zlib-streams 1.2.0 → 1.2.1

package/LICENSE

@@ -0,0 +1,91 @@
+BSD 3-Clause License
+
+Copyright (c) 2025-2026, Gildas Lormeau
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+---
+
+This software includes zlib (src/zlib) and altered versions of zlib sources
+(src/deflate.c, src/deflate.h, src/inflate.c, src/inflate.h, src/inftrees.c,
+src/inffast.h, src/trees.c, with deflate64 support added), which are
+distributed under the zlib license:
+
+Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
+
+Jean-loup Gailly        Mark Adler
+jloup@gzip.org          madler@alumni.caltech.edu
+
+---
+
+src/chunkcopy.h, src/compare256.h, src/cpu_features.h, src/inffast_chunk.c,
+src/inffast_chunk.h and src/insert_string.h come from the zlib fork of the
+Chromium project (Copyright 2017 ARM, Inc. for the chunk copy code), and are
+distributed under the Chromium license:
+
+Copyright 2015 The Chromium Authors
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google LLC nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/Makefile

@@ -152,7 +152,8 @@ WASM_EXPORTED_FUNCTIONS = "_inflate9_new","_inflate9_init","_inflate9_init_raw",
 WASM_CFLAGS = -Isrc -Isrc/zlib -Isrc/zlib/contrib/infback9 -O2 -flto -DDYNAMIC_CRC_TABLE -DBUILDFIXED -DZ_SOLO $(WASM_CRC_CFLAGS) $(WASM_DEFLATE_CFLAGS) $(INFLATE_CHUNK_CFLAGS)
 
 .PHONY: wasm
-wasm: dist/zlib-streams-dev.wasm
+wasm:
+	@$(MAKE) -B dist/zlib-streams-dev.wasm
 
 .PHONY: wasm_traced
 wasm_traced: dist/zlib-streams_traced.wasm
@@ -307,7 +308,8 @@ dist/zlib-streams-dev.wasm: $(WASM_SRCS)
 
 # Production-optimized wasm: smaller build with -Oz and no extra runtime methods.
 .PHONY: wasm_prod
-wasm_prod: dist/zlib-streams.wasm
+wasm_prod:
+	@$(MAKE) -B dist/zlib-streams.wasm
 
 dist/zlib-streams.wasm: $(WASM_SRCS)
 	@echo "Building production wasm $@ using $(EMCC)"
@@ -328,7 +330,8 @@ ZIP_MODULE_SRCS = src/wasm/aes_hmac_wasm.c
 ZIP_MODULE_EXPORTED_FUNCTIONS = $(WASM_EXPORTED_FUNCTIONS),"_aes_hmac_new","_aes_hmac_init","_aes_hmac_process","_aes_hmac_end"
 
 .PHONY: zip_module
-zip_module: dist/zip-module.wasm
+zip_module:
+	@$(MAKE) -B dist/zip-module.wasm
 
 dist/zip-module.wasm: $(WASM_SRCS) $(ZIP_MODULE_SRCS)
 	@echo "Building zip.js module $@ using $(EMCC)"

package/README.md

@@ -19,24 +19,28 @@ git submodule update --init --recursive
 ```
 
 ### 2. Build WASM module
-- Developmeent
+The build needs the Emscripten SDK. The Makefile looks for it in `emsdk/` at the repository root (ignored by git) and can be pointed elsewhere with `make EMCC=... WASM_OPT=...`.
+
+- Development: `-O2`, used by the test targets. Do not benchmark or ship this file.
 ```sh
 make wasm
 ```
 Output: `dist/zlib-streams-dev.wasm` and `dist/zlib-streams.js`
 
-- Production
+- Production: `-Oz` plus `wasm-opt`. This is the published module.
 ```sh
 make wasm_prod
 ```
 Output: `dist/zlib-streams.wasm` and `dist/zlib-streams.js`
 
-- zip.js module: the codecs plus the AES-CTR/HMAC-SHA1 engine behind the encrypted entries of zip.js
+- zip.js module: the codecs plus the AES-CTR/HMAC-SHA1 engine behind the encrypted entries of zip.js, vendored by zip.js as `lib/core/streams/zlib-wasm/zlib-streams.wasm`.
