1// ubc package provides ways for SHA1 blocks to be checked for
  2// Unavoidable Bit Conditions that arise from crypto analysis attacks.
  3package ubc
  4
  5// Based on the C implementation from Marc Stevens and Dan Shumow.
  6// https://github.com/cr-marcstevens/sha1collisiondetection
  7
  8type DvInfo struct {
  9	// DvType, DvK and DvB define the DV: I(K,B) or II(K,B) (see the paper).
 10	// https://marc-stevens.nl/research/papers/C13-S.pdf
 11	DvType uint32
 12	DvK    uint32
 13	DvB    uint32
 14
 15	// TestT is the step to do the recompression from for collision detection.
 16	TestT uint32
 17
 18	// MaskI and MaskB define the bit to check for each DV in the dvmask returned by ubc_check.
 19	MaskI uint32
 20	MaskB uint32
 21
 22	// Dm is the expanded message block XOR-difference defined by the DV.
 23	Dm [80]uint32
 24}
 25
 26// CalculateDvMask takes as input an expanded message block and
 27// verifies the unavoidable bitconditions for all listed DVs. It returns
 28// a dvmask where each bit belonging to a DV is set if all unavoidable
 29// bitconditions for that DV have been met.
 30//
 31//go:nosplit
 32func CalculateDvMask(W *[80]uint32) uint32 {
 33	if W == nil {
 34		return 0
 35	}
 36	mask := uint32(0xFFFFFFFF)
 37	mask &= (((((W[44] ^ W[45]) >> 29) & 1) - 1) | ^(DV_I_48_0_bit | DV_I_51_0_bit | DV_I_52_0_bit | DV_II_45_0_bit | DV_II_46_0_bit | DV_II_50_0_bit | DV_II_51_0_bit))
 38	mask &= (((((W[49] ^ W[50]) >> 29) & 1) - 1) | ^(DV_I_46_0_bit | DV_II_45_0_bit | DV_II_50_0_bit | DV_II_51_0_bit | DV_II_55_0_bit | DV_II_56_0_bit))
 39	mask &= (((((W[48] ^ W[49]) >> 29) & 1) - 1) | ^(DV_I_45_0_bit | DV_I_52_0_bit | DV_II_49_0_bit | DV_II_50_0_bit | DV_II_54_0_bit | DV_II_55_0_bit))
 40	mask &= ((((W[47] ^ (W[50] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_47_0_bit | DV_I_49_0_bit | DV_I_51_0_bit | DV_II_45_0_bit | DV_II_51_0_bit | DV_II_56_0_bit))
 41	mask &= (((((W[47] ^ W[48]) >> 29) & 1) - 1) | ^(DV_I_44_0_bit | DV_I_51_0_bit | DV_II_48_0_bit | DV_II_49_0_bit | DV_II_53_0_bit | DV_II_54_0_bit))
 42	mask &= (((((W[46] >> 4) ^ (W[49] >> 29)) & 1) - 1) | ^(DV_I_46_0_bit | DV_I_48_0_bit | DV_I_50_0_bit | DV_I_52_0_bit | DV_II_50_0_bit | DV_II_55_0_bit))
 43	mask &= (((((W[46] ^ W[47]) >> 29) & 1) - 1) | ^(DV_I_43_0_bit | DV_I_50_0_bit | DV_II_47_0_bit | DV_II_48_0_bit | DV_II_52_0_bit | DV_II_53_0_bit))
 44	mask &= (((((W[45] >> 4) ^ (W[48] >> 29)) & 1) - 1) | ^(DV_I_45_0_bit | DV_I_47_0_bit | DV_I_49_0_bit | DV_I_51_0_bit | DV_II_49_0_bit | DV_II_54_0_bit))
