powerdlz23 1.1.7 → 1.1.9

package/pto/yaamp/stratum/sha3/sph_hamsi.h

@@ -0,0 +1,322 @@
+/* $Id: sph_hamsi.h 216 2010-06-08 09:46:57Z tp $ */
+/**
+ * Hamsi interface. This code implements Hamsi with the recommended
+ * parameters for SHA-3, with outputs of 224, 256, 384 and 512 bits.
+ *
+ * ==========================(LICENSE BEGIN)============================
+ *
+ * Copyright (c) 2007-2010  Projet RNRT SAPHIR
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * ===========================(LICENSE END)=============================
+ *
+ * @file     sph_hamsi.h
+ * @author   Thomas Pornin <thomas.pornin@cryptolog.com>
+ */
+
+#ifndef SPH_HAMSI_H__
+#define SPH_HAMSI_H__
+
+#include <stddef.h>
+#include "sph_types.h"
+
+#ifdef __cplusplus
+extern "C"{
+#endif
+
+/**
+ * Output size (in bits) for Hamsi-224.
+ */
+#define SPH_SIZE_hamsi224   224
+
+/**
+ * Output size (in bits) for Hamsi-256.
+ */
+#define SPH_SIZE_hamsi256   256
+
+/**
+ * Output size (in bits) for Hamsi-384.
+ */
+#define SPH_SIZE_hamsi384   384
+
+/**
+ * Output size (in bits) for Hamsi-512.
+ */
+#define SPH_SIZE_hamsi512   512
+
+/**
+ * This structure is a context for Hamsi-224 and Hamsi-256 computations:
+ * it contains the intermediate values and some data from the last
+ * entered block. Once a Hamsi computation has been performed, the
+ * context can be reused for another computation.
+ *
+ * The contents of this structure are private. A running Hamsi
+ * computation can be cloned by copying the context (e.g. with a simple
+ * <code>memcpy()</code>).
+ */
+typedef struct {
+#ifndef DOXYGEN_IGNORE
+    unsigned char partial[4];
+    size_t partial_len;
+    sph_u32 h[8];
+#if SPH_64
+    sph_u64 count;
+#else
+    sph_u32 count_high, count_low;
+#endif
+#endif
+} sph_hamsi_small_context;
+
+/**
+ * This structure is a context for Hamsi-224 computations. It is
+ * identical to the common <code>sph_hamsi_small_context</code>.
+ */
+typedef sph_hamsi_small_context sph_hamsi224_context;
+
+/**
+ * This structure is a context for Hamsi-256 computations. It is
+ * identical to the common <code>sph_hamsi_small_context</code>.
+ */
+typedef sph_hamsi_small_context sph_hamsi256_context;
+
+/**
+ * This structure is a context for Hamsi-384 and Hamsi-512 computations:
+ * it contains the intermediate values and some data from the last
+ * entered block. Once a Hamsi computation has been performed, the
+ * context can be reused for another computation.
+ *
+ * The contents of this structure are private. A running Hamsi
+ * computation can be cloned by copying the context (e.g. with a simple
+ * <code>memcpy()</code>).
+ */
+typedef struct {
+#ifndef DOXYGEN_IGNORE
+    unsigned char partial[8];
+    size_t partial_len;
+    sph_u32 h[16];
+#if SPH_64
+    sph_u64 count;
+#else
+    sph_u32 count_high, count_low;
+#endif
+#endif
+} sph_hamsi_big_context;
+
+/**
+ * This structure is a context for Hamsi-384 computations. It is
+ * identical to the common <code>sph_hamsi_small_context</code>.
+ */
+typedef sph_hamsi_big_context sph_hamsi384_context;
+
+/**
+ * This structure is a context for Hamsi-512 computations. It is
+ * identical to the common <code>sph_hamsi_small_context</code>.
+ */
+typedef sph_hamsi_big_context sph_hamsi512_context;
+
+/**
+ * Initialize a Hamsi-224 context. This process performs no memory allocation.
+ *
+ * @param cc   the Hamsi-224 context (pointer to a
+ *             <code>sph_hamsi224_context</code>)
+ */
+void sph_hamsi224_init(void *cc);
+
+/**
+ * Process some data bytes. It is acceptable that <code>len</code> is zero
+ * (in which case this function does nothing).
+ *
+ * @param cc     the Hamsi-224 context
+ * @param data   the input data
+ * @param len    the input data length (in bytes)
+ */
+void sph_hamsi224(void *cc, const void *data, size_t len);
+
+/**
+ * Terminate the current Hamsi-224 computation and output the result into
+ * the provided buffer. The destination buffer must be wide enough to
+ * accomodate the result (28 bytes). The context is automatically
+ * reinitialized.
