ a: UInt32, _ b: UInt32) -> UInt64 { UInt64(a) * UInt64(b) }
+            let d0 = m(h0, r0) + m(h1, s4) + m(h2, s3) + m(h3, s2) + m(h4, s1)
+            var d1 = m(h0, r1) + m(h1, r0) + m(h2, s4) + m(h3, s3) + m(h4, s2)
+            var d2 = m(h0, r2) + m(h1, r1) + m(h2, r0) + m(h3, s4) + m(h4, s3)
+            var d3 = m(h0, r3) + m(h1, r2) + m(h2, r1) + m(h3, r0) + m(h4, s4)
+            var d4 = m(h0, r4) + m(h1, r3) + m(h2, r2) + m(h3, r1) + m(h4, r0)
+
+            var carry = d0 >> 26; h0 = UInt32(d0 & 0x3FF_FFFF)
+            d1 += carry; carry = d1 >> 26; h1 = UInt32(d1 & 0x3FF_FFFF)
+            d2 += carry; carry = d2 >> 26; h2 = UInt32(d2 & 0x3FF_FFFF)
+            d3 += carry; carry = d3 >> 26; h3 = UInt32(d3 & 0x3FF_FFFF)
+            d4 += carry; carry = d4 >> 26; h4 = UInt32(d4 & 0x3FF_FFFF)
+            h0 &+= UInt32(carry) &* 5; let c = h0 >> 26; h0 &= 0x3FF_FFFF
+            h1 &+= c
+            offset += 16
+        }
+
+        // Full carry, then h mod 2¹³⁰ − 5.
+        var c = h1 >> 26; h1 &= 0x3FF_FFFF
+        h2 &+= c; c = h2 >> 26; h2 &= 0x3FF_FFFF
+        h3 &+= c; c = h3 >> 26; h3 &= 0x3FF_FFFF
+        h4 &+= c; c = h4 >> 26; h4 &= 0x3FF_FFFF
+        h0 &+= c &* 5; c = h0 >> 26; h0 &= 0x3FF_FFFF
+        h1 &+= c
+
+        var g0 = h0 &+ 5; c = g0 >> 26; g0 &= 0x3FF_FFFF
+        var g1 = h1 &+ c; c = g1 >> 26; g1 &= 0x3FF_FFFF
+        var g2 = h2 &+ c; c = g2 >> 26; g2 &= 0x3FF_FFFF
+        var g3 = h3 &+ c; c = g3 >> 26; g3 &= 0x3FF_FFFF
+        let g4 = h4 &+ c &- (1 << 26)
+        // h − p when that is not negative.
+        if g4 >> 31 == 0 { (h0, h1, h2, h3, h4) = (g0, g1, g2, g3, g4) }
+
+        // h as 128 bits, plus s.
+        let w0 = h0 | h1 << 26
+        let w1 = h1 >> 6 | h2 << 20
+        let w2 = h2 >> 12 | h3 << 14
+        let w3 = h3 >> 18 | h4 << 8
+        var f = UInt64(w0) + UInt64(load32(key, 16)); let t0 = UInt32(truncatingIfNeeded: f)
+        f = UInt64(w1) + UInt64(load32(key, 20)) + (f >> 32); let t1 = UInt32(truncatingIfNeeded: f)
+        f = UInt64(w2) + UInt64(load32(key, 24)) + (f >> 32); let t2 = UInt32(truncatingIfNeeded: f)
+        f = UInt64(w3) + UInt64(load32(key, 28)) + (f >> 32); let t3 = UInt32(truncatingIfNeeded: f)
+        return [t0, t1, t2, t3].flatMap { word in (0..<4).map { UInt8(truncatingIfNeeded: word >> (8 * $0)) } }
+    }
+}
+
+extension UInt32 {
+    func rotatedLeft(_ count: UInt32) -> UInt32 { self << count | self >> (32 - count) }
+}

package/Sources/CryptoKit/CryptoKit.swift

@@ -0,0 +1,375 @@
+// `import CryptoKit` for the browser: the hash functions (SHA-1, SHA-256,
+// SHA-384, SHA-512 and MD5) in plain Swift, with CryptoKit's API, which is
+// what packages use it for (cache file names, content digests). Keys,
+// ciphers and signatures are not here: code that needs them is a compile
+// error in the browser build.
+
+import struct Foundation.Data
+
+/// A hash function.
