Crypto++ 7.0 Free C++ class library of cryptographic schemes

poly1305.cpp
1 // poly1305.cpp - written and placed in the public domain by Jeffrey Walton and Jean-Pierre Munch
2 // Based on Andy Polyakov's Base-2^26 scalar multiplication implementation for OpenSSL.
3
4 #include "pch.h"
5 #include "cryptlib.h"
6 #include "aes.h"
7 #include "cpu.h"
8 #include "poly1305.h"
9
10 NAMESPACE_BEGIN(CryptoPP)
11
12 #define CONSTANT_TIME_CARRY(a,b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1))
13
14 template <class T>
15 std::string Poly1305_Base<T>::AlgorithmProvider() const
16 {
17 return m_cipher.AlgorithmProvider();
18 }
19
20 template <class T>
21 void Poly1305_Base<T>::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
22 {
23 if (key && length)
24 {
25 // key is {k,r} pair, r is 16 bytes
26 length = SaturatingSubtract(length, (unsigned)BLOCKSIZE);
27 m_cipher.SetKey(key, length);
28 key += length;
29
30 // Rbar is clamped and little endian
31 m_r[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 0) & 0x0fffffff;
32 m_r[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 4) & 0x0ffffffc;
33 m_r[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 8) & 0x0ffffffc;
34 m_r[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 12) & 0x0ffffffc;
35
36 m_used = false;
37 }
38
39 ConstByteArrayParameter t;
40 if (params.GetValue(Name::IV(), t) && t.begin() && t.size())
41 {
42 // Nonce key is a class member to avoid the zeroizer on a temporary
43 CRYPTOPP_ASSERT(t.size() == m_nk.size());
44 std::memcpy(m_nk.begin(), t.begin(), m_nk.size());
45 m_cipher.ProcessBlock(m_nk.begin());
46
47 m_n[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk + 0);
48 m_n[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk + 4);
49 m_n[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk + 8);
50 m_n[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, m_nk + 12);
51
52 m_used = false;
53 }
54
55 Restart();
56 }
57
58 template <class T>
59 void Poly1305_Base<T>::Update(const byte *input, size_t length)
60 {
61 CRYPTOPP_ASSERT((input && length) || !length);
62 if (!length) return;
63
64 size_t rem, num = m_idx;
65 if (num)
66 {
67 rem = BLOCKSIZE - num;
68 if (length >= rem)
69 {
70 // Process
71 memcpy_s(m_acc + num, BLOCKSIZE - num, input, rem);
72 HashBlocks(m_acc, BLOCKSIZE, 1);
73 input += rem;
74 length -= rem;
75 }
76 else
77 {
78 // Accumulate
79 memcpy_s(m_acc + num, BLOCKSIZE - num, input, length);
80 m_idx = num + length;
81 return;
82 }
83 }
84
85 rem = length % BLOCKSIZE;
86 length -= rem;
87
88 if (length >= BLOCKSIZE) {
89 HashBlocks(input, length, 1);
90 input += length;
91 }
92
93 if (rem)
94 memcpy(m_acc, input, rem);
95
96 m_idx = rem;
97 }
98
99 template <class T>
100 void Poly1305_Base<T>::HashBlocks(const byte *input, size_t length, word32 padbit)
101 {
102 word32 r0, r1, r2, r3;
103 word32 s1, s2, s3;
104 word32 h0, h1, h2, h3, h4, c;
105 word64 d0, d1, d2, d3;
106
107 r0 = m_r[0]; r1 = m_r[1];
108 r2 = m_r[2]; r3 = m_r[3];
109
110 s1 = r1 + (r1 >> 2);
111 s2 = r2 + (r2 >> 2);
112 s3 = r3 + (r3 >> 2);
113
114 h0 = m_h[0]; h1 = m_h[1]; h2 = m_h[2];
115 h3 = m_h[3]; h4 = m_h[4];
116
117 while (length >= BLOCKSIZE)
118 {
119 // h += m[i]
120 h0 = (word32)(d0 = (word64)h0 + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 0));
121 h1 = (word32)(d1 = (word64)h1 + (d0 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 4));
122 h2 = (word32)(d2 = (word64)h2 + (d1 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 8));
123 h3 = (word32)(d3 = (word64)h3 + (d2 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 12));
