Security Scol plugin
blake2.cpp
1// blake2.cpp - written and placed in the public domain by Jeffrey Walton
2// and Zooko Wilcox-O'Hearn. Based on Aumasson, Neves,
3// Wilcox-O'Hearn and Winnerlein's reference BLAKE2
4// implementation at http://github.com/BLAKE2/BLAKE2.
5//
6// The BLAKE2b and BLAKE2s numbers are consistent with the BLAKE2 team's
7// numbers. However, we have an Altivec implementation of BLAKE2s,
8// and a POWER8 implementation of BLAKE2b (BLAKE2 team is missing them).
9// Altivec code is about 2x faster than C++ when using GCC 5.0 or
10// above. The POWER8 code is about 2.5x faster than C++ when using GCC 5.0
11// or above. If you use GCC 4.0 (PowerMac) or GCC 4.8 (GCC Compile Farm)
12// then the PowerPC code will be slower than C++. Be sure to use GCC 5.0
13// or above for PowerPC builds or disable Altivec for BLAKE2b and BLAKE2s
14// if using the old compilers.
15
16#include "pch.h"
17#include "config.h"
18#include "cryptlib.h"
19#include "argnames.h"
20#include "algparam.h"
21#include "blake2.h"
22#include "cpu.h"
23
24// Uncomment for benchmarking C++ against SSE2 or NEON.
25// Do so in both blake2.cpp and blake2_simd.cpp.
26// #undef CRYPTOPP_SSE41_AVAILABLE
27// #undef CRYPTOPP_ARM_NEON_AVAILABLE
28// #undef CRYPTOPP_ALTIVEC_AVAILABLE
29// #undef CRYPTOPP_POWER8_AVAILABLE
30
31// Disable NEON/ASIMD for Cortex-A53 and A57. The shifts are too slow and C/C++ is about
32// 3 cpb faster than NEON/ASIMD. Also see http://github.com/weidai11/cryptopp/issues/367.
33#if (defined(__aarch32__) || defined(__aarch64__)) && defined(CRYPTOPP_SLOW_ARMV8_SHIFT)
34# undef CRYPTOPP_ARM_NEON_AVAILABLE
35#endif
36
37// BLAKE2s bug on AIX 7.1 (POWER7) with XLC 12.01
38// https://github.com/weidai11/cryptopp/issues/743
39#if defined(__xlC__) && (__xlC__ < 0x0d01)
40# define CRYPTOPP_DISABLE_ALTIVEC 1
41# undef CRYPTOPP_POWER7_AVAILABLE
42# undef CRYPTOPP_POWER8_AVAILABLE
43# undef CRYPTOPP_ALTIVEC_AVAILABLE
44#endif
45
46// Can't use GetAlignmentOf<word64>() because of C++11 and constexpr
47// Can use 'const unsigned int' because of MSVC 2013
48#if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
49# define ALIGN_SPEC32 16
50# define ALIGN_SPEC64 16
51#else
52# define ALIGN_SPEC32 4
53# define ALIGN_SPEC64 8
54#endif
55
56NAMESPACE_BEGIN(CryptoPP)
57
58// Export the tables to the SIMD files
59extern const word32 BLAKE2S_IV[8];
60extern const word64 BLAKE2B_IV[8];
61
62CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
63const word32 BLAKE2S_IV[8] = {
64 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
65 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
66};
67
68CRYPTOPP_ALIGN_DATA(ALIGN_SPEC64)
69const word64 BLAKE2B_IV[8] = {
70 W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
71 W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
72 W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
73 W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)
74};
75
76NAMESPACE_END
77
78ANONYMOUS_NAMESPACE_BEGIN
79
80using CryptoPP::byte;
81using CryptoPP::word32;
82using CryptoPP::word64;
83using CryptoPP::rotrConstant;
84
85CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
86const byte BLAKE2S_SIGMA[10][16] = {
87 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
88 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
89 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
90 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
91 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
92 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
93 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
94 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
95 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
96 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
97};
98
99CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
100const byte BLAKE2B_SIGMA[12][16] = {
101 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
102 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
103 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
104 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
105 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
106 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
107 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
