1*66a1527dSchristos /*
2*66a1527dSchristos SipHash reference C implementation
3*66a1527dSchristos
4*66a1527dSchristos Copyright (c) 2012-2016 Jean-Philippe Aumasson
5*66a1527dSchristos <jeanphilippe.aumasson@gmail.com>
6*66a1527dSchristos Copyright (c) 2012-2014 Daniel J. Bernstein <djb@cr.yp.to>
7*66a1527dSchristos
8*66a1527dSchristos To the extent possible under law, the author(s) have dedicated all copyright
9*66a1527dSchristos and related and neighboring rights to this software to the public domain
10*66a1527dSchristos worldwide. This software is distributed without any warranty.
11*66a1527dSchristos
12*66a1527dSchristos You should have received a copy of the CC0 Public Domain Dedication along
13*66a1527dSchristos with
14*66a1527dSchristos this software. If not, see
15*66a1527dSchristos <http://creativecommons.org/publicdomain/zero/1.0/>.
16*66a1527dSchristos */
17*66a1527dSchristos #include <assert.h>
18*66a1527dSchristos #include <stdint.h>
19*66a1527dSchristos #include <stdio.h>
20*66a1527dSchristos #include <string.h>
21*66a1527dSchristos
22*66a1527dSchristos /* default: SipHash-2-4 */
23*66a1527dSchristos #define cROUNDS 2
24*66a1527dSchristos #define dROUNDS 4
25*66a1527dSchristos
26*66a1527dSchristos #define ROTL(x, b) (uint64_t)(((x) << (b)) | ((x) >> (64 - (b))))
27*66a1527dSchristos
28*66a1527dSchristos #define U32TO8_LE(p, v) \
29*66a1527dSchristos (p)[0] = (uint8_t)((v)); \
30*66a1527dSchristos (p)[1] = (uint8_t)((v) >> 8); \
31*66a1527dSchristos (p)[2] = (uint8_t)((v) >> 16); \
32*66a1527dSchristos (p)[3] = (uint8_t)((v) >> 24);
33*66a1527dSchristos
34*66a1527dSchristos #define U64TO8_LE(p, v) \
35*66a1527dSchristos U32TO8_LE((p), (uint32_t)((v))); \
36*66a1527dSchristos U32TO8_LE((p) + 4, (uint32_t)((v) >> 32));
37*66a1527dSchristos
38*66a1527dSchristos #define U8TO64_LE(p) \
39*66a1527dSchristos (((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) | \
40*66a1527dSchristos ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) | \
41*66a1527dSchristos ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40) | \
42*66a1527dSchristos ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56))
43*66a1527dSchristos
44*66a1527dSchristos #define SIPROUND \
45*66a1527dSchristos do { \
46*66a1527dSchristos v0 += v1; \
47*66a1527dSchristos v1 = ROTL(v1, 13); \
48*66a1527dSchristos v1 ^= v0; \
49*66a1527dSchristos v0 = ROTL(v0, 32); \
50*66a1527dSchristos v2 += v3; \
51*66a1527dSchristos v3 = ROTL(v3, 16); \
52*66a1527dSchristos v3 ^= v2; \
53*66a1527dSchristos v0 += v3; \
54*66a1527dSchristos v3 = ROTL(v3, 21); \
55*66a1527dSchristos v3 ^= v0; \
56*66a1527dSchristos v2 += v1; \
57*66a1527dSchristos v1 = ROTL(v1, 17); \
58*66a1527dSchristos v1 ^= v2; \
59*66a1527dSchristos v2 = ROTL(v2, 32); \
60*66a1527dSchristos } while (0)
61*66a1527dSchristos
62*66a1527dSchristos #ifdef DEBUG
63*66a1527dSchristos #define TRACE \
64*66a1527dSchristos do { \
65*66a1527dSchristos printf("(%3d) v0 %08x %08x\n", (int)inlen, (uint32_t)(v0 >> 32), \
66*66a1527dSchristos (uint32_t)v0); \
67*66a1527dSchristos printf("(%3d) v1 %08x %08x\n", (int)inlen, (uint32_t)(v1 >> 32), \
68*66a1527dSchristos (uint32_t)v1); \
69*66a1527dSchristos printf("(%3d) v2 %08x %08x\n", (int)inlen, (uint32_t)(v2 >> 32), \
70*66a1527dSchristos (uint32_t)v2); \
71*66a1527dSchristos printf("(%3d) v3 %08x %08x\n", (int)inlen, (uint32_t)(v3 >> 32), \
72*66a1527dSchristos (uint32_t)v3); \
73*66a1527dSchristos } while (0)
74*66a1527dSchristos #else
75*66a1527dSchristos #define TRACE
76*66a1527dSchristos #endif
77*66a1527dSchristos
