1*66bae5e7Schristos /*
2*66bae5e7Schristos * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
3*66bae5e7Schristos *
4*66bae5e7Schristos * Licensed under the Apache License 2.0 (the "License"). You may not use
5*66bae5e7Schristos * this file except in compliance with the License. You can obtain a copy
6*66bae5e7Schristos * in the file LICENSE in the source distribution or at
7*66bae5e7Schristos * https://www.openssl.org/source/license.html
8*66bae5e7Schristos */
9*66bae5e7Schristos
10*66bae5e7Schristos /*
11*66bae5e7Schristos * Derived from the BLAKE2 reference implementation written by Samuel Neves.
12*66bae5e7Schristos * Copyright 2012, Samuel Neves <sneves@dei.uc.pt>
13*66bae5e7Schristos * More information about the BLAKE2 hash function and its implementations
14*66bae5e7Schristos * can be found at https://blake2.net.
15*66bae5e7Schristos */
16*66bae5e7Schristos
17*66bae5e7Schristos #include <assert.h>
18*66bae5e7Schristos #include <string.h>
19*66bae5e7Schristos #include <openssl/crypto.h>
20*66bae5e7Schristos #include "blake2_impl.h"
21*66bae5e7Schristos #include "prov/blake2.h"
22*66bae5e7Schristos
23*66bae5e7Schristos static const uint32_t blake2s_IV[8] =
24*66bae5e7Schristos {
25*66bae5e7Schristos 0x6A09E667U, 0xBB67AE85U, 0x3C6EF372U, 0xA54FF53AU,
26*66bae5e7Schristos 0x510E527FU, 0x9B05688CU, 0x1F83D9ABU, 0x5BE0CD19U
27*66bae5e7Schristos };
28*66bae5e7Schristos
29*66bae5e7Schristos static const uint8_t blake2s_sigma[10][16] =
30*66bae5e7Schristos {
31*66bae5e7Schristos { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
32*66bae5e7Schristos { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
33*66bae5e7Schristos { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
34*66bae5e7Schristos { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
35*66bae5e7Schristos { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
36*66bae5e7Schristos { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
37*66bae5e7Schristos { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
38*66bae5e7Schristos { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
39*66bae5e7Schristos { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
40*66bae5e7Schristos { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,
41*66bae5e7Schristos };
42*66bae5e7Schristos
43*66bae5e7Schristos /* Set that it's the last block we'll compress */
blake2s_set_lastblock(BLAKE2S_CTX * S)44*66bae5e7Schristos static ossl_inline void blake2s_set_lastblock(BLAKE2S_CTX *S)
45*66bae5e7Schristos {
46*66bae5e7Schristos S->f[0] = -1;
47*66bae5e7Schristos }
48*66bae5e7Schristos
49*66bae5e7Schristos /* Initialize the hashing state. */
blake2s_init0(BLAKE2S_CTX * S)50*66bae5e7Schristos static ossl_inline void blake2s_init0(BLAKE2S_CTX *S)
51*66bae5e7Schristos {
52*66bae5e7Schristos int i;
53*66bae5e7Schristos
54*66bae5e7Schristos memset(S, 0, sizeof(BLAKE2S_CTX));
55*66bae5e7Schristos for (i = 0; i < 8; ++i) {
56*66bae5e7Schristos S->h[i] = blake2s_IV[i];
57*66bae5e7Schristos }
58*66bae5e7Schristos }
59*66bae5e7Schristos
60*66bae5e7Schristos /* init xors IV with input parameter block and sets the output length */
blake2s_init_param(BLAKE2S_CTX * S,const BLAKE2S_PARAM * P)61*66bae5e7Schristos static void blake2s_init_param(BLAKE2S_CTX *S, const BLAKE2S_PARAM *P)
62*66bae5e7Schristos {
