taigrr/arduinolibs
1
0
Fork 0
mirror of https://github.com/taigrr/arduinolibs synced 2025-01-18 04:33:12 -08:00
Code Issues Projects Releases Wiki Activity

Update docs

Browse Source
This commit is contained in:
Rhys Weatherley
2016-08-18 18:42:36 +10:00
parent 73c9ce4455
commit 85faa4b5e9
436 changed files with 5019 additions and 2572 deletions
Download Patch File Download Diff File Expand all files Collapse all files

449
Poly1305_8cpp_source.html
View File

@@ -129,233 +129,236 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
<div class="line"><a name="l00072"></a><span class="lineno"> 72</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#elif BIGNUMBER_LIMB_32BIT</span></div>
<div class="line"><a name="l00073"></a><span class="lineno"> 73</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define lelimbtoh(x) (le32toh((x)))</span></div>
<div class="line"><a name="l00074"></a><span class="lineno"> 74</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define htolelimb(x) (htole32((x)))</span></div>
<div class="line"><a name="l00075"></a><span class="lineno"> 75</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#endif</span></div>
<div class="line"><a name="l00076"></a><span class="lineno"> 76</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#if defined(CRYPTO_LITTLE_ENDIAN)</span></div>
<div class="line"><a name="l00077"></a><span class="lineno"> 77</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define littleToHost(r,size) do { ; } while (0)</span></div>
<div class="line"><a name="l00078"></a><span class="lineno"> 78</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#else</span></div>
<div class="line"><a name="l00079"></a><span class="lineno"> 79</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define littleToHost(r,size) \</span></div>
<div class="line"><a name="l00080"></a><span class="lineno"> 80</span>&#160;<span class="preprocessor"> do { \</span></div>
<div class="line"><a name="l00081"></a><span class="lineno"> 81</span>&#160;<span class="preprocessor"> for (uint8_t i = 0; i &lt; (size); ++i) \</span></div>
<div class="line"><a name="l00082"></a><span class="lineno"> 82</span>&#160;<span class="preprocessor"> (r)[i] = lelimbtoh((r)[i]); \</span></div>
<div class="line"><a name="l00083"></a><span class="lineno"> 83</span>&#160;<span class="preprocessor"> } while (0)</span></div>
<div class="line"><a name="l00084"></a><span class="lineno"> 84</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#endif</span></div>
<div class="line"><a name="l00085"></a><span class="lineno"> 85</span>&#160;<span class="preprocessor"></span></div>
<div class="line"><a name="l00089"></a><span class="lineno"><a class="line" href="classPoly1305.html#a7d62e7cd2d67f1c72142580036066fa2"> 89</a></span>&#160;<a class="code" href="classPoly1305.html#a7d62e7cd2d67f1c72142580036066fa2">Poly1305::Poly1305</a>()</div>
<div class="line"><a name="l00090"></a><span class="lineno"> 90</span>&#160;{</div>
<div class="line"><a name="l00091"></a><span class="lineno"> 91</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00092"></a><span class="lineno"> 92</span>&#160;}</div>
<div class="line"><a name="l00093"></a><span class="lineno"> 93</span>&#160;</div>
<div class="line"><a name="l00098"></a><span class="lineno"><a class="line" href="classPoly1305.html#ac021b5ebbc123fa4c0ee36330472c25d"> 98</a></span>&#160;<a class="code" href="classPoly1305.html#ac021b5ebbc123fa4c0ee36330472c25d">Poly1305::~Poly1305</a>()</div>
<div class="line"><a name="l00099"></a><span class="lineno"> 99</span>&#160;{</div>
<div class="line"><a name="l00100"></a><span class="lineno"> 100</span>&#160; clean(state);</div>
<div class="line"><a name="l00101"></a><span class="lineno"> 101</span>&#160;}</div>
<div class="line"><a name="l00102"></a><span class="lineno"> 102</span>&#160;</div>
<div class="line"><a name="l00110"></a><span class="lineno"><a class="line" href="classPoly1305.html#a544839403d0a19300c239708bc1e6ed8"> 110</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#a544839403d0a19300c239708bc1e6ed8">Poly1305::reset</a>(<span class="keyword">const</span> <span class="keywordtype">void</span> *key)</div>
<div class="line"><a name="l00111"></a><span class="lineno"> 111</span>&#160;{</div>
<div class="line"><a name="l00112"></a><span class="lineno"> 112</span>&#160; <span class="comment">// Copy the key into place and clear the bits we don&#39;t need.</span></div>
<div class="line"><a name="l00113"></a><span class="lineno"> 113</span>&#160; uint8_t *r = (uint8_t *)state.r;</div>
<div class="line"><a name="l00114"></a><span class="lineno"> 114</span>&#160; memcpy(r, key, 16);</div>
<div class="line"><a name="l00115"></a><span class="lineno"> 115</span>&#160; r[3] &amp;= 0x0F;</div>
<div class="line"><a name="l00116"></a><span class="lineno"> 116</span>&#160; r[4] &amp;= 0xFC;</div>
<div class="line"><a name="l00117"></a><span class="lineno"> 117</span>&#160; r[7] &amp;= 0x0F;</div>
<div class="line"><a name="l00118"></a><span class="lineno"> 118</span>&#160; r[8] &amp;= 0xFC;</div>
<div class="line"><a name="l00119"></a><span class="lineno"> 119</span>&#160; r[11] &amp;= 0x0F;</div>
<div class="line"><a name="l00120"></a><span class="lineno"> 120</span>&#160; r[12] &amp;= 0xFC;</div>
<div class="line"><a name="l00121"></a><span class="lineno"> 121</span>&#160; r[15] &amp;= 0x0F;</div>
<div class="line"><a name="l00122"></a><span class="lineno"> 122</span>&#160;</div>
<div class="line"><a name="l00123"></a><span class="lineno"> 123</span>&#160; <span class="comment">// Convert into little-endian if necessary.</span></div>
<div class="line"><a name="l00124"></a><span class="lineno"> 124</span>&#160; littleToHost(state.r, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00075"></a><span class="lineno"> 75</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#elif BIGNUMBER_LIMB_64BIT</span></div>
<div class="line"><a name="l00076"></a><span class="lineno"> 76</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define lelimbtoh(x) (le64toh((x)))</span></div>
<div class="line"><a name="l00077"></a><span class="lineno"> 77</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define htolelimb(x) (htole64((x)))</span></div>
<div class="line"><a name="l00078"></a><span class="lineno"> 78</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#endif</span></div>
<div class="line"><a name="l00079"></a><span class="lineno"> 79</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#if defined(CRYPTO_LITTLE_ENDIAN)</span></div>
<div class="line"><a name="l00080"></a><span class="lineno"> 80</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define littleToHost(r,size) do { ; } while (0)</span></div>
<div class="line"><a name="l00081"></a><span class="lineno"> 81</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#else</span></div>
<div class="line"><a name="l00082"></a><span class="lineno"> 82</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#define littleToHost(r,size) \</span></div>
<div class="line"><a name="l00083"></a><span class="lineno"> 83</span>&#160;<span class="preprocessor"> do { \</span></div>
<div class="line"><a name="l00084"></a><span class="lineno"> 84</span>&#160;<span class="preprocessor"> for (uint8_t i = 0; i &lt; (size); ++i) \</span></div>
<div class="line"><a name="l00085"></a><span class="lineno"> 85</span>&#160;<span class="preprocessor"> (r)[i] = lelimbtoh((r)[i]); \</span></div>
<div class="line"><a name="l00086"></a><span class="lineno"> 86</span>&#160;<span class="preprocessor"> } while (0)</span></div>
<div class="line"><a name="l00087"></a><span class="lineno"> 87</span>&#160;<span class="preprocessor"></span><span class="preprocessor">#endif</span></div>