 45	mask &= (((((W[45] ^ W[46]) >> 29) & 1) - 1) | ^(DV_I_49_0_bit | DV_I_52_0_bit | DV_II_46_0_bit | DV_II_47_0_bit | DV_II_51_0_bit | DV_II_52_0_bit))
 46	mask &= (((((W[44] >> 4) ^ (W[47] >> 29)) & 1) - 1) | ^(DV_I_44_0_bit | DV_I_46_0_bit | DV_I_48_0_bit | DV_I_50_0_bit | DV_II_48_0_bit | DV_II_53_0_bit))
 47	mask &= (((((W[43] >> 4) ^ (W[46] >> 29)) & 1) - 1) | ^(DV_I_43_0_bit | DV_I_45_0_bit | DV_I_47_0_bit | DV_I_49_0_bit | DV_II_47_0_bit | DV_II_52_0_bit))
 48	mask &= (((((W[43] ^ W[44]) >> 29) & 1) - 1) | ^(DV_I_47_0_bit | DV_I_50_0_bit | DV_I_51_0_bit | DV_II_45_0_bit | DV_II_49_0_bit | DV_II_50_0_bit))
 49	mask &= (((((W[42] >> 4) ^ (W[45] >> 29)) & 1) - 1) | ^(DV_I_44_0_bit | DV_I_46_0_bit | DV_I_48_0_bit | DV_I_52_0_bit | DV_II_46_0_bit | DV_II_51_0_bit))
 50	mask &= (((((W[41] >> 4) ^ (W[44] >> 29)) & 1) - 1) | ^(DV_I_43_0_bit | DV_I_45_0_bit | DV_I_47_0_bit | DV_I_51_0_bit | DV_II_45_0_bit | DV_II_50_0_bit))
 51	mask &= (((((W[40] ^ W[41]) >> 29) & 1) - 1) | ^(DV_I_44_0_bit | DV_I_47_0_bit | DV_I_48_0_bit | DV_II_46_0_bit | DV_II_47_0_bit | DV_II_56_0_bit))
 52	mask &= (((((W[54] ^ W[55]) >> 29) & 1) - 1) | ^(DV_I_51_0_bit | DV_II_47_0_bit | DV_II_50_0_bit | DV_II_55_0_bit | DV_II_56_0_bit))
 53	mask &= (((((W[53] ^ W[54]) >> 29) & 1) - 1) | ^(DV_I_50_0_bit | DV_II_46_0_bit | DV_II_49_0_bit | DV_II_54_0_bit | DV_II_55_0_bit))
 54	mask &= (((((W[52] ^ W[53]) >> 29) & 1) - 1) | ^(DV_I_49_0_bit | DV_II_45_0_bit | DV_II_48_0_bit | DV_II_53_0_bit | DV_II_54_0_bit))
 55	mask &= ((((W[50] ^ (W[53] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_50_0_bit | DV_I_52_0_bit | DV_II_46_0_bit | DV_II_48_0_bit | DV_II_54_0_bit))
 56	mask &= (((((W[50] ^ W[51]) >> 29) & 1) - 1) | ^(DV_I_47_0_bit | DV_II_46_0_bit | DV_II_51_0_bit | DV_II_52_0_bit | DV_II_56_0_bit))
 57	mask &= ((((W[49] ^ (W[52] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_49_0_bit | DV_I_51_0_bit | DV_II_45_0_bit | DV_II_47_0_bit | DV_II_53_0_bit))
 58	mask &= ((((W[48] ^ (W[51] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_48_0_bit | DV_I_50_0_bit | DV_I_52_0_bit | DV_II_46_0_bit | DV_II_52_0_bit))
 59	mask &= (((((W[42] ^ W[43]) >> 29) & 1) - 1) | ^(DV_I_46_0_bit | DV_I_49_0_bit | DV_I_50_0_bit | DV_II_48_0_bit | DV_II_49_0_bit))
 60	mask &= (((((W[41] ^ W[42]) >> 29) & 1) - 1) | ^(DV_I_45_0_bit | DV_I_48_0_bit | DV_I_49_0_bit | DV_II_47_0_bit | DV_II_48_0_bit))
