1 /* 2 BLAKE2 reference source code package - optimized C implementations 3 4 Copyright 2012, Samuel Neves <sneves (at) dei.uc.pt>. You may use this under the 5 terms of the CC0, the OpenSSL Licence, or the Apache Public License 2.0, at 6 your option. The terms of these licenses can be found at: 7 8 - CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0 9 - OpenSSL license : https://www.openssl.org/source/license.html 10 - Apache 2.0 : http://www.apache.org/licenses/LICENSE-2.0 11 12 More information about the BLAKE2 hash function can be found at 13 https://blake2.net. 14 */ 15 16 #include <stdint.h> 17 #include <string.h> 18 #include <stdio.h> 19 20 #include "blake2.h" 21 #include "blake2-impl.h" 22 23 #include "blake2-config.h" 24 25 #ifdef _MSC_VER 26 #include <intrin.h> /* for _mm_set_epi64x */ 27 #endif 28 #include <emmintrin.h> 29 #if defined(HAVE_SSSE3) 30 #include <tmmintrin.h> 31 #endif 32 #if defined(HAVE_SSE41) 33 #include <smmintrin.h> 34 #endif 35 #if defined(HAVE_AVX) 36 #include <immintrin.h> 37 #endif 38 #if defined(HAVE_XOP) 39 #include <x86intrin.h> 40 #endif 41 42 #include "blake2b-round.h" 43 44 static const uint64_t blake2b_IV[8] = 45 { 46 0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL, 47 0x3c6ef372fe94f82bULL, 0xa54ff53a5f1d36f1ULL, 48 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL, 49 0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL 50 }; 51 52 static const uint8_t blake2b_sigma[12][16] = 53 { 54 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } , 55 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } , 56 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } , 57 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } , 58 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } , 59 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } , 60 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } , 61 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } , 62 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } , 63 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } , 64 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } , 65 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } 66 }; 67 68 69 /* Some helper functions, not necessarily useful */ 70 BLAKE2_LOCAL_INLINE(int) blake2b_set_lastnode( blake2b_state *S ) 71 { 72 S->f[1] = -1; 73 return 0; 74 } 75 76 BLAKE2_LOCAL_INLINE(int) blake2b_clear_lastnode( blake2b_state *S ) 77 { 78 S->f[1] = 0; 79 return 0; 80 } 81 82 BLAKE2_LOCAL_INLINE(int) blake2b_is_lastblock( const blake2b_state *S ) 83 { 84 return S->f[0] != 0; 85 } 86 87 BLAKE2_LOCAL_INLINE(int) blake2b_set_lastblock( blake2b_state *S ) 88 { 89 if( S->last_node ) blake2b_set_lastnode( S ); 90 91 S->f[0] = -1; 92 return 0; 93 } 94 95 BLAKE2_LOCAL_INLINE(int) blake2b_clear_lastblock( blake2b_state *S ) 96 { 97 if( S->last_node ) blake2b_clear_lastnode( S ); 98 99 S->f[0] = 0; 100 return 0; 101 } 102 103 104 BLAKE2_LOCAL_INLINE(int) blake2b_increment_counter( blake2b_state *S, const uint64_t inc ) 105 { 106 #if __x86_64__ 107 /* ADD/ADC chain */ 108 __uint128_t t = ( ( __uint128_t )S->t[1] << 64 ) | S->t[0]; 109 t += inc; 110 S->t[0] = ( uint64_t )( t >> 0 ); 111 S->t[1] = ( uint64_t )( t >> 64 ); 112 #else 113 S->t[0] += inc; 114 S->t[1] += ( S->t[0] < inc ); 115 #endif 116 return 0; 117 } 118 119 120 /* Parameter-related functions */ 121 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_digest_length( blake2b_param *P, const uint8_t digest_length ) 122 { 123 P->digest_length = digest_length; 124 return 0; 125 } 126 127 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_fanout( blake2b_param *P, const uint8_t fanout ) 128 { 129 P->fanout = fanout; 130 return 0; 131 } 132 133 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_max_depth( blake2b_param *P, const uint8_t depth ) 134 { 135 P->depth = depth; 136 return 0; 137 } 138 139 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_leaf_length( blake2b_param *P, const uint32_t leaf_length ) 140 { 141 P->leaf_length = leaf_length; 142 return 0; 143 } 144 145 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_node_offset( blake2b_param *P, const uint64_t node_offset ) 146 { 147 P->node_offset = node_offset; 148 return 0; 149 } 150 151 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_node_depth( blake2b_param *P, const uint8_t node_depth ) 152 { 153 P->node_depth = node_depth; 154 return 0; 155 } 156 157 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_inner_length( blake2b_param *P, const uint8_t inner_length ) 158 { 159 P->inner_length = inner_length; 160 return 0; 161 } 162 163 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_salt( blake2b_param *P, const uint8_t salt[BLAKE2B_SALTBYTES] ) 164 { 165 memcpy( P->salt, salt, BLAKE2B_SALTBYTES ); 166 return 0; 167 } 168 169 BLAKE2_LOCAL_INLINE(int) blake2b_param_set_personal( blake2b_param *P, const uint8_t personal[BLAKE2B_PERSONALBYTES] ) 170 { 171 memcpy( P->personal, personal, BLAKE2B_PERSONALBYTES ); 172 return 0; 173 } 174 175 BLAKE2_LOCAL_INLINE(int) blake2b_init0( blake2b_state *S ) 176 { 177 int i; 178 memset( S, 0, sizeof( blake2b_state ) ); 179 180 for( i = 0; i < 8; ++i ) S->h[i] = blake2b_IV[i]; 181 182 return 0; 183 } 184 185 /* init xors IV with input parameter block */ 186 int blake2b_init_param( blake2b_state *S, const blake2b_param *P ) 187 { 188 /*blake2b_init0( S ); */ 189 const uint8_t * v = ( const uint8_t * )( blake2b_IV ); 190 const uint8_t * p = ( const uint8_t * )( P ); 191 uint8_t * h = ( uint8_t * )( S->h ); 192 int i; 193 /* IV XOR ParamBlock */ 194 memset( S, 0, sizeof( blake2b_state ) ); 195 196 for( i = 0; i < BLAKE2B_OUTBYTES; ++i ) h[i] = v[i] ^ p[i]; 197 198 return 0; 199 } 200 201 202 /* Some sort of default parameter block initialization, for sequential blake2b */ 203 int blake2b_init( blake2b_state *S, const uint8_t outlen ) 204 { 205 const blake2b_param P = 206 { 207 outlen, 208 0, 209 1, 210 1, 211 0, 212 0, 213 0, 214 0, 215 {0}, 216 {0}, 217 {0} 218 }; 219 220 if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return -1; 221 222 return blake2b_init_param( S, &P ); 223 } 224 225 int blake2b_init_key( blake2b_state *S, const uint8_t outlen, const void *key, const uint8_t keylen ) 226 { 227 const blake2b_param P = 228 { 229 outlen, 230 keylen, 231 1, 232 1, 233 0, 234 0, 235 0, 236 0, 237 {0}, 238 {0}, 239 {0} 240 }; 241 242 if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return -1; 243 244 if ( ( !keylen ) || keylen > BLAKE2B_KEYBYTES ) return -1; 245 246 if( blake2b_init_param( S, &P ) < 0 ) 247 return 0; 248 249 { 250 uint8_t block[BLAKE2B_BLOCKBYTES]; 251 memset( block, 0, BLAKE2B_BLOCKBYTES ); 252 memcpy( block, key, keylen ); 253 blake2b_update( S, block, BLAKE2B_BLOCKBYTES ); 254 secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */ 255 } 256 return 0; 257 } 258 259 BLAKE2_LOCAL_INLINE(int) blake2b_compress( blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES] ) 260 { 261 __m128i row1l, row1h; 262 __m128i row2l, row2h; 263 __m128i row3l, row3h; 264 __m128i row4l, row4h; 265 __m128i b0, b1; 266 __m128i t0, t1; 267 #if defined(HAVE_SSSE3) && !defined(HAVE_XOP) 268 const __m128i r16 = _mm_setr_epi8( 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9 ); 269 const __m128i r24 = _mm_setr_epi8( 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10 ); 270 #endif 271 #if defined(HAVE_SSE41) 272 const __m128i m0 = LOADU( block + 00 ); 273 const __m128i m1 = LOADU( block + 16 ); 274 const __m128i m2 = LOADU( block + 32 ); 275 const __m128i m3 = LOADU( block + 48 ); 276 const __m128i m4 = LOADU( block + 64 ); 277 const __m128i m5 = LOADU( block + 80 ); 278 const __m128i m6 = LOADU( block + 96 ); 279 const __m128i m7 = LOADU( block + 112 ); 280 #else 281 const uint64_t m0 = ( ( uint64_t * )block )[ 0]; 282 const uint64_t m1 = ( ( uint64_t * )block )[ 1]; 283 const uint64_t m2 = ( ( uint64_t * )block )[ 2]; 284 const uint64_t m3 = ( ( uint64_t * )block )[ 3]; 285 const uint64_t m4 = ( ( uint64_t * )block )[ 4]; 286 const uint64_t m5 = ( ( uint64_t * )block )[ 5]; 287 const uint64_t m6 = ( ( uint64_t * )block )[ 6]; 288 const uint64_t m7 = ( ( uint64_t * )block )[ 7]; 289 const uint64_t m8 = ( ( uint64_t * )block )[ 8]; 290 const uint64_t m9 = ( ( uint64_t * )block )[ 9]; 291 const uint64_t m10 = ( ( uint64_t * )block )[10]; 292 const uint64_t m11 = ( ( uint64_t * )block )[11]; 293 const uint64_t m12 = ( ( uint64_t * )block )[12]; 294 const uint64_t m13 = ( ( uint64_t * )block )[13]; 295 const uint64_t m14 = ( ( uint64_t * )block )[14]; 296 const uint64_t m15 = ( ( uint64_t * )block )[15]; 297 #endif 298 row1l = LOADU( &S->h[0] ); 299 row1h = LOADU( &S->h[2] ); 300 row2l = LOADU( &S->h[4] ); 301 row2h = LOADU( &S->h[6] ); 302 row3l = LOADU( &blake2b_IV[0] ); 303 row3h = LOADU( &blake2b_IV[2] ); 304 row4l = _mm_xor_si128( LOADU( &blake2b_IV[4] ), LOADU( &S->t[0] ) ); 305 row4h = _mm_xor_si128( LOADU( &blake2b_IV[6] ), LOADU( &S->f[0] ) ); 306 ROUND( 0 ); 307 ROUND( 1 ); 308 ROUND( 2 ); 309 ROUND( 3 ); 310 ROUND( 4 ); 311 ROUND( 5 ); 312 ROUND( 6 ); 313 ROUND( 7 ); 314 ROUND( 8 ); 315 ROUND( 9 ); 316 ROUND( 10 ); 317 ROUND( 11 ); 318 row1l = _mm_xor_si128( row3l, row1l ); 319 row1h = _mm_xor_si128( row3h, row1h ); 320 STOREU( &S->h[0], _mm_xor_si128( LOADU( &S->h[0] ), row1l ) ); 321 STOREU( &S->h[2], _mm_xor_si128( LOADU( &S->h[2] ), row1h ) ); 322 row2l = _mm_xor_si128( row4l, row2l ); 323 row2h = _mm_xor_si128( row4h, row2h ); 324 STOREU( &S->h[4], _mm_xor_si128( LOADU( &S->h[4] ), row2l ) ); 325 