Python code coverage for Modules/_blake2/impl/blake2s.c

#	count	content
1	n/a	/*
2	n/a	BLAKE2 reference source code package - optimized C implementations
3	n/a
4	n/a	Copyright 2012, Samuel Neves <sneves@dei.uc.pt>. You may use this under the
5	n/a	terms of the CC0, the OpenSSL Licence, or the Apache Public License 2.0, at
6	n/a	your option. The terms of these licenses can be found at:
7	n/a
8	n/a	- CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0
9	n/a	- OpenSSL license : https://www.openssl.org/source/license.html
10	n/a	- Apache 2.0 : http://www.apache.org/licenses/LICENSE-2.0
11	n/a
12	n/a	More information about the BLAKE2 hash function can be found at
13	n/a	https://blake2.net.
14	n/a	*/
15	n/a
16	n/a	#include <stdint.h>
17	n/a	#include <string.h>
18	n/a	#include <stdio.h>
19	n/a
20	n/a	#include "blake2.h"
21	n/a	#include "blake2-impl.h"
22	n/a
23	n/a	#include "blake2-config.h"
24	n/a
25	n/a
26	n/a	#include <emmintrin.h>
27	n/a	#if defined(HAVE_SSSE3)
28	n/a	#include <tmmintrin.h>
29	n/a	#endif
30	n/a	#if defined(HAVE_SSE41)
31	n/a	#include <smmintrin.h>
32	n/a	#endif
33	n/a	#if defined(HAVE_AVX)
34	n/a	#include <immintrin.h>
35	n/a	#endif
36	n/a	#if defined(HAVE_XOP)
37	n/a	#include <x86intrin.h>
38	n/a	#endif
39	n/a
40	n/a	#include "blake2s-round.h"
41	n/a
42	n/a	static const uint32_t blake2s_IV[8] =
43	n/a	{
44	n/a	0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
45	n/a	0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
46	n/a	};
47	n/a
48	n/a	static const uint8_t blake2s_sigma[10][16] =
49	n/a	{
50	n/a	{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
51	n/a	{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
52	n/a	{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
53	n/a	{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
54	n/a	{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
55	n/a	{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
56	n/a	{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
57	n/a	{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
58	n/a	{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
59	n/a	{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,
60	n/a	};
61	n/a
62	n/a
63	n/a	/* Some helper functions, not necessarily useful */
64	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_set_lastnode( blake2s_state *S )
65	n/a	{
66	n/a	S->f[1] = -1;
67	n/a	return 0;
68	n/a	}
69	n/a
70	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_clear_lastnode( blake2s_state *S )
71	n/a	{
72	n/a	S->f[1] = 0;
73	n/a	return 0;
74	n/a	}
75	n/a
76	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_is_lastblock( const blake2s_state *S )
77	n/a	{
78	n/a	return S->f[0] != 0;
79	n/a	}
80	n/a
81	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_set_lastblock( blake2s_state *S )
82	n/a	{
83	n/a	if( S->last_node ) blake2s_set_lastnode( S );
84	n/a
85	n/a	S->f[0] = -1;
86	n/a	return 0;
87	n/a	}
88	n/a
89	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_clear_lastblock( blake2s_state *S )
90	n/a	{
91	n/a	if( S->last_node ) blake2s_clear_lastnode( S );
92	n/a
93	n/a	S->f[0] = 0;
94	n/a	return 0;
95	n/a	}
96	n/a
97	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_increment_counter( blake2s_state *S, const uint32_t inc )
98	n/a	{
99	n/a	uint64_t t = ( ( uint64_t )S->t[1] << 32 ) \| S->t[0];
100	n/a	t += inc;
101	n/a	S->t[0] = ( uint32_t )( t >> 0 );
102	n/a	S->t[1] = ( uint32_t )( t >> 32 );
103	n/a	return 0;
104	n/a	}
105	n/a
106	n/a
107	n/a	/* Parameter-related functions */
