Arduino Cryptography Library
 All Classes Files Functions Variables Enumerations Enumerator Pages
BLAKE2s.cpp
1 /*
2  * Copyright (C) 2015 Southern Storm Software, Pty Ltd.
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice shall be included
12  * in all copies or substantial portions of the Software.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15  * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
18  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
19  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
20  * DEALINGS IN THE SOFTWARE.
21  */
22 
23 #include "BLAKE2s.h"
24 #include "Crypto.h"
25 #include "utility/EndianUtil.h"
26 #include "utility/RotateUtil.h"
27 #include "utility/ProgMemUtil.h"
28 #include <string.h>
29 
76 {
77  reset();
78 }
79 
85 {
86  clean(state);
87 }
88 
89 size_t BLAKE2s::hashSize() const
90 {
91  return 32;
92 }
93 
94 size_t BLAKE2s::blockSize() const
95 {
96  return 64;
97 }
98 
99 // Initialization vectors for BLAKE2s.
100 #define BLAKE2s_IV0 0x6A09E667
101 #define BLAKE2s_IV1 0xBB67AE85
102 #define BLAKE2s_IV2 0x3C6EF372
103 #define BLAKE2s_IV3 0xA54FF53A
104 #define BLAKE2s_IV4 0x510E527F
105 #define BLAKE2s_IV5 0x9B05688C
106 #define BLAKE2s_IV6 0x1F83D9AB
107 #define BLAKE2s_IV7 0x5BE0CD19
108 
110 {
111  state.h[0] = BLAKE2s_IV0 ^ 0x01010020; // Default output length of 32.
112  state.h[1] = BLAKE2s_IV1;
113  state.h[2] = BLAKE2s_IV2;
114  state.h[3] = BLAKE2s_IV3;
115  state.h[4] = BLAKE2s_IV4;
116  state.h[5] = BLAKE2s_IV5;
117  state.h[6] = BLAKE2s_IV6;
118  state.h[7] = BLAKE2s_IV7;
119  state.chunkSize = 0;
120  state.length = 0;
121 }
122 
130 void BLAKE2s::reset(uint8_t outputLength)
131 {
132  if (outputLength < 1)
133  outputLength = 1;
134  else if (outputLength > 32)
135  outputLength = 32;
136  state.h[0] = BLAKE2s_IV0 ^ 0x01010000 ^ outputLength;
137  state.h[1] = BLAKE2s_IV1;
138  state.h[2] = BLAKE2s_IV2;
139  state.h[3] = BLAKE2s_IV3;
140  state.h[4] = BLAKE2s_IV4;
141  state.h[5] = BLAKE2s_IV5;
142  state.h[6] = BLAKE2s_IV6;
143  state.h[7] = BLAKE2s_IV7;
144  state.chunkSize = 0;
145  state.length = 0;
146 }
147 
160 void BLAKE2s::reset(const void *key, size_t keyLen, uint8_t outputLength)
161 {
162  if (keyLen > 32)
163  keyLen = 32;
164  if (outputLength < 1)
165  outputLength = 1;
166  else if (outputLength > 32)
167  outputLength = 32;
168  state.h[0] = BLAKE2s_IV0 ^ 0x01010000 ^ (keyLen << 8) ^ outputLength;
169  state.h[1] = BLAKE2s_IV1;
170  state.h[2] = BLAKE2s_IV2;
171  state.h[3] = BLAKE2s_IV3;
172  state.h[4] = BLAKE2s_IV4;
173  state.h[5] = BLAKE2s_IV5;
174  state.h[6] = BLAKE2s_IV6;
175  state.h[7] = BLAKE2s_IV7;
176  if (keyLen > 0) {
177  // Set the first block to the key and pad with zeroes.
178  memcpy(state.m, key, keyLen);
179  memset(((uint8_t *)state.m) + keyLen, 0, 64 - keyLen);
180  state.chunkSize = 64;
181  state.length = 64;
182  } else {
183  // No key. The first data block is the first hashed block.
184  state.chunkSize = 0;
185  state.length = 0;
186  }
187 }
188 
189 void BLAKE2s::update(const void *data, size_t len)
190 {
191  // Break the input up into 512-bit chunks and process each in turn.
192  const uint8_t *d = (const uint8_t *)data;
193  while (len > 0) {
194  if (state.chunkSize == 64) {
195  // Previous chunk was full and we know that it wasn't the
196  // last chunk, so we can process it now with f0 set to zero.
197  processChunk(0);
198  state.chunkSize = 0;
199  }
200  uint8_t size = 64 - state.chunkSize;
201  if (size > len)
202  size = len;
203  memcpy(((uint8_t *)state.m) + state.chunkSize, d, size);
204  state.chunkSize += size;
205  state.length += size;
206  len -= size;
207  d += size;
208  }
209 }
210 
211 void BLAKE2s::finalize(void *hash, size_t len)
212 {
213  // Pad the last chunk and hash it with f0 set to all-ones.
214  memset(((uint8_t *)state.m) + state.chunkSize, 0, 64 - state.chunkSize);
215  processChunk(0xFFFFFFFF);
216 
217  // Convert the hash into little-endian in the message buffer.
218  for (uint8_t posn = 0; posn < 8; ++posn)
219  state.m[posn] = htole32(state.h[posn]);
220 
221  // Copy the hash to the caller's return buffer.