<div class="line"><a name="l00088"></a><span class="lineno"> 88</span>&#160;<span class="preprocessor"></span></div>
<div class="line"><a name="l00092"></a><span class="lineno"><a class="line" href="classPoly1305.html#a7d62e7cd2d67f1c72142580036066fa2"> 92</a></span>&#160;<a class="code" href="classPoly1305.html#a7d62e7cd2d67f1c72142580036066fa2">Poly1305::Poly1305</a>()</div>
<div class="line"><a name="l00093"></a><span class="lineno"> 93</span>&#160;{</div>
<div class="line"><a name="l00094"></a><span class="lineno"> 94</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00095"></a><span class="lineno"> 95</span>&#160;}</div>
<div class="line"><a name="l00096"></a><span class="lineno"> 96</span>&#160;</div>
<div class="line"><a name="l00101"></a><span class="lineno"><a class="line" href="classPoly1305.html#ac021b5ebbc123fa4c0ee36330472c25d"> 101</a></span>&#160;<a class="code" href="classPoly1305.html#ac021b5ebbc123fa4c0ee36330472c25d">Poly1305::~Poly1305</a>()</div>
<div class="line"><a name="l00102"></a><span class="lineno"> 102</span>&#160;{</div>
<div class="line"><a name="l00103"></a><span class="lineno"> 103</span>&#160; clean(state);</div>
<div class="line"><a name="l00104"></a><span class="lineno"> 104</span>&#160;}</div>
<div class="line"><a name="l00105"></a><span class="lineno"> 105</span>&#160;</div>
<div class="line"><a name="l00113"></a><span class="lineno"><a class="line" href="classPoly1305.html#a544839403d0a19300c239708bc1e6ed8"> 113</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#a544839403d0a19300c239708bc1e6ed8">Poly1305::reset</a>(<span class="keyword">const</span> <span class="keywordtype">void</span> *key)</div>
<div class="line"><a name="l00114"></a><span class="lineno"> 114</span>&#160;{</div>
<div class="line"><a name="l00115"></a><span class="lineno"> 115</span>&#160; <span class="comment">// Copy the key into place and clear the bits we don&#39;t need.</span></div>
<div class="line"><a name="l00116"></a><span class="lineno"> 116</span>&#160; uint8_t *r = (uint8_t *)state.r;</div>
<div class="line"><a name="l00117"></a><span class="lineno"> 117</span>&#160; memcpy(r, key, 16);</div>
<div class="line"><a name="l00118"></a><span class="lineno"> 118</span>&#160; r[3] &amp;= 0x0F;</div>
<div class="line"><a name="l00119"></a><span class="lineno"> 119</span>&#160; r[4] &amp;= 0xFC;</div>
<div class="line"><a name="l00120"></a><span class="lineno"> 120</span>&#160; r[7] &amp;= 0x0F;</div>
<div class="line"><a name="l00121"></a><span class="lineno"> 121</span>&#160; r[8] &amp;= 0xFC;</div>
<div class="line"><a name="l00122"></a><span class="lineno"> 122</span>&#160; r[11] &amp;= 0x0F;</div>
<div class="line"><a name="l00123"></a><span class="lineno"> 123</span>&#160; r[12] &amp;= 0xFC;</div>
<div class="line"><a name="l00124"></a><span class="lineno"> 124</span>&#160; r[15] &amp;= 0x0F;</div>
<div class="line"><a name="l00125"></a><span class="lineno"> 125</span>&#160;</div>
<div class="line"><a name="l00126"></a><span class="lineno"> 126</span>&#160; <span class="comment">// Reset the hashing process.</span></div>
<div class="line"><a name="l00127"></a><span class="lineno"> 127</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00128"></a><span class="lineno"> 128</span>&#160; memset(state.h, 0, <span class="keyword">sizeof</span>(state.h));</div>
<div class="line"><a name="l00129"></a><span class="lineno"> 129</span>&#160;}</div>
<div class="line"><a name="l00130"></a><span class="lineno"> 130</span>&#160;</div>
<div class="line"><a name="l00142"></a><span class="lineno"><a class="line" href="classPoly1305.html#ae4e0b647ff93f501bd01459b1616557c"> 142</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#ae4e0b647ff93f501bd01459b1616557c">Poly1305::update</a>(<span class="keyword">const</span> <span class="keywordtype">void</span> *data, <span class="keywordtype">size_t</span> len)</div>
<div class="line"><a name="l00143"></a><span class="lineno"> 143</span>&#160;{</div>
<div class="line"><a name="l00144"></a><span class="lineno"> 144</span>&#160; <span class="comment">// Break the input up into 128-bit chunks and process each in turn.</span></div>
<div class="line"><a name="l00145"></a><span class="lineno"> 145</span>&#160; <span class="keyword">const</span> uint8_t *d = (<span class="keyword">const</span> uint8_t *)data;</div>
<div class="line"><a name="l00146"></a><span class="lineno"> 146</span>&#160; <span class="keywordflow">while</span> (len &gt; 0) {</div>
<div class="line"><a name="l00147"></a><span class="lineno"> 147</span>&#160; uint8_t size = 16 - state.chunkSize;</div>
<div class="line"><a name="l00148"></a><span class="lineno"> 148</span>&#160; <span class="keywordflow">if</span> (size &gt; len)</div>
<div class="line"><a name="l00149"></a><span class="lineno"> 149</span>&#160; size = len;</div>
<div class="line"><a name="l00150"></a><span class="lineno"> 150</span>&#160; memcpy(((uint8_t *)state.c) + state.chunkSize, d, size);</div>
<div class="line"><a name="l00151"></a><span class="lineno"> 151</span>&#160; state.chunkSize += size;</div>
<div class="line"><a name="l00152"></a><span class="lineno"> 152</span>&#160; len -= size;</div>
<div class="line"><a name="l00153"></a><span class="lineno"> 153</span>&#160; d += size;</div>
<div class="line"><a name="l00154"></a><span class="lineno"> 154</span>&#160; <span class="keywordflow">if</span> (state.chunkSize == 16) {</div>
<div class="line"><a name="l00155"></a><span class="lineno"> 155</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00156"></a><span class="lineno"> 156</span>&#160; state.c[NUM_LIMBS_128BIT] = 1;</div>
<div class="line"><a name="l00157"></a><span class="lineno"> 157</span>&#160; processChunk();</div>
<div class="line"><a name="l00158"></a><span class="lineno"> 158</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00159"></a><span class="lineno"> 159</span>&#160; }</div>
<div class="line"><a name="l00160"></a><span class="lineno"> 160</span>&#160; }</div>
<div class="line"><a name="l00161"></a><span class="lineno"> 161</span>&#160;}</div>
<div class="line"><a name="l00162"></a><span class="lineno"> 162</span>&#160;</div>
<div class="line"><a name="l00179"></a><span class="lineno"><a class="line" href="classPoly1305.html#aab3fa6c5f6fa7d9ca6c82bead38f499c"> 179</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#aab3fa6c5f6fa7d9ca6c82bead38f499c">Poly1305::finalize</a>(<span class="keyword">const</span> <span class="keywordtype">void</span> *nonce, <span class="keywordtype">void</span> *token, <span class="keywordtype">size_t</span> len)</div>
<div class="line"><a name="l00180"></a><span class="lineno"> 180</span>&#160;{</div>
<div class="line"><a name="l00181"></a><span class="lineno"> 181</span>&#160; dlimb_t carry;</div>
<div class="line"><a name="l00182"></a><span class="lineno"> 182</span>&#160; uint8_t i;</div>
<div class="line"><a name="l00183"></a><span class="lineno"> 183</span>&#160; limb_t t[NUM_LIMBS_256BIT + 1];</div>
<div class="line"><a name="l00184"></a><span class="lineno"> 184</span>&#160;</div>
<div class="line"><a name="l00185"></a><span class="lineno"> 185</span>&#160; <span class="comment">// Pad and flush the final chunk.</span></div>
<div class="line"><a name="l00186"></a><span class="lineno"> 186</span>&#160; <span class="keywordflow">if</span> (state.chunkSize &gt; 0) {</div>
<div class="line"><a name="l00187"></a><span class="lineno"> 187</span>&#160; uint8_t *c = (uint8_t *)state.c;</div>
<div class="line"><a name="l00188"></a><span class="lineno"> 188</span>&#160; c[state.chunkSize] = 1;</div>
<div class="line"><a name="l00189"></a><span class="lineno"> 189</span>&#160; memset(c + state.chunkSize + 1, 0, 16 - state.chunkSize - 1);</div>