108	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_digest_length( blake2s_param *P, const uint8_t digest_length )
109	n/a	{
110	n/a	P->digest_length = digest_length;
111	n/a	return 0;
112	n/a	}
113	n/a
114	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_fanout( blake2s_param *P, const uint8_t fanout )
115	n/a	{
116	n/a	P->fanout = fanout;
117	n/a	return 0;
118	n/a	}
119	n/a
120	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_max_depth( blake2s_param *P, const uint8_t depth )
121	n/a	{
122	n/a	P->depth = depth;
123	n/a	return 0;
124	n/a	}
125	n/a
126	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_leaf_length( blake2s_param *P, const uint32_t leaf_length )
127	n/a	{
128	n/a	P->leaf_length = leaf_length;
129	n/a	return 0;
130	n/a	}
131	n/a
132	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_node_offset( blake2s_param *P, const uint64_t node_offset )
133	n/a	{
134	n/a	store48( P->node_offset, node_offset );
135	n/a	return 0;
136	n/a	}
137	n/a
138	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_node_depth( blake2s_param *P, const uint8_t node_depth )
139	n/a	{
140	n/a	P->node_depth = node_depth;
141	n/a	return 0;
142	n/a	}
143	n/a
144	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_inner_length( blake2s_param *P, const uint8_t inner_length )
145	n/a	{
146	n/a	P->inner_length = inner_length;
147	n/a	return 0;
148	n/a	}
149	n/a
150	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_salt( blake2s_param *P, const uint8_t salt[BLAKE2S_SALTBYTES] )
151	n/a	{
152	n/a	memcpy( P->salt, salt, BLAKE2S_SALTBYTES );
153	n/a	return 0;
154	n/a	}
155	n/a
156	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_param_set_personal( blake2s_param *P, const uint8_t personal[BLAKE2S_PERSONALBYTES] )
157	n/a	{
158	n/a	memcpy( P->personal, personal, BLAKE2S_PERSONALBYTES );
159	n/a	return 0;
160	n/a	}
161	n/a
162	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_init0( blake2s_state *S )
163	n/a	{
164	n/a	int i;
165	n/a	memset( S, 0, sizeof( blake2s_state ) );
166	n/a
167	n/a	for( i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i];
168	n/a
169	n/a	return 0;
170	n/a	}
171	n/a
172	n/a	/* init2 xors IV with input parameter block */
173	n/a	int blake2s_init_param( blake2s_state S, const blake2s_param P )
174	n/a	{
175	n/a	/blake2s_init0( S ); /
176	n/a	const uint8_t * v = ( const uint8_t * )( blake2s_IV );
177	n/a	const uint8_t * p = ( const uint8_t * )( P );
178	n/a	uint8_t * h = ( uint8_t * )( S->h );
179	n/a	int i;
180	n/a	/* IV XOR ParamBlock */
181	n/a	memset( S, 0, sizeof( blake2s_state ) );
182	n/a
183	n/a	for( i = 0; i < BLAKE2S_OUTBYTES; ++i ) h[i] = v[i] ^ p[i];
184	n/a
185	n/a	return 0;
186	n/a	}
187	n/a
188	n/a
189	n/a	/* Some sort of default parameter block initialization, for sequential blake2s */
190	n/a	int blake2s_init( blake2s_state *S, const uint8_t outlen )
191	n/a	{
192	n/a	const blake2s_param P =
193	n/a	{
194	n/a	outlen,
195	n/a	0,
196	n/a	1,
197	n/a	1,
198	n/a	0,
199	n/a	{0},
200	n/a	0,
201	n/a	0,
202	n/a	{0},
203	n/a	{0}
204	n/a	};
205	n/a	/* Move interval verification here? */
206	n/a	if ( ( !outlen ) \|\| ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
207	n/a	return blake2s_init_param( S, &P );
208	n/a	}
209	n/a
210	n/a
211	n/a	int blake2s_init_key( blake2s_state S, const uint8_t outlen, const void key, const uint8_t keylen )
212	n/a	{
213	n/a	const blake2s_param P =
214	n/a	{
215	n/a	outlen,
216	n/a	keylen,
217	n/a	1,
218	n/a	1,
219	n/a	0,
220	n/a	{0},
221	n/a	0,
222	n/a	0,
223	n/a	{0},
224	n/a	{0}
225	n/a	};
226	n/a