124 h4 += (word32)(d3 >> 32) + padbit;
125
126 // h *= r "%" p
127 d0 = ((word64)h0 * r0) +
128 ((word64)h1 * s3) +
129 ((word64)h2 * s2) +
130 ((word64)h3 * s1);
131 d1 = ((word64)h0 * r1) +
132 ((word64)h1 * r0) +
133 ((word64)h2 * s3) +
134 ((word64)h3 * s2) +
135 (h4 * s1);
136 d2 = ((word64)h0 * r2) +
137 ((word64)h1 * r1) +
138 ((word64)h2 * r0) +
139 ((word64)h3 * s3) +
140 (h4 * s2);
141 d3 = ((word64)h0 * r3) +
142 ((word64)h1 * r2) +
143 ((word64)h2 * r1) +
144 ((word64)h3 * r0) +
145 (h4 * s3);
146 h4 = (h4 * r0);
147
148 // a) h4:h0 = h4<<128 + d3<<96 + d2<<64 + d1<<32 + d0
149 h0 = (word32)d0;
150 h1 = (word32)(d1 += d0 >> 32);
151 h2 = (word32)(d2 += d1 >> 32);
152 h3 = (word32)(d3 += d2 >> 32);
153 h4 += (word32)(d3 >> 32);
154
155 // b) (h4:h0 += (h4:h0>>130) * 5) %= 2^130
156 c = (h4 >> 2) + (h4 & ~3U);
157 h4 &= 3;
158 h0 += c;
159 h1 += (c = CONSTANT_TIME_CARRY(h0,c));
160 h2 += (c = CONSTANT_TIME_CARRY(h1,c));
161 h3 += (c = CONSTANT_TIME_CARRY(h2,c));
162 h4 += CONSTANT_TIME_CARRY(h3,c);
163
164 input += BLOCKSIZE;
165 length -= BLOCKSIZE;
166 }
167
168 m_h[0] = h0; m_h[1] = h1; m_h[2] = h2;
169 m_h[3] = h3; m_h[4] = h4;
170 }
171
172 template <class T>
173 void Poly1305_Base<T>::TruncatedFinal(byte *mac, size_t size)
174 {
175 CRYPTOPP_ASSERT(mac); // Pointer is valid
176 CRYPTOPP_ASSERT(!m_used); // Nonce is fresh
177
178 ThrowIfInvalidTruncatedSize(size);
179
180 size_t num = m_idx;
181 if (num)
182 {
183 m_acc[num++] = 1; /* pad bit */
184 while (num < BLOCKSIZE)
185 m_acc[num++] = 0;
186 HashBlocks(m_acc, BLOCKSIZE, 0);
187 }
188
189 HashFinal(mac, size);
190
191 // Restart
192 m_used = true;
193 Restart();
194 }
195
196 template <class T>
197 void Poly1305_Base<T>::HashFinal(byte *mac, size_t size)
198 {
199 word32 h0, h1, h2, h3, h4;
200 word32 g0, g1, g2, g3, g4;
201 word32 mask;
202 word64 t;
203
204 h0 = m_h[0];
205 h1 = m_h[1];
206 h2 = m_h[2];
207 h3 = m_h[3];
208 h4 = m_h[4];
209
210 // compare to modulus by computing h + -p
211 g0 = (word32)(t = (word64)h0 + 5);
212 g1 = (word32)(t = (word64)h1 + (t >> 32));
213 g2 = (word32)(t = (word64)h2 + (t >> 32));
214 g3 = (word32)(t = (word64)h3 + (t >> 32));
215 g4 = h4 + (word32)(t >> 32);
216
217 // if there was carry into 131st bit, h3:h0 = g3:g0
218 mask = 0 - (g4 >> 2);
219 g0 &= mask; g1 &= mask;
220 g2 &= mask; g3 &= mask;
221 mask = ~mask;
222 h0 = (h0 & mask) | g0; h1 = (h1 & mask) | g1;
223 h2 = (h2 & mask) | g2; h3 = (h3 & mask) | g3;
224
225 // mac = (h + nonce) % (2^128)
226 h0 = (word32)(t = (word64)h0 + m_n[0]);
227 h1 = (word32)(t = (word64)h1 + (t >> 32) + m_n[1]);
228 h2 = (word32)(t = (word64)h2 + (t >> 32) + m_n[2]);
229 h3 = (word32)(t = (word64)h3 + (t >> 32) + m_n[3]);
230
231 if (size >= BLOCKSIZE)
232 {
233 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 0, h0);
234 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 4, h1);
235 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 8, h2);
236 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 12, h3);
237 }
238 else
239 {
240 FixedSizeAlignedSecBlock<byte, BLOCKSIZE> m;
241 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 0, h0);
242 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 4, h1);
243 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 8, h2);
244 PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 12, h3);
245 memcpy(mac, m, size);
246 }
247 }
248
249 template <class T>
250 void Poly1305_Base<T>::Resynchronize(const byte *nonce, int nonceLength)
251 {
252 CRYPTOPP_ASSERT(nonceLength == -1 || nonceLength == (int)BLOCKSIZE);