108 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
109 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
110 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
111 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
112 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
113};
114
115template <unsigned int R, unsigned int N>
116inline void BLAKE2B_G(const word64 m[16], word64& a, word64& b, word64& c, word64& d)
117{
118 a = a + b + m[BLAKE2B_SIGMA[R][2*N+0]];
119 d = rotrConstant<32>(d ^ a);
120 c = c + d;
121 b = rotrConstant<24>(b ^ c);
122 a = a + b + m[BLAKE2B_SIGMA[R][2*N+1]];
123 d = rotrConstant<16>(d ^ a);
124 c = c + d;
125 b = rotrConstant<63>(b ^ c);
126}
127
128template <unsigned int R>
129inline void BLAKE2B_ROUND(const word64 m[16], word64 v[16])
130{
131 BLAKE2B_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
132 BLAKE2B_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
133 BLAKE2B_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
134 BLAKE2B_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
135 BLAKE2B_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
136 BLAKE2B_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
137 BLAKE2B_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
138 BLAKE2B_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
139}
140
141template <unsigned int R, unsigned int N>
142inline void BLAKE2S_G(const word32 m[16], word32& a, word32& b, word32& c, word32& d)
143{
144 a = a + b + m[BLAKE2S_SIGMA[R][2*N+0]];
145 d = rotrConstant<16>(d ^ a);
146 c = c + d;
147 b = rotrConstant<12>(b ^ c);
148 a = a + b + m[BLAKE2S_SIGMA[R][2*N+1]];
149 d = rotrConstant<8>(d ^ a);
150 c = c + d;
151 b = rotrConstant<7>(b ^ c);
152}
153
154template <unsigned int R>
155inline void BLAKE2S_ROUND(const word32 m[16], word32 v[])
156{
157 BLAKE2S_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
158 BLAKE2S_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
159 BLAKE2S_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
160 BLAKE2S_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
161 BLAKE2S_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
162 BLAKE2S_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
163 BLAKE2S_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
164 BLAKE2S_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
165}
166
167ANONYMOUS_NAMESPACE_END
168
169NAMESPACE_BEGIN(CryptoPP)
170
171void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state);
172void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state);
173
174#if CRYPTOPP_SSE41_AVAILABLE
175extern void BLAKE2_Compress32_SSE4(const byte* input, BLAKE2s_State& state);
176extern void BLAKE2_Compress64_SSE4(const byte* input, BLAKE2b_State& state);
177#endif
178
179#if CRYPTOPP_ARM_NEON_AVAILABLE
180extern void BLAKE2_Compress32_NEON(const byte* input, BLAKE2s_State& state);
181extern void BLAKE2_Compress64_NEON(const byte* input, BLAKE2b_State& state);
182#endif
183
184#if CRYPTOPP_ALTIVEC_AVAILABLE
185extern void BLAKE2_Compress32_ALTIVEC(const byte* input, BLAKE2s_State& state);
186#endif
187
188#if CRYPTOPP_POWER8_AVAILABLE
189extern void BLAKE2_Compress64_POWER8(const byte* input, BLAKE2b_State& state);
190#endif
191
192unsigned int BLAKE2b::OptimalDataAlignment() const
193{
194#if defined(CRYPTOPP_SSE41_AVAILABLE)
195 if (HasSSE41())
196 return 16; // load __m128i
197 else
198#endif
199#if (CRYPTOPP_ARM_NEON_AVAILABLE)
200 if (HasNEON())
201 return 8; // load uint64x2_t
202 else
203#endif
204#if (CRYPTOPP_POWER8_AVAILABLE)
205 if (HasPower8())
206 return 16; // load vector long long
207 else
208#endif
209 return GetAlignmentOf<word64>();
210}
211
212std::string BLAKE2b::AlgorithmProvider() const
213{
214#if defined(CRYPTOPP_SSE41_AVAILABLE)
215 if (HasSSE41())
216 return "SSE4.1";
217 else
218#endif
219#if (CRYPTOPP_ARM_NEON_AVAILABLE)
220 if (HasNEON())
221 return "NEON";
222 else
223#endif
224#if (CRYPTOPP_POWER8_AVAILABLE)
225 if (HasPower8())
226 return "Power8";
227 else
228#endif
229 return "C++";
230}
231
232unsigned int BLAKE2s::OptimalDataAlignment() const
233{
234#if defined(CRYPTOPP_SSE41_AVAILABLE)
235 if (HasSSE41())
236 return 16; // load __m128i
237 else
238#endif
239#if (CRYPTOPP_ARM_NEON_AVAILABLE)
