2 BLAKE2 reference source code package - reference C implementations
4 Written in 2012 by Samuel Neves <sneves@dei.uc.pt>
6 To the extent possible under law, the author(s) have dedicated all copyright
7 and related and neighboring rights to this software to the public domain
8 worldwide. This software is distributed without any warranty.
10 You should have received a copy of the CC0 Public Domain Dedication along with
11 this software. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
19 #include "blake2-impl.h"
21 static const uint32_t blake2s_IV[8] =
23 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
24 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
27 static const uint8_t blake2s_sigma[10][16] =
29 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
30 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
31 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
32 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
33 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
34 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
35 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
36 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
37 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
38 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,
41 static inline int blake2s_set_lastnode( blake2s_state *S )
47 static inline int blake2s_clear_lastnode( blake2s_state *S )
53 /* Some helper functions, not necessarily useful */
54 static inline int blake2s_set_lastblock( blake2s_state *S )
56 if( S->last_node ) blake2s_set_lastnode( S );
62 static inline int blake2s_clear_lastblock( blake2s_state *S )
64 if( S->last_node ) blake2s_clear_lastnode( S );
70 static inline int blake2s_increment_counter( blake2s_state *S, const uint32_t inc )
73 S->t[1] += ( S->t[0] < inc );
77 // Parameter-related functions
78 static inline int blake2s_param_set_digest_length( blake2s_param *P, const uint8_t digest_length )
80 P->digest_length = digest_length;
84 static inline int blake2s_param_set_fanout( blake2s_param *P, const uint8_t fanout )
90 static inline int blake2s_param_set_max_depth( blake2s_param *P, const uint8_t depth )
96 static inline int blake2s_param_set_leaf_length( blake2s_param *P, const uint32_t leaf_length )
98 store32( &P->leaf_length, leaf_length );
102 static inline int blake2s_param_set_node_offset( blake2s_param *P, const uint64_t node_offset )
104 store48( P->node_offset, node_offset );
108 static inline int blake2s_param_set_node_depth( blake2s_param *P, const uint8_t node_depth )
110 P->node_depth = node_depth;
114 static inline int blake2s_param_set_inner_length( blake2s_param *P, const uint8_t inner_length )
116 P->inner_length = inner_length;
120 static inline int blake2s_param_set_salt( blake2s_param *P, const uint8_t salt[BLAKE2S_SALTBYTES] )
122 memcpy( P->salt, salt, BLAKE2S_SALTBYTES );
126 static inline int blake2s_param_set_personal( blake2s_param *P, const uint8_t personal[BLAKE2S_PERSONALBYTES] )
128 memcpy( P->personal, personal, BLAKE2S_PERSONALBYTES );
132 static inline int blake2s_init0( blake2s_state *S )
134 memset( S, 0, sizeof( blake2s_state ) );
136 for( int i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i];
141 #define blake2s_init BLAKE2_IMPL_NAME(blake2s_init)
142 #define blake2s_init_param BLAKE2_IMPL_NAME(blake2s_init_param)
143 #define blake2s_init_key BLAKE2_IMPL_NAME(blake2s_init_key)
144 #define blake2s_update BLAKE2_IMPL_NAME(blake2s_update)
145 #define blake2s_final BLAKE2_IMPL_NAME(blake2s_final)
146 #define blake2s BLAKE2_IMPL_NAME(blake2s)
148 #if defined(__cplusplus)
151 int blake2s_init( blake2s_state *S, size_t outlen );
152 int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
153 int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
154 int blake2s_update( blake2s_state *S, const uint8_t *in, size_t inlen );
155 int blake2s_final( blake2s_state *S, uint8_t *out, size_t outlen );
156 int blake2s( uint8_t *out, const void *in, const void *key, size_t outlen, size_t inlen, size_t keylen );
157 #if defined(__cplusplus)
161 /* init2 xors IV with input parameter block */
162 int blake2s_init_param( blake2s_state *S, const blake2s_param *P )
165 uint32_t *p = ( uint32_t * )( P );
167 /* IV XOR ParamBlock */
168 for( size_t i = 0; i < 8; ++i )
169 S->h[i] ^= load32( &p[i] );
171 S->outlen = P->digest_length;
176 // Sequential blake2s initialization
