blake2.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268
  1. /* ===================================================================
  2. *
  3. * Copyright (c) 2014, Legrandin <helderijs@gmail.com>
  4. * All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions
  8. * are met:
  9. *
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions and the following disclaimer.
  12. * 2. Redistributions in binary form must reproduce the above copyright
  13. * notice, this list of conditions and the following disclaimer in
  14. * the documentation and/or other materials provided with the
  15. * distribution.
  16. *
  17. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  20. * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  21. * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  22. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23. * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  24. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  25. * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  27. * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  28. * POSSIBILITY OF SUCH DAMAGE.
  29. * ===================================================================
  30. */
  31. #include <stdio.h>
  32. #include "common.h"
  33. #include "endianess.h"
  34. #define WORDS_IN_BLOCK 16
  35. #define WORDS_IN_STATE 8
  36. #define BLOCK_SIZE (WORDS_IN_BLOCK*BLAKE2_WORD_SIZE/8)
  37. typedef struct {
  38. blake2_word h[WORDS_IN_STATE];
  39. blake2_word off_counter_low;
  40. blake2_word off_counter_high;
  41. unsigned buf_occ;
  42. uint8_t buf[BLOCK_SIZE];
  43. } hash_state;
  44. typedef enum { NON_FINAL_BLOCK, FINAL_BLOCK } block_type;
  45. EXPORT_SYM int blake2_init (hash_state **state,
  46. const uint8_t *key,
  47. size_t key_size,
  48. size_t digest_size)
  49. {
  50. hash_state *hs;
  51. unsigned i;
  52. if (NULL == state)
  53. return ERR_NULL;
  54. if (NULL == key || key_size > MAX_KEY_BYTES)
  55. return ERR_KEY_SIZE;
  56. if (0 == digest_size || digest_size > MAX_DIGEST_BYTES)
  57. return ERR_DIGEST_SIZE;
  58. *state = hs = (hash_state*) calloc(1, sizeof(hash_state));
  59. if (NULL == hs)
  60. return ERR_MEMORY;
  61. for (i=0; i<WORDS_IN_STATE; i++) {
  62. hs->h[i] = iv[i];
  63. }
  64. hs->h[0] = (blake2_word)(hs->h[0] ^ 0x01010000 ^ (key_size << 8) ^ digest_size);
  65. /** If the key is present, the first block is the key padded with zeroes **/
  66. if (key_size>0) {
  67. memcpy(hs->buf, key, key_size);
  68. hs->buf_occ = BLOCK_SIZE;
  69. }
  70. return 0;
  71. }
  72. EXPORT_SYM int blake2_destroy(hash_state *hs)
  73. {
  74. free(hs);
  75. return 0;
  76. }
  77. EXPORT_SYM int blake2_copy(const hash_state *src, hash_state *dst)
  78. {
  79. if (NULL == src || NULL == dst) {
  80. return ERR_NULL;
  81. }
  82. *dst = *src;
  83. return 0;
  84. }
  85. #define ROTR(x,n) (((x) >> (n)) ^ ((x) << (BLAKE2_WORD_SIZE - (n))))
  86. #define G(v,a,b,c,d,x,y) \
  87. { \
  88. v[a] = v[a] + v[b] + x; \
  89. v[d] = ROTR(v[d] ^ v[a], G_R1); \
  90. v[c] = v[c] + v[d]; \
  91. v[b] = ROTR(v[b] ^ v[c], G_R2); \
  92. v[a] = v[a] + v[b] + y; \
  93. v[d] = ROTR(v[d] ^ v[a], G_R3); \
  94. v[c] = v[c] + v[d]; \
  95. v[b] = ROTR(v[b] ^ v[c], G_R4); \
  96. }
  97. static void blake2b_compress(blake2_word state[8],
  98. const blake2_word m[WORDS_IN_BLOCK],
  99. blake2_word off_counter_low,
  100. blake2_word off_counter_high,
  101. block_type bt
  102. )
  103. {
  104. static const uint8_t sigma[12][16] = {
  105. { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
  106. { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
  107. { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
  108. { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
  109. { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