240 if (HasNEON())
241 return 4; // load uint32x4_t
242 else
243#endif
244#if (CRYPTOPP_ALTIVEC_AVAILABLE)
245 if (HasAltivec())
246 return 16; // load vector unsigned int
247 else
248#endif
249 return GetAlignmentOf<word32>();
250}
251
252std::string BLAKE2s::AlgorithmProvider() const
253{
254#if defined(CRYPTOPP_SSE41_AVAILABLE)
255 if (HasSSE41())
256 return "SSE4.1";
257 else
258#endif
259#if (CRYPTOPP_ARM_NEON_AVAILABLE)
260 if (HasNEON())
261 return "NEON";
262 else
263#endif
264#if (CRYPTOPP_ALTIVEC_AVAILABLE)
265 if (HasAltivec())
266 return "Altivec";
267 else
268#endif
269 return "C++";
270}
271
272void BLAKE2s_State::Reset()
273{
274 std::memset(m_hft, 0x00, m_hft.SizeInBytes());
275 m_len = 0;
276}
277
278void BLAKE2b_State::Reset()
279{
280 std::memset(m_hft, 0x00, m_hft.SizeInBytes());
281 m_len = 0;
282}
283
284BLAKE2s_ParameterBlock::BLAKE2s_ParameterBlock(size_t digestLen, size_t keyLen,
285 const byte* saltStr, size_t saltLen,
286 const byte* personalizationStr, size_t personalizationLen)
287{
288 Reset(digestLen, keyLen);
289
290 if (saltStr && saltLen)
291 memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
292
293 if (personalizationStr && personalizationLen)
294 memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
295}
296
297BLAKE2b_ParameterBlock::BLAKE2b_ParameterBlock(size_t digestLen, size_t keyLen,
298 const byte* saltStr, size_t saltLen,
299 const byte* personalizationStr, size_t personalizationLen)
300{
301 Reset(digestLen, keyLen);
302
303 if (saltStr && saltLen)
304 memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
305
306 if (personalizationStr && personalizationLen)
307 memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
308}
309
310void BLAKE2s_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
311{
312 std::memset(m_data, 0x00, m_data.size());
313 m_data[DigestOff] = static_cast<byte>(digestLen);
314 m_data[KeyOff] = static_cast<byte>(keyLen);
315 m_data[FanoutOff] = m_data[DepthOff] = 1;
316}
317
318void BLAKE2b_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
319{
320 std::memset(m_data, 0x00, m_data.size());
321 m_data[DigestOff] = static_cast<byte>(digestLen);
322 m_data[KeyOff] = static_cast<byte>(keyLen);
323 m_data[FanoutOff] = m_data[DepthOff] = 1;
324}
325
326BLAKE2s::BLAKE2s(bool treeMode, unsigned int digestSize)
327 : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
328{
329 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
330
331 UncheckedSetKey(NULLPTR, 0, MakeParameters
332 (Name::DigestSize(), (int)digestSize)
333 (Name::TreeMode(), treeMode));
334}
335
336BLAKE2b::BLAKE2b(bool treeMode, unsigned int digestSize)
337 : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
338{
339 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
340
341 UncheckedSetKey(NULLPTR, 0, MakeParameters
342 (Name::DigestSize(), (int)digestSize)
343 (Name::TreeMode(), treeMode));
344}
345
346BLAKE2s::BLAKE2s(unsigned int digestSize)
347 : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
348{
349 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
350
351 UncheckedSetKey(NULLPTR, 0, MakeParameters
352 (Name::DigestSize(), (int)digestSize)
353 (Name::TreeMode(), false));
354}
355
356BLAKE2b::BLAKE2b(unsigned int digestSize)
357 : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
358{
359 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
360
361 UncheckedSetKey(NULLPTR, 0, MakeParameters
362 (Name::DigestSize(), (int)digestSize)
363 (Name::TreeMode(), false));
364}
365
366BLAKE2s::BLAKE2s(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
367 const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
368 : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
369{
370 CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
371 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
372 CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
373 CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
374
375 UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
376 (Name::DigestSize(),(int)digestSize)
377 (Name::TreeMode(),treeMode)
378 (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
379 (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
380}
381