+public protocol HashFunction: Sendable {
+    associatedtype Digest: CryptoKit.Digest
+    static var blockByteCount: Int { get }
+    init()
+    mutating func update(bufferPointer: UnsafeRawBufferPointer)
+    func finalize() -> Digest
+}
+
+extension HashFunction {
+    public mutating func update<D: DataProtocol>(data: D) {
+        let bytes = [UInt8](data)
+        bytes.withUnsafeBytes { update(bufferPointer: $0) }
+    }
+
+    public static func hash<D: DataProtocol>(data: D) -> Digest {
+        var hasher = Self()
+        hasher.update(data: data)
+        return hasher.finalize()
+    }
+}
+
+/// A hash's output: a sequence of bytes.
+public protocol Digest: Hashable, Sequence, CustomStringConvertible, Sendable where Element == UInt8 {
+    static var byteCount: Int { get }
+    var bytes: [UInt8] { get }
+}
+
+extension Digest {
+    public func makeIterator() -> Array<UInt8>.Iterator { bytes.makeIterator() }
+    public func withUnsafeBytes<R>(_ body: (UnsafeRawBufferPointer) throws -> R) rethrows -> R { try bytes.withUnsafeBytes(body) }
+    public var description: String {
+        "\(Self.self): \(bytes.map { ($0 < 16 ? "0" : "") + String($0, radix: 16) }.joined())"
+    }
+}
+
+import protocol Foundation.DataProtocol
+
+// MARK: - SHA-2
+
+public struct SHA256Digest: Digest {
+    public static let byteCount = 32
+    public let bytes: [UInt8]
+}
+
+public struct SHA384Digest: Digest {
+    public static let byteCount = 48
+    public let bytes: [UInt8]
+}
+
+public struct SHA512Digest: Digest {
+    public static let byteCount = 64
+    public let bytes: [UInt8]
+}
+
+public struct SHA256: HashFunction {
+    public static let blockByteCount = 64
+    public static let byteCount = 32
+    var state = _SHA32(initial: [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19])
+
+    public init() {}
+    public mutating func update(bufferPointer: UnsafeRawBufferPointer) { state.update(bufferPointer) }
+    public func finalize() -> SHA256Digest { SHA256Digest(bytes: state.finalize(words: 8)) }
+}
+
+public struct SHA384: HashFunction {
+    public static let blockByteCount = 128
+    public static let byteCount = 48
+    var state = _SHA64(initial: [0xcbbb9d5dc1059ed8, 0x629a292a367cd507, 0x9159015a3070dd17, 0x152fecd8f70e5939,
+                                 0x67332667ffc00b31, 0x8eb44a8768581511, 0xdb0c2e0d64f98fa7, 0x47b5481dbefa4fa4])
+
+    public init() {}
+    public mutating func update(bufferPointer: UnsafeRawBufferPointer) { state.update(bufferPointer) }
+    public func finalize() -> SHA384Digest { SHA384Digest(bytes: state.finalize(words: 6)) }
+}
+
+public struct SHA512: HashFunction {
+    public static let blockByteCount = 128
+    public static let byteCount = 64
+    var state = _SHA64(initial: [0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1,
+                                 0x510e527fade682d1, 0x9b05688c2b3e6c1f, 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179])
+
+    public init() {}
+    public mutating func update(bufferPointer: UnsafeRawBufferPointer) { state.update(bufferPointer) }
+    public func finalize() -> SHA512Digest { SHA512Digest(bytes: state.finalize(words: 8)) }
+}
+
+/// The insecure hash functions, kept for compatibility (file names, checksums).
