1 /* 2 BLAKE2 reference source code package - reference C implementations 3 4 Copyright 2012, Samuel Neves <sneves@dei.uc.pt>. You may use this under the 5 terms of the CC0, the OpenSSL Licence, or the Apache Public License 2.0, at 6 your option. The terms of these licenses can be found at: 7 8 - CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0 9 - OpenSSL license : https://www.openssl.org/source/license.html 10 - Apache 2.0 : http://www.apache.org/licenses/LICENSE-2.0 11 12 More information about the BLAKE2 hash function can be found at 13 https://blake2.net. 14 */ 15 16 #include "archive_platform.h" 17 18 #include <stdint.h> 19 #include <string.h> 20 #include <stdio.h> 21 22 #include "archive_blake2.h" 23 #include "archive_blake2_impl.h" 24 25 static const uint32_t blake2s_IV[8] = 26 { 27 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL, 28 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL 29 }; 30 31 static const uint8_t blake2s_sigma[10][16] = 32 { 33 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } , 34 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } , 35 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } , 36 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } , 37 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } , 38 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } , 39 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } , 40 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } , 41 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } , 42 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } , 43 }; 44 45 static void blake2s_set_lastnode( blake2s_state *S ) 46 { 47 S->f[1] = (uint32_t)-1; 48 } 49 50 /* Some helper functions, not necessarily useful */ 51 static int blake2s_is_lastblock( const blake2s_state *S ) 52 { 53 return S->f[0] != 0; 54 } 55 56 static void blake2s_set_lastblock( blake2s_state *S ) 57 { 58 if( S->last_node ) blake2s_set_lastnode( S ); 59 60 S->f[0] = (uint32_t)-1; 61 } 62 63 static void blake2s_increment_counter( blake2s_state *S, const uint32_t inc ) 64 { 65 S->t[0] += inc; 66 S->t[1] += ( S->t[0] < inc ); 67 } 68 69 static void blake2s_init0( blake2s_state *S ) 70 { 71 size_t i; 72 memset( S, 0, sizeof( blake2s_state ) ); 73 74 for( i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i]; 75 } 76 77 /* init2 xors IV with input parameter block */ 78 int blake2s_init_param( blake2s_state *S, const blake2s_param *P ) 79 { 80 const unsigned char *p = ( const unsigned char * )( P ); 81 size_t i; 82 83 blake2s_init0( S ); 84 85 /* IV XOR ParamBlock */ 86 for( i = 0; i < 8; ++i ) 87 S->h[i] ^= load32( &p[i * 4] ); 88 89 S->outlen = P->digest_length; 90 return 0; 91 } 92 93 94 /* Sequential blake2s initialization */ 95 int blake2s_init( blake2s_state *S, size_t outlen ) 96 { 97 blake2s_param P[1]; 98 99 /* Move interval verification here? */ 100 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1; 101 102 P->digest_length = (uint8_t)outlen; 103 P->key_length = 0; 104 P->fanout = 1; 105 P->depth = 1; 106 store32( &P->leaf_length, 0 ); 107 store32( &P->node_offset, 0 ); 108 store16( &P->xof_length, 0 ); 109 P->node_depth = 0; 110 P->inner_length = 0; 111 /* memset(P->reserved, 0, sizeof(P->reserved) ); */ 112 memset( P->salt, 0, sizeof( P->salt ) ); 113 memset( P->personal, 0, sizeof( P->personal ) ); 114 return blake2s_init_param( S, P ); 115 } 116 117 int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen ) 118 { 119 blake2s_param P[1]; 120 121 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1; 122 123 if ( !key || !keylen || keylen > BLAKE2S_KEYBYTES ) return -1; 124 125 P->digest_length = (uint8_t)outlen; 126 P->key_length = (uint8_t)keylen; 127 P->fanout = 1; 128 P->depth = 1; 129 store32( &P->leaf_length, 0 ); 130 store32( &P->node_offset, 0 ); 131 store16( &P->xof_length, 0 ); 132 P->node_depth = 0; 133 P->inner_length = 0; 134 /* memset(P->reserved, 0, sizeof(P->reserved) ); */ 135 memset( P->salt, 0, sizeof( P->salt ) ); 136 memset( P->personal, 0, sizeof( P->personal ) ); 137 138 if( blake2s_init_param( S, P ) < 0 ) return -1; 139 140 { 141 uint8_t block[BLAKE2S_BLOCKBYTES]; 142 memset( block, 0, BLAKE2S_BLOCKBYTES ); 143 memcpy( block, key, keylen ); 144 blake2s_update( S, block, BLAKE2S_BLOCKBYTES ); 145 secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */ 146 } 147 return 0; 148 } 149 150 #define G(r,i,a,b,c,d) \ 151 do { \ 152 a = a + b + m[blake2s_sigma[r][2*i+0]]; \ 153 d = rotr32(d ^ a, 16); \ 154 c = c + d; \ 155 b = rotr32(b ^ c, 12); \ 156 a = a + b + m[blake2s_sigma[r][2*i+1]]; \ 157 d = rotr32(d ^ a, 8); \ 158 c = c + d; \ 159 b = rotr32(b ^ c, 7); \ 160 } while(0) 161 162 #define ROUND(r) \ 163 do { \ 164 G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \ 165 G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \ 166 G(r,2,v[ 2],v[ 6],v[10],v[14]); \ 167 G(r,3,v[ 3],v[ 7],v[11],v[15]); \ 168 G(r,4,v[ 0],v[ 5],v[10],v[15]); \ 169 G(r,5,v[ 1],v[ 6],v[11],v[12]); \ 170 G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \ 171 G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \ 172 } while(0) 173 174 static void blake2s_compress( blake2s_state *S, const uint8_t in[BLAKE2S_BLOCKBYTES] ) 175 { 176 uint32_t m[16]; 177 uint32_t v[16]; 178 size_t i; 179 180 for( i = 0; i < 16; ++i ) { 181 m[i] = load32( in + i * sizeof( m[i] ) ); 182 } 183 184 for( i = 0; i < 8; ++i ) { 185 v[i] = S->h[i]; 186 } 187 188 v[ 8] = blake2s_IV[0]; 189 v[ 9] = blake2s_IV[1]; 190 v[10] = blake2s_IV[2]; 191 v[11] = blake2s_IV[3]; 192 v[12] = S->t[0] ^ blake2s_IV[4]; 193 v[13] = S->t[1] ^ blake2s_IV[5]; 194 v[14] = S->f[0] ^ blake2s_IV[6]; 195 v[15] = S->f[1] ^ blake2s_IV[7]; 196 197 ROUND( 0 ); 198 ROUND( 1 ); 199 ROUND( 2 ); 200 ROUND( 3 ); 201 ROUND( 4 ); 202 ROUND( 5 ); 203 ROUND( 6 ); 204 ROUND( 7 ); 205 ROUND( 8 ); 206 ROUND( 9 ); 207 208 for( i = 0; i < 8; ++i ) { 209 S->h[i] = S->h[i] ^ v[i] ^ v[i + 8]; 210 } 211 } 212 213 #undef G 214 #undef ROUND 215 216 int blake2s_update( blake2s_state *S, const void *pin, size_t inlen ) 217 { 218 const unsigned char * in = (const unsigned char *)pin; 219 if( inlen > 0 ) 220 { 221 size_t left = S->buflen; 222 size_t fill = BLAKE2S_BLOCKBYTES - left; 223 if( inlen > fill ) 224 { 225 S->buflen = 0; 226 memcpy( S->buf + left, in, fill ); /* Fill buffer */ 227 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES ); 228 blake2s_compress( S, S->buf ); /* Compress */ 229 in += fill; inlen -= fill; 230 while(inlen > BLAKE2S_BLOCKBYTES) { 231 blake2s_increment_counter(S, BLAKE2S_BLOCKBYTES); 232 