Crypto++ 8.0 Free C++ class library of cryptographic schemes

blake2.cpp
1 // blake2.cpp - written and placed in the public domain by Jeffrey Walton
2 // and Zooko Wilcox-O'Hearn. Based on Aumasson, Neves,
3 // Wilcox-O'Hearn and Winnerlein's reference BLAKE2
4 // implementation at http://github.com/BLAKE2/BLAKE2.
5 //
6 // The BLAKE2b and BLAKE2s numbers are consistent with the BLAKE2 team's
7 // numbers. However, we have an Altivec/POWER7 implementation of BLAKE2s,
8 // and a POWER8 implementation of BLAKE2b (BLAKE2 is missing them). The
9 // Altivec/POWER7 code is about 2x faster than C++ when using GCC 5.0 or
10 // above. The POWER8 code is about 2.5x faster than C++ when using GCC 5.0
11 // or above. If you use GCC 4.0 (PowerMac) or GCC 4.8 (GCC Compile Farm)
12 // then the PowerPC code will be slower than C++. Be sure to use GCC 5.0
13 // or above for PowerPC builds or disable Altivec for BLAKE2b and BLAKE2s
14 // if using the old compilers.
15
16 #include "pch.h"
17 #include "config.h"
18 #include "cryptlib.h"
19 #include "argnames.h"
20 #include "algparam.h"
21 #include "blake2.h"
22 #include "cpu.h"
23
24 // Uncomment for benchmarking C++ against SSE2 or NEON.
25 // Do so in both blake2.cpp and blake2-simd.cpp.
26 // #undef CRYPTOPP_SSE41_AVAILABLE
27 // #undef CRYPTOPP_ARM_NEON_AVAILABLE
28 // #undef CRYPTOPP_ALTIVEC_AVAILABLE
29 // #undef CRYPTOPP_POWER8_AVAILABLE
30
31 // Disable NEON/ASIMD for Cortex-A53 and A57. The shifts are too slow and C/C++ is about
32 // 3 cpb faster than NEON/ASIMD. Also see http://github.com/weidai11/cryptopp/issues/367.
33 #if (defined(__aarch32__) || defined(__aarch64__)) && defined(CRYPTOPP_SLOW_ARMV8_SHIFT)
34 # undef CRYPTOPP_ARM_NEON_AVAILABLE
35 #endif
36
37 // BLAKE2s bug on AIX 7.1 (POWER7) with XLC 12.01
38 // https://github.com/weidai11/cryptopp/issues/743
39 #if defined(__xlC__) && (__xlC__ < 0x0d01)
40 # define CRYPTOPP_DISABLE_ALTIVEC 1
41 # define CRYPTOPP_POWER7_ALTIVEC 1
42 # undef CRYPTOPP_POWER7_AVAILABLE
43 # undef CRYPTOPP_ALTIVEC_AVAILABLE
44 #endif
45
46 NAMESPACE_BEGIN(CryptoPP)
47
48 // Export the tables to the SIMD files
49 extern const word32 BLAKE2S_IV[8];
50 extern const word64 BLAKE2B_IV[8];
51
52 CRYPTOPP_ALIGN_DATA(16)
53 const word32 BLAKE2S_IV[8] = {
54 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
55 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
56 };
57
58 CRYPTOPP_ALIGN_DATA(16)
59 const word64 BLAKE2B_IV[8] = {
60 W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
61 W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
62 W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
63 W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)
64 };
65
66 NAMESPACE_END
67
68 ANONYMOUS_NAMESPACE_BEGIN
69
70 using CryptoPP::byte;
71 using CryptoPP::word32;
72 using CryptoPP::word64;
73 using CryptoPP::rotrConstant;
74
75 CRYPTOPP_ALIGN_DATA(16)
76 const byte BLAKE2S_SIGMA[10][16] = {
77 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
78 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
79 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
80 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
81 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
82 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
83 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
84 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
85 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
86 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
87 };
88
89 CRYPTOPP_ALIGN_DATA(16)
90 const byte BLAKE2B_SIGMA[12][16] = {
91 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
92 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
93 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
94 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
95 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
96 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
97 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
98 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
99 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
100 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
101 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
102 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
103 };
104
105 template <unsigned int R, unsigned int N>
106 inline void BLAKE2B_G(const word64 m[16], word64& a, word64& b, word64& c, word64& d)
107 {
108 a = a + b + m[BLAKE2B_SIGMA[R][2*N+0]];
109 d = rotrConstant<32>(d ^ a);
110 c = c + d;
111 b = rotrConstant<24>(b ^ c);
112 a = a + b + m[BLAKE2B_SIGMA[R][2*N+1]];
113 d = rotrConstant<16>(d ^ a);
114 c = c + d;
115 b = rotrConstant<63>(b ^ c);
116 }
117
118 template <unsigned int R>
119 inline void BLAKE2B_ROUND(const word64 m[16], word64 v[16])
120 {
121 BLAKE2B_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
122 BLAKE2B_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
123 BLAKE2B_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
124 BLAKE2B_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