 61	mask &= (((((W[40] >> 4) ^ (W[43] >> 29)) & 1) - 1) | ^(DV_I_44_0_bit | DV_I_46_0_bit | DV_I_50_0_bit | DV_II_49_0_bit | DV_II_56_0_bit))
 62	mask &= (((((W[39] >> 4) ^ (W[42] >> 29)) & 1) - 1) | ^(DV_I_43_0_bit | DV_I_45_0_bit | DV_I_49_0_bit | DV_II_48_0_bit | DV_II_55_0_bit))
 63
 64	if (mask & (DV_I_44_0_bit | DV_I_48_0_bit | DV_II_47_0_bit | DV_II_54_0_bit | DV_II_56_0_bit)) != 0 {
 65		mask &= (((((W[38] >> 4) ^ (W[41] >> 29)) & 1) - 1) | ^(DV_I_44_0_bit | DV_I_48_0_bit | DV_II_47_0_bit | DV_II_54_0_bit | DV_II_56_0_bit))
 66	}
 67	mask &= (((((W[37] >> 4) ^ (W[40] >> 29)) & 1) - 1) | ^(DV_I_43_0_bit | DV_I_47_0_bit | DV_II_46_0_bit | DV_II_53_0_bit | DV_II_55_0_bit))
 68	if (mask & (DV_I_52_0_bit | DV_II_48_0_bit | DV_II_51_0_bit | DV_II_56_0_bit)) != 0 {
 69		mask &= (((((W[55] ^ W[56]) >> 29) & 1) - 1) | ^(DV_I_52_0_bit | DV_II_48_0_bit | DV_II_51_0_bit | DV_II_56_0_bit))
 70	}
 71	if (mask & (DV_I_52_0_bit | DV_II_48_0_bit | DV_II_50_0_bit | DV_II_56_0_bit)) != 0 {
 72		mask &= ((((W[52] ^ (W[55] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_52_0_bit | DV_II_48_0_bit | DV_II_50_0_bit | DV_II_56_0_bit))
 73	}
 74	if (mask & (DV_I_51_0_bit | DV_II_47_0_bit | DV_II_49_0_bit | DV_II_55_0_bit)) != 0 {
 75		mask &= ((((W[51] ^ (W[54] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_51_0_bit | DV_II_47_0_bit | DV_II_49_0_bit | DV_II_55_0_bit))
 76	}
 77	if (mask & (DV_I_48_0_bit | DV_II_47_0_bit | DV_II_52_0_bit | DV_II_53_0_bit)) != 0 {
 78		mask &= (((((W[51] ^ W[52]) >> 29) & 1) - 1) | ^(DV_I_48_0_bit | DV_II_47_0_bit | DV_II_52_0_bit | DV_II_53_0_bit))
 79	}
 80	if (mask & (DV_I_46_0_bit | DV_I_49_0_bit | DV_II_45_0_bit | DV_II_48_0_bit)) != 0 {
 81		mask &= (((((W[36] >> 4) ^ (W[40] >> 29)) & 1) - 1) | ^(DV_I_46_0_bit | DV_I_49_0_bit | DV_II_45_0_bit | DV_II_48_0_bit))
 82	}
 83	if (mask & (DV_I_52_0_bit | DV_II_48_0_bit | DV_II_49_0_bit)) != 0 {
 84		mask &= ((0 - (((W[53] ^ W[56]) >> 29) & 1)) | ^(DV_I_52_0_bit | DV_II_48_0_bit | DV_II_49_0_bit))
 85	}
 86	if (mask & (DV_I_50_0_bit | DV_II_46_0_bit | DV_II_47_0_bit)) != 0 {
 87		mask &= ((0 - (((W[51] ^ W[54]) >> 29) & 1)) | ^(DV_I_50_0_bit | DV_II_46_0_bit | DV_II_47_0_bit))
 88	}
 89	if (mask & (DV_I_49_0_bit | DV_I_51_0_bit | DV_II_45_0_bit)) != 0 {
 90		mask &= ((0 - (((W[50] ^ W[52]) >> 29) & 1)) | ^(DV_I_49_0_bit | DV_I_51_0_bit | DV_II_45_0_bit))
 91	}
 92	if (mask & (DV_I_48_0_bit | DV_I_50_0_bit | DV_I_52_0_bit)) != 0 {
 93		mask &= ((0 - (((W[49] ^ W[51]) >> 29) & 1)) | ^(DV_I_48_0_bit | DV_I_50_0_bit | DV_I_52_0_bit))