+ *
+ * @param cc    the Hamsi-224 context
+ * @param dst   the destination buffer
+ */
+void sph_hamsi224_close(void *cc, void *dst);
+
+/**
+ * Add a few additional bits (0 to 7) to the current computation, then
+ * terminate it and output the result in the provided buffer, which must
+ * be wide enough to accomodate the result (28 bytes). If bit number i
+ * in <code>ub</code> has value 2^i, then the extra bits are those
+ * numbered 7 downto 8-n (this is the big-endian convention at the byte
+ * level). The context is automatically reinitialized.
+ *
+ * @param cc    the Hamsi-224 context
+ * @param ub    the extra bits
+ * @param n     the number of extra bits (0 to 7)
+ * @param dst   the destination buffer
+ */
+void sph_hamsi224_addbits_and_close(
+    void *cc, unsigned ub, unsigned n, void *dst);
+
+/**
+ * Initialize a Hamsi-256 context. This process performs no memory allocation.
+ *
+ * @param cc   the Hamsi-256 context (pointer to a
+ *             <code>sph_hamsi256_context</code>)
+ */
+void sph_hamsi256_init(void *cc);
+
+/**
+ * Process some data bytes. It is acceptable that <code>len</code> is zero
+ * (in which case this function does nothing).
+ *
+ * @param cc     the Hamsi-256 context
+ * @param data   the input data
+ * @param len    the input data length (in bytes)
+ */
+void sph_hamsi256(void *cc, const void *data, size_t len);
+
+/**
+ * Terminate the current Hamsi-256 computation and output the result into
+ * the provided buffer. The destination buffer must be wide enough to
+ * accomodate the result (32 bytes). The context is automatically
+ * reinitialized.
+ *
+ * @param cc    the Hamsi-256 context
+ * @param dst   the destination buffer
+ */
+void sph_hamsi256_close(void *cc, void *dst);
+
+/**
+ * Add a few additional bits (0 to 7) to the current computation, then
+ * terminate it and output the result in the provided buffer, which must
+ * be wide enough to accomodate the result (32 bytes). If bit number i
+ * in <code>ub</code> has value 2^i, then the extra bits are those
+ * numbered 7 downto 8-n (this is the big-endian convention at the byte
+ * level). The context is automatically reinitialized.
+ *
+ * @param cc    the Hamsi-256 context
+ * @param ub    the extra bits
+ * @param n     the number of extra bits (0 to 7)
+ * @param dst   the destination buffer
+ */
+void sph_hamsi256_addbits_and_close(
+    void *cc, unsigned ub, unsigned n, void *dst);
+
+/**
+ * Initialize a Hamsi-384 context. This process performs no memory allocation.
+ *
+ * @param cc   the Hamsi-384 context (pointer to a
+ *             <code>sph_hamsi384_context</code>)
+ */
+void sph_hamsi384_init(void *cc);
+
+/**
+ * Process some data bytes. It is acceptable that <code>len</code> is zero
+ * (in which case this function does nothing).
+ *
+ * @param cc     the Hamsi-384 context
+ * @param data   the input data
+ * @param len    the input data length (in bytes)
+ */
+void sph_hamsi384(void *cc, const void *data, size_t len);
+
+/**
+ * Terminate the current Hamsi-384 computation and output the result into
+ * the provided buffer. The destination buffer must be wide enough to
+ * accomodate the result (48 bytes). The context is automatically
+ * reinitialized.
+ *
+ * @param cc    the Hamsi-384 context
+ * @param dst   the destination buffer
+ */
+void sph_hamsi384_close(void *cc, void *dst);
+
+/**
+ * Add a few additional bits (0 to 7) to the current computation, then
+ * terminate it and output the result in the provided buffer, which must
+ * be wide enough to accomodate the result (48 bytes). If bit number i
+ * in <code>ub</code> has value 2^i, then the extra bits are those
+ * numbered 7 downto 8-n (this is the big-endian convention at the byte
+ * level). The context is automatically reinitialized.
+ *
+ * @param cc    the Hamsi-384 context
+ * @param ub    the extra bits
+ * @param n     the number of extra bits (0 to 7)
+ * @param dst   the destination buffer
+ */
+void sph_hamsi384_addbits_and_close(
+    void *cc, unsigned ub, unsigned n, void *dst);
+
+/**
+ * Initialize a Hamsi-512 context. This process performs no memory allocation.