125 BLAKE2B_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
126 BLAKE2B_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
127 BLAKE2B_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
128 BLAKE2B_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
129 }
130
131 template <unsigned int R, unsigned int N>
132 inline void BLAKE2S_G(const word32 m[16], word32& a, word32& b, word32& c, word32& d)
133 {
134 a = a + b + m[BLAKE2S_SIGMA[R][2*N+0]];
135 d = rotrConstant<16>(d ^ a);
136 c = c + d;
137 b = rotrConstant<12>(b ^ c);
138 a = a + b + m[BLAKE2S_SIGMA[R][2*N+1]];
139 d = rotrConstant<8>(d ^ a);
140 c = c + d;
141 b = rotrConstant<7>(b ^ c);
142 }
143
144 template <unsigned int R>
145 inline void BLAKE2S_ROUND(const word32 m[16], word32 v[])
146 {
147 BLAKE2S_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
148 BLAKE2S_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
149 BLAKE2S_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
150 BLAKE2S_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
151 BLAKE2S_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
152 BLAKE2S_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
153 BLAKE2S_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
154 BLAKE2S_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
155 }
156
157 ANONYMOUS_NAMESPACE_END
158
159 NAMESPACE_BEGIN(CryptoPP)
160
161 void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state);
162 void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state);
163
164 #if CRYPTOPP_SSE41_AVAILABLE
165 extern void BLAKE2_Compress32_SSE4(const byte* input, BLAKE2s_State& state);
166 extern void BLAKE2_Compress64_SSE4(const byte* input, BLAKE2b_State& state);
167 #endif
168
169 #if CRYPTOPP_ARM_NEON_AVAILABLE
170 extern void BLAKE2_Compress32_NEON(const byte* input, BLAKE2s_State& state);
171 extern void BLAKE2_Compress64_NEON(const byte* input, BLAKE2b_State& state);
172 #endif
173
174 #if CRYPTOPP_POWER7_AVAILABLE
175 extern void BLAKE2_Compress32_POWER7(const byte* input, BLAKE2s_State& state);
176 #elif CRYPTOPP_ALTIVEC_AVAILABLE
177 extern void BLAKE2_Compress32_ALTIVEC(const byte* input, BLAKE2s_State& state);
178 #endif
179
180 #if CRYPTOPP_POWER8_AVAILABLE
181 extern void BLAKE2_Compress64_POWER8(const byte* input, BLAKE2b_State& state);
182 #endif
183
184 unsigned int BLAKE2b::OptimalDataAlignment() const
185 {
186 #if defined(CRYPTOPP_SSE41_AVAILABLE)
187 if (HasSSE41())
188 return 16;
189 else
190 #endif
191 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
192 if (HasNEON())
193 return 4;
194 else
195 #endif
196 #if (CRYPTOPP_POWER8_AVAILABLE)
197 if (HasPower8())
198 return 16;
199 else
200 #endif
201 return GetAlignmentOf<word64>();
202 }
203
204 std::string BLAKE2b::AlgorithmProvider() const
205 {
206 #if defined(CRYPTOPP_SSE41_AVAILABLE)
207 if (HasSSE41())
208 return "SSE4.1";
209 else
210 #endif
211 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
212 if (HasNEON())
213 return "NEON";
214 else
215 #endif
216 #if (CRYPTOPP_POWER8_AVAILABLE)
217 if (HasPower8())
218 return "Power8";
219 else
220 #endif
221 return "C++";
222 }
223
224 unsigned int BLAKE2s::OptimalDataAlignment() const
225 {
226 #if defined(CRYPTOPP_SSE41_AVAILABLE)
227 if (HasSSE41())
228 return 16;
229 else
230 #endif
231 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
232 if (HasNEON())
233 return 4;
234 else
235 #endif
236 #if (CRYPTOPP_POWER7_AVAILABLE)
237 if (HasPower7())
238 return 16;
239 else
240 #elif (CRYPTOPP_ALTIVEC_AVAILABLE)
241 if (HasAltivec())
242 return 16;
243 else
244 #endif
245 return GetAlignmentOf<word32>();
246 }
247
248 std::string BLAKE2s::AlgorithmProvider() const
249 {
250 #if defined(CRYPTOPP_SSE41_AVAILABLE)
251 if (HasSSE41())
252 return "SSE4.1";
253 else
254 #endif
255 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
256 if (HasNEON())
257 return "NEON";
258 else
259 #endif
260 #if (CRYPTOPP_POWER7_AVAILABLE)
261 if (HasPower7())
262 return "Power7";
263 else
264 #elif (CRYPTOPP_ALTIVEC_AVAILABLE)
265 if (HasAltivec())
266 return "Altivec";
267 else
268 #endif
269 return "C++";
270 }
271
272 void BLAKE2s_State::Reset()
273 {
274 std::memset(m_hft, 0x00, m_hft.SizeInBytes());
275 m_len = 0;
276 }
277
278 void BLAKE2b_State::Reset()
279 {
280 std::memset(m_hft, 0x00, m_hft.SizeInBytes());
281 m_len = 0;
282 }
283
284 BLAKE2s_ParameterBlock::BLAKE2s_ParameterBlock(size_t digestLen, size_t keyLen,
285 const byte* saltStr, size_t saltLen,
286 const byte* personalizationStr, size_t personalizationLen)
287 {
288 Reset(digestLen, keyLen);
289
290 if (saltStr && saltLen)
291 memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
292
293 if (personalizationStr && personalizationLen)
294 memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
295 }
296
297 BLAKE2b_ParameterBlock::BLAKE2b_ParameterBlock(size_t digestLen, size_t keyLen,
298 const byte* saltStr, size_t saltLen,
299 const byte* personalizationStr, size_t personalizationLen)
300 {
