|
| 1 | +/* blake2b.c - an implementation of blake2b hash function. |
| 2 | + * |
| 3 | + * Copyright (c) 2012, Samuel Neves <sneves@dei.uc.pt> |
| 4 | + * Copyright (c) 2021, Aleksey Kravchenko <rhash.admin@gmail.com> |
| 5 | + * |
| 6 | + * Permission to use, copy, modify, and/or distribute this software for any |
| 7 | + * purpose with or without fee is hereby granted. |
| 8 | + * |
| 9 | + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH |
| 10 | + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY |
| 11 | + * AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, |
| 12 | + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM |
| 13 | + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE |
| 14 | + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR |
| 15 | + * PERFORMANCE OF THIS SOFTWARE. |
| 16 | + */ |
| 17 | + |
| 18 | +#include "blake2b.h" |
| 19 | +#include "byte_order.h" |
| 20 | +#include <string.h> |
| 21 | + |
| 22 | +static const uint64_t blake2b_IV[8] = |
| 23 | +{ |
| 24 | + I64(0x6a09e667f3bcc908), I64(0xbb67ae8584caa73b), |
| 25 | + I64(0x3c6ef372fe94f82b), I64(0xa54ff53a5f1d36f1), |
| 26 | + I64(0x510e527fade682d1), I64(0x9b05688c2b3e6c1f), |
| 27 | + I64(0x1f83d9abfb41bd6b), I64(0x5be0cd19137e2179) |
| 28 | +}; |
| 29 | + |
| 30 | +static const uint8_t blake2b_sigma[12][16] = |
| 31 | +{ |
| 32 | + { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, |
| 33 | + { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }, |
| 34 | + { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 }, |
| 35 | + { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 }, |
| 36 | + { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 }, |
| 37 | + { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 }, |
| 38 | + { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 }, |
| 39 | + { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 }, |
| 40 | + { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 }, |
| 41 | + { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }, |
| 42 | + { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, |
| 43 | + { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } |
| 44 | +}; |
| 45 | + |
| 46 | +void rhash_blake2b_init(blake2b_ctx* ctx) |
| 47 | +{ |
| 48 | + memset(ctx, 0, sizeof(*ctx)); |
| 49 | + /* init state by xoring IV with blake2b input parameter block */ |
| 50 | + ctx->hash[0] = blake2b_IV[0] ^ I64(0x01010040); |
| 51 | + ctx->hash[1] = blake2b_IV[1]; |
| 52 | + ctx->hash[2] = blake2b_IV[2]; |
| 53 | + ctx->hash[3] = blake2b_IV[3]; |
| 54 | + ctx->hash[4] = blake2b_IV[4]; |
| 55 | + ctx->hash[5] = blake2b_IV[5]; |
| 56 | + ctx->hash[6] = blake2b_IV[6]; |
| 57 | + ctx->hash[7] = blake2b_IV[7]; |
| 58 | +} |
| 59 | + |
| 60 | +#define G(r,i,a,b,c,d) \ |
| 61 | + do { \ |
| 62 | + a = a + b + m[blake2b_sigma[r][2*i+0]]; \ |
| 63 | + d = ROTR64(d ^ a, 32); \ |
| 64 | + c = c + d; \ |
| 65 | + b = ROTR64(b ^ c, 24); \ |
| 66 | + a = a + b + m[blake2b_sigma[r][2*i+1]]; \ |
| 67 | + d = ROTR64(d ^ a, 16); \ |
| 68 | + c = c + d; \ |
| 69 | + b = ROTR64(b ^ c, 63); \ |
| 70 | + } while(0) |
| 71 | + |
| 72 | +#define ROUND(r) \ |
| 73 | + do { \ |
| 74 | + G(r,0,v[0],v[4],v[ 8],v[12]); \ |
| 75 | + G(r,1,v[1],v[5],v[ 9],v[13]); \ |
| 76 | + G(r,2,v[2],v[6],v[10],v[14]); \ |
| 77 | + G(r,3,v[3],v[7],v[11],v[15]); \ |