 94	}
 95	if (mask & (DV_I_47_0_bit | DV_I_49_0_bit | DV_I_51_0_bit)) != 0 {
 96		mask &= ((0 - (((W[48] ^ W[50]) >> 29) & 1)) | ^(DV_I_47_0_bit | DV_I_49_0_bit | DV_I_51_0_bit))
 97	}
 98	if (mask & (DV_I_46_0_bit | DV_I_48_0_bit | DV_I_50_0_bit)) != 0 {
 99		mask &= ((0 - (((W[47] ^ W[49]) >> 29) & 1)) | ^(DV_I_46_0_bit | DV_I_48_0_bit | DV_I_50_0_bit))
100	}
101	if (mask & (DV_I_45_0_bit | DV_I_47_0_bit | DV_I_49_0_bit)) != 0 {
102		mask &= ((0 - (((W[46] ^ W[48]) >> 29) & 1)) | ^(DV_I_45_0_bit | DV_I_47_0_bit | DV_I_49_0_bit))
103	}
104	mask &= ((((W[45] ^ W[47]) & (1 << 6)) - (1 << 6)) | ^(DV_I_47_2_bit | DV_I_49_2_bit | DV_I_51_2_bit))
105	if (mask & (DV_I_44_0_bit | DV_I_46_0_bit | DV_I_48_0_bit)) != 0 {
106		mask &= ((0 - (((W[45] ^ W[47]) >> 29) & 1)) | ^(DV_I_44_0_bit | DV_I_46_0_bit | DV_I_48_0_bit))
107	}
108	mask &= (((((W[44] ^ W[46]) >> 6) & 1) - 1) | ^(DV_I_46_2_bit | DV_I_48_2_bit | DV_I_50_2_bit))
109	if (mask & (DV_I_43_0_bit | DV_I_45_0_bit | DV_I_47_0_bit)) != 0 {
110		mask &= ((0 - (((W[44] ^ W[46]) >> 29) & 1)) | ^(DV_I_43_0_bit | DV_I_45_0_bit | DV_I_47_0_bit))
111	}
112	mask &= ((0 - ((W[41] ^ (W[42] >> 5)) & (1 << 1))) | ^(DV_I_48_2_bit | DV_II_46_2_bit | DV_II_51_2_bit))
113	mask &= ((0 - ((W[40] ^ (W[41] >> 5)) & (1 << 1))) | ^(DV_I_47_2_bit | DV_I_51_2_bit | DV_II_50_2_bit))
114	if (mask & (DV_I_44_0_bit | DV_I_46_0_bit | DV_II_56_0_bit)) != 0 {
115		mask &= ((0 - (((W[40] ^ W[42]) >> 4) & 1)) | ^(DV_I_44_0_bit | DV_I_46_0_bit | DV_II_56_0_bit))
116	}
117	mask &= ((0 - ((W[39] ^ (W[40] >> 5)) & (1 << 1))) | ^(DV_I_46_2_bit | DV_I_50_2_bit | DV_II_49_2_bit))
118	if (mask & (DV_I_43_0_bit | DV_I_45_0_bit | DV_II_55_0_bit)) != 0 {
119		mask &= ((0 - (((W[39] ^ W[41]) >> 4) & 1)) | ^(DV_I_43_0_bit | DV_I_45_0_bit | DV_II_55_0_bit))
120	}
121	if (mask & (DV_I_44_0_bit | DV_II_54_0_bit | DV_II_56_0_bit)) != 0 {
122		mask &= ((0 - (((W[38] ^ W[40]) >> 4) & 1)) | ^(DV_I_44_0_bit | DV_II_54_0_bit | DV_II_56_0_bit))
123	}
124	if (mask & (DV_I_43_0_bit | DV_II_53_0_bit | DV_II_55_0_bit)) != 0 {
125		mask &= ((0 - (((W[37] ^ W[39]) >> 4) & 1)) | ^(DV_I_43_0_bit | DV_II_53_0_bit | DV_II_55_0_bit))
126	}
127	mask &= ((0 - ((W[36] ^ (W[37] >> 5)) & (1 << 1))) | ^(DV_I_47_2_bit | DV_I_50_2_bit | DV_II_46_2_bit))
128	if (mask & (DV_I_45_0_bit | DV_I_48_0_bit | DV_II_47_0_bit)) != 0 {
129		mask &= (((((W[35] >> 4) ^ (W[39] >> 29)) & 1) - 1) | ^(DV_I_45_0_bit | DV_I_48_0_bit | DV_II_47_0_bit))
130	}
