bird/lib/blake2s.c
Toke Høiland-Jørgensen 725d9af94a Lib: Add Blake2s and Blake2b hash functions
The Babel MAC authentication RFC recommends implementing Blake2s as one of
the supported algorithms. In order to achieve do this, add the blake2b and
blake2s hash functions for MAC authentication. The hashing function
implementations are the reference implementations from blake2.net.

The Blake2 algorithms allow specifying an arbitrary output size, and the
Babel MAC spec says to implement Blake2s with 128-bit output. To satisfy
this, we add two different variants of each of the algorithms, one using
the default size (256 bits for Blake2s, 512 bits for Blake2b), and one
using half the default output size.

Update to BIRD coding style done by committer.
2021-06-06 16:26:58 +02:00

313 lines
7.7 KiB
C

/*
* BIRD Library -- BLAKE2s Hash Function
*
* Based on the code from BLAKE2 reference source code package
*
* Copyright 2012, Samuel Neves <sneves@dei.uc.pt>
*
* You may use this under the terms of the CC0, the OpenSSL Licence, or the
* Apache Public License 2.0, at your option. The terms of these licenses
* can be found at:
*
* - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0
* - OpenSSL license : https://www.openssl.org/source/license.html
* - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0
*
* More information about the BLAKE2 hash function can be found at
* https://blake2.net/ web.
*/
#include "lib/mac.h"
#include "lib/blake2.h"
#include "lib/blake2-impl.h"
static const u32 blake2s_IV[8] =
{
0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
};
static const u8 blake2s_sigma[10][16] =
{
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
};
STATIC_ASSERT(sizeof(struct blake2s_param) == BLAKE2S_OUTBYTES);
static inline void
blake2s_set_lastnode(struct blake2s_state *s)
{
s->f[1] = (u32) -1;
}
/* Some helper functions, not necessarily useful */
static inline int
blake2s_is_lastblock(const struct blake2s_state *s)
{
return s->f[0] != 0;
}
static inline void
blake2s_set_lastblock(struct blake2s_state *s)
{
if (s->last_node)
blake2s_set_lastnode(s);
s->f[0] = (u32) -1;
}
static inline void
blake2s_increment_counter(struct blake2s_state *s, const u32 inc)
{
s->t[0] += inc;
s->t[1] += (s->t[0] < inc);
}
static void
blake2s_init0(struct blake2s_state *s)
{
memset(s, 0, sizeof(struct blake2s_state));
for (uint i = 0; i < 8; ++i)
s->h[i] = blake2s_IV[i];
}
/* init2 xors IV with input parameter block */
int
blake2s_init_param(struct blake2s_state *s, const struct blake2s_param *p)
{
const byte *pb = (const void *) p;
blake2s_init0(s);
/* IV XOR ParamBlock */
for (uint i = 0; i < 8; ++i)
s->h[i] ^= load32(&pb[i * 4]);
s->outlen = p->digest_length;
return 0;
}
/* Sequential blake2s initialization */
int
blake2s_init(struct blake2s_state *s, size_t outlen)
{
struct blake2s_param p[1];
/* Move interval verification here? */
if (!outlen || (outlen > BLAKE2S_OUTBYTES))
return -1;
p->digest_length = (uint8_t) outlen;
p->key_length = 0;
p->fanout = 1;
p->depth = 1;
store32(&p->leaf_length, 0);
store32(&p->node_offset, 0);
store16(&p->xof_length, 0);
p->node_depth = 0;
p->inner_length = 0;
/* memset(p->reserved, 0, sizeof(p->reserved)); */
memset(p->salt, 0, sizeof(p->salt));
memset(p->personal, 0, sizeof(p->personal));
return blake2s_init_param(s, p);
}
int
blake2s_init_key(struct blake2s_state *s, size_t outlen, const void *key, size_t keylen)
{
struct blake2s_param p[1];
if (!outlen || (outlen > BLAKE2S_OUTBYTES))
return -1;
if (!key || !keylen || (keylen > BLAKE2S_KEYBYTES))
return -1;