siphash(const uint8_t * in,const size_t inlen,const uint8_t * k,uint8_t * out,const size_t outlen)78*66a1527dSchristos int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k,
79*66a1527dSchristos uint8_t *out, const size_t outlen) {
80*66a1527dSchristos uint64_t v0 = 0x736f6d6570736575ULL;
81*66a1527dSchristos uint64_t v1 = 0x646f72616e646f6dULL;
82*66a1527dSchristos uint64_t v2 = 0x6c7967656e657261ULL;
83*66a1527dSchristos uint64_t v3 = 0x7465646279746573ULL;
84*66a1527dSchristos uint64_t k0 = U8TO64_LE(k);
85*66a1527dSchristos uint64_t k1 = U8TO64_LE(k + 8);
86*66a1527dSchristos uint64_t m;
87*66a1527dSchristos int i;
88*66a1527dSchristos const uint8_t *end = in + inlen - (inlen % sizeof(uint64_t));
89*66a1527dSchristos const int left = inlen & 7;
90*66a1527dSchristos uint64_t b = ((uint64_t)inlen) << 56;
91*66a1527dSchristos v3 ^= k1;
92*66a1527dSchristos v2 ^= k0;
93*66a1527dSchristos v1 ^= k1;
94*66a1527dSchristos v0 ^= k0;
95*66a1527dSchristos
96*66a1527dSchristos assert((outlen == 8) || (outlen == 16));
97*66a1527dSchristos if (outlen == 16)
98*66a1527dSchristos v1 ^= 0xee;
99*66a1527dSchristos
100*66a1527dSchristos for (; in != end; in += 8) {
101*66a1527dSchristos m = U8TO64_LE(in);
102*66a1527dSchristos v3 ^= m;
103*66a1527dSchristos
104*66a1527dSchristos TRACE;
105*66a1527dSchristos for (i = 0; i < cROUNDS; ++i)
106*66a1527dSchristos SIPROUND;
107*66a1527dSchristos
108*66a1527dSchristos v0 ^= m;
109*66a1527dSchristos }
110*66a1527dSchristos
111*66a1527dSchristos switch (left) {
112*66a1527dSchristos case 7:
113*66a1527dSchristos b |= ((uint64_t)in[6]) << 48;
114*66a1527dSchristos /* fallthrough */
115*66a1527dSchristos case 6:
116*66a1527dSchristos b |= ((uint64_t)in[5]) << 40;
117*66a1527dSchristos /* fallthrough */
118*66a1527dSchristos case 5:
119*66a1527dSchristos b |= ((uint64_t)in[4]) << 32;
120*66a1527dSchristos /* fallthrough */
121*66a1527dSchristos case 4:
122*66a1527dSchristos b |= ((uint64_t)in[3]) << 24;
123*66a1527dSchristos /* fallthrough */
124*66a1527dSchristos case 3:
125*66a1527dSchristos b |= ((uint64_t)in[2]) << 16;
126*66a1527dSchristos /* fallthrough */
127*66a1527dSchristos case 2:
128*66a1527dSchristos b |= ((uint64_t)in[1]) << 8;
129*66a1527dSchristos /* fallthrough */
130*66a1527dSchristos case 1:
131*66a1527dSchristos b |= ((uint64_t)in[0]);
132*66a1527dSchristos break;
133*66a1527dSchristos case 0:
134*66a1527dSchristos break;
135*66a1527dSchristos }
136*66a1527dSchristos
137*66a1527dSchristos v3 ^= b;
138*66a1527dSchristos
139*66a1527dSchristos TRACE;
140*66a1527dSchristos for (i = 0; i < cROUNDS; ++i)
141*66a1527dSchristos SIPROUND;
142*66a1527dSchristos
143*66a1527dSchristos v0 ^= b;
144*66a1527dSchristos
145*66a1527dSchristos if (outlen == 16)
146*66a1527dSchristos v2 ^= 0xee;
147*66a1527dSchristos else
148*66a1527dSchristos v2 ^= 0xff;
149*66a1527dSchristos
150*66a1527dSchristos TRACE;
151*66a1527dSchristos for (i = 0; i < dROUNDS; ++i)
152*66a1527dSchristos SIPROUND;
153*66a1527dSchristos
154*66a1527dSchristos b = v0 ^ v1 ^ v2 ^ v3;
155*66a1527dSchristos U64TO8_LE(out, b);
156*66a1527dSchristos
157*66a1527dSchristos if (outlen == 8)
158*66a1527dSchristos return 0;
159*66a1527dSchristos
160*66a1527dSchristos v1 ^= 0xdd;
161*66a1527dSchristos
162*66a1527dSchristos TRACE;
163*66a1527dSchristos for (i = 0; i < dROUNDS; ++i)
164*66a1527dSchristos SIPROUND;
165*66a1527dSchristos
166*66a1527dSchristos b = v0 ^ v1 ^ v2 ^ v3;
167*66a1527dSchristos U64TO8_LE(out + 8, b);
168*66a1527dSchristos
169*66a1527dSchristos return 0;
170*66a1527dSchristos }
171