<div class="line"><a name="l00190"></a><span class="lineno"> 190</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00191"></a><span class="lineno"> 191</span>&#160; state.c[NUM_LIMBS_128BIT] = 0;</div>
<div class="line"><a name="l00192"></a><span class="lineno"> 192</span>&#160; processChunk();</div>
<div class="line"><a name="l00193"></a><span class="lineno"> 193</span>&#160; }</div>
<div class="line"><a name="l00194"></a><span class="lineno"> 194</span>&#160;</div>
<div class="line"><a name="l00195"></a><span class="lineno"> 195</span>&#160; <span class="comment">// At this point, processChunk() has left h as a partially reduced</span></div>
<div class="line"><a name="l00196"></a><span class="lineno"> 196</span>&#160; <span class="comment">// result that is less than (2^130 - 5) * 6. Perform one more</span></div>
<div class="line"><a name="l00197"></a><span class="lineno"> 197</span>&#160; <span class="comment">// reduction and a trial subtraction to produce the final result.</span></div>
<div class="line"><a name="l00198"></a><span class="lineno"> 198</span>&#160;</div>
<div class="line"><a name="l00199"></a><span class="lineno"> 199</span>&#160; <span class="comment">// Multiply the high bits of h by 5 and add them to the 130 low bits.</span></div>
<div class="line"><a name="l00200"></a><span class="lineno"> 200</span>&#160; carry = (dlimb_t)((state.h[NUM_LIMBS_128BIT] &gt;&gt; 2) +</div>
<div class="line"><a name="l00201"></a><span class="lineno"> 201</span>&#160; (state.h[NUM_LIMBS_128BIT] &amp; ~((limb_t)3)));</div>
<div class="line"><a name="l00202"></a><span class="lineno"> 202</span>&#160; state.h[NUM_LIMBS_128BIT] &amp;= 0x0003;</div>
<div class="line"><a name="l00203"></a><span class="lineno"> 203</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00204"></a><span class="lineno"> 204</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00205"></a><span class="lineno"> 205</span>&#160; state.h[i] = (limb_t)carry;</div>
<div class="line"><a name="l00206"></a><span class="lineno"> 206</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00207"></a><span class="lineno"> 207</span>&#160; }</div>
<div class="line"><a name="l00208"></a><span class="lineno"> 208</span>&#160; state.h[i] += (limb_t)carry;</div>
<div class="line"><a name="l00209"></a><span class="lineno"> 209</span>&#160;</div>
<div class="line"><a name="l00210"></a><span class="lineno"> 210</span>&#160; <span class="comment">// Subtract (2^130 - 5) from h by computing t = h + 5 - 2^130.</span></div>
<div class="line"><a name="l00211"></a><span class="lineno"> 211</span>&#160; <span class="comment">// The &quot;minus 2^130&quot; step is implicit.</span></div>
<div class="line"><a name="l00212"></a><span class="lineno"> 212</span>&#160; carry = 5;</div>
<div class="line"><a name="l00213"></a><span class="lineno"> 213</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_130BIT; ++i) {</div>
<div class="line"><a name="l00214"></a><span class="lineno"> 214</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00215"></a><span class="lineno"> 215</span>&#160; t[i] = (limb_t)carry;</div>
<div class="line"><a name="l00216"></a><span class="lineno"> 216</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00217"></a><span class="lineno"> 217</span>&#160; }</div>
<div class="line"><a name="l00218"></a><span class="lineno"> 218</span>&#160;</div>
<div class="line"><a name="l00219"></a><span class="lineno"> 219</span>&#160; <span class="comment">// Borrow occurs if bit 2^130 of the previous t result is zero.</span></div>
<div class="line"><a name="l00220"></a><span class="lineno"> 220</span>&#160; <span class="comment">// Carefully turn this into a selection mask so we can select either</span></div>
<div class="line"><a name="l00221"></a><span class="lineno"> 221</span>&#160; <span class="comment">// h or t as the final result. We don&#39;t care about the highest word</span></div>
<div class="line"><a name="l00222"></a><span class="lineno"> 222</span>&#160; <span class="comment">// of the result because we are about to drop it in the next step.</span></div>
<div class="line"><a name="l00223"></a><span class="lineno"> 223</span>&#160; <span class="comment">// We have to do it this way to avoid giving away any information</span></div>
<div class="line"><a name="l00224"></a><span class="lineno"> 224</span>&#160; <span class="comment">// about the value of h in the instruction timing.</span></div>
<div class="line"><a name="l00225"></a><span class="lineno"> 225</span>&#160; limb_t mask = (~((t[NUM_LIMBS_128BIT] &gt;&gt; 2) &amp; 1)) + 1;</div>
<div class="line"><a name="l00226"></a><span class="lineno"> 226</span>&#160; limb_t nmask = ~mask;</div>
<div class="line"><a name="l00227"></a><span class="lineno"> 227</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00228"></a><span class="lineno"> 228</span>&#160; state.h[i] = (state.h[i] &amp; nmask) | (t[i] &amp; mask);</div>
<div class="line"><a name="l00229"></a><span class="lineno"> 229</span>&#160; }</div>
<div class="line"><a name="l00230"></a><span class="lineno"> 230</span>&#160;</div>
<div class="line"><a name="l00231"></a><span class="lineno"> 231</span>&#160; <span class="comment">// Add the encrypted nonce and format the final hash.</span></div>
<div class="line"><a name="l00232"></a><span class="lineno"> 232</span>&#160; memcpy(state.c, nonce, 16);</div>
<div class="line"><a name="l00233"></a><span class="lineno"> 233</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00234"></a><span class="lineno"> 234</span>&#160; carry = 0;</div>
<div class="line"><a name="l00235"></a><span class="lineno"> 235</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00236"></a><span class="lineno"> 236</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00237"></a><span class="lineno"> 237</span>&#160; carry += state.c[i];</div>
<div class="line"><a name="l00238"></a><span class="lineno"> 238</span>&#160; state.h[i] = htolelimb((limb_t)carry);</div>
<div class="line"><a name="l00239"></a><span class="lineno"> 239</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00240"></a><span class="lineno"> 240</span>&#160; }</div>
<div class="line"><a name="l00241"></a><span class="lineno"> 241</span>&#160; <span class="keywordflow">if</span> (len &gt; 16)</div>
<div class="line"><a name="l00242"></a><span class="lineno"> 242</span>&#160; len = 16;</div>
<div class="line"><a name="l00243"></a><span class="lineno"> 243</span>&#160; memcpy(token, state.h, len);</div>
<div class="line"><a name="l00244"></a><span class="lineno"> 244</span>&#160;}</div>
<div class="line"><a name="l00245"></a><span class="lineno"> 245</span>&#160;</div>
<div class="line"><a name="l00251"></a><span class="lineno"><a class="line" href="classPoly1305.html#aaea2f40c1f22dcc2f8f690c793fb4388"> 251</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#aaea2f40c1f22dcc2f8f690c793fb4388">Poly1305::pad</a>()</div>
<div class="line"><a name="l00252"></a><span class="lineno"> 252</span>&#160;{</div>
<div class="line"><a name="l00253"></a><span class="lineno"> 253</span>&#160; <span class="keywordflow">if</span> (state.chunkSize != 0) {</div>
<div class="line"><a name="l00254"></a><span class="lineno"> 254</span>&#160; memset(((uint8_t *)state.c) + state.chunkSize, 0, 16 - state.chunkSize);</div>
<div class="line"><a name="l00255"></a><span class="lineno"> 255</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00256"></a><span class="lineno"> 256</span>&#160; state.c[NUM_LIMBS_128BIT] = 1;</div>
<div class="line"><a name="l00257"></a><span class="lineno"> 257</span>&#160; processChunk();</div>
<div class="line"><a name="l00258"></a><span class="lineno"> 258</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00259"></a><span class="lineno"> 259</span>&#160; }</div>
<div class="line"><a name="l00260"></a><span class="lineno"> 260</span>&#160;}</div>