63*66bae5e7Schristos size_t i;
64*66bae5e7Schristos const uint8_t *p = (const uint8_t *)(P);
65*66bae5e7Schristos
66*66bae5e7Schristos blake2s_init0(S);
67*66bae5e7Schristos S->outlen = P->digest_length;
68*66bae5e7Schristos
69*66bae5e7Schristos /* The param struct is carefully hand packed, and should be 32 bytes on
70*66bae5e7Schristos * every platform. */
71*66bae5e7Schristos assert(sizeof(BLAKE2S_PARAM) == 32);
72*66bae5e7Schristos /* IV XOR ParamBlock */
73*66bae5e7Schristos for (i = 0; i < 8; ++i) {
74*66bae5e7Schristos S->h[i] ^= load32(&p[i*4]);
75*66bae5e7Schristos }
76*66bae5e7Schristos }
77*66bae5e7Schristos
ossl_blake2s_param_init(BLAKE2S_PARAM * P)78*66bae5e7Schristos void ossl_blake2s_param_init(BLAKE2S_PARAM *P)
79*66bae5e7Schristos {
80*66bae5e7Schristos P->digest_length = BLAKE2S_DIGEST_LENGTH;
81*66bae5e7Schristos P->key_length = 0;
82*66bae5e7Schristos P->fanout = 1;
83*66bae5e7Schristos P->depth = 1;
84*66bae5e7Schristos store32(P->leaf_length, 0);
85*66bae5e7Schristos store48(P->node_offset, 0);
86*66bae5e7Schristos P->node_depth = 0;
87*66bae5e7Schristos P->inner_length = 0;
88*66bae5e7Schristos memset(P->salt, 0, sizeof(P->salt));
89*66bae5e7Schristos memset(P->personal, 0, sizeof(P->personal));
90*66bae5e7Schristos }
91*66bae5e7Schristos
ossl_blake2s_param_set_digest_length(BLAKE2S_PARAM * P,uint8_t outlen)92*66bae5e7Schristos void ossl_blake2s_param_set_digest_length(BLAKE2S_PARAM *P, uint8_t outlen)
93*66bae5e7Schristos {
94*66bae5e7Schristos P->digest_length = outlen;
95*66bae5e7Schristos }
96*66bae5e7Schristos
ossl_blake2s_param_set_key_length(BLAKE2S_PARAM * P,uint8_t keylen)97*66bae5e7Schristos void ossl_blake2s_param_set_key_length(BLAKE2S_PARAM *P, uint8_t keylen)
98*66bae5e7Schristos {
99*66bae5e7Schristos P->key_length = keylen;
100*66bae5e7Schristos }
101*66bae5e7Schristos
ossl_blake2s_param_set_personal(BLAKE2S_PARAM * P,const uint8_t * personal,size_t len)102*66bae5e7Schristos void ossl_blake2s_param_set_personal(BLAKE2S_PARAM *P, const uint8_t *personal,
103*66bae5e7Schristos size_t len)
104*66bae5e7Schristos {
105*66bae5e7Schristos memcpy(P->personal, personal, len);
106*66bae5e7Schristos memset(P->personal + len, 0, BLAKE2S_PERSONALBYTES - len);
107*66bae5e7Schristos }
108*66bae5e7Schristos
ossl_blake2s_param_set_salt(BLAKE2S_PARAM * P,const uint8_t * salt,size_t len)109*66bae5e7Schristos void ossl_blake2s_param_set_salt(BLAKE2S_PARAM *P, const uint8_t *salt,
110*66bae5e7Schristos size_t len)
111*66bae5e7Schristos {
112*66bae5e7Schristos memcpy(P->salt, salt, len);
113*66bae5e7Schristos memset(P->salt + len, 0, BLAKE2S_SALTBYTES - len);}
114*66bae5e7Schristos
115*66bae5e7Schristos /*
116*66bae5e7Schristos * Initialize the hashing context with the given parameter block.
117*66bae5e7Schristos * Always returns 1.
118*66bae5e7Schristos */
ossl_blake2s_init(BLAKE2S_CTX * c,const BLAKE2S_PARAM * P)119*66bae5e7Schristos int ossl_blake2s_init(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P)
120*66bae5e7Schristos {
121*66bae5e7Schristos blake2s_init_param(c, P);
122*66bae5e7Schristos return 1;
123*66bae5e7Schristos }
124*66bae5e7Schristos
125*66bae5e7Schristos /*
126*66bae5e7Schristos * Initialize the hashing context with the given parameter block and key.
127*66bae5e7Schristos * Always returns 1.
