Botan 3.5.0
Crypto and TLS for C&
blake2b.cpp
Go to the documentation of this file.
1/*
2* BLAKE2b
3* (C) 2016 cynecx
4* (C) 2017 Jack Lloyd
5*
6* Botan is released under the Simplified BSD License (see license.txt)
7*/
8
9#include <botan/internal/blake2b.h>
10
11#include <botan/exceptn.h>
12#include <botan/mem_ops.h>
13#include <botan/internal/fmt.h>
14#include <botan/internal/loadstor.h>
15#include <botan/internal/rotate.h>
16#include <botan/internal/stl_util.h>
17
18#include <algorithm>
19#include <array>
20
21namespace Botan {
22
23namespace {
24
25constexpr std::array<uint64_t, 8> blake2b_IV{0x6a09e667f3bcc908,
26 0xbb67ae8584caa73b,
27 0x3c6ef372fe94f82b,
28 0xa54ff53a5f1d36f1,
29 0x510e527fade682d1,
30 0x9b05688c2b3e6c1f,
31 0x1f83d9abfb41bd6b,
32 0x5be0cd19137e2179};
33
34} // namespace
35
36BLAKE2b::BLAKE2b(size_t output_bits) : m_output_bits(output_bits), m_H(blake2b_IV.size()), m_T(), m_F(), m_key_size(0) {
37 if(output_bits == 0 || output_bits > 512 || output_bits % 8 != 0) {
38 throw Invalid_Argument("Bad output bits size for BLAKE2b");
39 }
40
41 state_init();
42}
43
44void BLAKE2b::state_init() {
45 copy_mem(m_H.data(), blake2b_IV.data(), blake2b_IV.size());
46 m_H[0] ^= (0x01010000 | (static_cast<uint8_t>(m_key_size) << 8) | static_cast<uint8_t>(output_length()));
47 m_T[0] = m_T[1] = 0;
48 m_F = 0;
49
50 m_buffer.clear();
51 if(m_key_size > 0) {
52 m_buffer.append(m_padded_key_buffer);
53 }
54}
55
56namespace {
57
58BOTAN_FORCE_INLINE void G(uint64_t& a, uint64_t& b, uint64_t& c, uint64_t& d, uint64_t M0, uint64_t M1) {
59 a = a + b + M0;
60 d = rotr<32>(d ^ a);
61 c = c + d;
62 b = rotr<24>(b ^ c);
63 a = a + b + M1;
64 d = rotr<16>(d ^ a);
65 c = c + d;
66 b = rotr<63>(b ^ c);
67}
68
69template <size_t i0,
70 size_t i1,
71 size_t i2,
72 size_t i3,
73 size_t i4,
74 size_t i5,
75 size_t i6,
76 size_t i7,
77 size_t i8,
78 size_t i9,
79 size_t iA,
80 size_t iB,
81 size_t iC,
82 size_t iD,
83 size_t iE,
84 size_t iF>
85BOTAN_FORCE_INLINE void ROUND(uint64_t* v, const uint64_t* M) {
86 G(v[0], v[4], v[8], v[12], M[i0], M[i1]);
87 G(v[1], v[5], v[9], v[13], M[i2], M[i3]);
88 G(v[2], v[6], v[10], v[14], M[i4], M[i5]);
89 G(v[3], v[7], v[11], v[15], M[i6], M[i7]);
90 G(v[0], v[5], v[10], v[15], M[i8], M[i9]);
91 G(v[1], v[6], v[11], v[12], M[iA], M[iB]);
92 G(v[2], v[7], v[8], v[13], M[iC], M[iD]);
93 G(v[3], v[4], v[9], v[14], M[iE], M[iF]);
94}
95
96} // namespace
97
98void BLAKE2b::compress(const uint8_t* input, size_t blocks, uint64_t increment) {
99 for(size_t b = 0; b != blocks; ++b) {
100 m_T[0] += increment;
101 if(m_T[0] < increment) {
102 m_T[1]++;
103 }
104
105 uint64_t M[16];
106 uint64_t v[16];
107 load_le(M, input, 16);
108
109 input += BLAKE2B_BLOCKBYTES;
110
111 for(size_t i = 0; i < 8; i++) {
112 v[i] = m_H[i];
113 }
114 for(size_t i = 0; i != 8; ++i) {
115 v[i + 8] = blake2b_IV[i];
116 }
117
118 v[12] ^= m_T[0];
119 v[13] ^= m_T[1];
120 v[14] ^= m_F;
121
122 ROUND<0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15>(v, M);
123 ROUND<14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3>(v, M);
124 ROUND<11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4>(v, M);
125 ROUND<7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8>(v, M);
126 ROUND<9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13>(v, M);
127 ROUND<2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9>(v, M);
128 ROUND<12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11>(v, M);
129 ROUND<13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10>(v, M);
130 ROUND<6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5>(v, M);
131 ROUND<10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0>(v, M);
132 ROUND<0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15>(v, M);