<div class="line"><a name="l00261"></a><span class="lineno"> 261</span>&#160;</div>
<div class="line"><a name="l00265"></a><span class="lineno"><a class="line" href="classPoly1305.html#ae3f3392b9a2bd0f3472e7e50dd7e21dd"> 265</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#ae3f3392b9a2bd0f3472e7e50dd7e21dd">Poly1305::clear</a>()</div>
<div class="line"><a name="l00266"></a><span class="lineno"> 266</span>&#160;{</div>
<div class="line"><a name="l00267"></a><span class="lineno"> 267</span>&#160; clean(state);</div>
<div class="line"><a name="l00268"></a><span class="lineno"> 268</span>&#160;}</div>
<div class="line"><a name="l00269"></a><span class="lineno"> 269</span>&#160;</div>
<div class="line"><a name="l00273"></a><span class="lineno"> 273</span>&#160;<span class="keywordtype">void</span> Poly1305::processChunk()</div>
<div class="line"><a name="l00274"></a><span class="lineno"> 274</span>&#160;{</div>
<div class="line"><a name="l00275"></a><span class="lineno"> 275</span>&#160; limb_t t[NUM_LIMBS_256BIT + 1];</div>
<div class="line"><a name="l00276"></a><span class="lineno"> 276</span>&#160;</div>
<div class="line"><a name="l00277"></a><span class="lineno"> 277</span>&#160; <span class="comment">// Compute h = ((h + c) * r) mod (2^130 - 5).</span></div>
<div class="line"><a name="l00278"></a><span class="lineno"> 278</span>&#160;</div>
<div class="line"><a name="l00279"></a><span class="lineno"> 279</span>&#160; <span class="comment">// Start with h += c. We assume that h is less than (2^130 - 5) * 6</span></div>
<div class="line"><a name="l00280"></a><span class="lineno"> 280</span>&#160; <span class="comment">// and that c is less than 2^129, so the result will be less than 2^133.</span></div>
<div class="line"><a name="l00281"></a><span class="lineno"> 281</span>&#160; dlimb_t carry = 0;</div>
<div class="line"><a name="l00282"></a><span class="lineno"> 282</span>&#160; uint8_t i, j;</div>
<div class="line"><a name="l00283"></a><span class="lineno"> 283</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_130BIT; ++i) {</div>
<div class="line"><a name="l00284"></a><span class="lineno"> 284</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00285"></a><span class="lineno"> 285</span>&#160; carry += state.c[i];</div>
<div class="line"><a name="l00286"></a><span class="lineno"> 286</span>&#160; state.h[i] = (limb_t)carry;</div>
<div class="line"><a name="l00287"></a><span class="lineno"> 287</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00288"></a><span class="lineno"> 288</span>&#160; }</div>
<div class="line"><a name="l00289"></a><span class="lineno"> 289</span>&#160;</div>
<div class="line"><a name="l00290"></a><span class="lineno"> 290</span>&#160; <span class="comment">// Multiply h by r. We know that r is less than 2^124 because the</span></div>
<div class="line"><a name="l00291"></a><span class="lineno"> 291</span>&#160; <span class="comment">// top 4 bits were AND-ed off by reset(). That makes h * r less</span></div>
<div class="line"><a name="l00292"></a><span class="lineno"> 292</span>&#160; <span class="comment">// than 2^257. Which is less than the (2^130 - 6)^2 we want for</span></div>
<div class="line"><a name="l00293"></a><span class="lineno"> 293</span>&#160; <span class="comment">// the modulo reduction step that follows.</span></div>
<div class="line"><a name="l00294"></a><span class="lineno"> 294</span>&#160; carry = 0;</div>
<div class="line"><a name="l00295"></a><span class="lineno"> 295</span>&#160; limb_t word = state.r[0];</div>
<div class="line"><a name="l00296"></a><span class="lineno"> 296</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_130BIT; ++i) {</div>
<div class="line"><a name="l00297"></a><span class="lineno"> 297</span>&#160; carry += ((dlimb_t)(state.h[i])) * word;</div>
<div class="line"><a name="l00298"></a><span class="lineno"> 298</span>&#160; t[i] = (limb_t)carry;</div>
<div class="line"><a name="l00299"></a><span class="lineno"> 299</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00300"></a><span class="lineno"> 300</span>&#160; }</div>
<div class="line"><a name="l00301"></a><span class="lineno"> 301</span>&#160; t[NUM_LIMBS_130BIT] = (limb_t)carry;</div>
<div class="line"><a name="l00302"></a><span class="lineno"> 302</span>&#160; <span class="keywordflow">for</span> (i = 1; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00303"></a><span class="lineno"> 303</span>&#160; word = state.r[i];</div>
<div class="line"><a name="l00304"></a><span class="lineno"> 304</span>&#160; carry = 0;</div>
<div class="line"><a name="l00305"></a><span class="lineno"> 305</span>&#160; <span class="keywordflow">for</span> (j = 0; j &lt; NUM_LIMBS_130BIT; ++j) {</div>
<div class="line"><a name="l00306"></a><span class="lineno"> 306</span>&#160; carry += ((dlimb_t)(state.h[j])) * word;</div>
<div class="line"><a name="l00307"></a><span class="lineno"> 307</span>&#160; carry += t[i + j];</div>
<div class="line"><a name="l00308"></a><span class="lineno"> 308</span>&#160; t[i + j] = (limb_t)carry;</div>
<div class="line"><a name="l00309"></a><span class="lineno"> 309</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00310"></a><span class="lineno"> 310</span>&#160; }</div>
<div class="line"><a name="l00311"></a><span class="lineno"> 311</span>&#160; t[i + NUM_LIMBS_130BIT] = (limb_t)carry;</div>
<div class="line"><a name="l00312"></a><span class="lineno"> 312</span>&#160; }</div>
<div class="line"><a name="l00313"></a><span class="lineno"> 313</span>&#160;</div>
<div class="line"><a name="l00314"></a><span class="lineno"> 314</span>&#160; <span class="comment">// Reduce h * r modulo (2^130 - 5) by multiplying the high 130 bits by 5</span></div>
<div class="line"><a name="l00315"></a><span class="lineno"> 315</span>&#160; <span class="comment">// and adding them to the low 130 bits. See the explaination in the</span></div>
<div class="line"><a name="l00316"></a><span class="lineno"> 316</span>&#160; <span class="comment">// comments for Curve25519::reduce() for a description of how this works.</span></div>
<div class="line"><a name="l00317"></a><span class="lineno"> 317</span>&#160; carry = ((dlimb_t)(t[NUM_LIMBS_128BIT] &gt;&gt; 2)) +</div>
<div class="line"><a name="l00318"></a><span class="lineno"> 318</span>&#160; (t[NUM_LIMBS_128BIT] &amp; ~((limb_t)3));</div>
<div class="line"><a name="l00319"></a><span class="lineno"> 319</span>&#160; t[NUM_LIMBS_128BIT] &amp;= 0x0003;</div>
<div class="line"><a name="l00320"></a><span class="lineno"> 320</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00321"></a><span class="lineno"> 321</span>&#160; <span class="comment">// Shift the next word of t up by (LIMB_BITS - 2) bits and then</span></div>
<div class="line"><a name="l00322"></a><span class="lineno"> 322</span>&#160; <span class="comment">// multiply it by 5. Breaking it down, we can add the results</span></div>
<div class="line"><a name="l00323"></a><span class="lineno"> 323</span>&#160; <span class="comment">// of shifting up by LIMB_BITS and shifting up by (LIMB_BITS - 2).</span></div>
<div class="line"><a name="l00324"></a><span class="lineno"> 324</span>&#160; <span class="comment">// The main wrinkle here is that this can result in an intermediate</span></div>
<div class="line"><a name="l00325"></a><span class="lineno"> 325</span>&#160; <span class="comment">// carry that is (LIMB_BITS * 2 + 1) bits in size which doesn&#39;t</span></div>
<div class="line"><a name="l00326"></a><span class="lineno"> 326</span>&#160; <span class="comment">// fit within a dlimb_t variable. However, we can defer adding</span></div>
<div class="line"><a name="l00327"></a><span class="lineno"> 327</span>&#160; <span class="comment">// (word &lt;&lt; LIMB_BITS) until after the &quot;carry &gt;&gt;= LIMB_BITS&quot; step</span></div>