  110. { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
  111. { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
  112. { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
  113. { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
  114. { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
  115. { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
  116. { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
  117. };
  118. blake2_word work[WORDS_IN_BLOCK];
  119. unsigned i;
  120. for (i=0; i<WORDS_IN_STATE; i++) {
  121. work[i] = state[i];
  122. work[i+WORDS_IN_STATE] = iv[i];
  123. }
  124. work[12] ^= off_counter_low;
  125. work[13] ^= off_counter_high;
  126. if (bt == FINAL_BLOCK)
  127. work[14] = ~work[14];
  128. for (i=0; i<F_ROUNDS; i++) {
  129. const uint8_t *s;
  130. s = &sigma[i][0];
  131. G(work, 0, 4, 8, 12, m[s[ 0]], m[s[ 1]]);
  132. G(work, 1, 5, 9, 13, m[s[ 2]], m[s[ 3]]);
  133. G(work, 2, 6, 10, 14, m[s[ 4]], m[s[ 5]]);
  134. G(work, 3, 7, 11, 15, m[s[ 6]], m[s[ 7]]);
  135. G(work, 0, 5, 10, 15, m[s[ 8]], m[s[ 9]]);
  136. G(work, 1, 6, 11, 12, m[s[10]], m[s[11]]);
  137. G(work, 2, 7, 8, 13, m[s[12]], m[s[13]]);
  138. G(work, 3, 4, 9, 14, m[s[14]], m[s[15]]);
  139. }
  140. for (i=0; i<WORDS_IN_STATE; i++)
  141. state[i] ^= work[i] ^ work[i+WORDS_IN_STATE];
  142. }
  143. static int blake2b_process_buffer(hash_state *hs,
  144. size_t new_data_added,
  145. block_type bt)
  146. {
  147. blake2_word bufw[WORDS_IN_BLOCK];
  148. const uint8_t *buf;
  149. unsigned i;
  150. buf = hs->buf;
  151. for (i=0; i<WORDS_IN_BLOCK; i++) {
  152. bufw[i] = LOAD_WORD_LITTLE(buf);
  153. buf += sizeof(blake2_word);
  154. }
  155. hs->off_counter_low = (blake2_word)(hs->off_counter_low + new_data_added);
  156. if (hs->off_counter_low < new_data_added) {
  157. if (0 == ++hs->off_counter_high)
  158. return ERR_MAX_DATA;
  159. }
  160. blake2b_compress(hs->h,
  161. bufw,
  162. hs->off_counter_low,
  163. hs->off_counter_high,
  164. bt);
  165. hs->buf_occ = 0;
  166. return 0;
  167. }
  168. EXPORT_SYM int blake2_update(hash_state *hs,
  169. const uint8_t *in,
  170. size_t len)
  171. {
  172. if (NULL == hs)
  173. return ERR_NULL;
  174. if (len > 0 && NULL == in)
  175. return ERR_NULL;
  176. while (len > 0) {
  177. unsigned tc, left;
  178. /** Consume input **/
  179. left = (unsigned)(BLOCK_SIZE - hs->buf_occ);
  180. tc = (unsigned)MIN(len, left);
  181. memcpy(&hs->buf[hs->buf_occ], in, tc);
  182. len -= tc;
  183. in += tc;
  184. hs->buf_occ += tc;
  185. /* Flush buffer if full. However, we must leave at least
  186. * one byte in the buffer at the end, because we don't
  187. * know if we are processing the last block.
  188. */
  189. if (hs->buf_occ == BLOCK_SIZE && len>0) {
  190. int result;
  191. result = blake2b_process_buffer(hs, BLOCK_SIZE, NON_FINAL_BLOCK);
  192. if (result)
  193. return result;
  194. }
  195. }
  196. return 0;
  197. }
  198. EXPORT_SYM int blake2_digest(const hash_state *hs,
  199. uint8_t digest[MAX_DIGEST_BYTES])
  200. {
  201. hash_state temp_hs;
  202. unsigned i;
  203. int result;
  204. if (NULL==hs || NULL==digest)
  205. return ERR_NULL;
  206. temp_hs = *hs;
  207. /** Pad buffer with zeroes, if needed. In the special case
  208. * of no key and no data, we must process an all zero block.
  209. */
  210. for (i=temp_hs.buf_occ; i<BLOCK_SIZE; i++) {
  211. temp_hs.buf[i] = 0;
  212. }
  213. result = blake2b_process_buffer(&temp_hs,
  214. temp_hs.buf_occ,
  215. FINAL_BLOCK);
  216. if (result)
  217. return result;
  218. assert(sizeof temp_hs.h == MAX_DIGEST_BYTES);
  219. for (i=0; i<WORDS_IN_STATE; i++) {
  220. STORE_WORD_LITTLE(digest, temp_hs.h[i]);
  221. digest += sizeof(blake2_word);
  222. }
  223. return 0;
  224. }