1/* 2 BLAKE2 reference source code package - optimized C implementations 3 4 Copyright 2012, Samuel Neves <sneves@dei.uc.pt>. You may use this under the 5 terms of the CC0, the OpenSSL Licence, or the Apache Public License 2.0, at 6 your option. The terms of these licenses can be found at: 7 8 - CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0 9 - OpenSSL license : https://www.openssl.org/source/license.html 10 - Apache 2.0 : http://www.apache.org/licenses/LICENSE-2.0 11 12 More information about the BLAKE2 hash function can be found at 13 https://blake2.net. 14*/ 15 16#include <stdint.h> 17#include <string.h> 18#include <stdio.h> 19 20#include "blake2.h" 21#include "blake2-impl.h" 22 23#include "blake2-config.h" 24 25 26#include <emmintrin.h> 27#if defined(HAVE_SSSE3) 28#include <tmmintrin.h> 29#endif 30#if defined(HAVE_SSE41) 31#include <smmintrin.h> 32#endif 33#if defined(HAVE_AVX) 34#include <immintrin.h> 35#endif 36#if defined(HAVE_XOP) 37#include <x86intrin.h> 38#endif 39 40#include "blake2s-round.h" 41 42static const uint32_t blake2s_IV[8] = 43{ 44 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL, 45 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL 46}; 47 48static const uint8_t blake2s_sigma[10][16] = 49{ 50 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } , 51 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } , 52 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } , 53 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } , 54 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } , 55 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } , 56 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } , 57 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } , 58 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } , 59 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } , 60}; 61 62 63/* Some helper functions, not necessarily useful */ 64BLAKE2_LOCAL_INLINE(int) blake2s_set_lastnode( blake2s_state *S ) 65{ 66 S->f[1] = -1; 67 return 0; 68} 69 70BLAKE2_LOCAL_INLINE(int) blake2s_clear_lastnode( blake2s_state *S ) 71{ 72 S->f[1] = 0; 73 return 0; 74} 75 76BLAKE2_LOCAL_INLINE(int) blake2s_is_lastblock( const blake2s_state *S ) 77{ 78 return S->f[0] != 0; 79} 80 81BLAKE2_LOCAL_INLINE(int) blake2s_set_lastblock( blake2s_state *S ) 82{ 83 if( S->last_node ) blake2s_set_lastnode( S ); 84 85 S->f[0] = -1; 86 return 0; 87} 88 89BLAKE2_LOCAL_INLINE(int) blake2s_clear_lastblock( blake2s_state *S ) 90{ 91 if( S->last_node ) blake2s_clear_lastnode( S ); 92 93 S->f[0] = 0; 94 return 0; 95} 96 97BLAKE2_LOCAL_INLINE(int) blake2s_increment_counter( blake2s_state *S, const uint32_t inc ) 98{ 99 uint64_t t = ( ( uint64_t )S->t[1] << 32 ) | S->t[0]; 100 t += inc; 101 S->t[0] = ( uint32_t )( t >> 0 ); 102 S->t[1] = ( uint32_t )( t >> 32 ); 103 return 0; 104} 105 106 107/* Parameter-related functions */ 108BLAKE2_LOCAL_INLINE(int) blake2s_param_set_digest_length( blake2s_param *P, const uint8_t digest_length ) 109{ 110 P->digest_length = digest_length; 111 return 0; 112} 113 114BLAKE2_LOCAL_INLINE(int) blake2s_param_set_fanout( blake2s_param *P, const uint8_t fanout ) 115{ 116 P->fanout = fanout; 117 return 0; 118} 119 120BLAKE2_LOCAL_INLINE(int) blake2s_param_set_max_depth( blake2s_param *P, const uint8_t depth ) 121{ 122 P->depth = depth; 123 return 0; 124} 125 126BLAKE2_LOCAL_INLINE(int) blake2s_param_set_leaf_length( blake2s_param *P, const uint32_t leaf_length ) 127{ 128 P->leaf_length = leaf_length; 129 return 0; 130} 131 132BLAKE2_LOCAL_INLINE(int) blake2s_param_set_node_offset( blake2s_param *P, const uint64_t node_offset ) 133{ 134 store48( P->node_offset, node_offset ); 135 return 0; 136} 137 138BLAKE2_LOCAL_INLINE(int) blake2s_param_set_node_depth( blake2s_param *P, const uint8_t node_depth ) 139{ 140 P->node_depth = node_depth; 141 return 0; 142} 143 144BLAKE2_LOCAL_INLINE(int) blake2s_param_set_inner_length( blake2s_param *P, const uint8_t inner_length ) 145{ 146 P->inner_length = inner_length; 147 return 0; 148} 149 150BLAKE2_LOCAL_INLINE(int) blake2s_param_set_salt( blake2s_param *P, const uint8_t salt[BLAKE2S_SALTBYTES] ) 151{ 152 memcpy( P->salt, salt, BLAKE2S_SALTBYTES ); 153 return 0; 154} 155 156BLAKE2_LOCAL_INLINE(int) blake2s_param_set_personal( blake2s_param *P, const uint8_t personal[BLAKE2S_PERSONALBYTES] ) 157{ 158 memcpy( P->personal, personal, BLAKE2S_PERSONALBYTES ); 159 return 0; 160} 161 162BLAKE2_LOCAL_INLINE(int) blake2s_init0( blake2s_state *S ) 163{ 164 int i; 165 memset( S, 0, sizeof( blake2s_state ) ); 166 167 for( i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i]; 168 169 return 0; 170} 171 172/* init2 xors IV with input parameter block */ 173int blake2s_init_param( blake2s_state *S, const blake2s_param *P ) 174{ 175 /*blake2s_init0( S ); */ 176 const uint8_t * v = ( const uint8_t * )( blake2s_IV ); 177 const uint8_t * p = ( const uint8_t * )( P ); 178 uint8_t * h = ( uint8_t * )( S->h ); 179 int i; 180 /* IV XOR ParamBlock */ 181 memset( S, 0, sizeof( blake2s_state ) ); 182 183 for( i = 0; i < BLAKE2S_OUTBYTES; ++i ) h[i] = v[i] ^ p[i]; 184 185 return 0; 186} 187 188 189/* Some sort of default parameter block initialization, for sequential blake2s */ 190int blake2s_init( blake2s_state *S, const uint8_t outlen ) 191{ 192 const blake2s_param P = 193 { 194 outlen, 195 0, 196 1, 197 1, 198 0, 199 {0}, 200 0, 201 0, 202 {0}, 203 {0} 204 }; 205 /* Move interval verification here? */ 206 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1; 207 return blake2s_init_param( S, &P ); 208} 209 210 211int blake2s_init_key( blake2s_state *S, const uint8_t outlen, const void *key, const uint8_t keylen ) 212{ 213 const blake2s_param P = 214 { 215 outlen, 216 keylen, 217 1, 218 1, 219 0, 220 {0}, 221 0, 222 0, 223 {0}, 224 {0} 225 }; 226 227 /* Move interval verification here? */ 228 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1; 229 230 if ( ( !key ) || ( !keylen ) || keylen > BLAKE2S_KEYBYTES ) return -1; 231 232 if( blake2s_init_param( S, &P ) < 0 ) 233 return -1; 234 235 { 236 uint8_t block[BLAKE2S_BLOCKBYTES]; 237 memset( block, 0, BLAKE2S_BLOCKBYTES ); 238 memcpy( block, key, keylen ); 239 blake2s_update( S, block, BLAKE2S_BLOCKBYTES ); 240 secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */ 241 } 242 return 0; 243} 244 245 246BLAKE2_LOCAL_INLINE(int) blake2s_compress( blake2s_state *S, const uint8_t block[BLAKE2S_BLOCKBYTES] ) 247{ 248 __m128i row1, row2, row3, row4; 249 __m128i buf1, buf2, buf3, buf4; 250#if defined(HAVE_SSE41) 251 __m128i t0, t1; 252#if !defined(HAVE_XOP) 253 __m128i t2; 254#endif 255#endif 256 __m128i ff0, ff1; 257#if defined(HAVE_SSSE3) && !defined(HAVE_XOP) 258 const __m128i r8 = _mm_set_epi8( 12, 15, 14, 13, 8, 11, 10, 9, 4, 7, 6, 5, 0, 3, 2, 1 ); 259 const __m128i r16 = _mm_set_epi8( 13, 12, 15, 14, 9, 8, 11, 10, 5, 4, 7, 6, 1, 0, 3, 2 ); 260#endif 261#if defined(HAVE_SSE41) 262 const __m128i m0 = LOADU( block + 00 ); 263 const __m128i m1 = LOADU( block + 16 ); 264 const __m128i m2 = LOADU( block + 32 ); 265 const __m128i m3 = LOADU( block + 48 ); 266#else 267 const uint32_t m0 = ( ( uint32_t * )block )[ 0]; 268 const uint32_t m1 = ( ( uint32_t * )block )[ 1]; 269 const uint32_t m2 = ( ( uint32_t * )block )[ 2]; 270 const uint32_t m3 = ( ( uint32_t * )block )[ 3]; 271 const uint32_t m4 = ( ( uint32_t * )block )[ 4]; 272 const uint32_t m5 = ( ( uint32_t * )block )[ 5]; 273 const uint32_t m6 = ( ( uint32_t * )block )[ 6]; 274 const uint32_t m7 = ( ( uint32_t * )block )[ 7]; 275 const uint32_t m8 = ( ( uint32_t * )block )[ 8]; 276 const uint32_t m9 = ( ( uint32_t * )block )[ 9]; 277 const uint32_t m10 = ( ( uint32_t * )block )[10]; 278 const uint32_t m11 = ( ( uint32_t * )block )[11]; 279 const uint32_t m12 = ( ( uint32_t * )block )[12]; 280 const uint32_t m13 = ( ( uint32_t * )block )[13]; 281 const uint32_t m14 = ( ( uint32_t * )block )[14]; 282 const uint32_t m15 = ( ( uint32_t * )block )[15]; 283#endif 284 row1 = ff0 = LOADU( &S->h[0] ); 285 row2 = ff1 = LOADU( &S->h[4] ); 286 row3 = _mm_setr_epi32( 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A ); 287 row4 = _mm_xor_si128( _mm_setr_epi32( 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 ), LOADU( &S->t[0] ) ); 288 ROUND( 0 ); 289 ROUND( 1 ); 290 ROUND( 2 ); 291 ROUND( 3 ); 292 ROUND( 4 ); 293 ROUND( 5 ); 294 ROUND( 6 ); 295 ROUND( 7 ); 296 ROUND( 8 ); 297 ROUND( 9 ); 298 STOREU( &S->h[0], _mm_xor_si128( ff0, _mm_xor_si128( row1, row3 ) ) ); 299 STOREU( &S->h[4], _mm_xor_si128( ff1, _mm_xor_si128( row2, row4 ) ) ); 300 return 0; 301} 302 303/* inlen now in bytes */ 304int blake2s_update( blake2s_state *S, const uint8_t *in, uint64_t inlen ) 305{ 306 while( inlen > 0 ) 307 { 308 size_t left = S->buflen; 309 size_t fill = 2 * BLAKE2S_BLOCKBYTES - left; 310 311 if( inlen > fill ) 312 { 313 memcpy( S->buf + left, in, fill ); /* Fill buffer */ 314 S->buflen += fill; 315 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES ); 316 blake2s_compress( S, S->buf ); /* Compress */ 317 memcpy( S->buf, S->buf + BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES ); /* Shift buffer left */ 318 S->buflen -= BLAKE2S_BLOCKBYTES; 319 in += fill; 320 inlen -= fill; 321 } 322 else /* inlen <= fill */ 323 { 324 memcpy( S->buf + left, in, inlen ); 325 S->buflen += inlen; /* Be lazy, do not compress */ 326 in += inlen; 327 inlen -= inlen; 328 } 329 } 330 331 return 0; 332} 333 334/* Is this correct? */ 335int blake2s_final( blake2s_state *S, uint8_t *out, uint8_t outlen ) 336{ 337 uint8_t buffer[BLAKE2S_OUTBYTES] = {0}; 338 int i; 339 340 if( outlen > BLAKE2S_OUTBYTES ) 341 return -1; 342 343 if( blake2s_is_lastblock( S ) ) 344 return -1; 345 346 if( S->buflen > BLAKE2S_BLOCKBYTES ) 347 { 348 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES ); 349 blake2s_compress( S, S->buf ); 350 S->buflen -= BLAKE2S_BLOCKBYTES; 351 memmove( S->buf, S->buf + BLAKE2S_BLOCKBYTES, S->buflen ); 352 } 353 354 blake2s_increment_counter( S, ( uint32_t )S->buflen ); 355 blake2s_set_lastblock( S ); 356 memset( S->buf + S->buflen, 0, 2 * BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */ 357 blake2s_compress( S, S->buf ); 358 359 for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */ 360 store32( buffer + sizeof( S->h[i] ) * i, S->h[i] ); 361 362 memcpy( out, buffer, outlen ); 363 return 0; 364} 365 366/* inlen, at least, should be uint64_t. Others can be size_t. */ 367int blake2s( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen ) 368{ 369 blake2s_state S[1]; 370 371 /* Verify parameters */ 372 if ( NULL == in && inlen > 0 ) return -1; 373 374 if ( NULL == out ) return -1; 375 376 if ( NULL == key && keylen > 0) return -1; 377 378 if( !outlen || outlen > BLAKE2S_OUTBYTES ) return -1; 379 380 if( keylen > BLAKE2S_KEYBYTES ) return -1; 381 382 if( keylen > 0 ) 383 { 384 if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1; 385 } 386 else 387 { 388 if( blake2s_init( S, outlen ) < 0 ) return -1; 389 } 390 391 blake2s_update( S, ( const uint8_t * )in, inlen ); 392 blake2s_final( S, out, outlen ); 393 return 0; 394} 395 396#if defined(SUPERCOP) 397int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen ) 398{ 399 return blake2s( out, in, NULL, BLAKE2S_OUTBYTES, inlen, 0 ); 400} 401#endif 402 403#if defined(BLAKE2S_SELFTEST) 404#include <string.h> 405#include "blake2-kat.h" 406int main( int argc, char **argv ) 407{ 408 uint8_t key[BLAKE2S_KEYBYTES]; 409 uint8_t buf[KAT_LENGTH]; 410 size_t i; 411 412 for( i = 0; i < BLAKE2S_KEYBYTES; ++i ) 413 key[i] = ( uint8_t )i; 414 415 for( i = 0; i < KAT_LENGTH; ++i ) 416 buf[i] = ( uint8_t )i; 417 418 for( i = 0; i < KAT_LENGTH; ++i ) 419 { 420 uint8_t hash[BLAKE2S_OUTBYTES]; 421 422 if( blake2s( hash, buf, key, BLAKE2S_OUTBYTES, i, BLAKE2S_KEYBYTES ) < 0 || 423 0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) ) 424 { 425 puts( "error" ); 426 return -1; 427 } 428 } 429 430 puts( "ok" ); 431 return 0; 432} 433#endif 434 435 436