<div class="line"><a name="l00328"></a><span class="lineno"> 328</span>&#160; <span class="comment">// because it won&#39;t affect the low bits of the carry.</span></div>
<div class="line"><a name="l00329"></a><span class="lineno"> 329</span>&#160; word = t[i + NUM_LIMBS_130BIT];</div>
<div class="line"><a name="l00330"></a><span class="lineno"> 330</span>&#160; carry += ((dlimb_t)word) &lt;&lt; (LIMB_BITS - 2);</div>
<div class="line"><a name="l00331"></a><span class="lineno"> 331</span>&#160; carry += t[i];</div>
<div class="line"><a name="l00332"></a><span class="lineno"> 332</span>&#160; state.h[i] = (limb_t)carry;</div>
<div class="line"><a name="l00333"></a><span class="lineno"> 333</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00334"></a><span class="lineno"> 334</span>&#160; carry += word;</div>
<div class="line"><a name="l00335"></a><span class="lineno"> 335</span>&#160; }</div>
<div class="line"><a name="l00336"></a><span class="lineno"> 336</span>&#160; state.h[i] = (limb_t)(carry + t[NUM_LIMBS_128BIT]);</div>
<div class="line"><a name="l00337"></a><span class="lineno"> 337</span>&#160;</div>
<div class="line"><a name="l00338"></a><span class="lineno"> 338</span>&#160; <span class="comment">// At this point, h is either the answer of reducing modulo (2^130 - 5)</span></div>
<div class="line"><a name="l00339"></a><span class="lineno"> 339</span>&#160; <span class="comment">// or it is at most 5 subtractions away from the answer we want.</span></div>
<div class="line"><a name="l00340"></a><span class="lineno"> 340</span>&#160; <span class="comment">// Leave it as-is for now with h less than (2^130 - 5) * 6. It is</span></div>
<div class="line"><a name="l00341"></a><span class="lineno"> 341</span>&#160; <span class="comment">// still within a range where the next h * r step will not overflow.</span></div>
<div class="line"><a name="l00342"></a><span class="lineno"> 342</span>&#160;}</div>
<div class="ttc" id="classPoly1305_html_aab3fa6c5f6fa7d9ca6c82bead38f499c"><div class="ttname"><a href="classPoly1305.html#aab3fa6c5f6fa7d9ca6c82bead38f499c">Poly1305::finalize</a></div><div class="ttdeci">void finalize(const void *nonce, void *token, size_t len)</div><div class="ttdoc">Finalizes the authentication process and returns the token. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00179">Poly1305.cpp:179</a></div></div>
<div class="ttc" id="classPoly1305_html_a544839403d0a19300c239708bc1e6ed8"><div class="ttname"><a href="classPoly1305.html#a544839403d0a19300c239708bc1e6ed8">Poly1305::reset</a></div><div class="ttdeci">void reset(const void *key)</div><div class="ttdoc">Resets the Poly1305 message authenticator for a new session. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00110">Poly1305.cpp:110</a></div></div>
<div class="ttc" id="classPoly1305_html_ae4e0b647ff93f501bd01459b1616557c"><div class="ttname"><a href="classPoly1305.html#ae4e0b647ff93f501bd01459b1616557c">Poly1305::update</a></div><div class="ttdeci">void update(const void *data, size_t len)</div><div class="ttdoc">Updates the message authenticator with more data. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00142">Poly1305.cpp:142</a></div></div>
<div class="ttc" id="classPoly1305_html_aaea2f40c1f22dcc2f8f690c793fb4388"><div class="ttname"><a href="classPoly1305.html#aaea2f40c1f22dcc2f8f690c793fb4388">Poly1305::pad</a></div><div class="ttdeci">void pad()</div><div class="ttdoc">Pads the input stream with zero bytes to a multiple of 16. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00251">Poly1305.cpp:251</a></div></div>
<div class="ttc" id="classPoly1305_html_ac021b5ebbc123fa4c0ee36330472c25d"><div class="ttname"><a href="classPoly1305.html#ac021b5ebbc123fa4c0ee36330472c25d">Poly1305::~Poly1305</a></div><div class="ttdeci">~Poly1305()</div><div class="ttdoc">Destroys this Poly1305 message authenticator after clearing all sensitive information. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00098">Poly1305.cpp:98</a></div></div>
<div class="ttc" id="classPoly1305_html_a7d62e7cd2d67f1c72142580036066fa2"><div class="ttname"><a href="classPoly1305.html#a7d62e7cd2d67f1c72142580036066fa2">Poly1305::Poly1305</a></div><div class="ttdeci">Poly1305()</div><div class="ttdoc">Constructs a new Poly1305 message authenticator. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00089">Poly1305.cpp:89</a></div></div>
<div class="ttc" id="classPoly1305_html_ae3f3392b9a2bd0f3472e7e50dd7e21dd"><div class="ttname"><a href="classPoly1305.html#ae3f3392b9a2bd0f3472e7e50dd7e21dd">Poly1305::clear</a></div><div class="ttdeci">void clear()</div><div class="ttdoc">Clears the authenticator&#39;s state, removing all sensitive data. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00265">Poly1305.cpp:265</a></div></div>
<div class="line"><a name="l00126"></a><span class="lineno"> 126</span>&#160; <span class="comment">// Convert into little-endian if necessary.</span></div>
<div class="line"><a name="l00127"></a><span class="lineno"> 127</span>&#160; littleToHost(state.r, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00128"></a><span class="lineno"> 128</span>&#160;</div>
<div class="line"><a name="l00129"></a><span class="lineno"> 129</span>&#160; <span class="comment">// Reset the hashing process.</span></div>
<div class="line"><a name="l00130"></a><span class="lineno"> 130</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00131"></a><span class="lineno"> 131</span>&#160; memset(state.h, 0, <span class="keyword">sizeof</span>(state.h));</div>
<div class="line"><a name="l00132"></a><span class="lineno"> 132</span>&#160;}</div>
<div class="line"><a name="l00133"></a><span class="lineno"> 133</span>&#160;</div>
<div class="line"><a name="l00145"></a><span class="lineno"><a class="line" href="classPoly1305.html#ae4e0b647ff93f501bd01459b1616557c"> 145</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#ae4e0b647ff93f501bd01459b1616557c">Poly1305::update</a>(<span class="keyword">const</span> <span class="keywordtype">void</span> *data, <span class="keywordtype">size_t</span> len)</div>
<div class="line"><a name="l00146"></a><span class="lineno"> 146</span>&#160;{</div>
<div class="line"><a name="l00147"></a><span class="lineno"> 147</span>&#160; <span class="comment">// Break the input up into 128-bit chunks and process each in turn.</span></div>
<div class="line"><a name="l00148"></a><span class="lineno"> 148</span>&#160; <span class="keyword">const</span> uint8_t *d = (<span class="keyword">const</span> uint8_t *)data;</div>
<div class="line"><a name="l00149"></a><span class="lineno"> 149</span>&#160; <span class="keywordflow">while</span> (len &gt; 0) {</div>
<div class="line"><a name="l00150"></a><span class="lineno"> 150</span>&#160; uint8_t size = 16 - state.chunkSize;</div>
<div class="line"><a name="l00151"></a><span class="lineno"> 151</span>&#160; <span class="keywordflow">if</span> (size &gt; len)</div>
<div class="line"><a name="l00152"></a><span class="lineno"> 152</span>&#160; size = len;</div>
<div class="line"><a name="l00153"></a><span class="lineno"> 153</span>&#160; memcpy(((uint8_t *)state.c) + state.chunkSize, d, size);</div>
<div class="line"><a name="l00154"></a><span class="lineno"> 154</span>&#160; state.chunkSize += size;</div>
<div class="line"><a name="l00155"></a><span class="lineno"> 155</span>&#160; len -= size;</div>
<div class="line"><a name="l00156"></a><span class="lineno"> 156</span>&#160; d += size;</div>
<div class="line"><a name="l00157"></a><span class="lineno"> 157</span>&#160; <span class="keywordflow">if</span> (state.chunkSize == 16) {</div>