+public enum Insecure {
+    public struct SHA1Digest: Digest {
+        public static let byteCount = 20
+        public let bytes: [UInt8]
+    }
+
+    public struct MD5Digest: Digest {
+        public static let byteCount = 16
+        public let bytes: [UInt8]
+    }
+
+    public struct SHA1: HashFunction {
+        public static let blockByteCount = 64
+        public static let byteCount = 20
+        var buffer = _Blocks(size: 64)
+        var h: [UInt32] = [0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0]
+
+        public init() {}
+
+        public mutating func update(bufferPointer: UnsafeRawBufferPointer) {
+            var h = self.h
+            buffer.append(bufferPointer) { block in Self.compress(&h, block) }
+            self.h = h
+        }
+
+        public func finalize() -> SHA1Digest {
+            var copy = self
+            var h = copy.h
+            copy.buffer.pad(lengthBytes: 8, bigEndian: true) { block in Self.compress(&h, block) }
+            return SHA1Digest(bytes: h.flatMap { _bigEndianBytes($0) })
+        }
+
+        static func compress(_ h: inout [UInt32], _ block: [UInt8]) {
+            var w = [UInt32](repeating: 0, count: 80)
+            for i in 0..<16 { w[i] = _word32(block, i * 4) }
+            for i in 16..<80 { w[i] = _rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1) }
+            var (a, b, c, d, e) = (h[0], h[1], h[2], h[3], h[4])
+            for i in 0..<80 {
+                let (f, k): (UInt32, UInt32) = switch i {
+                case 0..<20: ((b & c) | (~b & d), 0x5A827999)
+                case 20..<40: (b ^ c ^ d, 0x6ED9EBA1)
+                case 40..<60: ((b & c) | (b & d) | (c & d), 0x8F1BBCDC)
+                default: (b ^ c ^ d, 0xCA62C1D6)
+                }
+                let t = _rotl(a, 5) &+ f &+ e &+ k &+ w[i]
+                (e, d, c, b, a) = (d, c, _rotl(b, 30), a, t)
+            }
+            h[0] &+= a; h[1] &+= b; h[2] &+= c; h[3] &+= d; h[4] &+= e
+        }
+    }
+
+    public struct MD5: HashFunction {
+        public static let blockByteCount = 64
+        public static let byteCount = 16
+        var buffer = _Blocks(size: 64)
+        var h: [UInt32] = [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476]
+
+        public init() {}
+
+        public mutating func update(bufferPointer: UnsafeRawBufferPointer) {
+            var h = self.h
+            buffer.append(bufferPointer) { block in Self.compress(&h, block) }
+            self.h = h
+        }
+
+        public func finalize() -> MD5Digest {
+            var copy = self
+            var h = copy.h
+            copy.buffer.pad(lengthBytes: 8, bigEndian: false) { block in Self.compress(&h, block) }
+            return MD5Digest(bytes: h.flatMap { word in (0..<4).map { UInt8(truncatingIfNeeded: word >> ($0 * 8)) } })
+        }
+
+        static let s: [UInt32] = [7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
+                                  5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
+                                  4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
+                                  6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21]
+        static let k: [UInt32] = (0..<64).map { UInt32(truncatingIfNeeded: Int64(abs(_sin(Double($0 + 1))) * 4294967296.0)) }
+
+        static func compress(_ h: inout [UInt32], _ block: [UInt8]) {
+            var m = [UInt32](repeating: 0, count: 16)
+            for i in 0..<16 {
+                m[i] = UInt32(block[i * 4]) | UInt32(block[i * 4 + 1]) << 8 | UInt32(block[i * 4 + 2]) << 16 | UInt32(block[i * 4 + 3]) << 24
+            }
+            var (a, b, c, d) = (h[0], h[1], h[2], h[3])
+            for i in 0..<64 {
+                var f: UInt32
+                let g: Int
+                switch i {
+                case 0..<16: f = (b & c) | (~b & d); g = i
+                case 16..<32: f = (d & b) | (~d & c); g = (5 * i + 1) % 16
+                case 32..<48: f = b ^ c ^ d; g = (3 * i + 5) % 16
+                default: f = c ^ (b | ~d); g = (7 * i) % 16
+                }
+                f = f &+ a &+ k[i] &+ m[g]
+                a = d; d = c; c = b
+                b = b &+ _rotl(f, s[i])
+            }
+            h[0] &+= a; h[1] &+= b; h[2] &+= c; h[3] &+= d
+        }
+    }
+}
+
+// MARK: - Internals
+
+/// Buffers input into blocks, and pads the last one (Merkle–Damgård).
+struct _Blocks: Sendable {
+    let size: Int
+    var pending: [UInt8] = []
+    var length: UInt64 = 0
+
+    init(size: Int) { self.size = size }
+
+    mutating func append(_ bytes: UnsafeRawBufferPointer, _ compress: ([UInt8]) -> Void) {
+        length &+= UInt64(bytes.count)
+        pending.append(contentsOf: bytes)
+        var start = 0
+        while pending.count - start >= size {
+            compress(Array(pending[start..<start + size]))
+            start += size
+        }
+        pending.removeFirst(start)
+    }
+
+    mutating func pad(lengthBytes: Int, bigEndian: Bool, _ compress: ([UInt8]) -> Void) {
+        let bits = length &* 8
+        var tail = pending + [0x80]
+        while (tail.count + lengthBytes) % size != 0 { tail.append(0) }
+        var lengthField = [UInt8](repeating: 0, count: lengthBytes)
+        for i in 0..<min(8, lengthBytes) {
+            let byte = UInt8(truncatingIfNeeded: bits >> (UInt64(i) * 8))
+            if bigEndian { lengthField[lengthBytes - 1 - i] = byte } else { lengthField[i] = byte }
+        }
+        tail += lengthField
+        var start = 0
+        while start < tail.count {
+            compress(Array(tail[start..<start + size]))
+            start += size
+        }
+        pending = []
+    }
+}
+
+/// SHA-224/256's state.