 ```sh
 make zip_module
 make test_zip_module
 ```
 Output: `dist/zip-module.wasm`
 
+The files in `dist/` are tracked, so a checkout leaves them with the same timestamp as the sources and `make dist/<file>` reports them up to date even when the sources changed. The three targets above always rebuild their file; the test targets depend on the file rules and rebuild only when a source is newer. Rebuild and commit `dist/` in the same commit as a change to `src/`.
+
 ## License
 See LICENSE for details.

package/package.json

@@ -3,7 +3,7 @@
   "description": "WASM-based Compression Streams API implementation using zlib, with support for deflate64 decompression.",
   "author": "Gildas Lormeau",
   "license": "BSD-3-Clause",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "type": "module",
   "keywords": [
     "deflate",

package/src/wasm/aes_hmac_wasm.c

@@ -2,7 +2,8 @@
    little-endian integer starting at 1, and HMAC-SHA1 over the ciphertext. Forward-only T-table
    AES, the aes_core.c layout. One context per stream: init() takes the cipher key and the
    authentication key, process() works in place and takes whole 16-byte blocks except for the last
-   call, end() writes the 20-byte MAC when given an output pointer and frees the context. */
+   call, end() writes the 20-byte MAC when given an output pointer, clears sensitive state, and
+   frees the context. */
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
@@ -15,11 +16,11 @@
 struct aes_hmac_ctx {
   uint32_t round_keys[ROUND_KEYS_LENGTH];
   int rounds;
-  uint8_t counter[BLOCK_LENGTH];
-  uint32_t h[5];
-  uint8_t block[SHA1_BLOCK_LENGTH];
-  unsigned block_length;
-  uint64_t total_length;
+  /* 64-bit WinZip counter followed by eight zero bytes; wasm32 is little-endian. */
+  uint64_t counter[2];
+  uint32_t sha1_state[5];
+  uint64_t sha1_count;
+  uint8_t sha1_buffer[SHA1_BLOCK_LENGTH];
   uint8_t opad[SHA1_BLOCK_LENGTH];
 };
 
@@ -40,6 +41,15 @@ static void store_be32(uint8_t *p, uint32_t v) {
   p[3] = (uint8_t)v;
 }
 
+/* Volatile stores keep LTO from removing the wipe before free(). */
+__attribute__((noinline, minsize))
+static void secure_clear(void *ptr, size_t length) {
+  volatile uint8_t *p = (volatile uint8_t *)ptr;
+  while (length--) {
+    *p++ = 0;
+  }
+}
+
 static void init_tables(void) {
   uint8_t p = 1, q = 1;
   do {
@@ -93,122 +103,185 @@ static void encrypt_block(const struct aes_hmac_ctx *c, const uint8_t in[BLOCK_L
   uint32_t s0 = load_be32(in) ^ rk[0], s1 = load_be32(in + 4) ^ rk[1];
   uint32_t s2 = load_be32(in + 8) ^ rk[2], s3 = load_be32(in + 12) ^ rk[3];
   uint32_t t0, t1, t2, t3;