133 ROUND<14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3>(v, M);
134
135 for(size_t i = 0; i < 8; i++) {
136 m_H[i] ^= v[i] ^ v[i + 8];
137 }
138 }
139}
140
141void BLAKE2b::add_data(std::span<const uint8_t> input) {
142 BufferSlicer in(input);
143
144 while(!in.empty()) {
145 if(const auto one_block = m_buffer.handle_unaligned_data(in)) {
146 compress(one_block->data(), 1, BLAKE2B_BLOCKBYTES);
147 }
148
149 if(m_buffer.in_alignment()) {
150 const auto [aligned_data, full_blocks] = m_buffer.aligned_data_to_process(in);
151 if(full_blocks > 0) {
152 compress(aligned_data.data(), full_blocks, BLAKE2B_BLOCKBYTES);
153 }
154 }
155 }
156}
157
158void BLAKE2b::final_result(std::span<uint8_t> output) {
159 const auto pos = m_buffer.elements_in_buffer();
160 m_buffer.fill_up_with_zeros();
161
162 m_F = 0xFFFFFFFFFFFFFFFF;
163 compress(m_buffer.consume().data(), 1, pos);
164 copy_out_le(output.first(output_length()), m_H);
165 state_init();
166}
167
171
172std::string BLAKE2b::name() const {
173 return fmt("BLAKE2b({})", m_output_bits);
174}
175
176std::unique_ptr<HashFunction> BLAKE2b::new_object() const {
177 return std::make_unique<BLAKE2b>(m_output_bits);
178}
179
180std::unique_ptr<HashFunction> BLAKE2b::copy_state() const {
181 return std::make_unique<BLAKE2b>(*this);
182}
183
185 return m_key_size > 0;
186}
187
188void BLAKE2b::key_schedule(std::span<const uint8_t> key) {
189 BOTAN_ASSERT_NOMSG(key.size() <= m_buffer.size());
190
191 m_key_size = key.size();
192 m_padded_key_buffer.resize(m_buffer.size());
193
194 if(m_padded_key_buffer.size() > m_key_size) {
195 size_t padding = m_padded_key_buffer.size() - m_key_size;
196 clear_mem(m_padded_key_buffer.data() + m_key_size, padding);
197 }
198
199 copy_mem(m_padded_key_buffer.data(), key.data(), key.size());
200 state_init();
201}
202
204 zeroise(m_H);
205 m_buffer.clear();
206 zeroise(m_padded_key_buffer);
207 m_key_size = 0;
208 state_init();
209}
210
211} // namespace Botan
#define BOTAN_ASSERT_NOMSG(expr)
Definition assert.h:59
constexpr size_t size() const
size_t elements_in_buffer() const
std::tuple< std::span< const uint8_t >, size_t > aligned_data_to_process(BufferSlicer &slicer) const
void append(std::span< const T > elements)
std::optional< std::span< const T > > handle_unaligned_data(BufferSlicer &slicer)
std::span< const T > consume()
BLAKE2b(size_t output_bits=512)
Definition blake2b.cpp:36
Key_Length_Specification key_spec() const override
Definition blake2b.cpp:168
void key_schedule(std::span< const uint8_t > key) override
Definition blake2b.cpp:188
size_t output_length() const override
Definition blake2b.h:36
std::unique_ptr< HashFunction > new_object() const override
Definition blake2b.cpp:176
std::string name() const override
Definition blake2b.cpp:172
bool has_keying_material() const override
Definition blake2b.cpp:184
void add_data(std::span< const uint8_t > input) override
Definition blake2b.cpp:141
void clear() override
Definition blake2b.cpp:203
std::unique_ptr< HashFunction > copy_state() const override
Definition blake2b.cpp:180
void final_result(std::span< uint8_t > out) override
Definition blake2b.cpp:158
bool empty() const
Definition stl_util.h:129
#define BOTAN_FORCE_INLINE
Definition compiler.h:165
void zeroise(std::vector< T, Alloc > &vec)
Definition secmem.h:108
constexpr size_t BLAKE2B_BLOCKBYTES
Definition blake2b.h:21
std::string fmt(std::string_view format, const T &... args)
Definition fmt.h:53
constexpr T rotr(T input)
Definition rotate.h:33
void copy_out_le(std::span< uint8_t > out, InR &&in)
Definition loadstor.h:751
constexpr auto load_le(ParamTs &&... params)
Definition loadstor.h:458
constexpr void copy_mem(T *out, const T *in, size_t n)
Definition mem_ops.h:146
constexpr void clear_mem(T *ptr, size_t n)
Definition mem_ops.h:120