<div class="line"><a name="l00158"></a><span class="lineno"> 158</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00159"></a><span class="lineno"> 159</span>&#160; state.c[NUM_LIMBS_128BIT] = 1;</div>
<div class="line"><a name="l00160"></a><span class="lineno"> 160</span>&#160; processChunk();</div>
<div class="line"><a name="l00161"></a><span class="lineno"> 161</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00162"></a><span class="lineno"> 162</span>&#160; }</div>
<div class="line"><a name="l00163"></a><span class="lineno"> 163</span>&#160; }</div>
<div class="line"><a name="l00164"></a><span class="lineno"> 164</span>&#160;}</div>
<div class="line"><a name="l00165"></a><span class="lineno"> 165</span>&#160;</div>
<div class="line"><a name="l00182"></a><span class="lineno"><a class="line" href="classPoly1305.html#aab3fa6c5f6fa7d9ca6c82bead38f499c"> 182</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#aab3fa6c5f6fa7d9ca6c82bead38f499c">Poly1305::finalize</a>(<span class="keyword">const</span> <span class="keywordtype">void</span> *nonce, <span class="keywordtype">void</span> *token, <span class="keywordtype">size_t</span> len)</div>
<div class="line"><a name="l00183"></a><span class="lineno"> 183</span>&#160;{</div>
<div class="line"><a name="l00184"></a><span class="lineno"> 184</span>&#160; dlimb_t carry;</div>
<div class="line"><a name="l00185"></a><span class="lineno"> 185</span>&#160; uint8_t i;</div>
<div class="line"><a name="l00186"></a><span class="lineno"> 186</span>&#160; limb_t t[NUM_LIMBS_256BIT + 1];</div>
<div class="line"><a name="l00187"></a><span class="lineno"> 187</span>&#160;</div>
<div class="line"><a name="l00188"></a><span class="lineno"> 188</span>&#160; <span class="comment">// Pad and flush the final chunk.</span></div>
<div class="line"><a name="l00189"></a><span class="lineno"> 189</span>&#160; <span class="keywordflow">if</span> (state.chunkSize &gt; 0) {</div>
<div class="line"><a name="l00190"></a><span class="lineno"> 190</span>&#160; uint8_t *c = (uint8_t *)state.c;</div>
<div class="line"><a name="l00191"></a><span class="lineno"> 191</span>&#160; c[state.chunkSize] = 1;</div>
<div class="line"><a name="l00192"></a><span class="lineno"> 192</span>&#160; memset(c + state.chunkSize + 1, 0, 16 - state.chunkSize - 1);</div>
<div class="line"><a name="l00193"></a><span class="lineno"> 193</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00194"></a><span class="lineno"> 194</span>&#160; state.c[NUM_LIMBS_128BIT] = 0;</div>
<div class="line"><a name="l00195"></a><span class="lineno"> 195</span>&#160; processChunk();</div>
<div class="line"><a name="l00196"></a><span class="lineno"> 196</span>&#160; }</div>
<div class="line"><a name="l00197"></a><span class="lineno"> 197</span>&#160;</div>
<div class="line"><a name="l00198"></a><span class="lineno"> 198</span>&#160; <span class="comment">// At this point, processChunk() has left h as a partially reduced</span></div>
<div class="line"><a name="l00199"></a><span class="lineno"> 199</span>&#160; <span class="comment">// result that is less than (2^130 - 5) * 6. Perform one more</span></div>
<div class="line"><a name="l00200"></a><span class="lineno"> 200</span>&#160; <span class="comment">// reduction and a trial subtraction to produce the final result.</span></div>
<div class="line"><a name="l00201"></a><span class="lineno"> 201</span>&#160;</div>
<div class="line"><a name="l00202"></a><span class="lineno"> 202</span>&#160; <span class="comment">// Multiply the high bits of h by 5 and add them to the 130 low bits.</span></div>
<div class="line"><a name="l00203"></a><span class="lineno"> 203</span>&#160; carry = (dlimb_t)((state.h[NUM_LIMBS_128BIT] &gt;&gt; 2) +</div>
<div class="line"><a name="l00204"></a><span class="lineno"> 204</span>&#160; (state.h[NUM_LIMBS_128BIT] &amp; ~((limb_t)3)));</div>
<div class="line"><a name="l00205"></a><span class="lineno"> 205</span>&#160; state.h[NUM_LIMBS_128BIT] &amp;= 0x0003;</div>
<div class="line"><a name="l00206"></a><span class="lineno"> 206</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00207"></a><span class="lineno"> 207</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00208"></a><span class="lineno"> 208</span>&#160; state.h[i] = (limb_t)carry;</div>
<div class="line"><a name="l00209"></a><span class="lineno"> 209</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00210"></a><span class="lineno"> 210</span>&#160; }</div>
<div class="line"><a name="l00211"></a><span class="lineno"> 211</span>&#160; state.h[i] += (limb_t)carry;</div>
<div class="line"><a name="l00212"></a><span class="lineno"> 212</span>&#160;</div>
<div class="line"><a name="l00213"></a><span class="lineno"> 213</span>&#160; <span class="comment">// Subtract (2^130 - 5) from h by computing t = h + 5 - 2^130.</span></div>
<div class="line"><a name="l00214"></a><span class="lineno"> 214</span>&#160; <span class="comment">// The &quot;minus 2^130&quot; step is implicit.</span></div>
<div class="line"><a name="l00215"></a><span class="lineno"> 215</span>&#160; carry = 5;</div>
<div class="line"><a name="l00216"></a><span class="lineno"> 216</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_130BIT; ++i) {</div>
<div class="line"><a name="l00217"></a><span class="lineno"> 217</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00218"></a><span class="lineno"> 218</span>&#160; t[i] = (limb_t)carry;</div>
<div class="line"><a name="l00219"></a><span class="lineno"> 219</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00220"></a><span class="lineno"> 220</span>&#160; }</div>
<div class="line"><a name="l00221"></a><span class="lineno"> 221</span>&#160;</div>
<div class="line"><a name="l00222"></a><span class="lineno"> 222</span>&#160; <span class="comment">// Borrow occurs if bit 2^130 of the previous t result is zero.</span></div>
<div class="line"><a name="l00223"></a><span class="lineno"> 223</span>&#160; <span class="comment">// Carefully turn this into a selection mask so we can select either</span></div>
<div class="line"><a name="l00224"></a><span class="lineno"> 224</span>&#160; <span class="comment">// h or t as the final result. We don&#39;t care about the highest word</span></div>
<div class="line"><a name="l00225"></a><span class="lineno"> 225</span>&#160; <span class="comment">// of the result because we are about to drop it in the next step.</span></div>
<div class="line"><a name="l00226"></a><span class="lineno"> 226</span>&#160; <span class="comment">// We have to do it this way to avoid giving away any information</span></div>
<div class="line"><a name="l00227"></a><span class="lineno"> 227</span>&#160; <span class="comment">// about the value of h in the instruction timing.</span></div>
<div class="line"><a name="l00228"></a><span class="lineno"> 228</span>&#160; limb_t mask = (~((t[NUM_LIMBS_128BIT] &gt;&gt; 2) &amp; 1)) + 1;</div>
<div class="line"><a name="l00229"></a><span class="lineno"> 229</span>&#160; limb_t nmask = ~mask;</div>
<div class="line"><a name="l00230"></a><span class="lineno"> 230</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00231"></a><span class="lineno"> 231</span>&#160; state.h[i] = (state.h[i] &amp; nmask) | (t[i] &amp; mask);</div>
<div class="line"><a name="l00232"></a><span class="lineno"> 232</span>&#160; }</div>
<div class="line"><a name="l00233"></a><span class="lineno"> 233</span>&#160;</div>
<div class="line"><a name="l00234"></a><span class="lineno"> 234</span>&#160; <span class="comment">// Add the encrypted nonce and format the final hash.</span></div>
<div class="line"><a name="l00235"></a><span class="lineno"> 235</span>&#160; memcpy(state.c, nonce, 16);</div>
<div class="line"><a name="l00236"></a><span class="lineno"> 236</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00237"></a><span class="lineno"> 237</span>&#160; carry = 0;</div>