-  rk += 4;
-  for (int r = 1; r < c->rounds; r++) {
-    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 255] ^ Te2[(s2 >> 8) & 255] ^ Te3[s3 & 255] ^ rk[0];
-    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 255] ^ Te2[(s3 >> 8) & 255] ^ Te3[s0 & 255] ^ rk[1];
-    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 255] ^ Te2[(s0 >> 8) & 255] ^ Te3[s1 & 255] ^ rk[2];
-    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 255] ^ Te2[(s1 >> 8) & 255] ^ Te3[s2 & 255] ^ rk[3];
-    s0 = t0;
-    s1 = t1;
-    s2 = t2;
-    s3 = t3;
-    rk += 4;
+#define AES_ROUND(O0, O1, O2, O3, I0, I1, I2, I3, K) do { \
+  (O0) = Te0[(I0) >> 24] ^ Te1[((I1) >> 16) & 255] ^ Te2[((I2) >> 8) & 255] ^ Te3[(I3) & 255] ^ (K)[0]; \
+  (O1) = Te0[(I1) >> 24] ^ Te1[((I2) >> 16) & 255] ^ Te2[((I3) >> 8) & 255] ^ Te3[(I0) & 255] ^ (K)[1]; \
+  (O2) = Te0[(I2) >> 24] ^ Te1[((I3) >> 16) & 255] ^ Te2[((I0) >> 8) & 255] ^ Te3[(I1) & 255] ^ (K)[2]; \
+  (O3) = Te0[(I3) >> 24] ^ Te1[((I0) >> 16) & 255] ^ Te2[((I1) >> 8) & 255] ^ Te3[(I2) & 255] ^ (K)[3]; \
+} while (0)
+  AES_ROUND(t0, t1, t2, t3, s0, s1, s2, s3, rk + 4);
+  AES_ROUND(s0, s1, s2, s3, t0, t1, t2, t3, rk + 8);
+  AES_ROUND(t0, t1, t2, t3, s0, s1, s2, s3, rk + 12);
+  AES_ROUND(s0, s1, s2, s3, t0, t1, t2, t3, rk + 16);
+  AES_ROUND(t0, t1, t2, t3, s0, s1, s2, s3, rk + 20);
+  AES_ROUND(s0, s1, s2, s3, t0, t1, t2, t3, rk + 24);
+  AES_ROUND(t0, t1, t2, t3, s0, s1, s2, s3, rk + 28);
+  AES_ROUND(s0, s1, s2, s3, t0, t1, t2, t3, rk + 32);
+  AES_ROUND(t0, t1, t2, t3, s0, s1, s2, s3, rk + 36);
+  rk += 40;
+  if (c->rounds > 10) {
+    AES_ROUND(s0, s1, s2, s3, t0, t1, t2, t3, rk);
+    AES_ROUND(t0, t1, t2, t3, s0, s1, s2, s3, rk + 4);
+    rk += 8;
   }
-  store_be32(out, (((uint32_t)sbox[s0 >> 24] << 24) | ((uint32_t)sbox[(s1 >> 16) & 255] << 16) | ((uint32_t)sbox[(s2 >> 8) & 255] << 8) | sbox[s3 & 255]) ^ rk[0]);
-  store_be32(out + 4, (((uint32_t)sbox[s1 >> 24] << 24) | ((uint32_t)sbox[(s2 >> 16) & 255] << 16) | ((uint32_t)sbox[(s3 >> 8) & 255] << 8) | sbox[s0 & 255]) ^ rk[1]);
-  store_be32(out + 8, (((uint32_t)sbox[s2 >> 24] << 24) | ((uint32_t)sbox[(s3 >> 16) & 255] << 16) | ((uint32_t)sbox[(s0 >> 8) & 255] << 8) | sbox[s1 & 255]) ^ rk[2]);
-  store_be32(out + 12, (((uint32_t)sbox[s3 >> 24] << 24) | ((uint32_t)sbox[(s0 >> 16) & 255] << 16) | ((uint32_t)sbox[(s1 >> 8) & 255] << 8) | sbox[s2 & 255]) ^ rk[3]);
+  if (c->rounds > 12) {
+    AES_ROUND(s0, s1, s2, s3, t0, t1, t2, t3, rk);
+    AES_ROUND(t0, t1, t2, t3, s0, s1, s2, s3, rk + 4);
+    rk += 8;
+  }
+#undef AES_ROUND
+  store_be32(out, (Te2[t0 >> 24] & 0xff000000) ^ (Te3[(t1 >> 16) & 255] & 0x00ff0000) ^