+struct _SHA32: Sendable {
+    var buffer = _Blocks(size: 64)
+    var h: [UInt32]
+
+    init(initial: [UInt32]) { h = initial }
+
+    static let k: [UInt32] = [
+        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+    ]
+
+    mutating func update(_ bytes: UnsafeRawBufferPointer) {
+        var h = self.h
+        buffer.append(bytes) { Self.compress(&h, $0) }
+        self.h = h
+    }
+
+    func finalize(words: Int) -> [UInt8] {
+        var copy = self
+        var h = copy.h
+        copy.buffer.pad(lengthBytes: 8, bigEndian: true) { Self.compress(&h, $0) }
+        return h.prefix(words).flatMap { _bigEndianBytes($0) }
+    }
+
+    static func compress(_ h: inout [UInt32], _ block: [UInt8]) {
+        var w = [UInt32](repeating: 0, count: 64)
+        for i in 0..<16 { w[i] = _word32(block, i * 4) }
+        for i in 16..<64 {
+            let s0 = _rotr(w[i - 15], 7) ^ _rotr(w[i - 15], 18) ^ (w[i - 15] >> 3)
+            let s1 = _rotr(w[i - 2], 17) ^ _rotr(w[i - 2], 19) ^ (w[i - 2] >> 10)
+            w[i] = w[i - 16] &+ s0 &+ w[i - 7] &+ s1
+        }
+        var (a, b, c, d, e, f, g, hh) = (h[0], h[1], h[2], h[3], h[4], h[5], h[6], h[7])
+        for i in 0..<64 {
+            let s1 = _rotr(e, 6) ^ _rotr(e, 11) ^ _rotr(e, 25)
+            let ch = (e & f) ^ (~e & g)
+            let t1 = hh &+ s1 &+ ch &+ k[i] &+ w[i]
+            let s0 = _rotr(a, 2) ^ _rotr(a, 13) ^ _rotr(a, 22)
+            let maj = (a & b) ^ (a & c) ^ (b & c)
+            let t2 = s0 &+ maj
+            (hh, g, f, e, d, c, b, a) = (g, f, e, d &+ t1, c, b, a, t1 &+ t2)
+        }
+        h[0] &+= a; h[1] &+= b; h[2] &+= c; h[3] &+= d; h[4] &+= e; h[5] &+= f; h[6] &+= g; h[7] &+= hh
+    }
+}
+
+/// SHA-384/512's state.
+struct _SHA64: Sendable {
+    var buffer = _Blocks(size: 128)
+    var h: [UInt64]
+
+    init(initial: [UInt64]) { h = initial }
+
+    static let k: [UInt64] = [
+        0x428a2f98d728ae22, 0x7137449123ef65cd, 0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc, 0x3956c25bf348b538, 0x59f111f1b605d019,
+        0x923f82a4af194f9b, 0xab1c5ed5da6d8118, 0xd807aa98a3030242, 0x12835b0145706fbe, 0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2,
+        0x72be5d74f27b896f, 0x80deb1fe3b1696b1, 0x9bdc06a725c71235, 0xc19bf174cf692694, 0xe49b69c19ef14ad2, 0xefbe4786384f25e3,
+        0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65, 0x2de92c6f592b0275, 0x4a7484aa6ea6e483, 0x5cb0a9dcbd41fbd4, 0x76f988da831153b5,
+        0x983e5152ee66dfab, 0xa831c66d2db43210, 0xb00327c898fb213f, 0xbf597fc7beef0ee4, 0xc6e00bf33da88fc2, 0xd5a79147930aa725,
+        0x06ca6351e003826f, 0x142929670a0e6e70, 0x27b70a8546d22ffc, 0x2e1b21385c26c926, 0x4d2c6dfc5ac42aed, 0x53380d139d95b3df,
+        0x650a73548baf63de, 0x766a0abb3c77b2a8, 0x81c2c92e47edaee6, 0x92722c851482353b, 0xa2bfe8a14cf10364, 0xa81a664bbc423001,
+        0xc24b8b70d0f89791, 0xc76c51a30654be30, 0xd192e819d6ef5218, 0xd69906245565a910, 0xf40e35855771202a, 0x106aa07032bbd1b8,
+        0x19a4c116b8d2d0c8, 0x1e376c085141ab53, 0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8, 0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb,