blake2s_compress( S, in ); 233 in += BLAKE2S_BLOCKBYTES; 234 inlen -= BLAKE2S_BLOCKBYTES; 235 } 236 } 237 memcpy( S->buf + S->buflen, in, inlen ); 238 S->buflen += inlen; 239 } 240 return 0; 241 } 242 243 int blake2s_final( blake2s_state *S, void *out, size_t outlen ) 244 { 245 uint8_t buffer[BLAKE2S_OUTBYTES] = {0}; 246 size_t i; 247 248 if( out == NULL || outlen < S->outlen ) 249 return -1; 250 251 if( blake2s_is_lastblock( S ) ) 252 return -1; 253 254 blake2s_increment_counter( S, ( uint32_t )S->buflen ); 255 blake2s_set_lastblock( S ); 256 memset( S->buf + S->buflen, 0, BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */ 257 blake2s_compress( S, S->buf ); 258 259 for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */ 260 store32( buffer + sizeof( S->h[i] ) * i, S->h[i] ); 261 262 memcpy( out, buffer, outlen ); 263 secure_zero_memory(buffer, sizeof(buffer)); 264 return 0; 265 } 266 267 int blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) 268 { 269 blake2s_state S[1]; 270 271 /* Verify parameters */ 272 if ( NULL == in && inlen > 0 ) return -1; 273 274 if ( NULL == out ) return -1; 275 276 if ( NULL == key && keylen > 0) return -1; 277 278 if( !outlen || outlen > BLAKE2S_OUTBYTES ) return -1; 279 280 if( keylen > BLAKE2S_KEYBYTES ) return -1; 281 282 if( keylen > 0 ) 283 { 284 if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1; 285 } 286 else 287 { 288 if( blake2s_init( S, outlen ) < 0 ) return -1; 289 } 290 291 blake2s_update( S, ( const uint8_t * )in, inlen ); 292 blake2s_final( S, out, outlen ); 293 return 0; 294 } 295 296 #if defined(SUPERCOP) 297 int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen ) 298 { 299 return blake2s( out, BLAKE2S_OUTBYTES, in, inlen, NULL, 0 ); 300 } 301 #endif 302 303 #if defined(BLAKE2S_SELFTEST) 304 #include <string.h> 305 #include "blake2-kat.h" 306 int main( void ) 307 { 308 uint8_t key[BLAKE2S_KEYBYTES]; 309 uint8_t buf[BLAKE2_KAT_LENGTH]; 310 size_t i, step; 311 312 for( i = 0; i < BLAKE2S_KEYBYTES; ++i ) 313 key[i] = ( uint8_t )i; 314 315 for( i = 0; i < BLAKE2_KAT_LENGTH; ++i ) 316 buf[i] = ( uint8_t )i; 317 318 /* Test simple API */ 319 for( i = 0; i < BLAKE2_KAT_LENGTH; ++i ) 320 { 321 uint8_t hash[BLAKE2S_OUTBYTES]; 322 blake2s( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES ); 323 324 if( 0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) ) 325 { 326 goto fail; 327 } 328 } 329 330 /* Test streaming API */ 331 for(step = 1; step < BLAKE2S_BLOCKBYTES; ++step) { 332 for (i = 0; i < BLAKE2_KAT_LENGTH; ++i) { 333 uint8_t hash[BLAKE2S_OUTBYTES]; 334 blake2s_state S; 335 uint8_t * p = buf; 336 size_t mlen = i; 337 int err = 0; 338 339 if( (err = blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) { 340 goto fail; 341 } 342 343 while (mlen >= step) { 344 if ( (err = blake2s_update(&S, p, step)) < 0 ) { 345 goto fail; 346 } 347 mlen -= step; 348 p += step; 349 } 350 if ( (err = blake2s_update(&S, p, mlen)) < 0) { 351 goto fail; 352 } 353 if ( (err = blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) { 354 goto fail; 355 } 356 357 if (0 != memcmp(hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES)) { 358 goto fail; 359 } 360 } 361 } 362 363 puts( "ok" ); 364 return 0; 365 fail: 366 puts("error"); 367 return -1; 368 } 369 #endif 370