+ *
+ * @param cc   the Hamsi-512 context (pointer to a
+ *             <code>sph_hamsi512_context</code>)
+ */
+void sph_hamsi512_init(void *cc);
+
+/**
+ * Process some data bytes. It is acceptable that <code>len</code> is zero
+ * (in which case this function does nothing).
+ *
+ * @param cc     the Hamsi-512 context
+ * @param data   the input data
+ * @param len    the input data length (in bytes)
+ */
+void sph_hamsi512(void *cc, const void *data, size_t len);
+
+/**
+ * Terminate the current Hamsi-512 computation and output the result into
+ * the provided buffer. The destination buffer must be wide enough to
+ * accomodate the result (64 bytes). The context is automatically
+ * reinitialized.
+ *
+ * @param cc    the Hamsi-512 context
+ * @param dst   the destination buffer
+ */
+void sph_hamsi512_close(void *cc, void *dst);
+
+/**
+ * Add a few additional bits (0 to 7) to the current computation, then
+ * terminate it and output the result in the provided buffer, which must
+ * be wide enough to accomodate the result (64 bytes). If bit number i
+ * in <code>ub</code> has value 2^i, then the extra bits are those
+ * numbered 7 downto 8-n (this is the big-endian convention at the byte
+ * level). The context is automatically reinitialized.
+ *
+ * @param cc    the Hamsi-512 context
+ * @param ub    the extra bits
+ * @param n     the number of extra bits (0 to 7)
+ * @param dst   the destination buffer
+ */
+void sph_hamsi512_addbits_and_close(
+    void *cc, unsigned ub, unsigned n, void *dst);
+
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+

package/pto/yaamp/stratum/sha3/sph_hefty1.c

@@ -0,0 +1,378 @@
+/*
+ * HEFTY1 cryptographic hash function
+ *
+ * Copyright (c) 2014, dbcc14 <BM-NBx4AKznJuyem3dArgVY8MGyABpihRy5>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * The views and conclusions contained in the software and documentation are those
+ * of the authors and should not be interpreted as representing official policies,
+ * either expressed or implied, of the FreeBSD Project.
+ */
+
+#include <assert.h>
+#include <string.h>
+
+#include "sph_hefty1.h"
+
+#define Min(A, B) (A <= B ? A : B)
+#define RoundFunc(ctx, A, B, C, D, E, F, G, H, W, K)                    \
+    {                                                                   \
+        /* To thwart parallelism, Br modifies itself each time it's     \
+         * called.  This also means that calling it in different        \
+         * orders yeilds different results.  In C the order of          \
+         * evaluation of function arguments and + operands are          \
+         * unspecified (and depends on the compiler), so we must make   \
+         * the order of Br calls explicit.                              \
+         */                                                             \
+        uint32_t brG = Br(ctx, G);                                      \
+        uint32_t tmp1 = Ch(E, Br(ctx, F), brG) + H + W + K;             \
+        uint32_t tmp2 = tmp1 + Sigma1(Br(ctx, E));                      \
+        uint32_t brC = Br(ctx, C);                                      \
+        uint32_t brB = Br(ctx, B);                                      \
+        uint32_t tmp3 = Ma(Br(ctx, A), brB, brC);                       \
+        uint32_t tmp4 = tmp3 + Sigma0(Br(ctx, A));                      \
+        H = G;                                                          \
+        G = F;                                                          \
+        F = E;                                                          \
+        E = D + Br(ctx, tmp2);                                          \
+        D = C;                                                          \
+        C = B;                                                          \
+        B = A;                                                          \
+        A = tmp2 + tmp4;                                                \
