1 /*
2 BLAKE2 reference source code package - optimized C implementations
3
4 Copyright 2012, Samuel Neves <sneves@dei.uc.pt>. You may use this under the
5 terms of the CC0, the OpenSSL Licence, or the Apache Public License 2.0, at
6 your option. The terms of these licenses can be found at:
7
8 - CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0
9 - OpenSSL license : https://www.openssl.org/source/license.html
10 - Apache 2.0 : http://www.apache.org/licenses/LICENSE-2.0
11
12 More information about the BLAKE2 hash function can be found at
13 https://blake2.net.
14 */
15
16 #include <stdint.h>
17 #include <string.h>
18 #include <stdio.h>
19
20 #include "blake2.h"
21 #include "blake2-impl.h"
22
23 #include "blake2-config.h"
24
25
26 #include <emmintrin.h>
27 #if defined(HAVE_SSSE3)
28 #include <tmmintrin.h>
29 #endif
30 #if defined(HAVE_SSE41)
31 #include <smmintrin.h>
32 #endif
33 #if defined(HAVE_AVX)
34 #include <immintrin.h>
35 #endif
36 #if defined(HAVE_XOP)
37 #include <x86intrin.h>
38 #endif
39
40 #include "blake2s-round.h"
41
42 static const uint32_t blake2s_IV[8] =
43 {
44 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
45 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
46 };
47
48 static const uint8_t blake2s_sigma[10][16] =
49 {
50 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
51 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
52 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
53 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
54 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
55 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
56 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
57 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
58 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
59 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,
60 };
61
62
63 /* Some helper functions, not necessarily useful */
blake2s_set_lastnode(blake2s_state * S)64 BLAKE2_LOCAL_INLINE(int) blake2s_set_lastnode( blake2s_state *S )
65 {
66 S->f[1] = -1;
67 return 0;
68 }
69
blake2s_clear_lastnode(blake2s_state * S)70 BLAKE2_LOCAL_INLINE(int) blake2s_clear_lastnode( blake2s_state *S )
71 {
72 S->f[1] = 0;
73 return 0;
74 }
75
blake2s_is_lastblock(const blake2s_state * S)76 BLAKE2_LOCAL_INLINE(int) blake2s_is_lastblock( const blake2s_state *S )
77 {
78 return S->f[0] != 0;
79 }
80
blake2s_set_lastblock(blake2s_state * S)81 BLAKE2_LOCAL_INLINE(int) blake2s_set_lastblock( blake2s_state *S )
82 {
83 if( S->last_node ) blake2s_set_lastnode( S );
84
85 S->f[0] = -1;
86 return 0;
87 }
88
blake2s_clear_lastblock(blake2s_state * S)89 BLAKE2_LOCAL_INLINE(int) blake2s_clear_lastblock( blake2s_state *S )
90 {
91 if( S->last_node ) blake2s_clear_lastnode( S );
92
93 S->f[0] = 0;
94 return 0;
95 }
96
blake2s_increment_counter(blake2s_state * S,const uint32_t inc)97 BLAKE2_LOCAL_INLINE(int) blake2s_increment_counter( blake2s_state *S, const uint32_t inc )
98 {
99 uint64_t t = ( ( uint64_t )S->t[1] << 32 ) | S->t[0];
100 t += inc;
101 S->t[0] = ( uint32_t )( t >> 0 );
102 S->t[1] = ( uint32_t )( t >> 32 );
103 return 0;
104 }
105
106
107 /* Parameter-related functions */
blake2s_param_set_digest_length(blake2s_param * P,const uint8_t digest_length)108 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_digest_length( blake2s_param *P, const uint8_t digest_length )
109 {
110 P->digest_length = digest_length;
111 return 0;
112 }