+      (Te0[(t2 >> 8) & 255] & 0x0000ff00) ^ (Te1[t3 & 255] & 0x000000ff) ^ rk[0]);
+  store_be32(out + 4, (Te2[t1 >> 24] & 0xff000000) ^ (Te3[(t2 >> 16) & 255] & 0x00ff0000) ^
+      (Te0[(t3 >> 8) & 255] & 0x0000ff00) ^ (Te1[t0 & 255] & 0x000000ff) ^ rk[1]);
+  store_be32(out + 8, (Te2[t2 >> 24] & 0xff000000) ^ (Te3[(t3 >> 16) & 255] & 0x00ff0000) ^
+      (Te0[(t0 >> 8) & 255] & 0x0000ff00) ^ (Te1[t1 & 255] & 0x000000ff) ^ rk[2]);
+  store_be32(out + 12, (Te2[t3 >> 24] & 0xff000000) ^ (Te3[(t0 >> 16) & 255] & 0x00ff0000) ^
+      (Te0[(t1 >> 8) & 255] & 0x0000ff00) ^ (Te1[t2 & 255] & 0x000000ff) ^ rk[3]);
 }
 
-static void sha1_block(struct aes_hmac_ctx *c, const uint8_t *p) {
-  uint32_t w[80];
-  for (int i = 0; i < 16; i++) {
-    w[i] = load_be32(p + 4 * i);
-  }
-  for (int i = 16; i < 80; i++) {
-    w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
-  }
-  uint32_t a = c->h[0], b = c->h[1], cc = c->h[2], d = c->h[3], e = c->h[4], t;
-  for (int i = 0; i < 20; i++) {
-    t = rotl(a, 5) + ((b & cc) | (~b & d)) + e + 0x5A827999 + w[i];
-    e = d;
-    d = cc;
-    cc = rotl(b, 30);
-    b = a;
-    a = t;
-  }
-  for (int i = 20; i < 40; i++) {
-    t = rotl(a, 5) + (b ^ cc ^ d) + e + 0x6ED9EBA1 + w[i];
-    e = d;
-    d = cc;
-    cc = rotl(b, 30);
-    b = a;
-    a = t;
-  }
-  for (int i = 40; i < 60; i++) {
-    t = rotl(a, 5) + ((b & cc) | (b & d) | (cc & d)) + e + 0x8F1BBCDC + w[i];
-    e = d;
-    d = cc;
-    cc = rotl(b, 30);
-    b = a;
-    a = t;
-  }
-  for (int i = 60; i < 80; i++) {
-    t = rotl(a, 5) + (b ^ cc ^ d) + e + 0xCA62C1D6 + w[i];
-    e = d;
-    d = cc;
-    cc = rotl(b, 30);
-    b = a;
-    a = t;
-  }
-  c->h[0] += a;
-  c->h[1] += b;
-  c->h[2] += cc;
-  c->h[3] += d;
-  c->h[4] += e;
+/*
+ * SHA-1 in C
+ * By Steve Reid <steve@edmweb.com>
+ * 100% Public Domain
+ *
+ * Adapted from OpenSSH portable's openbsd-compat/sha1.c for this combined
+ * AES/HMAC context and the little-endian wasm32 target.
+ */
+typedef union {
+  uint8_t c[SHA1_BLOCK_LENGTH];
+  uint32_t l[SHA1_BLOCK_LENGTH / sizeof(uint32_t)];
+} sha1_block;
+
+#define SHA1_ROL(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
+/* wasm32 is little-endian, so the first 16 words need byte swapping. */
+#define SHA1_BLK0(block, i) ((block).l[i] = \
+    (SHA1_ROL((block).l[i], 24) & 0xFF00FF00) | \
+    (SHA1_ROL((block).l[i], 8) & 0x00FF00FF))
+#define SHA1_BLK(block, i) ((block).l[(i) & 15] = SHA1_ROL( \
+    (block).l[((i) + 13) & 15] ^ (block).l[((i) + 8) & 15] ^ \
+    (block).l[((i) + 2) & 15] ^ (block).l[(i) & 15], 1))
+#define SHA1_R0(block, v, w, x, y, z, i) do { \