<div class="line"><a name="l00238"></a><span class="lineno"> 238</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00239"></a><span class="lineno"> 239</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00240"></a><span class="lineno"> 240</span>&#160; carry += state.c[i];</div>
<div class="line"><a name="l00241"></a><span class="lineno"> 241</span>&#160; state.h[i] = htolelimb((limb_t)carry);</div>
<div class="line"><a name="l00242"></a><span class="lineno"> 242</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00243"></a><span class="lineno"> 243</span>&#160; }</div>
<div class="line"><a name="l00244"></a><span class="lineno"> 244</span>&#160; <span class="keywordflow">if</span> (len &gt; 16)</div>
<div class="line"><a name="l00245"></a><span class="lineno"> 245</span>&#160; len = 16;</div>
<div class="line"><a name="l00246"></a><span class="lineno"> 246</span>&#160; memcpy(token, state.h, len);</div>
<div class="line"><a name="l00247"></a><span class="lineno"> 247</span>&#160;}</div>
<div class="line"><a name="l00248"></a><span class="lineno"> 248</span>&#160;</div>
<div class="line"><a name="l00254"></a><span class="lineno"><a class="line" href="classPoly1305.html#aaea2f40c1f22dcc2f8f690c793fb4388"> 254</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#aaea2f40c1f22dcc2f8f690c793fb4388">Poly1305::pad</a>()</div>
<div class="line"><a name="l00255"></a><span class="lineno"> 255</span>&#160;{</div>
<div class="line"><a name="l00256"></a><span class="lineno"> 256</span>&#160; <span class="keywordflow">if</span> (state.chunkSize != 0) {</div>
<div class="line"><a name="l00257"></a><span class="lineno"> 257</span>&#160; memset(((uint8_t *)state.c) + state.chunkSize, 0, 16 - state.chunkSize);</div>
<div class="line"><a name="l00258"></a><span class="lineno"> 258</span>&#160; littleToHost(state.c, NUM_LIMBS_128BIT);</div>
<div class="line"><a name="l00259"></a><span class="lineno"> 259</span>&#160; state.c[NUM_LIMBS_128BIT] = 1;</div>
<div class="line"><a name="l00260"></a><span class="lineno"> 260</span>&#160; processChunk();</div>
<div class="line"><a name="l00261"></a><span class="lineno"> 261</span>&#160; state.chunkSize = 0;</div>
<div class="line"><a name="l00262"></a><span class="lineno"> 262</span>&#160; }</div>
<div class="line"><a name="l00263"></a><span class="lineno"> 263</span>&#160;}</div>
<div class="line"><a name="l00264"></a><span class="lineno"> 264</span>&#160;</div>
<div class="line"><a name="l00268"></a><span class="lineno"><a class="line" href="classPoly1305.html#ae3f3392b9a2bd0f3472e7e50dd7e21dd"> 268</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classPoly1305.html#ae3f3392b9a2bd0f3472e7e50dd7e21dd">Poly1305::clear</a>()</div>
<div class="line"><a name="l00269"></a><span class="lineno"> 269</span>&#160;{</div>
<div class="line"><a name="l00270"></a><span class="lineno"> 270</span>&#160; clean(state);</div>
<div class="line"><a name="l00271"></a><span class="lineno"> 271</span>&#160;}</div>
<div class="line"><a name="l00272"></a><span class="lineno"> 272</span>&#160;</div>
<div class="line"><a name="l00276"></a><span class="lineno"> 276</span>&#160;<span class="keywordtype">void</span> Poly1305::processChunk()</div>
<div class="line"><a name="l00277"></a><span class="lineno"> 277</span>&#160;{</div>
<div class="line"><a name="l00278"></a><span class="lineno"> 278</span>&#160; limb_t t[NUM_LIMBS_256BIT + 1];</div>
<div class="line"><a name="l00279"></a><span class="lineno"> 279</span>&#160;</div>
<div class="line"><a name="l00280"></a><span class="lineno"> 280</span>&#160; <span class="comment">// Compute h = ((h + c) * r) mod (2^130 - 5).</span></div>
<div class="line"><a name="l00281"></a><span class="lineno"> 281</span>&#160;</div>
<div class="line"><a name="l00282"></a><span class="lineno"> 282</span>&#160; <span class="comment">// Start with h += c. We assume that h is less than (2^130 - 5) * 6</span></div>
<div class="line"><a name="l00283"></a><span class="lineno"> 283</span>&#160; <span class="comment">// and that c is less than 2^129, so the result will be less than 2^133.</span></div>
<div class="line"><a name="l00284"></a><span class="lineno"> 284</span>&#160; dlimb_t carry = 0;</div>
<div class="line"><a name="l00285"></a><span class="lineno"> 285</span>&#160; uint8_t i, j;</div>
<div class="line"><a name="l00286"></a><span class="lineno"> 286</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_130BIT; ++i) {</div>
<div class="line"><a name="l00287"></a><span class="lineno"> 287</span>&#160; carry += state.h[i];</div>
<div class="line"><a name="l00288"></a><span class="lineno"> 288</span>&#160; carry += state.c[i];</div>
<div class="line"><a name="l00289"></a><span class="lineno"> 289</span>&#160; state.h[i] = (limb_t)carry;</div>
<div class="line"><a name="l00290"></a><span class="lineno"> 290</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00291"></a><span class="lineno"> 291</span>&#160; }</div>
<div class="line"><a name="l00292"></a><span class="lineno"> 292</span>&#160;</div>
<div class="line"><a name="l00293"></a><span class="lineno"> 293</span>&#160; <span class="comment">// Multiply h by r. We know that r is less than 2^124 because the</span></div>
<div class="line"><a name="l00294"></a><span class="lineno"> 294</span>&#160; <span class="comment">// top 4 bits were AND-ed off by reset(). That makes h * r less</span></div>
<div class="line"><a name="l00295"></a><span class="lineno"> 295</span>&#160; <span class="comment">// than 2^257. Which is less than the (2^130 - 6)^2 we want for</span></div>
<div class="line"><a name="l00296"></a><span class="lineno"> 296</span>&#160; <span class="comment">// the modulo reduction step that follows.</span></div>
<div class="line"><a name="l00297"></a><span class="lineno"> 297</span>&#160; carry = 0;</div>
<div class="line"><a name="l00298"></a><span class="lineno"> 298</span>&#160; limb_t word = state.r[0];</div>
<div class="line"><a name="l00299"></a><span class="lineno"> 299</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_130BIT; ++i) {</div>
<div class="line"><a name="l00300"></a><span class="lineno"> 300</span>&#160; carry += ((dlimb_t)(state.h[i])) * word;</div>
<div class="line"><a name="l00301"></a><span class="lineno"> 301</span>&#160; t[i] = (limb_t)carry;</div>
<div class="line"><a name="l00302"></a><span class="lineno"> 302</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00303"></a><span class="lineno"> 303</span>&#160; }</div>
<div class="line"><a name="l00304"></a><span class="lineno"> 304</span>&#160; t[NUM_LIMBS_130BIT] = (limb_t)carry;</div>
<div class="line"><a name="l00305"></a><span class="lineno"> 305</span>&#160; <span class="keywordflow">for</span> (i = 1; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00306"></a><span class="lineno"> 306</span>&#160; word = state.r[i];</div>
<div class="line"><a name="l00307"></a><span class="lineno"> 307</span>&#160; carry = 0;</div>
<div class="line"><a name="l00308"></a><span class="lineno"> 308</span>&#160; <span class="keywordflow">for</span> (j = 0; j &lt; NUM_LIMBS_130BIT; ++j) {</div>
<div class="line"><a name="l00309"></a><span class="lineno"> 309</span>&#160; carry += ((dlimb_t)(state.h[j])) * word;</div>
<div class="line"><a name="l00310"></a><span class="lineno"> 310</span>&#160; carry += t[i + j];</div>
<div class="line"><a name="l00311"></a><span class="lineno"> 311</span>&#160; t[i + j] = (limb_t)carry;</div>
<div class="line"><a name="l00312"></a><span class="lineno"> 312</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00313"></a><span class="lineno"> 313</span>&#160; }</div>
<div class="line"><a name="l00314"></a><span class="lineno"> 314</span>&#160; t[i + NUM_LIMBS_130BIT] = (limb_t)carry;</div>