382BLAKE2b::BLAKE2b(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
383 const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
384 : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
385{
386 CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
387 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
388 CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
389 CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
390
391 UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
392 (Name::DigestSize(),(int)digestSize)
393 (Name::TreeMode(),treeMode)
394 (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
395 (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
396}
397
398void BLAKE2s::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
399{
400 if (key && length)
401 {
402 m_key.New(BLOCKSIZE);
403 std::memcpy(m_key, key, length);
404 std::memset(m_key + length, 0x00, BLOCKSIZE - length);
405 m_keyLength = length;
406 }
407 else
408 {
409 m_key.resize(0);
410 m_keyLength = 0;
411 }
412
413 m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
414 Name::DigestSize(), static_cast<int>(m_digestSize)));
415
416 m_state.Reset();
417 m_block.Reset(m_digestSize, m_keyLength);
418 (void)params.GetValue(Name::TreeMode(), m_treeMode);
419
420 ConstByteArrayParameter t;
421 if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
422 memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
423
424 if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
425 memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
426
427 Restart();
428}
429
430void BLAKE2b::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
431{
432 if (key && length)
433 {
434 m_key.New(BLOCKSIZE);
435 std::memcpy(m_key, key, length);
436 std::memset(m_key + length, 0x00, BLOCKSIZE - length);
437 m_keyLength = length;
438 }
439 else
440 {
441 m_key.resize(0);
442 m_keyLength = 0;
443 }
444
445 m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
446 Name::DigestSize(), static_cast<int>(m_digestSize)));
447
448 m_state.Reset();
449 m_block.Reset(m_digestSize, m_keyLength);
450 (void)params.GetValue(Name::TreeMode(), m_treeMode);
451
452 ConstByteArrayParameter t;
453 if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
454 memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
455
456 if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
457 memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
458
459 Restart();
460}
461
462void BLAKE2s::Restart()
463{
464 static const word32 zero[2] = {0,0};
465 Restart(m_block, zero);
466}
467
468void BLAKE2b::Restart()
469{
470 static const word64 zero[2] = {0,0};
471 Restart(m_block, zero);
472}
473
474void BLAKE2s::Restart(const BLAKE2s_ParameterBlock& block, const word32 counter[2])
475{
476 // We take a counter as a parameter to allow customized state.
477 m_state.Reset();
478 if (counter != NULLPTR)
479 {
480 word32* t = m_state.t();
481 t[0] = counter[0];
482 t[1] = counter[1];
483 }
484
485 // We take a parameter block as a parameter to allow customized state.
486 // Avoid the copy of the parameter block when we are passing our own block.
487 if (block.data() != m_block.data()) {
488 std::memcpy(m_block.data(), block.data(), m_block.size());
489 }
490
491 m_block.m_data[BLAKE2s_ParameterBlock::DigestOff] = (byte)m_digestSize;
492 m_block.m_data[BLAKE2s_ParameterBlock::KeyOff] = (byte)m_keyLength;
493
494 const word32* iv = BLAKE2S_IV;
495 PutBlock<word32, LittleEndian, true> put(m_block.data(), m_state.h());
496 put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
497
498 // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
499 // The key is padded to a full Blocksize with 0. Key it during Restart to
500 // avoid FirstPut and friends. Key size == 0 means no key.
501 if (m_keyLength)
502 Update(m_key, BLOCKSIZE);
503}
504
505void BLAKE2b::Restart(const BLAKE2b_ParameterBlock& block, const word64 counter[2])
506{
507 // We take a counter as a parameter to allow customized state.
508 m_state.Reset();
509 if (counter != NULLPTR)
510 {
511 word64* t = m_state.t();
512 t[0] = counter[0];
513 t[1] = counter[1];
514 }
515
516 // We take a parameter block as a parameter to allow customized state.
517 // Avoid the copy of the parameter block when we are passing our own block.