+  (z) += (((w) & ((x) ^ (y))) ^ (y)) + SHA1_BLK0((block), (i)) + \
+      0x5A827999 + SHA1_ROL((v), 5); \
+  (w) = SHA1_ROL((w), 30); \
+} while (0)
+#define SHA1_R1(block, v, w, x, y, z, i) do { \
+  (z) += (((w) & ((x) ^ (y))) ^ (y)) + SHA1_BLK((block), (i)) + \
+      0x5A827999 + SHA1_ROL((v), 5); \
+  (w) = SHA1_ROL((w), 30); \
+} while (0)
+#define SHA1_R2(block, v, w, x, y, z, i) do { \
+  (z) += ((w) ^ (x) ^ (y)) + SHA1_BLK((block), (i)) + \
+      0x6ED9EBA1 + SHA1_ROL((v), 5); \
+  (w) = SHA1_ROL((w), 30); \
+} while (0)
+#define SHA1_R3(block, v, w, x, y, z, i) do { \
+  (z) += ((((w) | (x)) & (y)) | ((w) & (x))) + SHA1_BLK((block), (i)) + \
+      0x8F1BBCDC + SHA1_ROL((v), 5); \
+  (w) = SHA1_ROL((w), 30); \
+} while (0)
+#define SHA1_R4(block, v, w, x, y, z, i) do { \
+  (z) += ((w) ^ (x) ^ (y)) + SHA1_BLK((block), (i)) + \
+      0xCA62C1D6 + SHA1_ROL((v), 5); \
+  (w) = SHA1_ROL((w), 30); \
+} while (0)
+
+static void sha1_transform(uint32_t state[5], const uint8_t buffer[SHA1_BLOCK_LENGTH]) {
+  uint32_t a, b, c, d, e;
+  sha1_block block;
+
+  memcpy(&block, buffer, sizeof(block));
+  a = state[0];
+  b = state[1];
+  c = state[2];
+  d = state[3];
+  e = state[4];
+
+  SHA1_R0(block,a,b,c,d,e, 0); SHA1_R0(block,e,a,b,c,d, 1); SHA1_R0(block,d,e,a,b,c, 2); SHA1_R0(block,c,d,e,a,b, 3);
+  SHA1_R0(block,b,c,d,e,a, 4); SHA1_R0(block,a,b,c,d,e, 5); SHA1_R0(block,e,a,b,c,d, 6); SHA1_R0(block,d,e,a,b,c, 7);
+  SHA1_R0(block,c,d,e,a,b, 8); SHA1_R0(block,b,c,d,e,a, 9); SHA1_R0(block,a,b,c,d,e,10); SHA1_R0(block,e,a,b,c,d,11);
+  SHA1_R0(block,d,e,a,b,c,12); SHA1_R0(block,c,d,e,a,b,13); SHA1_R0(block,b,c,d,e,a,14); SHA1_R0(block,a,b,c,d,e,15);
+  SHA1_R1(block,e,a,b,c,d,16); SHA1_R1(block,d,e,a,b,c,17); SHA1_R1(block,c,d,e,a,b,18); SHA1_R1(block,b,c,d,e,a,19);
+  SHA1_R2(block,a,b,c,d,e,20); SHA1_R2(block,e,a,b,c,d,21); SHA1_R2(block,d,e,a,b,c,22); SHA1_R2(block,c,d,e,a,b,23);
+  SHA1_R2(block,b,c,d,e,a,24); SHA1_R2(block,a,b,c,d,e,25); SHA1_R2(block,e,a,b,c,d,26); SHA1_R2(block,d,e,a,b,c,27);
+  SHA1_R2(block,c,d,e,a,b,28); SHA1_R2(block,b,c,d,e,a,29); SHA1_R2(block,a,b,c,d,e,30); SHA1_R2(block,e,a,b,c,d,31);
+  SHA1_R2(block,d,e,a,b,c,32); SHA1_R2(block,c,d,e,a,b,33); SHA1_R2(block,b,c,d,e,a,34); SHA1_R2(block,a,b,c,d,e,35);
+  SHA1_R2(block,e,a,b,c,d,36); SHA1_R2(block,d,e,a,b,c,37); SHA1_R2(block,c,d,e,a,b,38); SHA1_R2(block,b,c,d,e,a,39);
+  SHA1_R3(block,a,b,c,d,e,40); SHA1_R3(block,e,a,b,c,d,41); SHA1_R3(block,d,e,a,b,c,42); SHA1_R3(block,c,d,e,a,b,43);
+  SHA1_R3(block,b,c,d,e,a,44); SHA1_R3(block,a,b,c,d,e,45); SHA1_R3(block,e,a,b,c,d,46); SHA1_R3(block,d,e,a,b,c,47);