STOREU( &S->h[6], _mm_xor_si128( LOADU( &S->h[6] ), row2h ) ); 326 return 0; 327 } 328 329 330 int blake2b_update( blake2b_state *S, const uint8_t *in, uint64_t inlen ) 331 { 332 while( inlen > 0 ) 333 { 334 size_t left = S->buflen; 335 size_t fill = 2 * BLAKE2B_BLOCKBYTES - left; 336 337 if( inlen > fill ) 338 { 339 memcpy( S->buf + left, in, fill ); /* Fill buffer */ 340 S->buflen += fill; 341 blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES ); 342 blake2b_compress( S, S->buf ); /* Compress */ 343 memcpy( S->buf, S->buf + BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES ); /* Shift buffer left */ 344 S->buflen -= BLAKE2B_BLOCKBYTES; 345 in += fill; 346 inlen -= fill; 347 } 348 else /* inlen <= fill */ 349 { 350 memcpy( S->buf + left, in, inlen ); 351 S->buflen += inlen; /* Be lazy, do not compress */ 352 in += inlen; 353 inlen -= inlen; 354 } 355 } 356 357 return 0; 358 } 359 360 361 int blake2b_final( blake2b_state *S, uint8_t *out, uint8_t outlen ) 362 { 363 if( outlen > BLAKE2B_OUTBYTES ) 364 return -1; 365 366 if( blake2b_is_lastblock( S ) ) 367 return -1; 368 369 if( S->buflen > BLAKE2B_BLOCKBYTES ) 370 { 371 blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES ); 372 blake2b_compress( S, S->buf ); 373 S->buflen -= BLAKE2B_BLOCKBYTES; 374 memmove( S->buf, S->buf + BLAKE2B_BLOCKBYTES, S->buflen ); 375 } 376 377 blake2b_increment_counter( S, S->buflen ); 378 blake2b_set_lastblock( S ); 379 memset( S->buf + S->buflen, 0, 2 * BLAKE2B_BLOCKBYTES - S->buflen ); /* Padding */ 380 blake2b_compress( S, S->buf ); 381 memcpy( out, &S->h[0], outlen ); 382 return 0; 383 } 384 385 386 int blake2b( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen ) 387 { 388 blake2b_state S[1]; 389 390 /* Verify parameters */ 391 if ( NULL == in && inlen > 0 ) return -1; 392 393 if ( NULL == out ) return -1; 394 395 if( NULL == key && keylen > 0 ) return -1; 396 397 if( !outlen || outlen > BLAKE2B_OUTBYTES ) return -1; 398 399 if( keylen > BLAKE2B_KEYBYTES ) return -1; 400 401 if( keylen ) 402 { 403 if( blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1; 404 } 405 else 406 { 407 if( blake2b_init( S, outlen ) < 0 ) return -1; 408 } 409 410 blake2b_update( S, ( const uint8_t * )in, inlen ); 411 blake2b_final( S, out, outlen ); 412 return 0; 413 } 414 415 #if defined(SUPERCOP) 416 int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen ) 417 { 418 return blake2b( out, in, NULL, BLAKE2B_OUTBYTES, inlen, 0 ); 419 } 420 #endif 421 422 #if defined(BLAKE2B_SELFTEST) 423 #include <string.h> 424 #include "blake2-kat.h" 425 int main( int argc, char **argv ) 426 { 427 uint8_t key[BLAKE2B_KEYBYTES]; 428 uint8_t buf[KAT_LENGTH]; 429 size_t i; 430 431 for( i = 0; i < BLAKE2B_KEYBYTES; ++i ) 432 key[i] = ( uint8_t )i; 433 434 for( i = 0; i < KAT_LENGTH; ++i ) 435 buf[i] = ( uint8_t )i; 436 437 for( i = 0; i < KAT_LENGTH; ++i ) 438 { 439 uint8_t hash[BLAKE2B_OUTBYTES]; 440 blake2b( hash, buf, key, BLAKE2B_OUTBYTES, i, BLAKE2B_KEYBYTES ); 441 442 if( 0 != memcmp( hash, blake2b_keyed_kat[i], BLAKE2B_OUTBYTES ) ) 443 { 444 puts( "error" ); 445 return -1; 446 } 447 } 448 449 puts( "ok" ); 450 return 0; 451 } 452 #endif 453 454