<div class="line"><a name="l00315"></a><span class="lineno"> 315</span>&#160; }</div>
<div class="line"><a name="l00316"></a><span class="lineno"> 316</span>&#160;</div>
<div class="line"><a name="l00317"></a><span class="lineno"> 317</span>&#160; <span class="comment">// Reduce h * r modulo (2^130 - 5) by multiplying the high 130 bits by 5</span></div>
<div class="line"><a name="l00318"></a><span class="lineno"> 318</span>&#160; <span class="comment">// and adding them to the low 130 bits. See the explaination in the</span></div>
<div class="line"><a name="l00319"></a><span class="lineno"> 319</span>&#160; <span class="comment">// comments for Curve25519::reduce() for a description of how this works.</span></div>
<div class="line"><a name="l00320"></a><span class="lineno"> 320</span>&#160; carry = ((dlimb_t)(t[NUM_LIMBS_128BIT] &gt;&gt; 2)) +</div>
<div class="line"><a name="l00321"></a><span class="lineno"> 321</span>&#160; (t[NUM_LIMBS_128BIT] &amp; ~((limb_t)3));</div>
<div class="line"><a name="l00322"></a><span class="lineno"> 322</span>&#160; t[NUM_LIMBS_128BIT] &amp;= 0x0003;</div>
<div class="line"><a name="l00323"></a><span class="lineno"> 323</span>&#160; <span class="keywordflow">for</span> (i = 0; i &lt; NUM_LIMBS_128BIT; ++i) {</div>
<div class="line"><a name="l00324"></a><span class="lineno"> 324</span>&#160; <span class="comment">// Shift the next word of t up by (LIMB_BITS - 2) bits and then</span></div>
<div class="line"><a name="l00325"></a><span class="lineno"> 325</span>&#160; <span class="comment">// multiply it by 5. Breaking it down, we can add the results</span></div>
<div class="line"><a name="l00326"></a><span class="lineno"> 326</span>&#160; <span class="comment">// of shifting up by LIMB_BITS and shifting up by (LIMB_BITS - 2).</span></div>
<div class="line"><a name="l00327"></a><span class="lineno"> 327</span>&#160; <span class="comment">// The main wrinkle here is that this can result in an intermediate</span></div>
<div class="line"><a name="l00328"></a><span class="lineno"> 328</span>&#160; <span class="comment">// carry that is (LIMB_BITS * 2 + 1) bits in size which doesn&#39;t</span></div>
<div class="line"><a name="l00329"></a><span class="lineno"> 329</span>&#160; <span class="comment">// fit within a dlimb_t variable. However, we can defer adding</span></div>
<div class="line"><a name="l00330"></a><span class="lineno"> 330</span>&#160; <span class="comment">// (word &lt;&lt; LIMB_BITS) until after the &quot;carry &gt;&gt;= LIMB_BITS&quot; step</span></div>
<div class="line"><a name="l00331"></a><span class="lineno"> 331</span>&#160; <span class="comment">// because it won&#39;t affect the low bits of the carry.</span></div>
<div class="line"><a name="l00332"></a><span class="lineno"> 332</span>&#160; word = t[i + NUM_LIMBS_130BIT];</div>
<div class="line"><a name="l00333"></a><span class="lineno"> 333</span>&#160; carry += ((dlimb_t)word) &lt;&lt; (LIMB_BITS - 2);</div>
<div class="line"><a name="l00334"></a><span class="lineno"> 334</span>&#160; carry += t[i];</div>
<div class="line"><a name="l00335"></a><span class="lineno"> 335</span>&#160; state.h[i] = (limb_t)carry;</div>
<div class="line"><a name="l00336"></a><span class="lineno"> 336</span>&#160; carry &gt;&gt;= LIMB_BITS;</div>
<div class="line"><a name="l00337"></a><span class="lineno"> 337</span>&#160; carry += word;</div>
<div class="line"><a name="l00338"></a><span class="lineno"> 338</span>&#160; }</div>
<div class="line"><a name="l00339"></a><span class="lineno"> 339</span>&#160; state.h[i] = (limb_t)(carry + t[NUM_LIMBS_128BIT]);</div>
<div class="line"><a name="l00340"></a><span class="lineno"> 340</span>&#160;</div>
<div class="line"><a name="l00341"></a><span class="lineno"> 341</span>&#160; <span class="comment">// At this point, h is either the answer of reducing modulo (2^130 - 5)</span></div>
<div class="line"><a name="l00342"></a><span class="lineno"> 342</span>&#160; <span class="comment">// or it is at most 5 subtractions away from the answer we want.</span></div>
<div class="line"><a name="l00343"></a><span class="lineno"> 343</span>&#160; <span class="comment">// Leave it as-is for now with h less than (2^130 - 5) * 6. It is</span></div>
<div class="line"><a name="l00344"></a><span class="lineno"> 344</span>&#160; <span class="comment">// still within a range where the next h * r step will not overflow.</span></div>
<div class="line"><a name="l00345"></a><span class="lineno"> 345</span>&#160;}</div>
<div class="ttc" id="classPoly1305_html_aab3fa6c5f6fa7d9ca6c82bead38f499c"><div class="ttname"><a href="classPoly1305.html#aab3fa6c5f6fa7d9ca6c82bead38f499c">Poly1305::finalize</a></div><div class="ttdeci">void finalize(const void *nonce, void *token, size_t len)</div><div class="ttdoc">Finalizes the authentication process and returns the token. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00182">Poly1305.cpp:182</a></div></div>
<div class="ttc" id="classPoly1305_html_a544839403d0a19300c239708bc1e6ed8"><div class="ttname"><a href="classPoly1305.html#a544839403d0a19300c239708bc1e6ed8">Poly1305::reset</a></div><div class="ttdeci">void reset(const void *key)</div><div class="ttdoc">Resets the Poly1305 message authenticator for a new session. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00113">Poly1305.cpp:113</a></div></div>
<div class="ttc" id="classPoly1305_html_ae4e0b647ff93f501bd01459b1616557c"><div class="ttname"><a href="classPoly1305.html#ae4e0b647ff93f501bd01459b1616557c">Poly1305::update</a></div><div class="ttdeci">void update(const void *data, size_t len)</div><div class="ttdoc">Updates the message authenticator with more data. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00145">Poly1305.cpp:145</a></div></div>
<div class="ttc" id="classPoly1305_html_aaea2f40c1f22dcc2f8f690c793fb4388"><div class="ttname"><a href="classPoly1305.html#aaea2f40c1f22dcc2f8f690c793fb4388">Poly1305::pad</a></div><div class="ttdeci">void pad()</div><div class="ttdoc">Pads the input stream with zero bytes to a multiple of 16. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00254">Poly1305.cpp:254</a></div></div>
<div class="ttc" id="classPoly1305_html_ac021b5ebbc123fa4c0ee36330472c25d"><div class="ttname"><a href="classPoly1305.html#ac021b5ebbc123fa4c0ee36330472c25d">Poly1305::~Poly1305</a></div><div class="ttdeci">~Poly1305()</div><div class="ttdoc">Destroys this Poly1305 message authenticator after clearing all sensitive information. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00101">Poly1305.cpp:101</a></div></div>
<div class="ttc" id="classPoly1305_html_a7d62e7cd2d67f1c72142580036066fa2"><div class="ttname"><a href="classPoly1305.html#a7d62e7cd2d67f1c72142580036066fa2">Poly1305::Poly1305</a></div><div class="ttdeci">Poly1305()</div><div class="ttdoc">Constructs a new Poly1305 message authenticator. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00092">Poly1305.cpp:92</a></div></div>
<div class="ttc" id="classPoly1305_html_ae3f3392b9a2bd0f3472e7e50dd7e21dd"><div class="ttname"><a href="classPoly1305.html#ae3f3392b9a2bd0f3472e7e50dd7e21dd">Poly1305::clear</a></div><div class="ttdeci">void clear()</div><div class="ttdoc">Clears the authenticator&#39;s state, removing all sensitive data. </div><div class="ttdef"><b>Definition:</b> <a href="Poly1305_8cpp_source.html#l00268">Poly1305.cpp:268</a></div></div>
</div><!-- fragment --></div><!-- contents -->
<!-- start footer part -->
<hr class="footer"/><address class="footer"><small>
Generated on Sat Mar 26 2016 19:04:41 for ArduinoLibs by &#160;<a href="http://www.doxygen.org/index.html">
Generated on Thu Aug 18 2016 18:42:10 for ArduinoLibs by &#160;<a href="http://www.doxygen.org/index.html">
<img class="footer" src="doxygen.png" alt="doxygen"/>
</a> 1.8.6
</small></address>