ArduinoLibs
 All Classes Files Functions Variables Typedefs Enumerations Enumerator Friends Groups Pages
BLAKE2b.cpp
1 /*
2  * Copyright (C) 2015 Southern Storm Software, Pty Ltd.
3  *
4  * Permission is hereby granted, free of charge, to any person obtaining a
5  * copy of this software and associated documentation files (the "Software"),
6  * to deal in the Software without restriction, including without limitation
7  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8  * and/or sell copies of the Software, and to permit persons to whom the
9  * Software is furnished to do so, subject to the following conditions:
10  *
11  * The above copyright notice and this permission notice shall be included
12  * in all copies or substantial portions of the Software.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15  * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
18  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
19  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
20  * DEALINGS IN THE SOFTWARE.
21  */
22 
23 #include "BLAKE2b.h"
24 #include "Crypto.h"
25 #include "utility/EndianUtil.h"
26 #include "utility/RotateUtil.h"
27 #include "utility/ProgMemUtil.h"
28 #include <string.h>
29 
48 {
49  reset();
50 }
51 
57 {
58  clean(state);
59 }
60 
61 size_t BLAKE2b::hashSize() const
62 {
63  return 64;
64 }
65 
66 size_t BLAKE2b::blockSize() const
67 {
68  return 128;
69 }
70 
71 // Initialization vectors for BLAKE2b.
72 #define BLAKE2b_IV0 0x6a09e667f3bcc908ULL
73 #define BLAKE2b_IV1 0xbb67ae8584caa73bULL
74 #define BLAKE2b_IV2 0x3c6ef372fe94f82bULL
75 #define BLAKE2b_IV3 0xa54ff53a5f1d36f1ULL
76 #define BLAKE2b_IV4 0x510e527fade682d1ULL
77 #define BLAKE2b_IV5 0x9b05688c2b3e6c1fULL
78 #define BLAKE2b_IV6 0x1f83d9abfb41bd6bULL
79 #define BLAKE2b_IV7 0x5be0cd19137e2179ULL
80 
82 {
83  state.h[0] = BLAKE2b_IV0 ^ 0x01010040; // Default output length of 64.
84  state.h[1] = BLAKE2b_IV1;
85  state.h[2] = BLAKE2b_IV2;
86  state.h[3] = BLAKE2b_IV3;
87  state.h[4] = BLAKE2b_IV4;
88  state.h[5] = BLAKE2b_IV5;
89  state.h[6] = BLAKE2b_IV6;
90  state.h[7] = BLAKE2b_IV7;
91  state.chunkSize = 0;
92  state.lengthLow = 0;
93  state.lengthHigh = 0;
94 }
95 
103 void BLAKE2b::reset(uint8_t outputLength)
104 {
105  state.h[0] = BLAKE2b_IV0 ^ 0x01010000 ^ outputLength;
106  state.h[1] = BLAKE2b_IV1;
107  state.h[2] = BLAKE2b_IV2;
108  state.h[3] = BLAKE2b_IV3;
109  state.h[4] = BLAKE2b_IV4;
110  state.h[5] = BLAKE2b_IV5;
111  state.h[6] = BLAKE2b_IV6;
112  state.h[7] = BLAKE2b_IV7;
113  state.chunkSize = 0;
114  state.lengthLow = 0;
115  state.lengthHigh = 0;
116 }
117 
118 void BLAKE2b::update(const void *data, size_t len)
119 {
120  // Break the input up into 1024-bit chunks and process each in turn.
121  const uint8_t *d = (const uint8_t *)data;
122  while (len > 0) {
123  if (state.chunkSize == 128) {
124  // Previous chunk was full and we know that it wasn't the
125  // last chunk, so we can process it now with f0 set to zero.
126  processChunk(0);
127  state.chunkSize = 0;
128  }
129  uint8_t size = 128 - state.chunkSize;
130  if (size > len)
131  size = len;
132  memcpy(((uint8_t *)state.m) + state.chunkSize, d, size);
133  state.chunkSize += size;
134  uint64_t temp = state.lengthLow;
135  state.lengthLow += size;
136  if (state.lengthLow < temp)
137  ++state.lengthHigh;
138  len -= size;
139  d += size;
140  }
141 }
142 
143 void BLAKE2b::finalize(void *hash, size_t len)
144 {
145  // Pad the last chunk and hash it with f0 set to all-ones.
146  memset(((uint8_t *)state.m) + state.chunkSize, 0, 128 - state.chunkSize);
147  processChunk(0xFFFFFFFFFFFFFFFFULL);
148 
149  // Convert the hash into little-endian in the message buffer.
150  for (uint8_t posn = 0; posn < 8; ++posn)
151  state.m[posn] = htole64(state.h[posn]);
152 
153  // Copy the hash to the caller's return buffer.