227	n/a	/* Move interval verification here? */
228	n/a	if ( ( !outlen ) \|\| ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
229	n/a
230	n/a	if ( ( !key ) \|\| ( !keylen ) \|\| keylen > BLAKE2S_KEYBYTES ) return -1;
231	n/a
232	n/a	if( blake2s_init_param( S, &P ) < 0 )
233	n/a	return -1;
234	n/a
235	n/a	{
236	n/a	uint8_t block[BLAKE2S_BLOCKBYTES];
237	n/a	memset( block, 0, BLAKE2S_BLOCKBYTES );
238	n/a	memcpy( block, key, keylen );
239	n/a	blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
240	n/a	secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
241	n/a	}
242	n/a	return 0;
243	n/a	}
244	n/a
245	n/a
246	n/a	BLAKE2_LOCAL_INLINE(int) blake2s_compress( blake2s_state *S, const uint8_t block[BLAKE2S_BLOCKBYTES] )
247	n/a	{
248	n/a	__m128i row1, row2, row3, row4;
249	n/a	__m128i buf1, buf2, buf3, buf4;
250	n/a	#if defined(HAVE_SSE41)
251	n/a	__m128i t0, t1;
252	n/a	#if !defined(HAVE_XOP)
253	n/a	__m128i t2;
254	n/a	#endif
255	n/a	#endif
256	n/a	__m128i ff0, ff1;
257	n/a	#if defined(HAVE_SSSE3) && !defined(HAVE_XOP)
258	n/a	const __m128i r8 = _mm_set_epi8( 12, 15, 14, 13, 8, 11, 10, 9, 4, 7, 6, 5, 0, 3, 2, 1 );
259	n/a	const __m128i r16 = _mm_set_epi8( 13, 12, 15, 14, 9, 8, 11, 10, 5, 4, 7, 6, 1, 0, 3, 2 );
260	n/a	#endif
261	n/a	#if defined(HAVE_SSE41)
262	n/a	const __m128i m0 = LOADU( block + 00 );
263	n/a	const __m128i m1 = LOADU( block + 16 );
264	n/a	const __m128i m2 = LOADU( block + 32 );
265	n/a	const __m128i m3 = LOADU( block + 48 );
266	n/a	#else
267	n/a	const uint32_t m0 = ( ( uint32_t * )block )[ 0];
268	n/a	const uint32_t m1 = ( ( uint32_t * )block )[ 1];
269	n/a	const uint32_t m2 = ( ( uint32_t * )block )[ 2];
270	n/a	const uint32_t m3 = ( ( uint32_t * )block )[ 3];
271	n/a	const uint32_t m4 = ( ( uint32_t * )block )[ 4];
272	n/a	const uint32_t m5 = ( ( uint32_t * )block )[ 5];
273	n/a	const uint32_t m6 = ( ( uint32_t * )block )[ 6];
274	n/a	const uint32_t m7 = ( ( uint32_t * )block )[ 7];
275	n/a	const uint32_t m8 = ( ( uint32_t * )block )[ 8];
276	n/a	const uint32_t m9 = ( ( uint32_t * )block )[ 9];
277	n/a	const uint32_t m10 = ( ( uint32_t * )block )[10];
278	n/a	const uint32_t m11 = ( ( uint32_t * )block )[11];
279	n/a	const uint32_t m12 = ( ( uint32_t * )block )[12];
280	n/a	const uint32_t m13 = ( ( uint32_t * )block )[13];
281	n/a	const uint32_t m14 = ( ( uint32_t * )block )[14];
282	n/a	const uint32_t m15 = ( ( uint32_t * )block )[15];
283	n/a	#endif
284	n/a	row1 = ff0 = LOADU( &S->h[0] );
285	n/a	row2 = ff1 = LOADU( &S->h[4] );
286	n/a	row3 = _mm_setr_epi32( 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A );
287	n/a	row4 = _mm_xor_si128( _mm_setr_epi32( 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 ), LOADU( &S->t[0] ) );
288	n/a	ROUND( 0 );
289	n/a	ROUND( 1 );
290	n/a	ROUND( 2 );
291	n/a	ROUND( 3 );
292	n/a	ROUND( 4 );
293	n/a	ROUND( 5 );
294	n/a	ROUND( 6 );
295	n/a	ROUND( 7 );
296	n/a	ROUND( 8 );
297	n/a	ROUND( 9 );
298	n/a	STOREU( &S->h[0], _mm_xor_si128( ff0, _mm_xor_si128( row1, row3 ) ) );
299	n/a	STOREU( &S->h[4], _mm_xor_si128( ff1, _mm_xor_si128( row2, row4 ) ) );
300	n/a	return 0;
301	n/a	}
302	n/a
303	n/a	/* inlen now in bytes */
304	n/a	int blake2s_update( blake2s_state S, const uint8_t in, uint64_t inlen )
305	n/a	{
306	n/a	while( inlen > 0 )
307	n/a	{
308	n/a	size_t left = S->buflen;
309	n/a	size_t fill = 2 * BLAKE2S_BLOCKBYTES - left;
310	n/a
311	n/a	if( inlen > fill )
312	n/a	{
313	n/a	memcpy( S->buf + left, in, fill ); /* Fill buffer */
314	n/a	S->buflen += fill;
315	n/a	blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