| 78 | + G(r,4,v[0],v[5],v[10],v[15]); \ |
| 79 | + G(r,5,v[1],v[6],v[11],v[12]); \ |
| 80 | + G(r,6,v[2],v[7],v[ 8],v[13]); \ |
| 81 | + G(r,7,v[3],v[4],v[ 9],v[14]); \ |
| 82 | + } while(0) |
| 83 | + |
| 84 | +static void rhash_blake2b_process_block(blake2b_ctx* ctx, const uint64_t* m, uint64_t finalization_flag) |
| 85 | +{ |
| 86 | + uint64_t v[16]; |
| 87 | + size_t i; |
| 88 | + |
| 89 | + memcpy(v, ctx->hash, sizeof(uint64_t) * 8); |
| 90 | + v[ 8] = blake2b_IV[0]; |
| 91 | + v[ 9] = blake2b_IV[1]; |
| 92 | + v[10] = blake2b_IV[2]; |
| 93 | + v[11] = blake2b_IV[3]; |
| 94 | + v[12] = blake2b_IV[4] ^ ctx->length; // length correction |
| 95 | + v[13] = blake2b_IV[5]; |
| 96 | + v[14] = blake2b_IV[6] ^ finalization_flag; |
| 97 | + v[15] = blake2b_IV[7]; |
| 98 | + |
| 99 | + ROUND(0); |
| 100 | + ROUND(1); |
| 101 | + ROUND(2); |
| 102 | + ROUND(3); |
| 103 | + ROUND(4); |
| 104 | + ROUND(5); |
| 105 | + ROUND(6); |
| 106 | + ROUND(7); |
| 107 | + ROUND(8); |
| 108 | + ROUND(9); |
| 109 | + ROUND(10); |
| 110 | + ROUND(11); |
| 111 | + |
| 112 | + for(i = 0; i < 8; ++i) |
| 113 | + ctx->hash[i] ^= v[i] ^ v[i + 8]; |
| 114 | +} |
| 115 | + |
| 116 | +void rhash_blake2b_update(blake2b_ctx* ctx, const unsigned char* msg, size_t size) |
| 117 | +{ |
| 118 | + if(size > 0) |
| 119 | + { |
| 120 | + size_t index = (size_t)ctx->length & 127; |
| 121 | + if(index) |
| 122 | + { |
| 123 | + size_t rest = blake2b_block_size - index; |
| 124 | + if (size > rest) { |
| 125 | + le64_copy(ctx->message, index, msg, rest); /* fill the block */ |
| 126 | + |
| 127 | + /* process the block */ |
| 128 | + size -= rest; |
| 129 | + msg += rest; |
| 130 | + ctx->length += rest; |
| 131 | + index = 0; |
| 132 | + rhash_blake2b_process_block(ctx, ctx->message, I64(0)); |
| 133 | + } |
| 134 | + } else if (ctx->length) { |
| 135 | + rhash_blake2b_process_block(ctx, ctx->message, I64(0)); |
| 136 | + } |
| 137 | + while(size > blake2b_block_size) { |
| 138 | + uint64_t* aligned_message_block; |
| 139 | + if (IS_LITTLE_ENDIAN && IS_ALIGNED_64(msg)) { |
| 140 | + aligned_message_block = (uint64_t*)msg; |
| 141 | + } else { |
| 142 | + le64_copy(ctx->message, 0, msg, blake2b_block_size); |
| 143 | + aligned_message_block = ctx->message; |
| 144 | + } |
| 145 | + size -= blake2b_block_size; |
| 146 | + msg += blake2b_block_size; |
| 147 | + ctx->length += blake2b_block_size; |
| 148 | + rhash_blake2b_process_block(ctx, aligned_message_block, I64(0)); |
| 149 | + } |
| 150 | + le64_copy(ctx->message, index, msg, size); /* save leftovers */ |
| 151 | + ctx->length += size; |
| 152 | + } |
| 153 | +} |
| 154 | + |
| 155 | +void rhash_blake2b_final(blake2b_ctx* ctx, unsigned char *result) |
| 156 | +{ |
| 157 | + size_t length = (size_t)ctx->length & 127; |
| 158 | + if (length) |
| 159 | + { |
| 160 | + /* pad the message with zeros */ |
| 161 | + size_t index = length >> 3; |
| 162 | + size_t shift = (length & 7) * 8; |
| 163 | + ctx->message[index] &= ~(I64(0xFFFFFFFFFFFFFFFF) << shift); |
| 164 | + for(index++; index < 16; index++) |
| 165 | + ctx->message[index] = 0; |
| 166 | + } |
| 167 | + rhash_blake2b_process_block(ctx, ctx->message, I64(0xFFFFFFFFFFFFFFFF)); |
| 168 | + |
| 169 | + /* convert hash state to result bytes */ |
| 170 | + le64_copy(result, 0, ctx->hash, blake2b_hash_size); |
| 171 | +} |
0 commit comments