301 Reset(digestLen, keyLen);
302
303 if (saltStr && saltLen)
304 memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
305
306 if (personalizationStr && personalizationLen)
307 memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
308 }
309
310 void BLAKE2s_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
311 {
312 std::memset(m_data, 0x00, m_data.size());
313 m_data[DigestOff] = static_cast<byte>(digestLen);
314 m_data[KeyOff] = static_cast<byte>(keyLen);
315 m_data[FanoutOff] = m_data[DepthOff] = 1;
316 }
317
318 void BLAKE2b_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
319 {
320 std::memset(m_data, 0x00, m_data.size());
321 m_data[DigestOff] = static_cast<byte>(digestLen);
322 m_data[KeyOff] = static_cast<byte>(keyLen);
323 m_data[FanoutOff] = m_data[DepthOff] = 1;
324 }
325
326 BLAKE2s::BLAKE2s(bool treeMode, unsigned int digestSize)
327 : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
328 {
329 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
330
331 UncheckedSetKey(NULLPTR, 0, MakeParameters
332 (Name::DigestSize(), (int)digestSize)
333 (Name::TreeMode(), treeMode));
334 }
335
336 BLAKE2b::BLAKE2b(bool treeMode, unsigned int digestSize)
337 : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
338 {
339 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
340
341 UncheckedSetKey(NULLPTR, 0, MakeParameters
342 (Name::DigestSize(), (int)digestSize)
343 (Name::TreeMode(), treeMode));
344 }
345
346 BLAKE2s::BLAKE2s(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
347 const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
348 : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
349 {
350 CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
351 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
352 CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
353 CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
354
355 UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
356 (Name::DigestSize(),(int)digestSize)
357 (Name::TreeMode(),treeMode)
358 (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
359 (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
360 }
361
362 BLAKE2b::BLAKE2b(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
363 const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
364 : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
365 {
366 CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
367 CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
368 CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
369 CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
370
371 UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
372 (Name::DigestSize(),(int)digestSize)
373 (Name::TreeMode(),treeMode)
374 (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
375 (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
376 }
377
378 void BLAKE2s::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
379 {
380 if (key && length)
381 {
382 m_key.New(BLOCKSIZE);
383 std::memcpy(m_key, key, length);
384 std::memset(m_key + length, 0x00, BLOCKSIZE - length);
385 m_keyLength = length;
386 }
387 else
388 {
389 m_key.resize(0);
390 m_keyLength = 0;
391 }
392
393 m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
394 Name::DigestSize(), static_cast<int>(m_digestSize)));
395
396 m_state.Reset();
397 m_block.Reset(m_digestSize, m_keyLength);
398 (void)params.GetValue(Name::TreeMode(), m_treeMode);
399
400 ConstByteArrayParameter t;
401 if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
402 memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
403
404 if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
405 memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
406
407 Restart();
408 }
409
410 void BLAKE2b::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
411 {
412 if (key && length)
413 {
414 m_key.New(BLOCKSIZE);
415 std::memcpy(m_key, key, length);
416 std::memset(m_key + length, 0x00, BLOCKSIZE - length);
417 m_keyLength = length;
418 }
419 else
420 {
421 m_key.resize(0);
422 m_keyLength = 0;
423 }
424
425 m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
426 Name::DigestSize(), static_cast<int>(m_digestSize)));
427
428 m_state.Reset();
429 m_block.Reset(m_digestSize, m_keyLength);
430 (void)params.GetValue(Name::TreeMode(), m_treeMode);
431
432 ConstByteArrayParameter t;
433 if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
434 memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
435
436 if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
437 memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
438
439 Restart();
440 }
441
442 void BLAKE2s::Restart()
443 {
444 static const word32 zero[2] = {0,0};
445 Restart(m_block, zero);
446 }
447
448 void BLAKE2b::Restart()
449 {
450 static const word64 zero[2] = {0,0};
451 Restart(m_block, zero);
452 }
453
454 void BLAKE2s::Restart(const BLAKE2s_ParameterBlock& block, const word32 counter[2])
455 {
456 // We take a counter as a parameter to allow customized state.