253 nonceLength == -1 ? nonceLength = BLOCKSIZE : nonceLength;
254 this->UncheckedSetKey(NULLPTR, 0, MakeParameters(Name::IV(), ConstByteArrayParameter(nonce, nonceLength)));
255 }
256
257 template <class T>
258 void Poly1305_Base<T>::GetNextIV(RandomNumberGenerator &rng, byte *iv)
259 {
260 rng.GenerateBlock(iv, BLOCKSIZE);
261 }
262
263 template <class T>
264 void Poly1305_Base<T>::Restart()
265 {
266 m_h[0] = m_h[1] = m_h[2] = m_h[3] = m_h[4] = 0;
267 // m_r[0] = m_r[1] = m_r[2] = m_r[3] = 0;
268 m_idx = 0;
269 }
270
271 template class Poly1305_Base<AES>;
272 template class Poly1305<AES>;
273
274 NAMESPACE_END
ConstByteArrayParameter
Used to pass byte array input as part of a NameValuePairs object.
Definition: algparam.h:20
Poly1305_Base
Poly1305 message authentication code base class.
Definition: poly1305.h:59
RandomNumberGenerator::GenerateBlock
virtual void GenerateBlock(byte *output, size_t size)
Generate random array of bytes.
Definition: cryptlib.cpp:311
ConstByteArrayParameter::size
size_t size() const
Length of the memory block.
Definition: algparam.h:84
Poly1305_Base::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: poly1305.cpp:15
cryptlib.h
Abstract base classes that provide a uniform interface to this library.
memcpy_s
void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
Bounds checking replacement for memcpy()
Definition: misc.h:439
Poly1305_Base::UncheckedSetKey
void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
Sets the key for this object without performing parameter validation.
Definition: poly1305.cpp:21
RandomNumberGenerator
Interface for random number generators.
Definition: cryptlib.h:1349
LITTLE_ENDIAN_ORDER
byte order is little-endian
Definition: cryptlib.h:145
Poly1305_Base::TruncatedFinal
void TruncatedFinal(byte *mac, size_t size)
Computes the hash of the current message.
Definition: poly1305.cpp:173
ConstByteArrayParameter::begin
const byte * begin() const
Pointer to the first byte in the memory block.
Definition: algparam.h:80
MakeParameters
AlgorithmParameters MakeParameters(const char *name, const T &value, bool throwIfNotUsed=true)
Create an object that implements NameValuePairs.
Definition: algparam.h:502
aes.h
Class file for the AES cipher (Rijndael)
pch.h
Precompiled header file.
SaturatingSubtract
T1 SaturatingSubtract(const T1 &a, const T2 &b)
Performs a saturating subtract clamped at 0.
Definition: misc.h:946
FixedSizeAlignedSecBlock< byte, BLOCKSIZE >
Poly1305_Base::Resynchronize
void Resynchronize(const byte *iv, int ivLength=-1)
Resynchronize with an IV.
Definition: poly1305.cpp:250
Poly1305
Poly1305 message authentication code.
Definition: poly1305.h:146
Poly1305_Base::GetNextIV
void GetNextIV(RandomNumberGenerator &rng, byte *iv)
Retrieves a secure IV for the next message.
Definition: poly1305.cpp:258
CRYPTOPP_ASSERT
#define CRYPTOPP_ASSERT(exp)
Debugging and diagnostic assertion.
Definition: trap.h:60
cpu.h
Functions for CPU features and intrinsics.
Name::IV
const char * IV()
ConstByteArrayParameter, also accepts const byte * for backwards compatibility.
Definition: argnames.h:21
CryptoPP
Crypto++ library namespace.
poly1305.h
Classes for Poly1305 message authentication code.
NameValuePairs::GetValue
bool GetValue(const char *name, T &value) const
Get a named value.
Definition: cryptlib.h:350
Poly1305_Base::Update
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: poly1305.cpp:59
Poly1305_Base::Restart
void Restart()
Restart the hash.
Definition: poly1305.cpp:264
NameValuePairs
Interface for retrieving values given their names.
Definition: cryptlib.h:293