+    }                                                                   \
+
+/* Nothing up my sleeve constants */
+static const uint32_t K[64] = {
+    0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
+    0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
+    0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
+    0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
+    0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
+    0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
+    0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
+    0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
+    0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
+    0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
+    0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
+    0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
+    0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
+    0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
+    0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
+    0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
+};
+
+/* Initial hash values */
+static const uint32_t H[HEFTY1_STATE_WORDS] = {
+    0x6a09e667UL,
+    0xbb67ae85UL,
+    0x3c6ef372UL,
+    0xa54ff53aUL,
+    0x510e527fUL,
+    0x9b05688cUL,
+    0x1f83d9abUL,
+    0x5be0cd19UL
+};
+
+static inline uint32_t Rr(uint32_t X, uint8_t n)
+{
+    return (X >> n) | (X << (32 - n));
+}
+
+static inline uint32_t Ch(uint32_t E, uint32_t F, uint32_t G)
+{
+    return (E & F) ^ (~E & G);
+}
+
+static inline uint32_t Sigma1(uint32_t E)
+{
+    return Rr(E, 6) ^ Rr(E, 11) ^ Rr(E, 25);
+}
+
+static inline uint32_t sigma1(uint32_t X)
+{
+    return Rr(X, 17) ^ Rr(X, 19) ^ (X >> 10);
+}
+
+static inline uint32_t Ma(uint32_t A, uint32_t B, uint32_t C)
+{
+    return (A & B) ^ (A & C) ^ (B & C);
+}
+
+static inline uint32_t Sigma0(uint32_t A)
+{
+    return Rr(A, 2) ^ Rr(A, 13) ^ Rr(A, 22);
+}
+
+static inline uint32_t sigma0(uint32_t X)
+{
+    return Rr(X, 7) ^ Rr(X, 18) ^ (X >> 3);
+}
+
+static inline uint32_t Reverse32(uint32_t n)
+{
+    #if BYTE_ORDER == LITTLE_ENDIAN
+        return n << 24 | (n & 0x0000ff00) << 8 | (n & 0x00ff0000) >> 8 | n >> 24;
+    #else
+        return n;
+    #endif
+}
+
+static inline uint64_t Reverse64(uint64_t n)
+{
+    #if BYTE_ORDER == LITTLE_ENDIAN
+        uint32_t a = n >> 32;
+        uint32_t b = (n << 32) >> 32;
+
+        return (uint64_t)Reverse32(b) << 32 | Reverse32(a);
+    #else
+        return n;
+    #endif
+}
+
+/* Smoosh byte into nibble */
+static inline uint8_t Smoosh4(uint8_t X)
+{
+    return (X >> 4) ^ (X & 0xf);
+}
+
+/* Smoosh 32-bit word into 2-bits */
+static inline uint8_t Smoosh2(uint32_t X)
+{
+    uint16_t w = (X >> 16) ^ (X & 0xffff);
+    uint8_t n = Smoosh4((w >> 8) ^ (w & 0xff));
+    return (n >> 2) ^ (n & 0x3);
+}
+
+static void Mangle(uint32_t *S)
+{
+    uint32_t *R = S;
+    uint32_t *C = &S[1];
+
+    uint8_t r0 = Smoosh4(R[0] >> 24);
+    uint8_t r1 = Smoosh4(R[0] >> 16);
+    uint8_t r2 = Smoosh4(R[0] >> 8);
+    uint8_t r3 = Smoosh4(R[0] & 0xff);
+
+    int i;
+
+    /* Diffuse */
+    uint32_t tmp = 0;
+    for (i = 0; i < HEFTY1_SPONGE_WORDS - 1; i++) {
+        uint8_t r = Smoosh2(tmp);
+        switch (r) {
+        case 0:
+            C[i] ^= Rr(R[0], i + r0);
+            break;
+        case 1:
+            C[i] += Rr(~R[0], i + r1);
+            break;
+        case 2:
+            C[i] &= Rr(~R[0], i + r2);
+            break;
+        case 3:
+            C[i] ^= Rr(R[0], i + r3);
+            break;
+        }
+        tmp ^= C[i];
+    }
+
+    /* Compress */
+    tmp = 0;
+    for (i = 0; i < HEFTY1_SPONGE_WORDS - 1; i++)
+        if (i % 2)
+            tmp ^= C[i];
+        else
+            tmp += C[i];
+    R[0] ^= tmp;
+}
+
+static void Absorb(uint32_t *S, uint32_t X)
+{
+    uint32_t *R = S;
+    R[0] ^= X;