131	if (mask & (DV_I_48_0_bit | DV_II_48_0_bit)) != 0 {
132		mask &= ((0 - ((W[63] ^ (W[64] >> 5)) & (1 << 0))) | ^(DV_I_48_0_bit | DV_II_48_0_bit))
133	}
134	if (mask & (DV_I_45_0_bit | DV_II_45_0_bit)) != 0 {
135		mask &= ((0 - ((W[63] ^ (W[64] >> 5)) & (1 << 1))) | ^(DV_I_45_0_bit | DV_II_45_0_bit))
136	}
137	if (mask & (DV_I_47_0_bit | DV_II_47_0_bit)) != 0 {
138		mask &= ((0 - ((W[62] ^ (W[63] >> 5)) & (1 << 0))) | ^(DV_I_47_0_bit | DV_II_47_0_bit))
139	}
140	if (mask & (DV_I_46_0_bit | DV_II_46_0_bit)) != 0 {
141		mask &= ((0 - ((W[61] ^ (W[62] >> 5)) & (1 << 0))) | ^(DV_I_46_0_bit | DV_II_46_0_bit))
142	}
143	mask &= ((0 - ((W[61] ^ (W[62] >> 5)) & (1 << 2))) | ^(DV_I_46_2_bit | DV_II_46_2_bit))
144	if (mask & (DV_I_45_0_bit | DV_II_45_0_bit)) != 0 {
145		mask &= ((0 - ((W[60] ^ (W[61] >> 5)) & (1 << 0))) | ^(DV_I_45_0_bit | DV_II_45_0_bit))
146	}
147	if (mask & (DV_II_51_0_bit | DV_II_54_0_bit)) != 0 {
148		mask &= (((((W[58] ^ W[59]) >> 29) & 1) - 1) | ^(DV_II_51_0_bit | DV_II_54_0_bit))
149	}
150	if (mask & (DV_II_50_0_bit | DV_II_53_0_bit)) != 0 {
151		mask &= (((((W[57] ^ W[58]) >> 29) & 1) - 1) | ^(DV_II_50_0_bit | DV_II_53_0_bit))
152	}
153	if (mask & (DV_II_52_0_bit | DV_II_54_0_bit)) != 0 {
154		mask &= ((((W[56] ^ (W[59] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_II_52_0_bit | DV_II_54_0_bit))
155	}
156	if (mask & (DV_II_51_0_bit | DV_II_52_0_bit)) != 0 {
157		mask &= ((0 - (((W[56] ^ W[59]) >> 29) & 1)) | ^(DV_II_51_0_bit | DV_II_52_0_bit))
158	}
159	if (mask & (DV_II_49_0_bit | DV_II_52_0_bit)) != 0 {
160		mask &= (((((W[56] ^ W[57]) >> 29) & 1) - 1) | ^(DV_II_49_0_bit | DV_II_52_0_bit))
161	}
162	if (mask & (DV_II_51_0_bit | DV_II_53_0_bit)) != 0 {
163		mask &= ((((W[55] ^ (W[58] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_II_51_0_bit | DV_II_53_0_bit))
164	}
165	if (mask & (DV_II_50_0_bit | DV_II_52_0_bit)) != 0 {
166		mask &= ((((W[54] ^ (W[57] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_II_50_0_bit | DV_II_52_0_bit))
167	}
168	if (mask & (DV_II_49_0_bit | DV_II_51_0_bit)) != 0 {
169		mask &= ((((W[53] ^ (W[56] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_II_49_0_bit | DV_II_51_0_bit))
170	}
171	mask &= ((((W[51] ^ (W[50] >> 5)) & (1 << 1)) - (1 << 1)) | ^(DV_I_50_2_bit | DV_II_46_2_bit))
172	mask &= ((((W[48] ^ W[50]) & (1 << 6)) - (1 << 6)) | ^(DV_I_50_2_bit | DV_II_46_2_bit))
173	if (mask & (DV_I_51_0_bit | DV_I_52_0_bit)) != 0 {
174		mask &= ((0 - (((W[48] ^ W[55]) >> 29) & 1)) | ^(DV_I_51_0_bit | DV_I_52_0_bit))