518 if (block.data() != m_block.data()) {
519 std::memcpy(m_block.data(), block.data(), m_block.size());
520 }
521
522 m_block.m_data[BLAKE2b_ParameterBlock::DigestOff] = (byte)m_digestSize;
523 m_block.m_data[BLAKE2b_ParameterBlock::KeyOff] = (byte)m_keyLength;
524
525 const word64* iv = BLAKE2B_IV;
526 PutBlock<word64, LittleEndian, true> put(m_block.data(), m_state.h());
527 put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
528
529 // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
530 // The key is padded to a full Blocksize with 0. Key it during Restart to
531 // avoid FirstPut and friends. Key size == 0 means no key.
532 if (m_keyLength)
533 Update(m_key, BLOCKSIZE);
534}
535
536void BLAKE2s::Update(const byte *input, size_t length)
537{
538 CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
539
540 if (length > BLOCKSIZE - m_state.m_len)
541 {
542 if (m_state.m_len != 0)
543 {
544 // Complete current block
545 const size_t fill = BLOCKSIZE - m_state.m_len;
546 std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
547
548 IncrementCounter(BLOCKSIZE);
549 Compress(m_state.m_buf);
550 m_state.m_len = 0;
551
552 length -= fill, input += fill;
553 }
554
555 // Compress in-place to avoid copies
556 while (length > BLOCKSIZE)
557 {
558 IncrementCounter(BLOCKSIZE);
559 Compress(input);
560 length -= BLOCKSIZE, input += BLOCKSIZE;
561 }
562 }
563
564 // Copy tail bytes
565 if (length)
566 {
567 CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
568 std::memcpy(m_state.m_buf+m_state.m_len, input, length);
569 m_state.m_len += static_cast<unsigned int>(length);
570 }
571}
572
573void BLAKE2b::Update(const byte *input, size_t length)
574{
575 CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
576
577 if (length > BLOCKSIZE - m_state.m_len)
578 {
579 if (m_state.m_len != 0)
580 {
581 // Complete current block
582 const size_t fill = BLOCKSIZE - m_state.m_len;
583 std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
584
585 IncrementCounter(BLOCKSIZE);
586 Compress(m_state.m_buf);
587 m_state.m_len = 0;
588
589 length -= fill, input += fill;
590 }
591
592 // Compress in-place to avoid copies
593 while (length > BLOCKSIZE)
594 {
595 CRYPTOPP_ASSERT(m_state.m_len == 0);
596 IncrementCounter(BLOCKSIZE);
597 Compress(input);
598 length -= BLOCKSIZE, input += BLOCKSIZE;
599 }
600 }
601
602 // Copy tail bytes
603 if (length)
604 {
605 CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
606 std::memcpy(m_state.m_buf + m_state.m_len, input, length);
607 m_state.m_len += static_cast<unsigned int>(length);
608 }
609}
610
611void BLAKE2s::TruncatedFinal(byte *hash, size_t size)
612{
613 CRYPTOPP_ASSERT(hash != NULLPTR);
614 this->ThrowIfInvalidTruncatedSize(size);
615 word32* f = m_state.f();
616
617 // Set last block unconditionally
618 f[0] = ~static_cast<word32>(0);
619
620 // Set last node if tree mode
621 if (m_treeMode)
622 f[1] = ~static_cast<word32>(0);
623
624 // Increment counter for tail bytes only
625 IncrementCounter(m_state.m_len);
626
627 std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
628 Compress(m_state.m_buf);
629
630 // Copy to caller buffer
631 std::memcpy(hash, m_state.h(), size);
632
633 Restart();
634}
635
636void BLAKE2b::TruncatedFinal(byte *hash, size_t size)
637{
638 CRYPTOPP_ASSERT(hash != NULLPTR);
639 this->ThrowIfInvalidTruncatedSize(size);
640 word64* f = m_state.f();
641
642 // Set last block unconditionally
643 f[0] = ~static_cast<word64>(0);
644
645 // Set last node if tree mode
646 if (m_treeMode)
647 f[1] = ~static_cast<word64>(0);
648
649 // Increment counter for tail bytes only
650 IncrementCounter(m_state.m_len);
651