+    Mangle(S);
+}
+
+static uint32_t Squeeze(uint32_t *S)
+{
+    uint32_t Y = S[0];
+    Mangle(S);
+    return Y;
+}
+
+/* Branch, compress and serialize function */
+static inline uint32_t Br(HEFTY1_CTX *ctx, uint32_t X)
+{
+    uint32_t R = Squeeze(ctx->sponge);
+
+    uint8_t r0 = R >> 8;
+    uint8_t r1 = R & 0xff;
+
+    uint32_t Y = 1 << (r0 % 32);
+
+    switch (r1 % 4)
+    {
+    case 0:
+        /* Do nothing */
+        break;
+    case 1:
+        return X & ~Y;
+    case 2:
+        return X | Y;
+    case 3:
+        return X ^ Y;
+    }
+
+    return X;
+}
+
+static void HashBlock(HEFTY1_CTX *ctx)
+{
+    uint32_t A, B, C, D, E, F, G, H;
+    uint32_t W[HEFTY1_BLOCK_BYTES];
+
+    assert(ctx);
+
+    A = ctx->h[0];
+    B = ctx->h[1];
+    C = ctx->h[2];
+    D = ctx->h[3];
+    E = ctx->h[4];
+    F = ctx->h[5];
+    G = ctx->h[6];
+    H = ctx->h[7];
+
+    int t = 0;
+    for (; t < 16; t++) {
+        W[t] = Reverse32(((uint32_t *)&ctx->block[0])[t]); /* To host byte order */
+        Absorb(ctx->sponge, W[t] ^ K[t]);
+    }
+
+    for (t = 0; t < 16; t++) {
+        Absorb(ctx->sponge, D ^ H);
+        RoundFunc(ctx, A, B, C, D, E, F, G, H, W[t], K[t]);
+    }
+    for (t = 16; t < 64; t++) {
+        Absorb(ctx->sponge, H + D);
+        W[t] = sigma1(W[t - 2]) + W[t - 7] + sigma0(W[t - 15]) + W[t - 16];
+        RoundFunc(ctx, A, B, C, D, E, F, G, H, W[t], K[t]);
+    }
+
+    ctx->h[0] += A;
+    ctx->h[1] += B;
+    ctx->h[2] += C;
+    ctx->h[3] += D;
+    ctx->h[4] += E;
+    ctx->h[5] += F;
+    ctx->h[6] += G;
+    ctx->h[7] += H;
+
+    A = 0;
+    B = 0;
+    C = 0;
+    D = 0;
+    E = 0;
+    F = 0;
+    G = 0;
+    H = 0;
+
+    memset(W, 0, sizeof(W));
+}
+
+/* Public interface */
+
+void HEFTY1_Init(HEFTY1_CTX *ctx)
+{
+    assert(ctx);
+
+    memcpy(ctx->h, H, sizeof(ctx->h));
+    memset(ctx->block, 0, sizeof(ctx->block));
+    ctx->written = 0;
+    memset(ctx->sponge, 0, sizeof(ctx->sponge));
+}
+
+void HEFTY1_Update(HEFTY1_CTX *ctx, const void *buf, size_t len)
+{
+    assert(ctx);
+
+    uint64_t read = 0;
+    while (len) {
+        uint64_t end = ctx->written % HEFTY1_BLOCK_BYTES;
+        uint64_t count = Min(len, HEFTY1_BLOCK_BYTES - end);
+        memcpy(&ctx->block[end], &((unsigned char *)buf)[read], count);
+        len -= count;
+        read += count;
+        ctx->written += count;
+        if (!(ctx->written % HEFTY1_BLOCK_BYTES))
+            HashBlock(ctx);
+    }
+}
+
+void HEFTY1_Final(unsigned char *digest, HEFTY1_CTX *ctx)
+{
+    assert(digest);
+    assert(ctx);
+
+    /* Pad message (FIPS 180 Section 5.1.1) */
+    uint64_t used = ctx->written % HEFTY1_BLOCK_BYTES;
+    ctx->block[used++] = 0x80; /* Append 1 to end of message */
+    if (used > HEFTY1_BLOCK_BYTES - 8) {
+        /* We have already written into the last 64bits, so
+         * we must continue into the next block. */
+        memset(&ctx->block[used], 0, HEFTY1_BLOCK_BYTES - used);
+        HashBlock(ctx);
+        used = 0; /* Create a new block (below) */
+    }
+
+    /* All remaining bits to zero */
+    memset(&ctx->block[used], 0, HEFTY1_BLOCK_BYTES - 8 - used);
+
+    /* The last 64bits encode the length (in network byte order) */
+    uint64_t *len = (uint64_t *)&ctx->block[HEFTY1_BLOCK_BYTES - 8];
+    *len = Reverse64(ctx->written*8);
+
+    HashBlock(ctx);
+
+    /* Convert back to network byte order */
+    int i = 0;
+    for (; i < HEFTY1_STATE_WORDS; i++)
+        ctx->h[i] = Reverse32(ctx->h[i]);
+
+    memcpy(digest, ctx->h, sizeof(ctx->h));
+    memset(ctx, 0, sizeof(HEFTY1_CTX));
+}
+
+unsigned char* HEFTY1(const unsigned char *buf, size_t len, unsigned char *digest)
+{
+    HEFTY1_CTX ctx;
+    static unsigned char m[HEFTY1_DIGEST_BYTES];
+
+    if (!digest)
+        digest = m;
+
+    HEFTY1_Init(&ctx);
+    HEFTY1_Update(&ctx, buf, len);
+    HEFTY1_Final(digest, &ctx);
+
+    return digest;
+}