175	}
176	mask &= ((((W[47] ^ W[49]) & (1 << 6)) - (1 << 6)) | ^(DV_I_49_2_bit | DV_I_51_2_bit))
177	mask &= ((((W[48] ^ (W[47] >> 5)) & (1 << 1)) - (1 << 1)) | ^(DV_I_47_2_bit | DV_II_51_2_bit))
178	mask &= ((((W[46] ^ W[48]) & (1 << 6)) - (1 << 6)) | ^(DV_I_48_2_bit | DV_I_50_2_bit))
179	mask &= ((((W[47] ^ (W[46] >> 5)) & (1 << 1)) - (1 << 1)) | ^(DV_I_46_2_bit | DV_II_50_2_bit))
180	mask &= ((0 - ((W[44] ^ (W[45] >> 5)) & (1 << 1))) | ^(DV_I_51_2_bit | DV_II_49_2_bit))
181	mask &= ((((W[43] ^ W[45]) & (1 << 6)) - (1 << 6)) | ^(DV_I_47_2_bit | DV_I_49_2_bit))
182	mask &= (((((W[42] ^ W[44]) >> 6) & 1) - 1) | ^(DV_I_46_2_bit | DV_I_48_2_bit))
183	mask &= ((((W[43] ^ (W[42] >> 5)) & (1 << 1)) - (1 << 1)) | ^(DV_II_46_2_bit | DV_II_51_2_bit))
184	mask &= ((((W[42] ^ (W[41] >> 5)) & (1 << 1)) - (1 << 1)) | ^(DV_I_51_2_bit | DV_II_50_2_bit))
185	mask &= ((((W[41] ^ (W[40] >> 5)) & (1 << 1)) - (1 << 1)) | ^(DV_I_50_2_bit | DV_II_49_2_bit))
186	if (mask & (DV_I_52_0_bit | DV_II_51_0_bit)) != 0 {
187		mask &= ((((W[39] ^ (W[43] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_52_0_bit | DV_II_51_0_bit))
188	}
189	if (mask & (DV_I_51_0_bit | DV_II_50_0_bit)) != 0 {
190		mask &= ((((W[38] ^ (W[42] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_51_0_bit | DV_II_50_0_bit))
191	}
192	if (mask & (DV_I_48_2_bit | DV_I_51_2_bit)) != 0 {
193		mask &= ((0 - ((W[37] ^ (W[38] >> 5)) & (1 << 1))) | ^(DV_I_48_2_bit | DV_I_51_2_bit))
194	}
195	if (mask & (DV_I_50_0_bit | DV_II_49_0_bit)) != 0 {
196		mask &= ((((W[37] ^ (W[41] >> 25)) & (1 << 4)) - (1 << 4)) | ^(DV_I_50_0_bit | DV_II_49_0_bit))
197	}
198	if (mask & (DV_II_52_0_bit | DV_II_54_0_bit)) != 0 {
199		mask &= ((0 - ((W[36] ^ W[38]) & (1 << 4))) | ^(DV_II_52_0_bit | DV_II_54_0_bit))
200	}
201	mask &= ((0 - ((W[35] ^ (W[36] >> 5)) & (1 << 1))) | ^(DV_I_46_2_bit | DV_I_49_2_bit))
202	if (mask & (DV_I_51_0_bit | DV_II_47_0_bit)) != 0 {
203		mask &= ((((W[35] ^ (W[39] >> 25)) & (1 << 3)) - (1 << 3)) | ^(DV_I_51_0_bit | DV_II_47_0_bit))
204	}
205
206	if mask != 0 {
207		if (mask & DV_I_43_0_bit) != 0 {
208			if not((W[61]^(W[62]>>5))&(1<<1)) != 0 ||
209				not(not((W[59]^(W[63]>>25))&(1<<5))) != 0 ||
210				not((W[58]^(W[63]>>30))&(1<<0)) != 0 {
211				mask &= ^DV_I_43_0_bit
212			}
213		}
214		if (mask & DV_I_44_0_bit) != 0 {
215			if not((W[62]^(W[63]>>5))&(1<<1)) != 0 ||
216				not(not((W[60]^(W[64]>>25))&(1<<5))) != 0 ||
217				not((W[59]^(W[64]>>30))&(1<<0)) != 0 {
218				mask &= ^DV_I_44_0_bit