113
blake2s_param_set_fanout(blake2s_param * P,const uint8_t fanout)114 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_fanout( blake2s_param *P, const uint8_t fanout )
115 {
116 P->fanout = fanout;
117 return 0;
118 }
119
blake2s_param_set_max_depth(blake2s_param * P,const uint8_t depth)120 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_max_depth( blake2s_param *P, const uint8_t depth )
121 {
122 P->depth = depth;
123 return 0;
124 }
125
blake2s_param_set_leaf_length(blake2s_param * P,const uint32_t leaf_length)126 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_leaf_length( blake2s_param *P, const uint32_t leaf_length )
127 {
128 P->leaf_length = leaf_length;
129 return 0;
130 }
131
blake2s_param_set_node_offset(blake2s_param * P,const uint64_t node_offset)132 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_node_offset( blake2s_param *P, const uint64_t node_offset )
133 {
134 store48( P->node_offset, node_offset );
135 return 0;
136 }
137
blake2s_param_set_node_depth(blake2s_param * P,const uint8_t node_depth)138 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_node_depth( blake2s_param *P, const uint8_t node_depth )
139 {
140 P->node_depth = node_depth;
141 return 0;
142 }
143
blake2s_param_set_inner_length(blake2s_param * P,const uint8_t inner_length)144 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_inner_length( blake2s_param *P, const uint8_t inner_length )
145 {
146 P->inner_length = inner_length;
147 return 0;
148 }
149
blake2s_param_set_salt(blake2s_param * P,const uint8_t salt[BLAKE2S_SALTBYTES])150 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_salt( blake2s_param *P, const uint8_t salt[BLAKE2S_SALTBYTES] )
151 {
152 memcpy( P->salt, salt, BLAKE2S_SALTBYTES );
153 return 0;
154 }
155
blake2s_param_set_personal(blake2s_param * P,const uint8_t personal[BLAKE2S_PERSONALBYTES])156 BLAKE2_LOCAL_INLINE(int) blake2s_param_set_personal( blake2s_param *P, const uint8_t personal[BLAKE2S_PERSONALBYTES] )
157 {
158 memcpy( P->personal, personal, BLAKE2S_PERSONALBYTES );
159 return 0;
160 }
161
blake2s_init0(blake2s_state * S)162 BLAKE2_LOCAL_INLINE(int) blake2s_init0( blake2s_state *S )
163 {
164 int i;
165 memset( S, 0, sizeof( blake2s_state ) );
166
167 for( i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i];
168
169 return 0;
170 }
171
172 /* init2 xors IV with input parameter block */
blake2s_init_param(blake2s_state * S,const blake2s_param * P)173 int blake2s_init_param( blake2s_state *S, const blake2s_param *P )
174 {
175 /*blake2s_init0( S ); */
176 const uint8_t * v = ( const uint8_t * )( blake2s_IV );
177 const uint8_t * p = ( const uint8_t * )( P );
178 uint8_t * h = ( uint8_t * )( S->h );
179 int i;
180 /* IV XOR ParamBlock */
181 memset( S, 0, sizeof( blake2s_state ) );
182
183 for( i = 0; i < BLAKE2S_OUTBYTES; ++i ) h[i] = v[i] ^ p[i];
184
185 return 0;
186 }
187
188
189 /* Some sort of default parameter block initialization, for sequential blake2s */
blake2s_init(blake2s_state * S,const uint8_t outlen)190 int blake2s_init( blake2s_state *S, const uint8_t outlen )
191 {
192 const blake2s_param P =
193 {
194 outlen,
195 0,
196 1,
197 1,
198 0,
199 {0},
200 0,
201 0,
202 {0},
203 {0}
204 };
205 /* Move interval verification here? */
206 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
207 return blake2s_init_param( S, &P );
208 }
209
210