652 std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
653 Compress(m_state.m_buf);
654
655 // Copy to caller buffer
656 std::memcpy(hash, m_state.h(), size);
657
658 Restart();
659}
660
661void BLAKE2s::IncrementCounter(size_t count)
662{
663 word32* t = m_state.t();
664 t[0] += static_cast<word32>(count);
665 t[1] += !!(t[0] < count);
666}
667
668void BLAKE2b::IncrementCounter(size_t count)
669{
670 word64* t = m_state.t();
671 t[0] += static_cast<word64>(count);
672 t[1] += !!(t[0] < count);
673}
674
675void BLAKE2s::Compress(const byte *input)
676{
677#if CRYPTOPP_SSE41_AVAILABLE
678 if(HasSSE41())
679 {
680 return BLAKE2_Compress32_SSE4(input, m_state);
681 }
682#endif
683#if CRYPTOPP_ARM_NEON_AVAILABLE
684 if(HasNEON())
685 {
686 return BLAKE2_Compress32_NEON(input, m_state);
687 }
688#endif
689#if CRYPTOPP_ALTIVEC_AVAILABLE
690 if(HasAltivec())
691 {
692 return BLAKE2_Compress32_ALTIVEC(input, m_state);
693 }
694#endif
695 return BLAKE2_Compress32_CXX(input, m_state);
696}
697
698void BLAKE2b::Compress(const byte *input)
699{
700#if CRYPTOPP_SSE41_AVAILABLE
701 if(HasSSE41())
702 {
703 return BLAKE2_Compress64_SSE4(input, m_state);
704 }
705#endif
706#if CRYPTOPP_ARM_NEON_AVAILABLE
707 if(HasNEON())
708 {
709 return BLAKE2_Compress64_NEON(input, m_state);
710 }
711#endif
712#if CRYPTOPP_POWER8_AVAILABLE
713 if(HasPower8())
714 {
715 return BLAKE2_Compress64_POWER8(input, m_state);
716 }
717#endif
718 return BLAKE2_Compress64_CXX(input, m_state);
719}
720
721void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state)
722{
723 word64 m[16], v[16];
724
725 GetBlock<word64, LittleEndian, true> get1(input);
726 get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
727
728 GetBlock<word64, LittleEndian, true> get2(state.h());
729 get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
730
731 const word64* iv = BLAKE2B_IV;
732 const word64* tf = state.t();
733 v[ 8] = iv[0];
734 v[ 9] = iv[1];
735 v[10] = iv[2];
736 v[11] = iv[3];
737 v[12] = tf[0] ^ iv[4];
738 v[13] = tf[1] ^ iv[5];
739 v[14] = tf[2] ^ iv[6];
740 v[15] = tf[3] ^ iv[7];
741
742 BLAKE2B_ROUND<0>(m, v);
743 BLAKE2B_ROUND<1>(m, v);
744 BLAKE2B_ROUND<2>(m, v);
745 BLAKE2B_ROUND<3>(m, v);
746 BLAKE2B_ROUND<4>(m, v);
747 BLAKE2B_ROUND<5>(m, v);
748 BLAKE2B_ROUND<6>(m, v);
749 BLAKE2B_ROUND<7>(m, v);
750 BLAKE2B_ROUND<8>(m, v);
751 BLAKE2B_ROUND<9>(m, v);
752 BLAKE2B_ROUND<10>(m, v);
753 BLAKE2B_ROUND<11>(m, v);
754
755 word64* h = state.h();
756 for (unsigned int i = 0; i < 8; ++i)
757 h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
758}
759
760void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state)
761{
762 word32 m[16], v[16];
763
764 GetBlock<word32, LittleEndian, true> get1(input);
765 get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
766
767 GetBlock<word32, LittleEndian, true> get2(state.h());
768 get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
769
770 const word32* iv = BLAKE2S_IV;
771 const word32* tf = state.t();
772 v[ 8] = iv[0];
773 v[ 9] = iv[1];
774 v[10] = iv[2];
775 v[11] = iv[3];
776 v[12] = tf[0] ^ iv[4];
777 v[13] = tf[1] ^ iv[5];
778 v[14] = tf[2] ^ iv[6];
779 v[15] = tf[3] ^ iv[7];
780
781 BLAKE2S_ROUND<0>(m, v);
782 BLAKE2S_ROUND<1>(m, v);
783 BLAKE2S_ROUND<2>(m, v);
784 BLAKE2S_ROUND<3>(m, v);
785 BLAKE2S_ROUND<4>(m, v);
786 BLAKE2S_ROUND<5>(m, v);
787 BLAKE2S_ROUND<6>(m, v);
788 BLAKE2S_ROUND<7>(m, v);
789 BLAKE2S_ROUND<8>(m, v);
790 BLAKE2S_ROUND<9>(m, v);
791
792 word32* h = state.h();
793 for (unsigned int i = 0; i < 8; ++i)
794 h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
795}
796
797NAMESPACE_END
algparam.h
Classes for working with NameValuePairs.