219			}
220		}
221		if (mask & DV_I_46_2_bit) != 0 {
222			mask &= ((^((W[40] ^ W[42]) >> 2)) | ^DV_I_46_2_bit)
223		}
224		if (mask & DV_I_47_2_bit) != 0 {
225			if not((W[62]^(W[63]>>5))&(1<<2)) != 0 ||
226				not(not((W[41]^W[43])&(1<<6))) != 0 {
227				mask &= ^DV_I_47_2_bit
228			}
229		}
230		if (mask & DV_I_48_2_bit) != 0 {
231			if not((W[63]^(W[64]>>5))&(1<<2)) != 0 ||
232				not(not((W[48]^(W[49]<<5))&(1<<6))) != 0 {
233				mask &= ^DV_I_48_2_bit
234			}
235		}
236		if (mask & DV_I_49_2_bit) != 0 {
237			if not(not((W[49]^(W[50]<<5))&(1<<6))) != 0 ||
238				not((W[42]^W[50])&(1<<1)) != 0 ||
239				not(not((W[39]^(W[40]<<5))&(1<<6))) != 0 ||
240				not((W[38]^W[40])&(1<<1)) != 0 {
241				mask &= ^DV_I_49_2_bit
242			}
243		}
244		if (mask & DV_I_50_0_bit) != 0 {
245			mask &= (((W[36] ^ W[37]) << 7) | ^DV_I_50_0_bit)
246		}
247		if (mask & DV_I_50_2_bit) != 0 {
248			mask &= (((W[43] ^ W[51]) << 11) | ^DV_I_50_2_bit)
249		}
250		if (mask & DV_I_51_0_bit) != 0 {
251			mask &= (((W[37] ^ W[38]) << 9) | ^DV_I_51_0_bit)
252		}
253		if (mask & DV_I_51_2_bit) != 0 {
254			if not(not((W[51]^(W[52]<<5))&(1<<6))) != 0 ||
255				not(not((W[49]^W[51])&(1<<6))) != 0 ||
256				not(not((W[37]^(W[37]>>5))&(1<<1))) != 0 ||
257				not(not((W[35]^(W[39]>>25))&(1<<5))) != 0 {
258				mask &= ^DV_I_51_2_bit
259			}
260		}
261		if (mask & DV_I_52_0_bit) != 0 {
262			mask &= (((W[38] ^ W[39]) << 11) | ^DV_I_52_0_bit)
263		}
264		if (mask & DV_II_46_2_bit) != 0 {
265			mask &= (((W[47] ^ W[51]) << 17) | ^DV_II_46_2_bit)
266		}
267		if (mask & DV_II_48_0_bit) != 0 {
268			if not(not((W[36]^(W[40]>>25))&(1<<3))) != 0 ||
269				not((W[35]^(W[40]<<2))&(1<<30)) != 0 {
270				mask &= ^DV_II_48_0_bit
271			}
272		}
273		if (mask & DV_II_49_0_bit) != 0 {
274			if not(not((W[37]^(W[41]>>25))&(1<<3))) != 0 ||
275				not((W[36]^(W[41]<<2))&(1<<30)) != 0 {
276				mask &= ^DV_II_49_0_bit
277			}
278		}
279		if (mask & DV_II_49_2_bit) != 0 {
280			if not(not((W[53]^(W[54]<<5))&(1<<6))) != 0 ||
281				not(not((W[51]^W[53])&(1<<6))) != 0 ||
282				not((W[50]^W[54])&(1<<1)) != 0 ||
283				not(not((W[45]^(W[46]<<5))&(1<<6))) != 0 ||
284				not(not((W[37]^(W[41]>>25))&(1<<5))) != 0 ||
285				not((W[36]^(W[41]>>30))&(1<<0)) != 0 {
286				mask &= ^DV_II_49_2_bit
287			}
288		}
289		if (mask & DV_II_50_0_bit) != 0 {
290			if not((W[55]^W[58])&(1<<29)) != 0 ||
291				not(not((W[38]^(W[42]>>25))&(1<<3))) != 0 ||
292				not((W[37]^(W[42]<<2))&(1<<30)) != 0 {
293				mask &= ^DV_II_50_0_bit