blake2s_init_key(blake2s_state * S,const uint8_t outlen,const void * key,const uint8_t keylen)211 int blake2s_init_key( blake2s_state *S, const uint8_t outlen, const void *key, const uint8_t keylen )
212 {
213 const blake2s_param P =
214 {
215 outlen,
216 keylen,
217 1,
218 1,
219 0,
220 {0},
221 0,
222 0,
223 {0},
224 {0}
225 };
226
227 /* Move interval verification here? */
228 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
229
230 if ( ( !key ) || ( !keylen ) || keylen > BLAKE2S_KEYBYTES ) return -1;
231
232 if( blake2s_init_param( S, &P ) < 0 )
233 return -1;
234
235 {
236 uint8_t block[BLAKE2S_BLOCKBYTES];
237 memset( block, 0, BLAKE2S_BLOCKBYTES );
238 memcpy( block, key, keylen );
239 blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
240 secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
241 }
242 return 0;
243 }
244
245
blake2s_compress(blake2s_state * S,const uint8_t block[BLAKE2S_BLOCKBYTES])246 BLAKE2_LOCAL_INLINE(int) blake2s_compress( blake2s_state *S, const uint8_t block[BLAKE2S_BLOCKBYTES] )
247 {
248 __m128i row1, row2, row3, row4;
249 __m128i buf1, buf2, buf3, buf4;
250 #if defined(HAVE_SSE41)
251 __m128i t0, t1;
252 #if !defined(HAVE_XOP)
253 __m128i t2;
254 #endif
255 #endif
256 __m128i ff0, ff1;
257 #if defined(HAVE_SSSE3) && !defined(HAVE_XOP)
258 const __m128i r8 = _mm_set_epi8( 12, 15, 14, 13, 8, 11, 10, 9, 4, 7, 6, 5, 0, 3, 2, 1 );
259 const __m128i r16 = _mm_set_epi8( 13, 12, 15, 14, 9, 8, 11, 10, 5, 4, 7, 6, 1, 0, 3, 2 );
260 #endif
261 #if defined(HAVE_SSE41)
262 const __m128i m0 = LOADU( block + 00 );
263 const __m128i m1 = LOADU( block + 16 );
264 const __m128i m2 = LOADU( block + 32 );
265 const __m128i m3 = LOADU( block + 48 );
266 #else
267 const uint32_t m0 = ( ( uint32_t * )block )[ 0];
268 const uint32_t m1 = ( ( uint32_t * )block )[ 1];
269 const uint32_t m2 = ( ( uint32_t * )block )[ 2];
270 const uint32_t m3 = ( ( uint32_t * )block )[ 3];
271 const uint32_t m4 = ( ( uint32_t * )block )[ 4];
272 const uint32_t m5 = ( ( uint32_t * )block )[ 5];
273 const uint32_t m6 = ( ( uint32_t * )block )[ 6];
274 const uint32_t m7 = ( ( uint32_t * )block )[ 7];
275 const uint32_t m8 = ( ( uint32_t * )block )[ 8];
276 const uint32_t m9 = ( ( uint32_t * )block )[ 9];
277 const uint32_t m10 = ( ( uint32_t * )block )[10];
278 const uint32_t m11 = ( ( uint32_t * )block )[11];
279 const uint32_t m12 = ( ( uint32_t * )block )[12];
280 const uint32_t m13 = ( ( uint32_t * )block )[13];
281 const uint32_t m14 = ( ( uint32_t * )block )[14];
282 const uint32_t m15 = ( ( uint32_t * )block )[15];
283 #endif
284 row1 = ff0 = LOADU( &S->h[0] );
285 row2 = ff1 = LOADU( &S->h[4] );
286 row3 = _mm_setr_epi32( 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A );
287 row4 = _mm_xor_si128( _mm_setr_epi32( 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 ), LOADU( &S->t[0] ) );
288 ROUND( 0 );
289 ROUND( 1 );
290 ROUND( 2 );
291 ROUND( 3 );
292 ROUND( 4 );
293 ROUND( 5 );
294 ROUND( 6 );
295 ROUND( 7 );
296 ROUND( 8 );
297 ROUND( 9 );
298 STOREU( &S->h[0], _mm_xor_si128( ff0, _mm_xor_si128( row1, row3 ) ) );
299 STOREU( &S->h[4], _mm_xor_si128( ff1, _mm_xor_si128( row2, row4 ) ) );
300 return 0;
301 }
302
303 /* inlen now in bytes */
blake2s_update(blake2s_state * S,const uint8_t * in,uint64_t inlen)304 int blake2s_update( blake2s_state *S, const uint8_t *in, uint64_t inlen )
305 {
306 while( inlen > 0 )
307 {
308 size_t left = S->buflen;
309 size_t fill = 2 * BLAKE2S_BLOCKBYTES - left;
310
311 if( inlen > fill )