177 int blake2s_init( blake2s_state *S, size_t outlen )
181 /* Move interval verification here? */
182 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
184 P->digest_length = ( uint8_t) outlen;
188 store32( &P->leaf_length, 0 );
189 store48( &P->node_offset, 0 );
192 // memset(P->reserved, 0, sizeof(P->reserved) );
193 memset( P->salt, 0, sizeof( P->salt ) );
194 memset( P->personal, 0, sizeof( P->personal ) );
195 return blake2s_init_param( S, P );
198 int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )
202 if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
204 if ( !key || !keylen || keylen > BLAKE2S_KEYBYTES ) return -1;
206 P->digest_length = ( uint8_t ) outlen;
207 P->key_length = ( uint8_t ) keylen;
210 store32( &P->leaf_length, 0 );
211 store48( &P->node_offset, 0 );
214 // memset(P->reserved, 0, sizeof(P->reserved) );
215 memset( P->salt, 0, sizeof( P->salt ) );
216 memset( P->personal, 0, sizeof( P->personal ) );
218 if( blake2s_init_param( S, P ) < 0 ) return -1;
221 uint8_t block[BLAKE2S_BLOCKBYTES];
222 memset( block, 0, BLAKE2S_BLOCKBYTES );
223 memcpy( block, key, keylen );
224 blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
225 secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
230 static int blake2s_compress( blake2s_state *S, const uint8_t block[BLAKE2S_BLOCKBYTES] )
235 for( size_t i = 0; i < 16; ++i )
236 m[i] = load32( block + i * sizeof( m[i] ) );
238 for( size_t i = 0; i < 8; ++i )
241 v[ 8] = blake2s_IV[0];
242 v[ 9] = blake2s_IV[1];
243 v[10] = blake2s_IV[2];
244 v[11] = blake2s_IV[3];
245 v[12] = S->t[0] ^ blake2s_IV[4];
246 v[13] = S->t[1] ^ blake2s_IV[5];
247 v[14] = S->f[0] ^ blake2s_IV[6];
248 v[15] = S->f[1] ^ blake2s_IV[7];
249 #define G(r,i,a,b,c,d) \
251 a = a + b + m[blake2s_sigma[r][2*i+0]]; \
252 d = rotr32(d ^ a, 16); \
254 b = rotr32(b ^ c, 12); \
255 a = a + b + m[blake2s_sigma[r][2*i+1]]; \
256 d = rotr32(d ^ a, 8); \
258 b = rotr32(b ^ c, 7); \
262 G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
263 G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
264 G(r,2,v[ 2],v[ 6],v[10],v[14]); \
265 G(r,3,v[ 3],v[ 7],v[11],v[15]); \
266 G(r,4,v[ 0],v[ 5],v[10],v[15]); \
267 G(r,5,v[ 1],v[ 6],v[11],v[12]); \
268 G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
269 G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
282 for( size_t i = 0; i < 8; ++i )
283 S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
291 int blake2s_update( blake2s_state *S, const uint8_t *in, size_t inlen )
295 uint32_t left = S->buflen;
296 uint32_t fill = 2 * BLAKE2S_BLOCKBYTES - left;
300 memcpy( S->buf + left, in, fill ); // Fill buffer
302 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
303 blake2s_compress( S, S->buf ); // Compress
304 memcpy( S->buf, S->buf + BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES ); // Shift buffer left
305 S->buflen -= BLAKE2S_BLOCKBYTES;
309 else // inlen <= fill
311 memcpy( S->buf + left, in, inlen );
312 S->buflen += ( uint32_t ) inlen; // Be lazy, do not compress
321 int blake2s_final( blake2s_state *S, uint8_t *out, size_t outlen )
323 uint8_t buffer[BLAKE2S_OUTBYTES];
326 if(S->outlen != outlen) return -1;
328 if( S->buflen > BLAKE2S_BLOCKBYTES )
330 blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
331 blake2s_compress( S, S->buf );
332 S->buflen -= BLAKE2S_BLOCKBYTES;
333 memcpy( S->buf, S->buf + BLAKE2S_BLOCKBYTES, S->buflen );
336 blake2s_increment_counter( S, ( uint32_t )S->buflen );
337 blake2s_set_lastblock( S );
338 memset( S->buf + S->buflen, 0, 2 * BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */
339 blake2s_compress( S, S->buf );
341 for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
342 store32( buffer + sizeof( S->h[i] ) * i, S->h[i] );
344 memcpy( out, buffer, outlen );
348 int blake2s( uint8_t *out, const void *in, const void *key, size_t outlen, size_t inlen, size_t keylen )
352 /* Verify parameters */
353 if ( NULL == in && inlen > 0 ) return -1;
355 if ( NULL == out ) return -1;
357 if ( NULL == key && keylen > 0 ) return -1;
359 if( !outlen || outlen > BLAKE2S_OUTBYTES ) return -1;
361 if( keylen > BLAKE2S_KEYBYTES ) return -1;
365 if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
369 if( blake2s_init( S, outlen ) < 0 ) return -1;
372 if( blake2s_update( S, ( uint8_t * )in, inlen ) < 0) return -1;
373 return blake2s_final( S, out, outlen );