154  if (len > 64)
155  len = 64;
156  memcpy(hash, state.m, len);
157 }
158 
160 {
161  clean(state);
162  reset();
163 }
164 
165 void BLAKE2b::resetHMAC(const void *key, size_t keyLen)
166 {
167  formatHMACKey(state.m, key, keyLen, 0x36);
168  state.lengthLow += 128;
169  processChunk(0);
170 }
171 
172 void BLAKE2b::finalizeHMAC(const void *key, size_t keyLen, void *hash, size_t hashLen)
173 {
174  uint8_t temp[64];
175  finalize(temp, sizeof(temp));
176  formatHMACKey(state.m, key, keyLen, 0x5C);
177  state.lengthLow += 128;
178  processChunk(0);
179  update(temp, sizeof(temp));
180  finalize(hash, hashLen);
181  clean(temp);
182 }
183 
184 // Permutation on the message input state for BLAKE2b.
185 static const uint8_t sigma[12][16] PROGMEM = {
186  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15},
187  {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3},
188  {11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4},
189  { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8},
190  { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13},
191  { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9},
192  {12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11},
193  {13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10},
194  { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5},
195  {10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0},
196  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15},
197  {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3},
198 };
199 
200 // Perform a BLAKE2b quarter round operation.
201 #define quarterRound(a, b, c, d, i) \
202  do { \
203  uint64_t _b = (b); \
204  uint64_t _a = (a) + _b + state.m[pgm_read_byte(&(sigma[index][2 * (i)]))]; \
205  uint64_t _d = rightRotate32_64((d) ^ _a); \
206  uint64_t _c = (c) + _d; \
207  _b = rightRotate24_64(_b ^ _c); \
208  _a += _b + state.m[pgm_read_byte(&(sigma[index][2 * (i) + 1]))]; \
209  (d) = _d = rightRotate16_64(_d ^ _a); \
210  _c += _d; \
211  (a) = _a; \
212  (b) = rightRotate63_64(_b ^ _c); \
213  (c) = _c; \
214  } while (0)
215 
216 void BLAKE2b::processChunk(uint64_t f0)
217 {
218  uint8_t index;
219  uint64_t v[16];
220 
221  // Byte-swap the message buffer into little-endian if necessary.
222 #if !defined(CRYPTO_LITTLE_ENDIAN)
223  for (index = 0; index < 16; ++index)
224  state.m[index] = le64toh(state.m[index]);
225 #endif
226 
227  // Format the block to be hashed.
228  memcpy(v, state.h, sizeof(state.h));
229  v[8] = BLAKE2b_IV0;
230  v[9] = BLAKE2b_IV1;
231  v[10] = BLAKE2b_IV2;
232  v[11] = BLAKE2b_IV3;
233  v[12] = BLAKE2b_IV4 ^ state.lengthLow;
234  v[13] = BLAKE2b_IV5 ^ state.lengthHigh;
235  v[14] = BLAKE2b_IV6 ^ f0;
236  v[15] = BLAKE2b_IV7;
237 
238  // Perform the 12 BLAKE2b rounds.
239  for (index = 0; index < 12; ++index) {
240  // Column round.
241  quarterRound(v[0], v[4], v[8], v[12], 0);
242  quarterRound(v[1], v[5], v[9], v[13], 1);
243  quarterRound(v[2], v[6], v[10], v[14], 2);
244  quarterRound(v[3], v[7], v[11], v[15], 3);
245 
246  // Diagonal round.
247  quarterRound(v[0], v[5], v[10], v[15], 4);
248  quarterRound(v[1], v[6], v[11], v[12], 5);
249  quarterRound(v[2], v[7], v[8], v[13], 6);
250  quarterRound(v[3], v[4], v[9], v[14], 7);
251  }
252 
253  // Combine the new and old hash values.
254  for (index = 0; index < 8; ++index)
255  state.h[index] ^= (v[index] ^ v[index + 8]);
256 }
void finalize(void *hash, size_t len)
Finalizes the hashing process and returns the hash.
Definition: BLAKE2b.cpp:143
void reset()
Resets the hash ready for a new hashing process.
Definition: BLAKE2b.cpp:81
void clear()
Clears the hash state, removing all sensitive data, and then resets the hash ready for a new hashing ...
Definition: BLAKE2b.cpp:159
BLAKE2b()
Constructs a BLAKE2b hash object.
Definition: BLAKE2b.cpp:47
size_t blockSize() const
Size of the internal block used by the hash algorithm.
Definition: BLAKE2b.cpp:66
size_t hashSize() const
Size of the hash result from finalize().
Definition: BLAKE2b.cpp:61
virtual ~BLAKE2b()
Destroys this BLAKE2b hash object after clearing sensitive information.
Definition: BLAKE2b.cpp:56
void update(const void *data, size_t len)
Updates the hash with more data.
Definition: BLAKE2b.cpp:118
uint8_t * data()
Returns a pointer to the start of the bitmap's data buffer.
Definition: Bitmap.h:53
void resetHMAC(const void *key, size_t keyLen)
Resets the hash ready for a new HMAC hashing process.
Definition: BLAKE2b.cpp:165
void formatHMACKey(void *block, const void *key, size_t len, uint8_t pad)
Formats a HMAC key into a block.
Definition: Hash.cpp:162
void finalizeHMAC(const void *key, size_t keyLen, void *hash, size_t hashLen)
Finalizes the HMAC hashing process and returns the hash.
Definition: BLAKE2b.cpp:172