p->digest_length = (uint8_t) outlen;
p->key_length = (uint8_t) keylen;
p->fanout = 1;
p->depth = 1;
store32(&p->leaf_length, 0);
store32(&p->node_offset, 0);
store16(&p->xof_length, 0);
p->node_depth = 0;
p->inner_length = 0;
/* memset(p->reserved, 0, sizeof(p->reserved)); */
memset(p->salt, 0, sizeof(p->salt));
memset(p->personal, 0, sizeof(p->personal));
if (blake2s_init_param(s, p) < 0)
return -1;
{
byte block[BLAKE2S_BLOCKBYTES];
memset(block, 0, BLAKE2S_BLOCKBYTES);
memcpy(block, key, keylen);
blake2s_update(s, block, BLAKE2S_BLOCKBYTES);
secure_zero_memory(block, BLAKE2S_BLOCKBYTES); /* Burn the key from stack */
}
return 0;
}
#define G(r,i,a,b,c,d) \
do { \
a = a + b + m[blake2s_sigma[r][2*i+0]]; \
d = rotr32(d ^ a, 16); \
c = c + d; \
b = rotr32(b ^ c, 12); \
a = a + b + m[blake2s_sigma[r][2*i+1]]; \
d = rotr32(d ^ a, 8); \
c = c + d; \
b = rotr32(b ^ c, 7); \
} while(0)
#define ROUND(r) \
do { \
G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
G(r,2,v[ 2],v[ 6],v[10],v[14]); \
G(r,3,v[ 3],v[ 7],v[11],v[15]); \
G(r,4,v[ 0],v[ 5],v[10],v[15]); \
G(r,5,v[ 1],v[ 6],v[11],v[12]); \
G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
} while(0)
static void
blake2s_compress(struct blake2s_state *s, const byte in[BLAKE2S_BLOCKBYTES])
{
u32 m[16];
u32 v[16];
uint i;
for (i = 0; i < 16; ++i)
m[i] = load32(in + i * sizeof(m[i]));
for (i = 0; i < 8; ++i)
v[i] = s->h[i];
v[ 8] = blake2s_IV[0];
v[ 9] = blake2s_IV[1];
v[10] = blake2s_IV[2];
v[11] = blake2s_IV[3];
v[12] = s->t[0] ^ blake2s_IV[4];
v[13] = s->t[1] ^ blake2s_IV[5];
v[14] = s->f[0] ^ blake2s_IV[6];
v[15] = s->f[1] ^ blake2s_IV[7];
ROUND(0);
ROUND(1);
ROUND(2);
ROUND(3);
ROUND(4);
ROUND(5);
ROUND(6);
ROUND(7);
ROUND(8);
ROUND(9);
for (i = 0; i < 8; ++i)
s->h[i] = s->h[i] ^ v[i] ^ v[i + 8];
}
#undef G
#undef ROUND
int
blake2s_update(struct blake2s_state *s, const void *pin, size_t inlen)
{
const byte *in = pin;
if (inlen > 0)
{
size_t left = s->buflen;
size_t fill = BLAKE2S_BLOCKBYTES - left;
if (inlen > fill)
{
s->buflen = 0;
memcpy(s->buf + left, in, fill); /* Fill buffer */
blake2s_increment_counter(s, BLAKE2S_BLOCKBYTES);
blake2s_compress(s, s->buf); /* Compress */
in += fill; inlen -= fill;
while (inlen > BLAKE2S_BLOCKBYTES)
{
blake2s_increment_counter(s, BLAKE2S_BLOCKBYTES);
blake2s_compress(s, in);
in += BLAKE2S_BLOCKBYTES;
inlen -= BLAKE2S_BLOCKBYTES;
}
}
memcpy(s->buf + s->buflen, in, inlen);
s->buflen += inlen;
}
return 0;
}
int
blake2s_final(struct blake2s_state *s, void *out, size_t outlen)
{
byte buffer[BLAKE2S_OUTBYTES] = {0};
if (!out || (outlen < s->outlen))
return -1;
if (blake2s_is_lastblock(s))
return -1;
blake2s_increment_counter(s, s->buflen);
blake2s_set_lastblock(s);
memset(s->buf + s->buflen, 0, BLAKE2S_BLOCKBYTES - s->buflen); /* Padding */
blake2s_compress(s, s->buf);
/* Output full hash to temp buffer */
for (uint i = 0; i < 8; ++i)
store32(buffer + sizeof(s->h[i]) * i, s->h[i]);
memcpy(out, buffer, outlen);
secure_zero_memory(buffer, sizeof(buffer));
return 0;
}
void
blake2s_mac_init(struct mac_context *mac, const byte *key, uint keylen)
{
struct blake2s_context *ctx = (void *) mac;
blake2s_init_key(&ctx->state, mac_get_length(mac), key, keylen);
}
void
blake2s_mac_update(struct mac_context *mac, const byte *data, uint datalen)
{
struct blake2s_context *ctx = (void *) mac;
blake2s_update(&ctx->state, data, datalen);
}
byte *
blake2s_mac_final(struct mac_context *mac)
{
struct blake2s_context *ctx = (void *) mac;
blake2s_final(&ctx->state, ctx->buf, mac_get_length(mac));
return ctx->buf;
}