+  SHA1_R3(block,c,d,e,a,b,48); SHA1_R3(block,b,c,d,e,a,49); SHA1_R3(block,a,b,c,d,e,50); SHA1_R3(block,e,a,b,c,d,51);
+  SHA1_R3(block,d,e,a,b,c,52); SHA1_R3(block,c,d,e,a,b,53); SHA1_R3(block,b,c,d,e,a,54); SHA1_R3(block,a,b,c,d,e,55);
+  SHA1_R3(block,e,a,b,c,d,56); SHA1_R3(block,d,e,a,b,c,57); SHA1_R3(block,c,d,e,a,b,58); SHA1_R3(block,b,c,d,e,a,59);
+  SHA1_R4(block,a,b,c,d,e,60); SHA1_R4(block,e,a,b,c,d,61); SHA1_R4(block,d,e,a,b,c,62); SHA1_R4(block,c,d,e,a,b,63);
+  SHA1_R4(block,b,c,d,e,a,64); SHA1_R4(block,a,b,c,d,e,65); SHA1_R4(block,e,a,b,c,d,66); SHA1_R4(block,d,e,a,b,c,67);
+  SHA1_R4(block,c,d,e,a,b,68); SHA1_R4(block,b,c,d,e,a,69); SHA1_R4(block,a,b,c,d,e,70); SHA1_R4(block,e,a,b,c,d,71);
+  SHA1_R4(block,d,e,a,b,c,72); SHA1_R4(block,c,d,e,a,b,73); SHA1_R4(block,b,c,d,e,a,74); SHA1_R4(block,a,b,c,d,e,75);
+  SHA1_R4(block,e,a,b,c,d,76); SHA1_R4(block,d,e,a,b,c,77); SHA1_R4(block,c,d,e,a,b,78); SHA1_R4(block,b,c,d,e,a,79);
+
+  state[0] += a;
+  state[1] += b;
+  state[2] += c;
+  state[3] += d;
+  state[4] += e;
+  a = b = c = d = e = 0;
 }
 
 static void sha1_init(struct aes_hmac_ctx *c) {
-  c->h[0] = 0x67452301;
-  c->h[1] = 0xEFCDAB89;
-  c->h[2] = 0x98BADCFE;
-  c->h[3] = 0x10325476;
-  c->h[4] = 0xC3D2E1F0;
-  c->block_length = 0;
-  c->total_length = 0;
+  c->sha1_count = 0;
+  c->sha1_state[0] = 0x67452301;
+  c->sha1_state[1] = 0xEFCDAB89;
+  c->sha1_state[2] = 0x98BADCFE;
+  c->sha1_state[3] = 0x10325476;
+  c->sha1_state[4] = 0xC3D2E1F0;
 }
 
-static void sha1_update(struct aes_hmac_ctx *c, const uint8_t *p, unsigned length) {
-  c->total_length += length;
-  if (c->block_length) {
-    unsigned n = SHA1_BLOCK_LENGTH - c->block_length;
-    if (n > length) {
-      n = length;
-    }
-    memcpy(c->block + c->block_length, p, n);
-    c->block_length += n;
-    p += n;
-    length -= n;
-    if (c->block_length == SHA1_BLOCK_LENGTH) {
-      sha1_block(c, c->block);
-      c->block_length = 0;
+static void sha1_update(struct aes_hmac_ctx *c, const uint8_t *data, size_t length) {
+  size_t i, j;
+
+  j = (size_t)((c->sha1_count >> 3) & 63);
+  c->sha1_count += ((uint64_t)length << 3);
+  if (j + length > 63) {
+    memcpy(&c->sha1_buffer[j], data, (i = SHA1_BLOCK_LENGTH - j));
+    sha1_transform(c->sha1_state, c->sha1_buffer);
+    for (; i + 63 < length; i += SHA1_BLOCK_LENGTH) {
+      sha1_transform(c->sha1_state, &data[i]);
     }
+    j = 0;
+  } else {
+    i = 0;
   }
-  while (length >= SHA1_BLOCK_LENGTH) {
-    sha1_block(c, p);
-    p += SHA1_BLOCK_LENGTH;
-    length -= SHA1_BLOCK_LENGTH;
-  }
-  if (length) {
-    memcpy(c->block, p, length);
