18c2ecf20Sopenharmony_ci/* SPDX-License-Identifier: GPL-2.0 */
28c2ecf20Sopenharmony_ci/*
38c2ecf20Sopenharmony_ci * Common values and helper functions for the NHPoly1305 hash function.
48c2ecf20Sopenharmony_ci */
58c2ecf20Sopenharmony_ci
68c2ecf20Sopenharmony_ci#ifndef _NHPOLY1305_H
78c2ecf20Sopenharmony_ci#define _NHPOLY1305_H
88c2ecf20Sopenharmony_ci
98c2ecf20Sopenharmony_ci#include <crypto/hash.h>
108c2ecf20Sopenharmony_ci#include <crypto/internal/poly1305.h>
118c2ecf20Sopenharmony_ci
128c2ecf20Sopenharmony_ci/* NH parameterization: */
138c2ecf20Sopenharmony_ci
148c2ecf20Sopenharmony_ci/* Endianness: little */
158c2ecf20Sopenharmony_ci/* Word size: 32 bits (works well on NEON, SSE2, AVX2) */
168c2ecf20Sopenharmony_ci
178c2ecf20Sopenharmony_ci/* Stride: 2 words (optimal on ARM32 NEON; works okay on other CPUs too) */
188c2ecf20Sopenharmony_ci#define NH_PAIR_STRIDE		2
198c2ecf20Sopenharmony_ci#define NH_MESSAGE_UNIT		(NH_PAIR_STRIDE * 2 * sizeof(u32))
208c2ecf20Sopenharmony_ci
218c2ecf20Sopenharmony_ci/* Num passes (Toeplitz iteration count): 4, to give ε = 2^{-128} */
228c2ecf20Sopenharmony_ci#define NH_NUM_PASSES		4
238c2ecf20Sopenharmony_ci#define NH_HASH_BYTES		(NH_NUM_PASSES * sizeof(u64))
248c2ecf20Sopenharmony_ci
258c2ecf20Sopenharmony_ci/* Max message size: 1024 bytes (32x compression factor) */
268c2ecf20Sopenharmony_ci#define NH_NUM_STRIDES		64
278c2ecf20Sopenharmony_ci#define NH_MESSAGE_WORDS	(NH_PAIR_STRIDE * 2 * NH_NUM_STRIDES)
288c2ecf20Sopenharmony_ci#define NH_MESSAGE_BYTES	(NH_MESSAGE_WORDS * sizeof(u32))
298c2ecf20Sopenharmony_ci#define NH_KEY_WORDS		(NH_MESSAGE_WORDS + \
308c2ecf20Sopenharmony_ci				 NH_PAIR_STRIDE * 2 * (NH_NUM_PASSES - 1))
318c2ecf20Sopenharmony_ci#define NH_KEY_BYTES		(NH_KEY_WORDS * sizeof(u32))
328c2ecf20Sopenharmony_ci
338c2ecf20Sopenharmony_ci#define NHPOLY1305_KEY_SIZE	(POLY1305_BLOCK_SIZE + NH_KEY_BYTES)
348c2ecf20Sopenharmony_ci
358c2ecf20Sopenharmony_cistruct nhpoly1305_key {
368c2ecf20Sopenharmony_ci	struct poly1305_core_key poly_key;
378c2ecf20Sopenharmony_ci	u32 nh_key[NH_KEY_WORDS];
388c2ecf20Sopenharmony_ci};
398c2ecf20Sopenharmony_ci
408c2ecf20Sopenharmony_cistruct nhpoly1305_state {
418c2ecf20Sopenharmony_ci
428c2ecf20Sopenharmony_ci	/* Running total of polynomial evaluation */
438c2ecf20Sopenharmony_ci	struct poly1305_state poly_state;
448c2ecf20Sopenharmony_ci
458c2ecf20Sopenharmony_ci	/* Partial block buffer */
468c2ecf20Sopenharmony_ci	u8 buffer[NH_MESSAGE_UNIT];
478c2ecf20Sopenharmony_ci	unsigned int buflen;
488c2ecf20Sopenharmony_ci
498c2ecf20Sopenharmony_ci	/*
508c2ecf20Sopenharmony_ci	 * Number of bytes remaining until the current NH message reaches
518c2ecf20Sopenharmony_ci	 * NH_MESSAGE_BYTES.  When nonzero, 'nh_hash' holds the partial NH hash.
528c2ecf20Sopenharmony_ci	 */
538c2ecf20Sopenharmony_ci	unsigned int nh_remaining;
548c2ecf20Sopenharmony_ci
558c2ecf20Sopenharmony_ci	__le64 nh_hash[NH_NUM_PASSES];
568c2ecf20Sopenharmony_ci};
578c2ecf20Sopenharmony_ci
588c2ecf20Sopenharmony_citypedef void (*nh_t)(const u32 *key, const u8 *message, size_t message_len,
598c2ecf20Sopenharmony_ci		     __le64 hash[NH_NUM_PASSES]);
608c2ecf20Sopenharmony_ci
618c2ecf20Sopenharmony_ciint crypto_nhpoly1305_setkey(struct crypto_shash *tfm,
628c2ecf20Sopenharmony_ci			     const u8 *key, unsigned int keylen);
638c2ecf20Sopenharmony_ci
648c2ecf20Sopenharmony_ciint crypto_nhpoly1305_init(struct shash_desc *desc);
658c2ecf20Sopenharmony_ciint crypto_nhpoly1305_update(struct shash_desc *desc,
668c2ecf20Sopenharmony_ci			     const u8 *src, unsigned int srclen);
678c2ecf20Sopenharmony_ciint crypto_nhpoly1305_update_helper(struct shash_desc *desc,
688c2ecf20Sopenharmony_ci				    const u8 *src, unsigned int srclen,
698c2ecf20Sopenharmony_ci				    nh_t nh_fn);
708c2ecf20Sopenharmony_ciint crypto_nhpoly1305_final(struct shash_desc *desc, u8 *dst);
718c2ecf20Sopenharmony_ciint crypto_nhpoly1305_final_helper(struct shash_desc *desc, u8 *dst,
728c2ecf20Sopenharmony_ci				   nh_t nh_fn);
738c2ecf20Sopenharmony_ci
748c2ecf20Sopenharmony_ci#endif /* _NHPOLY1305_H */
75