1 /* $OpenBSD: siphash.c,v 1.3 2015/02/20 11:51:03 tedu Exp $ */ 2 3 /*- 4 * Copyright (c) 2013 Andre Oppermann <andre@FreeBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * SipHash is a family of PRFs SipHash-c-d where the integer parameters c and d 34 * are the number of compression rounds and the number of finalization rounds. 35 * A compression round is identical to a finalization round and this round 36 * function is called SipRound. Given a 128-bit key k and a (possibly empty) 37 * byte string m, SipHash-c-d returns a 64-bit value SipHash-c-d(k; m). 38 * 39 * Implemented from the paper "SipHash: a fast short-input PRF", 2012.09.18, 40 * by Jean-Philippe Aumasson and Daniel J. Bernstein, 41 * Permanent Document ID b9a943a805fbfc6fde808af9fc0ecdfa 42 * https://131002.net/siphash/siphash.pdf 43 * https://131002.net/siphash/ 44 */ 45 46 #include <sys/param.h> 47 #include <sys/systm.h> 48 49 #include <crypto/siphash.h> 50 51 static void SipHash_CRounds(SIPHASH_CTX *, int); 52 static void SipHash_Rounds(SIPHASH_CTX *, int); 53 54 void 55 SipHash_Init(SIPHASH_CTX *ctx, const SIPHASH_KEY *key) 56 { 57 uint64_t k0, k1; 58 59 k0 = lemtoh64(&key->k0); 60 k1 = lemtoh64(&key->k1); 61 62 ctx->v[0] = 0x736f6d6570736575ULL ^ k0; 63 ctx->v[1] = 0x646f72616e646f6dULL ^ k1; 64 ctx->v[2] = 0x6c7967656e657261ULL ^ k0; 65 ctx->v[3] = 0x7465646279746573ULL ^ k1; 66 67 memset(ctx->buf, 0, sizeof(ctx->buf)); 68 ctx->bytes = 0; 69 } 70 71 void 72 SipHash_Update(SIPHASH_CTX *ctx, int rc, int rf, const void *src, size_t len) 73 { 74 const uint8_t *ptr = src; 75 size_t left, used; 76 77 if (len == 0) 78 return; 79 80 used = ctx->bytes % sizeof(ctx->buf); 81 ctx->bytes += len; 82 83 if (used > 0) { 84 left = sizeof(ctx->buf) - used; 85 86 if (len >= left) { 87 memcpy(&ctx->buf[used], ptr, left); 88 SipHash_CRounds(ctx, rc); 89 len -= left; 90 ptr += left; 91 } else { 92 memcpy(&ctx->buf[used], ptr, len); 93 return; 94 } 95 } 96 97 while (len >= sizeof(ctx->buf)) { 98 memcpy(ctx->buf, ptr, sizeof(ctx->buf)); 99 SipHash_CRounds(ctx, rc); 100 len -= sizeof(ctx->buf); 101 ptr += sizeof(ctx->buf); 102 } 103 104 if (len > 0) 105 memcpy(&ctx->buf[used], ptr, len); 106 } 107 108 void 109 SipHash_Final(void *dst, SIPHASH_CTX *ctx, int rc, int rf) 110 { 111 uint64_t r; 112 113 r = SipHash_End(ctx, rc, rf); 114 115 htolem64((uint64_t *)dst, r); 116 } 117 118 uint64_t 119 SipHash_End(SIPHASH_CTX *ctx, int rc, int rf) 120 { 121 uint64_t r; 122 size_t left, used; 123 124 used = ctx->bytes % sizeof(ctx->buf); 125 left = sizeof(ctx->buf) - used; 126 memset(&ctx->buf[used], 0, left - 1); 127 ctx->buf[7] = ctx->bytes; 128 129 SipHash_CRounds(ctx, rc); 130 ctx->v[2] ^= 0xff; 131 SipHash_Rounds(ctx, rf); 132 133 r = (ctx->v[0] ^ ctx->v[1]) ^ (ctx->v[2] ^ ctx->v[3]); 134 explicit_bzero(ctx, sizeof(*ctx)); 135 return (r); 136 } 137 138 uint64_t 139 SipHash(const SIPHASH_KEY *key, int rc, int rf, const void *src, size_t len) 140 { 141 SIPHASH_CTX ctx; 142 143 SipHash_Init(&ctx, key); 144 SipHash_Update(&ctx, rc, rf, src, len); 145 return (SipHash_End(&ctx, rc, rf)); 146 } 147 148 #define SIP_ROTL(x, b) ((x) << (b)) | ( (x) >> (64 - (b))) 149 150 static void 151 SipHash_Rounds(SIPHASH_CTX *ctx, int rounds) 152 { 153 while (rounds--) { 154 ctx->v[0] += ctx->v[1]; 155 ctx->v[2] += ctx->v[3]; 156 ctx->v[1] = SIP_ROTL(ctx->v[1], 13); 157 ctx->v[3] = SIP_ROTL(ctx->v[3], 16); 158 159 ctx->v[1] ^= ctx->v[0]; 160 ctx->v[3] ^= ctx->v[2]; 161 ctx->v[0] = SIP_ROTL(ctx->v[0], 32); 162 163 ctx->v[2] += ctx->v[1]; 164 ctx->v[0] += ctx->v[3]; 165 ctx->v[1] = SIP_ROTL(ctx->v[1], 17); 166 ctx->v[3] = SIP_ROTL(ctx->v[3], 21); 167 168 ctx->v[1] ^= ctx->v[2]; 169 ctx->v[3] ^= ctx->v[0]; 170 ctx->v[2] = SIP_ROTL(ctx->v[2], 32); 171 } 172 } 173 174 static void 175 SipHash_CRounds(SIPHASH_CTX *ctx, int rounds) 176 { 177 uint64_t m = lemtoh64((uint64_t *)ctx->buf); 178 179 ctx->v[3] ^= m; 180 SipHash_Rounds(ctx, rounds); 181 ctx->v[0] ^= m; 182 } 183