poly1305.h

Go to the documentation of this file.

// poly1305.h - written and placed in the public domain by Jeffrey Walton and Jean-Pierre Munch
//              Based on Andy Polyakov's Base-2^26 scalar multiplication implementation.
//              For more information, see https://www.openssl.org/~appro/cryptogams/.
 
// The library added Bernstein's Poly1305 classes at Crypto++ 6.0. The IETF
// uses a slightly different implementation than Bernstein, and the IETF
// classes were added at Crypto++ 8.1. We wanted to maintain ABI compatibility
// at the 8.1 release so the original Poly1305 classes were not disturbed.
// Instead new classes were added for IETF Poly1305. The back-end implementation
// shares code as expected, however.
 
 
#ifndef CRYPTOPP_POLY1305_H
#define CRYPTOPP_POLY1305_H
 
#include "cryptlib.h"
#include "seckey.h"
#include "secblock.h"
#include "argnames.h"
#include "algparam.h"
 
NAMESPACE_BEGIN(CryptoPP)
 
 
 
 
template <class T>
class CRYPTOPP_NO_VTABLE Poly1305_Base : public FixedKeyLength<32, SimpleKeyingInterface::UNIQUE_IV, 16>, public MessageAuthenticationCode
{
        CRYPTOPP_COMPILE_ASSERT(T::DEFAULT_KEYLENGTH == 16);
        CRYPTOPP_COMPILE_ASSERT(T::BLOCKSIZE == 16);
 
public:
        static std::string StaticAlgorithmName() {return std::string("Poly1305(") + T::StaticAlgorithmName() + ")";}
 
        CRYPTOPP_CONSTANT(DIGESTSIZE=T::BLOCKSIZE);
        CRYPTOPP_CONSTANT(BLOCKSIZE=T::BLOCKSIZE);
 
        virtual ~Poly1305_Base() {}
        Poly1305_Base() : m_idx(0), m_used(true) {}
 
        void Resynchronize (const byte *iv, int ivLength=-1);
        void GetNextIV (RandomNumberGenerator &rng, byte *iv);
 
        void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
        void Update(const byte *input, size_t length);
        void TruncatedFinal(byte *mac, size_t size);
        void Restart();
 
        unsigned int BlockSize() const {return BLOCKSIZE;}
        unsigned int DigestSize() const {return DIGESTSIZE;}
 
        std::string AlgorithmProvider() const;
 
protected:
        // TODO: No longer needed. Remove at next major version bump
        void HashBlocks(const byte *input, size_t length, word32 padbit);
        void HashFinal(byte *mac, size_t length);
 
        typename T::Encryption m_cipher;
 
        // Accumulated hash, clamped r-key, and encrypted nonce
        FixedSizeAlignedSecBlock<word32, 5> m_h;
        FixedSizeAlignedSecBlock<word32, 4> m_r;
        FixedSizeAlignedSecBlock<word32, 4> m_n;
 
        // Accumulated message bytes and index
        FixedSizeAlignedSecBlock<byte, BLOCKSIZE> m_acc, m_nk;
        size_t m_idx;
 
        // Track nonce reuse; assert in debug but continue
        bool m_used;
};
 
template <class T>
class Poly1305 : public MessageAuthenticationCodeFinal<Poly1305_Base<T> >
{
public:
        CRYPTOPP_CONSTANT(DEFAULT_KEYLENGTH=Poly1305_Base<T>::DEFAULT_KEYLENGTH);
 
        Poly1305() {}
 
        Poly1305(const byte *key, size_t keyLength=DEFAULT_KEYLENGTH, const byte *nonce=NULLPTR, size_t nonceLength=0)
                {this->SetKey(key, keyLength, MakeParameters(Name::IV(), ConstByteArrayParameter(nonce, nonceLength)));}
};
 
 
class Poly1305TLS_Base : public FixedKeyLength<32>, public MessageAuthenticationCode
{
public:
        static std::string StaticAlgorithmName() {return std::string("Poly1305TLS");}
        CRYPTOPP_CONSTANT(DIGESTSIZE=16);
        CRYPTOPP_CONSTANT(BLOCKSIZE=16);
 
        virtual ~Poly1305TLS_Base() {}
        Poly1305TLS_Base() {}
 
        void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params);
        void Update(const byte *input, size_t length);
        void TruncatedFinal(byte *mac, size_t size);
        void Restart();
 
        unsigned int BlockSize() const {return BLOCKSIZE;}
        unsigned int DigestSize() const {return DIGESTSIZE;}
 
protected:
        // Accumulated hash, clamped r-key, and encrypted nonce
        FixedSizeAlignedSecBlock<word32, 5> m_h;
        FixedSizeAlignedSecBlock<word32, 4> m_r;
        FixedSizeAlignedSecBlock<word32, 4> m_n;
 
        // Accumulated message bytes and index
        FixedSizeAlignedSecBlock<byte, BLOCKSIZE> m_acc;
        size_t m_idx;
};
 
DOCUMENTED_TYPEDEF(MessageAuthenticationCodeFinal<Poly1305TLS_Base>, Poly1305TLS);
 
NAMESPACE_END
 
#endif  // CRYPTOPP_POLY1305_H