222  if (len > 32)
223  len = 32;
224  memcpy(hash, state.m, len);
225 }
226 
228 {
229  clean(state);
230  reset();
231 }
232 
233 void BLAKE2s::resetHMAC(const void *key, size_t keyLen)
234 {
235  formatHMACKey(state.m, key, keyLen, 0x36);
236  state.length += 64;
237  processChunk(0);
238 }
239 
240 void BLAKE2s::finalizeHMAC(const void *key, size_t keyLen, void *hash, size_t hashLen)
241 {
242  uint8_t temp[32];
243  finalize(temp, sizeof(temp));
244  formatHMACKey(state.m, key, keyLen, 0x5C);
245  state.length += 64;
246  processChunk(0);
247  update(temp, sizeof(temp));
248  finalize(hash, hashLen);
249  clean(temp);
250 }
251 
252 // Permutation on the message input state for BLAKE2s.
253 static const uint8_t sigma[10][16] PROGMEM = {
254  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15},
255  {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3},
256  {11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4},
257  { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8},
258  { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13},
259  { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9},
260  {12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11},
261  {13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10},
262  { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5},
263  {10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0}
264 };
265 
266 // Perform a BLAKE2s quarter round operation.
267 #define quarterRound(a, b, c, d, i) \
268  do { \
269  uint32_t _b = (b); \
270  uint32_t _a = (a) + _b + state.m[pgm_read_byte(&(sigma[index][2 * (i)]))]; \
271  uint32_t _d = rightRotate16((d) ^ _a); \
272  uint32_t _c = (c) + _d; \
273  _b = rightRotate12(_b ^ _c); \
274  _a += _b + state.m[pgm_read_byte(&(sigma[index][2 * (i) + 1]))]; \
275  (d) = _d = rightRotate8(_d ^ _a); \
276  _c += _d; \
277  (a) = _a; \
278  (b) = rightRotate7(_b ^ _c); \
279  (c) = _c; \
280  } while (0)
281 
282 void BLAKE2s::processChunk(uint32_t f0)
283 {
284  uint8_t index;
285  uint32_t v[16];
286 
287  // Byte-swap the message buffer into little-endian if necessary.
288 #if !defined(CRYPTO_LITTLE_ENDIAN)
289  for (index = 0; index < 16; ++index)
290  state.m[index] = le32toh(state.m[index]);
291 #endif
292 
293  // Format the block to be hashed.
294  memcpy(v, state.h, sizeof(state.h));
295  v[8] = BLAKE2s_IV0;
296  v[9] = BLAKE2s_IV1;
297  v[10] = BLAKE2s_IV2;
298  v[11] = BLAKE2s_IV3;
299  v[12] = BLAKE2s_IV4 ^ (uint32_t)(state.length);
300  v[13] = BLAKE2s_IV5 ^ (uint32_t)(state.length >> 32);
301  v[14] = BLAKE2s_IV6 ^ f0;
302  v[15] = BLAKE2s_IV7;
303 
304  // Perform the 10 BLAKE2s rounds.
305  for (index = 0; index < 10; ++index) {
306  // Column round.
307  quarterRound(v[0], v[4], v[8], v[12], 0);
308  quarterRound(v[1], v[5], v[9], v[13], 1);
309  quarterRound(v[2], v[6], v[10], v[14], 2);
310  quarterRound(v[3], v[7], v[11], v[15], 3);
311 
312  // Diagonal round.
313  quarterRound(v[0], v[5], v[10], v[15], 4);
314  quarterRound(v[1], v[6], v[11], v[12], 5);
315  quarterRound(v[2], v[7], v[8], v[13], 6);
316  quarterRound(v[3], v[4], v[9], v[14], 7);
317  }
318 
319  // Combine the new and old hash values.
320  for (index = 0; index < 8; ++index)
321  state.h[index] ^= (v[index] ^ v[index + 8]);
322 }
virtual ~BLAKE2s()
Destroys this BLAKE2s hash object after clearing sensitive information.
Definition: BLAKE2s.cpp:84
size_t hashSize() const
Size of the hash result from finalize().
Definition: BLAKE2s.cpp:89
void clear()
Clears the hash state, removing all sensitive data, and then resets the hash ready for a new hashing ...
Definition: BLAKE2s.cpp:227
void reset()
Resets the hash ready for a new hashing process.
Definition: BLAKE2s.cpp:109
size_t blockSize() const
Size of the internal block used by the hash algorithm.
Definition: BLAKE2s.cpp:94
void update(const void *data, size_t len)
Updates the hash with more data.
Definition: BLAKE2s.cpp:189
void resetHMAC(const void *key, size_t keyLen)
Resets the hash ready for a new HMAC hashing process.
Definition: BLAKE2s.cpp:233
void finalize(void *hash, size_t len)
Finalizes the hashing process and returns the hash.
Definition: BLAKE2s.cpp:211
void finalizeHMAC(const void *key, size_t keyLen, void *hash, size_t hashLen)
Finalizes the HMAC hashing process and returns the hash.
Definition: BLAKE2s.cpp:240
BLAKE2s()
Constructs a BLAKE2s hash object.
Definition: BLAKE2s.cpp:75
void formatHMACKey(void *block, const void *key, size_t len, uint8_t pad)
Formats a HMAC key into a block.
Definition: Hash.cpp:162