1 /*
2 * Copyright (C) 2014 Vincent Hanquez <vincent@snarc.org>
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 *
24 * Based on scrypt from Colin Percival's paper
25 */
26
27 #include <stdint.h>
28 #include <string.h>
29 #include "cryptonite_bitfn.h"
30 #include "cryptonite_align.h"
31 #include "cryptonite_salsa.h"
32
blockmix_salsa8(uint32_t * in,uint32_t * out,uint32_t * X,const uint32_t r)33 static void blockmix_salsa8(uint32_t *in, uint32_t *out, uint32_t *X, const uint32_t r)
34 {
35 int i;
36
37 array_copy32(X, &in[(2 * r - 1) * 16], 16);
38
39 for (i = 0; i < 2 * r; i += 2) {
40 cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16]);
41 array_copy32(&out[i * 8], X, 16);
42
43 cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16+16]);
44 array_copy32(&out[i * 8 + r * 16], X, 16);
45 }
46 }
47
integerify(uint32_t * B,const uint32_t r)48 static inline uint64_t integerify(uint32_t *B, const uint32_t r)
49 {
50 return B[(2*r-1) * 16] | (uint64_t)B[(2*r-1) * 16 + 1] << 32;
51 }
52
cryptonite_scrypt_smix(uint8_t * B,const uint32_t r,const uint64_t N,uint32_t * V,uint32_t * XY)53 void cryptonite_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint32_t *V, uint32_t *XY)
54 {
55 uint32_t *X = XY;
56 uint32_t *Y = &XY[32 * r];
57 uint32_t *Z = &XY[64 * r];
58 uint64_t i, j;
59 int k;
60 const int r32 = 32*r;
61
62 for (k = 0; k < r32; k++)
63 X[k] = load_le32_aligned(&B[4 * k]);
64 for (i = 0; i < N; i += 2) {
65 array_copy32(&V[i * r32], X, r32);
66 blockmix_salsa8(X, Y, Z, r);
67 array_copy32(&V[(i + 1) * r32], Y, r32);
68 blockmix_salsa8(Y, X, Z, r);
69 }
70 for (i = 0; i < N; i += 2) {
71 j = integerify(X, r) & (N - 1);
72 array_xor32(X, &V[j * r32], r32);
73 blockmix_salsa8(X, Y, Z, r);
74
75 j = integerify(Y, r) & (N - 1);
76 array_xor32(Y, &V[j * r32], r32);
77 blockmix_salsa8(Y, X, Z, r);
78 }
79 for (k = 0; k < r32; k++)
80 store_le32_aligned(&B[4*k], X[k]);
81 }
82