128*66bae5e7Schristos */
ossl_blake2s_init_key(BLAKE2S_CTX * c,const BLAKE2S_PARAM * P,const void * key)129*66bae5e7Schristos int ossl_blake2s_init_key(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P,
130*66bae5e7Schristos const void *key)
131*66bae5e7Schristos {
132*66bae5e7Schristos blake2s_init_param(c, P);
133*66bae5e7Schristos
134*66bae5e7Schristos /* Pad the key to form first data block */
135*66bae5e7Schristos {
136*66bae5e7Schristos uint8_t block[BLAKE2S_BLOCKBYTES] = {0};
137*66bae5e7Schristos
138*66bae5e7Schristos memcpy(block, key, P->key_length);
139*66bae5e7Schristos ossl_blake2s_update(c, block, BLAKE2S_BLOCKBYTES);
140*66bae5e7Schristos OPENSSL_cleanse(block, BLAKE2S_BLOCKBYTES);
141*66bae5e7Schristos }
142*66bae5e7Schristos
143*66bae5e7Schristos return 1;
144*66bae5e7Schristos }
145*66bae5e7Schristos
146*66bae5e7Schristos /* Permute the state while xoring in the block of data. */
blake2s_compress(BLAKE2S_CTX * S,const uint8_t * blocks,size_t len)147*66bae5e7Schristos static void blake2s_compress(BLAKE2S_CTX *S,
148*66bae5e7Schristos const uint8_t *blocks,
149*66bae5e7Schristos size_t len)
150*66bae5e7Schristos {
151*66bae5e7Schristos uint32_t m[16];
152*66bae5e7Schristos uint32_t v[16];
153*66bae5e7Schristos size_t i;
154*66bae5e7Schristos size_t increment;
155*66bae5e7Schristos
156*66bae5e7Schristos /*
157*66bae5e7Schristos * There are two distinct usage vectors for this function:
158*66bae5e7Schristos *
159*66bae5e7Schristos * a) BLAKE2s_Update uses it to process complete blocks,
160*66bae5e7Schristos * possibly more than one at a time;
161*66bae5e7Schristos *
162*66bae5e7Schristos * b) BLAK2s_Final uses it to process last block, always
163*66bae5e7Schristos * single but possibly incomplete, in which case caller
164*66bae5e7Schristos * pads input with zeros.
165*66bae5e7Schristos */
166*66bae5e7Schristos assert(len < BLAKE2S_BLOCKBYTES || len % BLAKE2S_BLOCKBYTES == 0);
167*66bae5e7Schristos
168*66bae5e7Schristos /*
169*66bae5e7Schristos * Since last block is always processed with separate call,
170*66bae5e7Schristos * |len| not being multiple of complete blocks can be observed
171*66bae5e7Schristos * only with |len| being less than BLAKE2S_BLOCKBYTES ("less"
172*66bae5e7Schristos * including even zero), which is why following assignment doesn't
173*66bae5e7Schristos * have to reside inside the main loop below.