312 {
313 memcpy( S->buf + left, in, fill ); /* Fill buffer */
314 S->buflen += fill;
315 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
316 blake2s_compress( S, S->buf ); /* Compress */
317 memcpy( S->buf, S->buf + BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES ); /* Shift buffer left */
318 S->buflen -= BLAKE2S_BLOCKBYTES;
319 in += fill;
320 inlen -= fill;
321 }
322 else /* inlen <= fill */
323 {
324 memcpy( S->buf + left, in, inlen );
325 S->buflen += inlen; /* Be lazy, do not compress */
326 in += inlen;
327 inlen -= inlen;
328 }
329 }
330
331 return 0;
332 }
333
334 /* Is this correct? */
blake2s_final(blake2s_state * S,uint8_t * out,uint8_t outlen)335 int blake2s_final( blake2s_state *S, uint8_t *out, uint8_t outlen )
336 {
337 uint8_t buffer[BLAKE2S_OUTBYTES] = {0};
338 int i;
339
340 if( outlen > BLAKE2S_OUTBYTES )
341 return -1;
342
343 if( blake2s_is_lastblock( S ) )
344 return -1;
345
346 if( S->buflen > BLAKE2S_BLOCKBYTES )
347 {
348 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
349 blake2s_compress( S, S->buf );
350 S->buflen -= BLAKE2S_BLOCKBYTES;
351 memmove( S->buf, S->buf + BLAKE2S_BLOCKBYTES, S->buflen );
352 }
353
354 blake2s_increment_counter( S, ( uint32_t )S->buflen );
355 blake2s_set_lastblock( S );
356 memset( S->buf + S->buflen, 0, 2 * BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */
357 blake2s_compress( S, S->buf );
358
359 for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
360 store32( buffer + sizeof( S->h[i] ) * i, S->h[i] );
361
362 memcpy( out, buffer, outlen );
363 return 0;
364 }
365
366 /* inlen, at least, should be uint64_t. Others can be size_t. */
blake2s(uint8_t * out,const void * in,const void * key,const uint8_t outlen,const uint64_t inlen,uint8_t keylen)367 int blake2s( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen )
368 {
369 blake2s_state S[1];
370
371 /* Verify parameters */
372 if ( NULL == in && inlen > 0 ) return -1;
373
374 if ( NULL == out ) return -1;
375
376 if ( NULL == key && keylen > 0) return -1;
377
378 if( !outlen || outlen > BLAKE2S_OUTBYTES ) return -1;
379
380 if( keylen > BLAKE2S_KEYBYTES ) return -1;
381
382 if( keylen > 0 )
383 {
384 if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
385 }
386 else
387 {
388 if( blake2s_init( S, outlen ) < 0 ) return -1;
389 }
390
391 blake2s_update( S, ( const uint8_t * )in, inlen );
392 blake2s_final( S, out, outlen );
393 return 0;
394 }
395
396 #if defined(SUPERCOP)
crypto_hash(unsigned char * out,unsigned char * in,unsigned long long inlen)397 int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen )
398 {
399 return blake2s( out, in, NULL, BLAKE2S_OUTBYTES, inlen, 0 );
400 }
401 #endif
402
403 #if defined(BLAKE2S_SELFTEST)
404 #include <string.h>
405 #include "blake2-kat.h"
main(int argc,char ** argv)406 int main( int argc, char **argv )
407 {
408 uint8_t key[BLAKE2S_KEYBYTES];
409 uint8_t buf[KAT_LENGTH];
410 size_t i;
411
412 for( i = 0; i < BLAKE2S_KEYBYTES; ++i )
413 key[i] = ( uint8_t )i;
414
415 for( i = 0; i < KAT_LENGTH; ++i )
416 buf[i] = ( uint8_t )i;
417
418 for( i = 0; i < KAT_LENGTH; ++i )
419 {
420 uint8_t hash[BLAKE2S_OUTBYTES];
421
422 if( blake2s( hash, buf, key, BLAKE2S_OUTBYTES, i, BLAKE2S_KEYBYTES ) < 0 ||
423 0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) )
424 {
425 puts( "error" );
426 return -1;
427 }
428 }
429
430 puts( "ok" );
431 return 0;
432 }
433 #endif
434
435
436