1/* 2 BLAKE2 reference source code package - optimized C implementations 3 4 Written in 2012 by Samuel Neves <sneves@dei.uc.pt> 5 6 To the extent possible under law, the author(s) have dedicated all copyright 7 and related and neighboring rights to this software to the public domain 8 worldwide. This software is distributed without any warranty. 9 10 You should have received a copy of the CC0 Public Domain Dedication along with 11 this software. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>. 12*/ 13 14#include <stdint.h> 15#include <string.h> 16#include <stdio.h> 17 18#include "blake2.h" 19#include "blake2-impl.h" 20 21#include "blake2-config.h" 22 23#if defined(_MSC_VER) 24#include <intrin.h> 25#endif 26 27#if defined(HAVE_SSE2) 28#include <emmintrin.h> 29// MSVC only defines _mm_set_epi64x for x86_64... 30#if defined(_MSC_VER) && !defined(_M_X64) 31static inline __m128i _mm_set_epi64x( const uint64_t u1, const uint64_t u0 ) 32{ 33 return _mm_set_epi32( u1 >> 32, u1, u0 >> 32, u0 ); 34} 35#endif 36#endif 37 38 39#if defined(HAVE_SSSE3) 40#include <tmmintrin.h> 41#endif 42#if defined(HAVE_SSE4_1) 43#include <smmintrin.h> 44#endif 45#if defined(HAVE_AVX) 46#include <immintrin.h> 47#endif 48#if defined(HAVE_XOP) && !defined(_MSC_VER) 49#include <x86intrin.h> 50#endif 51 52#include "blake2s-round.h" 53 54static const uint32_t blake2s_IV[8] = 55{ 56 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL, 57 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL 58}; 59 60static const uint8_t blake2s_sigma[10][16] = 61{ 62 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } , 63 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } , 64 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } , 65 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } , 66 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } , 67 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } , 68 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } , 69 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } , 70 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } , 71 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } , 72}; 73 74 75/* Some helper functions, not necessarily useful */ 76static inline int blake2s_set_lastnode( blake2s_state *S ) 77{ 78 S->f[1] = ~0U; 79 return 0; 80} 81 82static inline int blake2s_clear_lastnode( blake2s_state *S ) 83{ 84 S->f[1] = 0U; 85 return 0; 86} 87 88static inline int blake2s_set_lastblock( blake2s_state *S ) 89{ 90 if( S->last_node ) blake2s_set_lastnode( S ); 91 92 S->f[0] = ~0U; 93 return 0; 94} 95 96static inline int blake2s_clear_lastblock( blake2s_state *S ) 97{ 98 if( S->last_node ) blake2s_clear_lastnode( S ); 99 100 S->f[0] = 0U; 101 return 0; 102} 103 104static inline int blake2s_increment_counter( blake2s_state *S, const uint32_t inc ) 105{ 106 uint64_t t = ( ( uint64_t )S->t[1] << 32 ) | S->t[0]; 107 t += inc; 108 S->t[0] = ( uint32_t )( t >> 0 ); 109 S->t[1] = ( uint32_t )( t >> 32 ); 110 return 0; 111} 112 113 114// Parameter-related functions 115static inline int blake2s_param_set_digest_length( blake2s_param *P, const uint8_t digest_length ) 116{ 117 P->digest_length = digest_length; 118 return 0; 119} 120 121static inline int blake2s_param_set_fanout( blake2s_param *P, const uint8_t fanout ) 122{ 123 P->fanout = fanout; 124 return 0; 125} 126 127static inline int blake2s_param_set_max_depth( blake2s_param *P, const uint8_t depth ) 128{ 129 P->depth = depth; 130 return 0; 131} 132 133static inline int blake2s_param_set_leaf_length( blake2s_param *P, const uint32_t leaf_length ) 134{ 135 P->leaf_length = leaf_length; 136 return 0; 137} 138 139static inline int blake2s_param_set_node_offset( blake2s_param *P, const uint64_t node_offset ) 140{ 141 store48( P->node_offset, node_offset ); 142 return 0; 143} 144 145static inline int blake2s_param_set_node_depth( blake2s_param *P, const uint8_t node_depth ) 146{ 147 P->node_depth = node_depth; 148 return 0; 149} 150 151static inline int blake2s_param_set_inner_length( blake2s_param *P, const uint8_t inner_length ) 152{ 153 P->inner_length = inner_length; 154 return 0; 155} 156 157static inline int blake2s_param_set_salt( blake2s_param *P, const uint8_t salt[BLAKE2S_SALTBYTES] ) 158{ 159 memcpy( P->salt, salt, BLAKE2S_SALTBYTES ); 160 return 0; 161} 162 163static inline int blake2s_param_set_personal( blake2s_param *P, const uint8_t personal[BLAKE2S_PERSONALBYTES] ) 164{ 165 memcpy( P->personal, personal, BLAKE2S_PERSONALBYTES ); 166 return 0; 167} 168 169static inline int blake2s_init0( blake2s_state *S ) 170{ 171 memset( S, 0, sizeof( blake2s_state ) ); 172 173 for( int i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i]; 174 175 return 0; 176} 177 178#if defined(__cplusplus) 179extern "C" { 180#endif 181 int blake2s_init( blake2s_state *S, size_t outlen ); 182 int blake2s_init_param( blake2s_state *S, const blake2s_param *P ); 183 int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen ); 184 int blake2s_update( blake2s_state *S, const uint8_t *in, size_t inlen ); 185 int blake2s_final( blake2s_state *S, uint8_t *out, size_t outlen ); 186 int blake2s( uint8_t *out, const void *in, const void *key, size_t outlen, size_t inlen, size_t keylen ); 187#if defined(__cplusplus) 188} 189#endif 190 191 192/* init2 xors IV with input parameter block */ 193int blake2s_init_param( blake2s_state *S, const blake2s_param *P ) 194{ 195 uint8_t *p, *h, *v; 196 //blake2s_init0( S ); 197 v = ( uint8_t * )( blake2s_IV ); 198 h = ( uint8_t * )( S->h ); 199 p = ( uint8_t * )( P ); 200 /* IV XOR ParamBlock */ 201 memset( S, 0, sizeof( blake2s_state ) ); 202 203 for( int i = 0; i < BLAKE2S_OUTBYTES; ++i ) h[i] = v[i] ^ p[i]; 204 205 S->outlen = P->digest_length; 206 return 0; 207} 208 209 210/* Some sort of default parameter block initialization, for sequential blake2s */ 211int blake2s_init( blake2s_state *S, size_t outlen ) 212{ 213 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1; 214 215 const blake2s_param P = 216 { 217 outlen, 218 0, 219 1, 220 1, 221 0, 222 {0}, 223 0, 224 0, 225 {0}, 226 {0} 227 }; 228 return blake2s_init_param( S, &P ); 229} 230 231 232int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen ) 233{ 234 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1; 235 236 if ( ( !key ) || ( !keylen ) || keylen > BLAKE2S_KEYBYTES ) return -1; 237 238 const blake2s_param P = 239 { 240 outlen, 241 keylen, 242 1, 243 1, 244 0, 245 {0}, 246 0, 247 0, 248 {0}, 249 {0} 250 }; 251 252 if( blake2s_init_param( S, &P ) < 0 ) 253 return -1; 254 255 { 256 uint8_t block[BLAKE2S_BLOCKBYTES]; 257 memset( block, 0, BLAKE2S_BLOCKBYTES ); 258 memcpy( block, key, keylen ); 259 blake2s_update( S, block, BLAKE2S_BLOCKBYTES ); 260 secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */ 261 } 262 return 0; 263} 264 265 266static inline int blake2s_compress( blake2s_state *S, const uint8_t block[BLAKE2S_BLOCKBYTES] ) 267{ 268 __m128i row1, row2, row3, row4; 269 __m128i buf1, buf2, buf3, buf4; 270#if defined(HAVE_SSE4_1) 271 __m128i t0, t1; 272#if !defined(HAVE_XOP) 273 __m128i t2; 274#endif 275#endif 276 __m128i ff0, ff1; 277#if defined(HAVE_SSSE3) && !defined(HAVE_XOP) 278 const __m128i r8 = _mm_set_epi8( 12, 15, 14, 13, 8, 11, 10, 9, 4, 7, 6, 5, 0, 3, 2, 1 ); 279 const __m128i r16 = _mm_set_epi8( 13, 12, 15, 14, 9, 8, 11, 10, 5, 4, 7, 6, 1, 0, 3, 2 ); 280#endif 281#if defined(HAVE_SSE4_1) 282 const __m128i m0 = LOADU( block + 00 ); 283 const __m128i m1 = LOADU( block + 16 ); 284 const __m128i m2 = LOADU( block + 32 ); 285 const __m128i m3 = LOADU( block + 48 ); 286#else 287 const uint32_t m0 = ( ( uint32_t * )block )[ 0]; 288 const uint32_t m1 = ( ( uint32_t * )block )[ 1]; 289 const uint32_t m2 = ( ( uint32_t * )block )[ 2]; 290 const uint32_t m3 = ( ( uint32_t * )block )[ 3]; 291 const uint32_t m4 = ( ( uint32_t * )block )[ 4]; 292 const uint32_t m5 = ( ( uint32_t * )block )[ 5]; 293 const uint32_t m6 = ( ( uint32_t * )block )[ 6]; 294 const uint32_t m7 = ( ( uint32_t * )block )[ 7]; 295 const uint32_t m8 = ( ( uint32_t * )block )[ 8]; 296 const uint32_t m9 = ( ( uint32_t * )block )[ 9]; 297 const uint32_t m10 = ( ( uint32_t * )block )[10]; 298 const uint32_t m11 = ( ( uint32_t * )block )[11]; 299 const uint32_t m12 = ( ( uint32_t * )block )[12]; 300 const uint32_t m13 = ( ( uint32_t * )block )[13]; 301 const uint32_t m14 = ( ( uint32_t * )block )[14]; 302 const uint32_t m15 = ( ( uint32_t * )block )[15]; 303#endif 304 row1 = ff0 = LOADU( &S->h[0] ); 305 row2 = ff1 = LOADU( &S->h[4] ); 306 row3 = _mm_setr_epi32( 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A ); 307 row4 = _mm_xor_si128( _mm_setr_epi32( 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 ), LOADU( &S->t[0] ) ); 308 ROUND( 0 ); 309 ROUND( 1 ); 310 ROUND( 2 ); 311 ROUND( 3 ); 312 ROUND( 4 ); 313 ROUND( 5 ); 314 ROUND( 6 ); 315 ROUND( 7 ); 316 ROUND( 8 ); 317 ROUND( 9 ); 318 STOREU( &S->h[0], _mm_xor_si128( ff0, _mm_xor_si128( row1, row3 ) ) ); 319 STOREU( &S->h[4], _mm_xor_si128( ff1, _mm_xor_si128( row2, row4 ) ) ); 320 return 0; 321} 322 323 324int blake2s_update( blake2s_state *S, const uint8_t *in, size_t inlen ) 325{ 326 while( inlen > 0 ) 327 { 328 size_t left = S->buflen; 329 size_t fill = 2 * BLAKE2S_BLOCKBYTES - left; 330 331 if( inlen > fill ) 332 { 333 memcpy( S->buf + left, in, fill ); // Fill buffer 334 S->buflen += fill; 335 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES ); 336 blake2s_compress( S, S->buf ); // Compress 337 memcpy( S->buf, S->buf + BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES ); // Shift buffer left 338 S->buflen -= BLAKE2S_BLOCKBYTES; 339 in += fill; 340 inlen -= fill; 341 } 342 else /* inlen <= fill */ 343 { 344 memcpy( S->buf + left, in, inlen ); 345 S->buflen += inlen; // Be lazy, do not compress 346 in += inlen; 347 inlen -= inlen; 348 } 349 } 350 351 return 0; 352} 353 354 355int blake2s_final( blake2s_state *S, uint8_t *out, size_t outlen ) 356{ 357 uint8_t buffer[BLAKE2S_OUTBYTES]; 358 359 if(outlen != S->outlen ) return -1; 360 361 if( S->buflen > BLAKE2S_BLOCKBYTES ) 362 { 363 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES ); 364 blake2s_compress( S, S->buf ); 365 S->buflen -= BLAKE2S_BLOCKBYTES; 366 memmove( S->buf, S->buf + BLAKE2S_BLOCKBYTES, S->buflen ); 367 } 368 369 blake2s_increment_counter( S, ( uint32_t )S->buflen ); 370 blake2s_set_lastblock( S ); 371 memset( S->buf + S->buflen, 0, 2 * BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */ 372 blake2s_compress( S, S->buf ); 373 374 for( int i = 0; i < 8; ++i ) /* Output full hash to temp buffer */ 375 store32( buffer + sizeof( S->h[i] ) * i, S->h[i] ); 376 377 memcpy( out, buffer, outlen ); 378 return 0; 379} 380 381int blake2s( uint8_t *out, const void *in, const void *key, size_t outlen, size_t inlen, size_t keylen ) 382{ 383 blake2s_state S[1]; 384 385 /* Verify parameters */ 386 if ( NULL == in && inlen > 0 ) return -1; 387 388 if ( NULL == out ) return -1; 389 390 if ( NULL == key && keylen > 0) return -1; 391 392 if( !outlen || outlen > BLAKE2S_OUTBYTES ) return -1; 393 394 if( keylen > BLAKE2S_KEYBYTES ) return -1; 395 396 if( keylen > 0 ) 397 { 398 if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1; 399 } 400 else 401 { 402 if( blake2s_init( S, outlen ) < 0 ) return -1; 403 } 404 405 if( blake2s_update( S, ( uint8_t * )in, inlen ) < 0) return -1; 406 return blake2s_final( S, out, outlen ); 407} 408 409#if defined(SUPERCOP) 410int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen ) 411{ 412 return blake2s( out, in, NULL, BLAKE2S_OUTBYTES, (size_t)inlen, 0 ); 413} 414#endif 415 416