blake2.c 7.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264
  1. /* ===================================================================
  2. *
  3. * Copyright (c) 2014, Legrandin <helderijs@gmail.com>
  4. * All rights reserved.
  5. *
  6. * Redistribution and use in source and binary forms, with or without
  7. * modification, are permitted provided that the following conditions
  8. * are met:
  9. *
  10. * 1. Redistributions of source code must retain the above copyright
  11. * notice, this list of conditions and the following disclaimer.
  12. * 2. Redistributions in binary form must reproduce the above copyright
  13. * notice, this list of conditions and the following disclaimer in
  14. * the documentation and/or other materials provided with the
  15. * distribution.
  16. *
  17. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  18. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  19. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  20. * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  21. * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  22. * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  23. * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  24. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  25. * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  27. * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  28. * POSSIBILITY OF SUCH DAMAGE.
  29. * ===================================================================
  30. */
  31. #include "pycrypto_common.h"
  32. #include <stdio.h>
  33. typedef struct {
  34. blake2_word h[8];
  35. blake2_word off_counter_low;
  36. blake2_word off_counter_high;
  37. size_t buf_occ;
  38. union {
  39. uint8_t b[16*sizeof(blake2_word)];
  40. blake2_word w[16];
  41. } buf;
  42. } hash_state;
  43. typedef enum { NON_FINAL_BLOCK, FINAL_BLOCK } block_type;
  44. static unsigned minAB(unsigned a, unsigned b)
  45. {
  46. return a < b ? a : b;
  47. }
  48. static int little_endian(void) {
  49. int test = 1;
  50. return *((uint8_t*)&test) == 1;
  51. }
  52. EXPORT_SYM int blake2_init (hash_state **state,
  53. const uint8_t *key,
  54. size_t key_size,
  55. size_t digest_size)
  56. {
  57. hash_state *hs;
  58. unsigned i;
  59. if (NULL == state)
  60. return ERR_NULL;
  61. if (NULL == key || key_size > MAX_KEY_BYTES)
  62. return ERR_KEY_SIZE;
  63. if (0 == digest_size || digest_size > MAX_DIGEST_BYTES)
  64. return ERR_DIGEST_SIZE;
  65. *state = hs = (hash_state*) calloc(1, sizeof(hash_state));
  66. if (NULL == hs)
  67. return ERR_MEMORY;
  68. for (i=0; i<8; i++) {
  69. hs->h[i] = iv[i];
  70. }
  71. hs->h[0] ^= 0x01010000 ^ (key_size << 8) ^ digest_size;
  72. /** If the key is present, the first block is the key padded with zeroes **/
  73. if (key_size>0) {
  74. memcpy(hs->buf.b, key, key_size);
  75. hs->buf_occ = sizeof hs->buf;
  76. }
  77. return 0;
  78. }
  79. EXPORT_SYM int blake2_destroy(hash_state *hs)
  80. {
  81. free(hs);
  82. return 0;
  83. }
  84. EXPORT_SYM int blake2_copy(const hash_state *src, hash_state *dst)
  85. {
  86. if (NULL == src || NULL == dst) {
  87. return ERR_NULL;
  88. }
  89. *dst = *src;
  90. return 0;
  91. }
  92. #define ROTR(x,n) (((x) >> (n)) ^ ((x) << (BLAKE2_WORD_SIZE - (n))))
  93. #define G(v,a,b,c,d,x,y) \
  94. { \
  95. v[a] = v[a] + v[b] + x; \
  96. v[d] = ROTR(v[d] ^ v[a], G_R1); \
  97. v[c] = v[c] + v[d]; \
  98. v[b] = ROTR(v[b] ^ v[c], G_R2); \
  99. v[a] = v[a] + v[b] + y; \
  100. v[d] = ROTR(v[d] ^ v[a], G_R3); \
  101. v[c] = v[c] + v[d]; \
  102. v[b] = ROTR(v[b] ^ v[c], G_R4); \
  103. }
  104. static void blake2b_compress(blake2_word state[8],
  105. const blake2_word m[16],