+        0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3, 0x748f82ee5defb2fc, 0x78a5636f43172f60, 0x84c87814a1f0ab72, 0x8cc702081a6439ec,
+        0x90befffa23631e28, 0xa4506cebde82bde9, 0xbef9a3f7b2c67915, 0xc67178f2e372532b, 0xca273eceea26619c, 0xd186b8c721c0c207,
+        0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178, 0x06f067aa72176fba, 0x0a637dc5a2c898a6, 0x113f9804bef90dae, 0x1b710b35131c471b,
+        0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c, 0x4cc5d4becb3e42b6, 0x597f299cfc657e2a,
+        0x5fcb6fab3ad6faec, 0x6c44198c4a475817,
+    ]
+
+    mutating func update(_ bytes: UnsafeRawBufferPointer) {
+        var h = self.h
+        buffer.append(bytes) { Self.compress(&h, $0) }
+        self.h = h
+    }
+
+    func finalize(words: Int) -> [UInt8] {
+        var copy = self
+        var h = copy.h
+        copy.buffer.pad(lengthBytes: 16, bigEndian: true) { Self.compress(&h, $0) }
+        return h.prefix(words).flatMap { word in (0..<8).reversed().map { UInt8(truncatingIfNeeded: word >> (UInt64($0) * 8)) } }
+    }
+
+    static func compress(_ h: inout [UInt64], _ block: [UInt8]) {
+        var w = [UInt64](repeating: 0, count: 80)
+        for i in 0..<16 {
+            w[i] = (0..<8).reduce(0) { $0 << 8 | UInt64(block[i * 8 + $1]) }
+        }
+        for i in 16..<80 {
+            let s0 = _rotr64(w[i - 15], 1) ^ _rotr64(w[i - 15], 8) ^ (w[i - 15] >> 7)
+            let s1 = _rotr64(w[i - 2], 19) ^ _rotr64(w[i - 2], 61) ^ (w[i - 2] >> 6)
+            w[i] = w[i - 16] &+ s0 &+ w[i - 7] &+ s1
+        }
+        var (a, b, c, d, e, f, g, hh) = (h[0], h[1], h[2], h[3], h[4], h[5], h[6], h[7])
+        for i in 0..<80 {
+            let s1 = _rotr64(e, 14) ^ _rotr64(e, 18) ^ _rotr64(e, 41)
+            let ch = (e & f) ^ (~e & g)
+            let t1 = hh &+ s1 &+ ch &+ k[i] &+ w[i]
+            let s0 = _rotr64(a, 28) ^ _rotr64(a, 34) ^ _rotr64(a, 39)
+            let maj = (a & b) ^ (a & c) ^ (b & c)
+            let t2 = s0 &+ maj
+            (hh, g, f, e, d, c, b, a) = (g, f, e, d &+ t1, c, b, a, t1 &+ t2)
+        }
+        h[0] &+= a; h[1] &+= b; h[2] &+= c; h[3] &+= d; h[4] &+= e; h[5] &+= f; h[6] &+= g; h[7] &+= hh
+    }
+}
+
+@inline(__always) func _rotl(_ x: UInt32, _ n: UInt32) -> UInt32 { (x << n) | (x >> (32 - n)) }
+@inline(__always) func _rotr(_ x: UInt32, _ n: UInt32) -> UInt32 { (x >> n) | (x << (32 - n)) }
+@inline(__always) func _rotr64(_ x: UInt64, _ n: UInt64) -> UInt64 { (x >> n) | (x << (64 - n)) }
+@inline(__always) func _word32(_ b: [UInt8], _ i: Int) -> UInt32 {
+    UInt32(b[i]) << 24 | UInt32(b[i + 1]) << 16 | UInt32(b[i + 2]) << 8 | UInt32(b[i + 3])
+}
+func _bigEndianBytes(_ word: UInt32) -> [UInt8] {
+    [UInt8(word >> 24), UInt8(truncatingIfNeeded: word >> 16), UInt8(truncatingIfNeeded: word >> 8), UInt8(truncatingIfNeeded: word)]
+}
+
+/// `sin` for MD5's constants, without a libm dependency.
+func _sin(_ x: Double) -> Double {
+    // Reduce to [-π, π], then a Taylor series (enough terms for 2⁻⁵³).
+    let twoPi = 6.283185307179586
+    var r = x - (x / twoPi).rounded() * twoPi
+    if r > .pi { r -= twoPi }
+    var term = r, sum = r
+    for n in 1..<20 {
+        term *= -r * r / Double((2 * n) * (2 * n + 1))
+        sum += term
+    }
+    return sum
+}