174*66bae5e7Schristos */
175*66bae5e7Schristos increment = len < BLAKE2S_BLOCKBYTES ? len : BLAKE2S_BLOCKBYTES;
176*66bae5e7Schristos
177*66bae5e7Schristos for (i = 0; i < 8; ++i) {
178*66bae5e7Schristos v[i] = S->h[i];
179*66bae5e7Schristos }
180*66bae5e7Schristos
181*66bae5e7Schristos do {
182*66bae5e7Schristos for (i = 0; i < 16; ++i) {
183*66bae5e7Schristos m[i] = load32(blocks + i * sizeof(m[i]));
184*66bae5e7Schristos }
185*66bae5e7Schristos
186*66bae5e7Schristos /* blake2s_increment_counter */
187*66bae5e7Schristos S->t[0] += increment;
188*66bae5e7Schristos S->t[1] += (S->t[0] < increment);
189*66bae5e7Schristos
190*66bae5e7Schristos v[ 8] = blake2s_IV[0];
191*66bae5e7Schristos v[ 9] = blake2s_IV[1];
192*66bae5e7Schristos v[10] = blake2s_IV[2];
193*66bae5e7Schristos v[11] = blake2s_IV[3];
194*66bae5e7Schristos v[12] = S->t[0] ^ blake2s_IV[4];
195*66bae5e7Schristos v[13] = S->t[1] ^ blake2s_IV[5];
196*66bae5e7Schristos v[14] = S->f[0] ^ blake2s_IV[6];
197*66bae5e7Schristos v[15] = S->f[1] ^ blake2s_IV[7];
198*66bae5e7Schristos #define G(r,i,a,b,c,d) \
199*66bae5e7Schristos do { \
200*66bae5e7Schristos a = a + b + m[blake2s_sigma[r][2*i+0]]; \
201*66bae5e7Schristos d = rotr32(d ^ a, 16); \
202*66bae5e7Schristos c = c + d; \
203*66bae5e7Schristos b = rotr32(b ^ c, 12); \
204*66bae5e7Schristos a = a + b + m[blake2s_sigma[r][2*i+1]]; \
205*66bae5e7Schristos d = rotr32(d ^ a, 8); \
206*66bae5e7Schristos c = c + d; \
207*66bae5e7Schristos b = rotr32(b ^ c, 7); \
208*66bae5e7Schristos } while (0)
209*66bae5e7Schristos #define ROUND(r) \
210*66bae5e7Schristos do { \
211*66bae5e7Schristos G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
212*66bae5e7Schristos G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
213*66bae5e7Schristos G(r,2,v[ 2],v[ 6],v[10],v[14]); \
214*66bae5e7Schristos G(r,3,v[ 3],v[ 7],v[11],v[15]); \
215*66bae5e7Schristos G(r,4,v[ 0],v[ 5],v[10],v[15]); \
216*66bae5e7Schristos G(r,5,v[ 1],v[ 6],v[11],v[12]); \
217*66bae5e7Schristos G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
218*66bae5e7Schristos G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
219*66bae5e7Schristos } while (0)
220*66bae5e7Schristos #if defined(OPENSSL_SMALL_FOOTPRINT)
221*66bae5e7Schristos /* almost 3x reduction on x86_64, 4.5x on ARMv8, 4x on ARMv4 */
222*66bae5e7Schristos for (i = 0; i < 10; i++) {
223*66bae5e7Schristos ROUND(i);
224*66bae5e7Schristos }
225*66bae5e7Schristos #else
226*66bae5e7Schristos ROUND(0);
227*66bae5e7Schristos ROUND(1);
228*66bae5e7Schristos ROUND(2);
229*66bae5e7Schristos ROUND(3);
230*66bae5e7Schristos ROUND(4);
231*66bae5e7Schristos ROUND(5);
232*66bae5e7Schristos ROUND(6);
233*66bae5e7Schristos ROUND(7);
234*66bae5e7Schristos ROUND(8);
235*66bae5e7Schristos ROUND(9);
236*66bae5e7Schristos #endif
237*66bae5e7Schristos
238*66bae5e7Schristos for (i = 0; i < 8; ++i) {
239*66bae5e7Schristos S->h[i] = v[i] ^= v[i + 8] ^ S->h[i];
240*66bae5e7Schristos }
241*66bae5e7Schristos #undef G
242*66bae5e7Schristos #undef ROUND
243*66bae5e7Schristos blocks += increment;
244*66bae5e7Schristos len -= increment;
245*66bae5e7Schristos } while (len);
246*66bae5e7Schristos }
247*66bae5e7Schristos
248*66bae5e7Schristos /* Absorb the input data into the hash state. Always returns 1. */
ossl_blake2s_update(BLAKE2S_CTX * c,const void * data,size_t datalen)249*66bae5e7Schristos int ossl_blake2s_update(BLAKE2S_CTX *c, const void *data, size_t datalen)
250*66bae5e7Schristos {
251*66bae5e7Schristos const uint8_t *in = data;
252*66bae5e7Schristos size_t fill;
253*66bae5e7Schristos
254*66bae5e7Schristos /*
255*66bae5e7Schristos * Intuitively one would expect intermediate buffer, c->buf, to
256*66bae5e7Schristos * store incomplete blocks. But in this case we are interested to
257*66bae5e7Schristos * temporarily stash even complete blocks, because last one in the
258*66bae5e7Schristos * stream has to be treated in special way, and at this point we
259*66bae5e7Schristos * don't know if last block in *this* call is last one "ever". This
260*66bae5e7Schristos * is the reason for why |datalen| is compared as >, and not >=.