294			}
295		}
296		if (mask & DV_II_50_2_bit) != 0 {
297			if not(not((W[54]^(W[55]<<5))&(1<<6))) != 0 ||
298				not(not((W[52]^W[54])&(1<<6))) != 0 ||
299				not((W[51]^W[55])&(1<<1)) != 0 ||
300				not((W[45]^W[47])&(1<<1)) != 0 ||
301				not(not((W[38]^(W[42]>>25))&(1<<5))) != 0 ||
302				not((W[37]^(W[42]>>30))&(1<<0)) != 0 {
303				mask &= ^DV_II_50_2_bit
304			}
305		}
306		if (mask & DV_II_51_0_bit) != 0 {
307			if not(not((W[39]^(W[43]>>25))&(1<<3))) != 0 ||
308				not((W[38]^(W[43]<<2))&(1<<30)) != 0 {
309				mask &= ^DV_II_51_0_bit
310			}
311		}
312		if (mask & DV_II_51_2_bit) != 0 {
313			if not(not((W[55]^(W[56]<<5))&(1<<6))) != 0 ||
314				not(not((W[53]^W[55])&(1<<6))) != 0 ||
315				not((W[52]^W[56])&(1<<1)) != 0 ||
316				not((W[46]^W[48])&(1<<1)) != 0 ||
317				not(not((W[39]^(W[43]>>25))&(1<<5))) != 0 ||
318				not((W[38]^(W[43]>>30))&(1<<0)) != 0 {
319				mask &= ^DV_II_51_2_bit
320			}
321		}
322		if (mask & DV_II_52_0_bit) != 0 {
323			if not(not((W[59]^W[60])&(1<<29))) != 0 ||
324				not(not((W[40]^(W[44]>>25))&(1<<3))) != 0 ||
325				not(not((W[40]^(W[44]>>25))&(1<<4))) != 0 ||
326				not((W[39]^(W[44]<<2))&(1<<30)) != 0 {
327				mask &= ^DV_II_52_0_bit
328			}
329		}
330		if (mask & DV_II_53_0_bit) != 0 {
331			if not((W[58]^W[61])&(1<<29)) != 0 ||
332				not(not((W[57]^(W[61]>>25))&(1<<4))) != 0 ||
333				not(not((W[41]^(W[45]>>25))&(1<<3))) != 0 ||
334				not(not((W[41]^(W[45]>>25))&(1<<4))) != 0 {
335				mask &= ^DV_II_53_0_bit
336			}
337		}
338		if (mask & DV_II_54_0_bit) != 0 {
339			if not(not((W[58]^(W[62]>>25))&(1<<4))) != 0 ||
340				not(not((W[42]^(W[46]>>25))&(1<<3))) != 0 ||
341				not(not((W[42]^(W[46]>>25))&(1<<4))) != 0 {
342				mask &= ^DV_II_54_0_bit
343			}
344		}
345		if (mask & DV_II_55_0_bit) != 0 {
346			if not(not((W[59]^(W[63]>>25))&(1<<4))) != 0 ||
347				not(not((W[57]^(W[59]>>25))&(1<<4))) != 0 ||
348				not(not((W[43]^(W[47]>>25))&(1<<3))) != 0 ||
349				not(not((W[43]^(W[47]>>25))&(1<<4))) != 0 {
350				mask &= ^DV_II_55_0_bit
351			}
352		}
353		if (mask & DV_II_56_0_bit) != 0 {
354			if not(not((W[60]^(W[64]>>25))&(1<<4))) != 0 ||
355				not(not((W[44]^(W[48]>>25))&(1<<3))) != 0 ||
356				not(not((W[44]^(W[48]>>25))&(1<<4))) != 0 {
357				mask &= ^DV_II_56_0_bit
358			}
359		}
360	}
361
362	return mask
363}
364
365func not(x uint32) uint32 {
366	if x == 0 {
367		return 1
368	}
369
370	return 0
371}
372
373//go:nosplit
374func SHA1_dvs() []DvInfo {
375	return sha1_dvs
376}