MakeParameters
AlgorithmParameters MakeParameters(const char *name, const T &value, bool throwIfNotUsed=true)
Create an object that implements NameValuePairs.
Definition algparam.h:508
argnames.h
Standard names for retrieving values by name when working with NameValuePairs.
blake2.h
Classes for BLAKE2b and BLAKE2s message digests and keyed message digests.
BLAKE2b::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition blake2.cpp:212
BLAKE2b::TruncatedFinal
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition blake2.cpp:636
BLAKE2b::OptimalDataAlignment
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition blake2.cpp:192
BLAKE2b::Restart
void Restart()
Restart the hash.
Definition blake2.cpp:468
BLAKE2b::Update
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition blake2.cpp:573
BLAKE2b::BLAKE2b
BLAKE2b(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2b hash.
Definition blake2.cpp:336
BLAKE2s::Update
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition blake2.cpp:536
BLAKE2s::Restart
void Restart()
Restart the hash.
Definition blake2.cpp:462
BLAKE2s::TruncatedFinal
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition blake2.cpp:611
BLAKE2s::BLAKE2s
BLAKE2s(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2s hash.
Definition blake2.cpp:326
BLAKE2s::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition blake2.cpp:252
BLAKE2s::OptimalDataAlignment
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition blake2.cpp:232
ConstByteArrayParameter
Used to pass byte array input as part of a NameValuePairs object.
Definition algparam.h:25
ConstByteArrayParameter::begin
const byte * begin() const
Pointer to the first byte in the memory block.
Definition algparam.h:84
ConstByteArrayParameter::size
size_t size() const
Length of the memory block.
Definition algparam.h:88
GetBlock
Access a block of memory.
Definition misc.h:2766
HashTransformation::ThrowIfInvalidTruncatedSize
void ThrowIfInvalidTruncatedSize(size_t size) const
Validates a truncated digest size.
Definition cryptlib.cpp:415
PutBlock
Access a block of memory.
Definition misc.h:2807
SecBlock::New
void New(size_type newSize)
Change size without preserving contents.
Definition secblock.h:1126
SecBlock::SizeInBytes
size_type SizeInBytes() const
Provides the number of bytes in the SecBlock.
Definition secblock.h:885
SecBlock::size
size_type size() const
Provides the count of elements in the SecBlock.
Definition secblock.h:867
SecBlock::resize
void resize(size_type newSize)
Change size and preserve contents.
Definition secblock.h:1198
config.h
Library configuration file.
byte
unsigned char byte
8-bit unsigned datatype
Definition config_int.h:56
word32
unsigned int word32
32-bit unsigned datatype
Definition config_int.h:62
cpu.h
Functions for CPU features and intrinsics.
cryptlib.h
Abstract base classes that provide a uniform interface to this library.
memcpy_s
void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
Bounds checking replacement for memcpy()
Definition misc.h:525
ConditionalByteReverse
T ConditionalByteReverse(ByteOrder order, T value)
Reverses bytes in a value depending upon endianness.
Definition misc.h:2208
pch.h
Precompiled header file.
BLAKE2b_ParameterBlock
BLAKE2b parameter block.
Definition blake2.h:112
BLAKE2b_State
BLAKE2b state information.
Definition blake2.h:197
BLAKE2s_ParameterBlock
BLAKE2s parameter block.
Definition blake2.h:61
BLAKE2s_State
BLAKE2s state information.
Definition blake2.h:164
Generated by doxygen 1.9.8