316	n/a	blake2s_compress( S, S->buf ); /* Compress */
317	n/a	memcpy( S->buf, S->buf + BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES ); /* Shift buffer left */
318	n/a	S->buflen -= BLAKE2S_BLOCKBYTES;
319	n/a	in += fill;
320	n/a	inlen -= fill;
321	n/a	}
322	n/a	else /* inlen <= fill */
323	n/a	{
324	n/a	memcpy( S->buf + left, in, inlen );
325	n/a	S->buflen += inlen; /* Be lazy, do not compress */
326	n/a	in += inlen;
327	n/a	inlen -= inlen;
328	n/a	}
329	n/a	}
330	n/a
331	n/a	return 0;
332	n/a	}
333	n/a
334	n/a	/* Is this correct? */
335	n/a	int blake2s_final( blake2s_state S, uint8_t out, uint8_t outlen )
336	n/a	{
337	n/a	uint8_t buffer[BLAKE2S_OUTBYTES] = {0};
338	n/a	int i;
339	n/a
340	n/a	if( outlen > BLAKE2S_OUTBYTES )
341	n/a	return -1;
342	n/a
343	n/a	if( blake2s_is_lastblock( S ) )
344	n/a	return -1;
345	n/a
346	n/a	if( S->buflen > BLAKE2S_BLOCKBYTES )
347	n/a	{
348	n/a	blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
349	n/a	blake2s_compress( S, S->buf );
350	n/a	S->buflen -= BLAKE2S_BLOCKBYTES;
351	n/a	memmove( S->buf, S->buf + BLAKE2S_BLOCKBYTES, S->buflen );
352	n/a	}
353	n/a
354	n/a	blake2s_increment_counter( S, ( uint32_t )S->buflen );
355	n/a	blake2s_set_lastblock( S );
356	n/a	memset( S->buf + S->buflen, 0, 2 * BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */
357	n/a	blake2s_compress( S, S->buf );
358	n/a
359	n/a	for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
360	n/a	store32( buffer + sizeof( S->h[i] ) * i, S->h[i] );
361	n/a
362	n/a	memcpy( out, buffer, outlen );
363	n/a	return 0;
364	n/a	}
365	n/a
366	n/a	/* inlen, at least, should be uint64_t. Others can be size_t. */
367	n/a	int blake2s( uint8_t out, const void in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen )
368	n/a	{
369	n/a	blake2s_state S[1];
370	n/a
371	n/a	/* Verify parameters */
372	n/a	if ( NULL == in && inlen > 0 ) return -1;
373	n/a
374	n/a	if ( NULL == out ) return -1;
375	n/a
376	n/a	if ( NULL == key && keylen > 0) return -1;
377	n/a
378	n/a	if( !outlen \|\| outlen > BLAKE2S_OUTBYTES ) return -1;
379	n/a
380	n/a	if( keylen > BLAKE2S_KEYBYTES ) return -1;
381	n/a
382	n/a	if( keylen > 0 )
383	n/a	{
384	n/a	if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
385	n/a	}
386	n/a	else
387	n/a	{
388	n/a	if( blake2s_init( S, outlen ) < 0 ) return -1;
389	n/a	}
390	n/a
391	n/a	blake2s_update( S, ( const uint8_t * )in, inlen );
392	n/a	blake2s_final( S, out, outlen );
393	n/a	return 0;
394	n/a	}
395	n/a
396	n/a	#if defined(SUPERCOP)
397	n/a	int crypto_hash( unsigned char out, unsigned char in, unsigned long long inlen )
398	n/a	{
399	n/a	return blake2s( out, in, NULL, BLAKE2S_OUTBYTES, inlen, 0 );
400	n/a	}
401	n/a	#endif
402	n/a
403	n/a	#if defined(BLAKE2S_SELFTEST)
404	n/a	#include <string.h>
405	n/a	#include "blake2-kat.h"
406	n/a	int main( int argc, char **argv )
407	n/a	{
408	n/a	uint8_t key[BLAKE2S_KEYBYTES];
409	n/a	uint8_t buf[KAT_LENGTH];
410	n/a	size_t i;
411	n/a
412	n/a	for( i = 0; i < BLAKE2S_KEYBYTES; ++i )
413	n/a	key[i] = ( uint8_t )i;
414	n/a
415	n/a	for( i = 0; i < KAT_LENGTH; ++i )
416	n/a	buf[i] = ( uint8_t )i;
417	n/a
418	n/a	for( i = 0; i < KAT_LENGTH; ++i )
419	n/a	{
420	n/a	uint8_t hash[BLAKE2S_OUTBYTES];
421	n/a
422	n/a	if( blake2s( hash, buf, key, BLAKE2S_OUTBYTES, i, BLAKE2S_KEYBYTES ) < 0 \|\|
423	n/a	0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) )
424	n/a	{
425	n/a	puts( "error" );
426	n/a	return -1;
427	n/a	}
428	n/a	}
429	n/a
430	n/a	puts( "ok" );
431	n/a	return 0;
432	n/a	}
433	n/a	#endif
434	n/a
435	n/a