  106. blake2_word off_counter_low,
  107. blake2_word off_counter_high,
  108. block_type bt
  109. )
  110. {
  111. static const uint8_t sigma[12][16] = {
  112. { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
  113. { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
  114. { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
  115. { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
  116. { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
  117. { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
  118. { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
  119. { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
  120. { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
  121. { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
  122. { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
  123. { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
  124. };
  125. unsigned i;
  126. blake2_word work[16];
  127. for (i=0; i<8; i++) {
  128. work[i] = state[i];
  129. work[i+8] = iv[i];
  130. }
  131. work[12] ^= off_counter_low;
  132. work[13] ^= off_counter_high;
  133. if (bt == FINAL_BLOCK)
  134. work[14] = ~work[14];
  135. for (i=0; i<F_ROUNDS; i++) {
  136. const uint8_t *s;
  137. s = &sigma[i][0];
  138. G(work, 0, 4, 8, 12, m[s[ 0]], m[s[ 1]]);
  139. G(work, 1, 5, 9, 13, m[s[ 2]], m[s[ 3]]);
  140. G(work, 2, 6, 10, 14, m[s[ 4]], m[s[ 5]]);
  141. G(work, 3, 7, 11, 15, m[s[ 6]], m[s[ 7]]);
  142. G(work, 0, 5, 10, 15, m[s[ 8]], m[s[ 9]]);
  143. G(work, 1, 6, 11, 12, m[s[10]], m[s[11]]);
  144. G(work, 2, 7, 8, 13, m[s[12]], m[s[13]]);
  145. G(work, 3, 4, 9, 14, m[s[14]], m[s[15]]);
  146. }
  147. for (i=0; i<8; i++)
  148. state[i] ^= work[i] ^ work[i+8];
  149. }
  150. static int blake2b_process_buffer(hash_state *hs,
  151. size_t new_data_added,
  152. block_type bt)
  153. {
  154. if (!little_endian()) {
  155. unsigned i;
  156. for (i=0; i<16; i++)
  157. byteswap(hs->buf.w + i);
  158. }
  159. hs->off_counter_low += new_data_added;
  160. if (hs->off_counter_low < new_data_added) {
  161. if (0 == ++hs->off_counter_high)
  162. return ERR_MAX_DATA;
  163. }
  164. blake2b_compress(hs->h,
  165. hs->buf.w,
  166. hs->off_counter_low,
  167. hs->off_counter_high,
  168. bt);
  169. hs->buf_occ = 0;
  170. return 0;
  171. }
  172. EXPORT_SYM int blake2_update(hash_state *hs,
  173. const uint8_t *in,
  174. size_t len)
  175. {
  176. if (NULL == hs)
  177. return ERR_NULL;
  178. if (len > 0 && NULL == in)
  179. return ERR_NULL;
  180. while (len > 0) {
  181. size_t consumed;
  182. if (hs->buf_occ == sizeof hs->buf) {
  183. int result;
  184. result = blake2b_process_buffer(hs, sizeof hs->buf.b, NON_FINAL_BLOCK);
  185. if (result)
  186. return result;
  187. }
  188. /** Consume input **/
  189. consumed = minAB(len, sizeof hs->buf.b - hs->buf_occ);
  190. memcpy(hs->buf.b + hs->buf_occ, in, consumed);
  191. len -= consumed;
  192. in += consumed;
  193. hs->buf_occ += consumed;
  194. }
  195. return 0;
  196. }
  197. EXPORT_SYM int blake2_digest(const hash_state *hs,
  198. uint8_t digest[MAX_DIGEST_BYTES])
  199. {
  200. hash_state temp_hs;
  201. int result;
  202. if (NULL==hs || NULL==digest)
  203. return ERR_NULL;
  204. temp_hs = *hs;
  205. /** Fill buffer with zeroes **/
  206. memset(temp_hs.buf.b + temp_hs.buf_occ,
  207. 0,
  208. sizeof temp_hs.buf.b - temp_hs.buf_occ);
  209. result = blake2b_process_buffer(&temp_hs,
  210. temp_hs.buf_occ,
  211. FINAL_BLOCK);
  212. if (result)
  213. return result;
  214. if (!little_endian()) {
  215. unsigned i;
  216. for (i=0; i<8; i++)
  217. byteswap(temp_hs.h + i);
  218. }
  219. memcpy(digest, temp_hs.h, MAX_DIGEST_BYTES);
  220. return 0;
  221. }