-    c->block_length = length;
-  }
+  memcpy(&c->sha1_buffer[j], &data[i], length - i);
 }
 
 static void sha1_final(struct aes_hmac_ctx *c, uint8_t out[SHA1_DIGEST_LENGTH]) {
-  uint64_t bits = c->total_length * 8;
-  uint8_t padding[SHA1_BLOCK_LENGTH + 8] = { 0x80 };
-  unsigned padding_length = (c->block_length < 56 ? 56 : 120) - c->block_length;
-  for (int i = 0; i < 8; i++) {
-    padding[padding_length + i] = (uint8_t)(bits >> (56 - 8 * i));
+  uint8_t final_count[8];
+
+  for (unsigned i = 0; i < 8; i++) {
+    final_count[i] = (uint8_t)((c->sha1_count >> ((7 - i) * 8)) & 255);
+  }
+  sha1_update(c, (const uint8_t *)"\200", 1);
+  while ((c->sha1_count & 504) != 448) {
+    sha1_update(c, (const uint8_t *)"\0", 1);
   }
-  sha1_update(c, padding, padding_length + 8);
-  for (int i = 0; i < 5; i++) {
-    store_be32(out + 4 * i, c->h[i]);
+  sha1_update(c, final_count, sizeof(final_count));
+  for (unsigned i = 0; i < SHA1_DIGEST_LENGTH; i++) {
+    out[i] = (uint8_t)((c->sha1_state[i >> 2] >> ((3 - (i & 3)) * 8)) & 255);
   }
+  secure_clear(c->sha1_state, sizeof(c->sha1_state));
+  secure_clear(c->sha1_buffer, sizeof(c->sha1_buffer));
+  c->sha1_count = 0;
 }
 
+#undef SHA1_R4
+#undef SHA1_R3
+#undef SHA1_R2
+#undef SHA1_R1
+#undef SHA1_R0
+#undef SHA1_BLK
+#undef SHA1_BLK0
+#undef SHA1_ROL
+
 static void hmac_init(struct aes_hmac_ctx *c, const uint8_t *key, unsigned length) {
   uint8_t ipad[SHA1_BLOCK_LENGTH], hashed_key[SHA1_DIGEST_LENGTH];
   if (length > SHA1_BLOCK_LENGTH) {
@@ -254,7 +327,7 @@ int aes_hmac_init(unsigned ctx, unsigned key_ptr, unsigned key_length, unsigned
     init_tables();
   }
   expand_key(c, (const uint8_t *)(uintptr_t)key_ptr, key_length);
-  memset(c->counter, 0, BLOCK_LENGTH);
+  memset(c->counter, 0, sizeof(c->counter));
   hmac_init(c, (const uint8_t *)(uintptr_t)auth_ptr, auth_length);
   return 0;
 }
@@ -270,12 +343,8 @@ void aes_hmac_process(unsigned ctx, unsigned ptr, unsigned length, int decrypt)
     sha1_update(c, p, length);
   }
   for (unsigned i = 0; i < length; i += BLOCK_LENGTH) {
-    for (int j = 0; j < BLOCK_LENGTH; j++) {
-      if (++c->counter[j]) {
-        break;
-      }
-    }
-    encrypt_block(c, c->counter, (uint8_t *)keystream);
+    ++c->counter[0];
+    encrypt_block(c, (const uint8_t *)c->counter, (uint8_t *)keystream);
     if (length - i >= BLOCK_LENGTH) {
       memcpy(words, p + i, BLOCK_LENGTH);
       words[0] ^= keystream[0];
@@ -303,5 +372,6 @@ void aes_hmac_end(unsigned ctx, unsigned out_ptr) {
   if (out_ptr) {
     hmac_final(c, (uint8_t *)(uintptr_t)out_ptr);
   }
+  secure_clear(c, sizeof(*c));
   free(c);
 }