261*66bae5e7Schristos */
262*66bae5e7Schristos fill = sizeof(c->buf) - c->buflen;
263*66bae5e7Schristos if (datalen > fill) {
264*66bae5e7Schristos if (c->buflen) {
265*66bae5e7Schristos memcpy(c->buf + c->buflen, in, fill); /* Fill buffer */
266*66bae5e7Schristos blake2s_compress(c, c->buf, BLAKE2S_BLOCKBYTES);
267*66bae5e7Schristos c->buflen = 0;
268*66bae5e7Schristos in += fill;
269*66bae5e7Schristos datalen -= fill;
270*66bae5e7Schristos }
271*66bae5e7Schristos if (datalen > BLAKE2S_BLOCKBYTES) {
272*66bae5e7Schristos size_t stashlen = datalen % BLAKE2S_BLOCKBYTES;
273*66bae5e7Schristos /*
274*66bae5e7Schristos * If |datalen| is a multiple of the blocksize, stash
275*66bae5e7Schristos * last complete block, it can be final one...
276*66bae5e7Schristos */
277*66bae5e7Schristos stashlen = stashlen ? stashlen : BLAKE2S_BLOCKBYTES;
278*66bae5e7Schristos datalen -= stashlen;
279*66bae5e7Schristos blake2s_compress(c, in, datalen);
280*66bae5e7Schristos in += datalen;
281*66bae5e7Schristos datalen = stashlen;
282*66bae5e7Schristos }
283*66bae5e7Schristos }
284*66bae5e7Schristos
285*66bae5e7Schristos assert(datalen <= BLAKE2S_BLOCKBYTES);
286*66bae5e7Schristos
287*66bae5e7Schristos memcpy(c->buf + c->buflen, in, datalen);
288*66bae5e7Schristos c->buflen += datalen; /* Be lazy, do not compress */
289*66bae5e7Schristos
290*66bae5e7Schristos return 1;
291*66bae5e7Schristos }
292*66bae5e7Schristos
293*66bae5e7Schristos /*
294*66bae5e7Schristos * Calculate the final hash and save it in md.
295*66bae5e7Schristos * Always returns 1.
296*66bae5e7Schristos */
ossl_blake2s_final(unsigned char * md,BLAKE2S_CTX * c)297*66bae5e7Schristos int ossl_blake2s_final(unsigned char *md, BLAKE2S_CTX *c)
298*66bae5e7Schristos {
299*66bae5e7Schristos uint8_t outbuffer[BLAKE2S_OUTBYTES] = {0};
300*66bae5e7Schristos uint8_t *target = outbuffer;
301*66bae5e7Schristos int iter = (c->outlen + 3) / 4;
302*66bae5e7Schristos int i;
303*66bae5e7Schristos
304*66bae5e7Schristos /* Avoid writing to the temporary buffer if possible */
305*66bae5e7Schristos if ((c->outlen % sizeof(c->h[0])) == 0)
306*66bae5e7Schristos target = md;
307*66bae5e7Schristos
308*66bae5e7Schristos blake2s_set_lastblock(c);
309*66bae5e7Schristos /* Padding */
310*66bae5e7Schristos memset(c->buf + c->buflen, 0, sizeof(c->buf) - c->buflen);
311*66bae5e7Schristos blake2s_compress(c, c->buf, c->buflen);
312*66bae5e7Schristos
313*66bae5e7Schristos /* Output full hash to buffer */
314*66bae5e7Schristos for (i = 0; i < iter; ++i)
315*66bae5e7Schristos store32(target + sizeof(c->h[i]) * i, c->h[i]);
316*66bae5e7Schristos
317*66bae5e7Schristos if (target != md)
318*66bae5e7Schristos memcpy(md, target, c->outlen);
319*66bae5e7Schristos
320*66bae5e7Schristos OPENSSL_cleanse(c, sizeof(BLAKE2S_CTX));
321*66bae5e7Schristos return 1;
322*66bae5e7Schristos }
323