457 m_state.Reset();
458 if (counter != NULLPTR)
459 {
460 word32* t = m_state.t();
461 t[0] = counter[0];
462 t[1] = counter[1];
463 }
464
465 // We take a parameter block as a parameter to allow customized state.
466 // Avoid the copy of the parameter block when we are passing our own block.
467 if (block.data() == m_block.data())
468 m_block.Reset(m_digestSize, m_keyLength);
469 else
470 {
471 std::memcpy(m_block.data(), block.data(), m_block.size());
472 m_block.m_data[BLAKE2s_ParameterBlock::DigestOff] = (byte)m_digestSize;
473 m_block.m_data[BLAKE2s_ParameterBlock::KeyOff] = (byte)m_keyLength;
474 }
475
476 const word32* iv = BLAKE2S_IV;
477 PutBlock<word32, LittleEndian, true> put(m_block.data(), m_state.h());
478 put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
479
480 // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
481 // The key is padded to a full Blocksize with 0. Key it during Restart to
482 // avoid FirstPut and friends. Key size == 0 means no key.
483 if (m_keyLength)
484 Update(m_key, BLOCKSIZE);
485 }
486
487 void BLAKE2b::Restart(const BLAKE2b_ParameterBlock& block, const word64 counter[2])
488 {
489 // We take a counter as a parameter to allow customized state.
490 m_state.Reset();
491 if (counter != NULLPTR)
492 {
493 word64* t = m_state.t();
494 t[0] = counter[0];
495 t[1] = counter[1];
496 }
497
498 // We take a parameter block as a parameter to allow customized state.
499 // Avoid the copy of the parameter block when we are passing our own block.
500 if (block.data() == m_block.data())
501 m_block.Reset(m_digestSize, m_keyLength);
502 else
503 {
504 std::memcpy(m_block.data(), block.data(), m_block.size());
505 m_block.m_data[BLAKE2b_ParameterBlock::DigestOff] = (byte)m_digestSize;
506 m_block.m_data[BLAKE2b_ParameterBlock::KeyOff] = (byte)m_keyLength;
507 }
508
509 const word64* iv = BLAKE2B_IV;
510 PutBlock<word64, LittleEndian, true> put(m_block.data(), m_state.h());
511 put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
512
513 // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
514 // The key is padded to a full Blocksize with 0. Key it during Restart to
515 // avoid FirstPut and friends. Key size == 0 means no key.
516 if (m_keyLength)
517 Update(m_key, BLOCKSIZE);
518 }
519
520 void BLAKE2s::Update(const byte *input, size_t length)
521 {
522 CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
523
524 if (length > BLOCKSIZE - m_state.m_len)
525 {
526 if (m_state.m_len != 0)
527 {
528 // Complete current block
529 const size_t fill = BLOCKSIZE - m_state.m_len;
530 std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
531
532 IncrementCounter(BLOCKSIZE);
533 Compress(m_state.m_buf);
534 m_state.m_len = 0;
535
536 length -= fill, input += fill;
537 }
538
539 // Compress in-place to avoid copies
540 while (length > BLOCKSIZE)
541 {
542 IncrementCounter(BLOCKSIZE);
543 Compress(input);
544 length -= BLOCKSIZE, input += BLOCKSIZE;
545 }
546 }
547
548 // Copy tail bytes
549 if (length)
550 {
551 CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
552 std::memcpy(m_state.m_buf+m_state.m_len, input, length);
553 m_state.m_len += static_cast<unsigned int>(length);
554 }
555 }
556
557 void BLAKE2b::Update(const byte *input, size_t length)
558 {
559 CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
560
561 if (length > BLOCKSIZE - m_state.m_len)
562 {
563 if (m_state.m_len != 0)
564 {
565 // Complete current block
566 const size_t fill = BLOCKSIZE - m_state.m_len;
567 std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
568
569 IncrementCounter(BLOCKSIZE);
570 Compress(m_state.m_buf);
571 m_state.m_len = 0;
572
573 length -= fill, input += fill;
574 }
575
576 // Compress in-place to avoid copies
577 while (length > BLOCKSIZE)
578 {
579 CRYPTOPP_ASSERT(m_state.m_len == 0);
580 IncrementCounter(BLOCKSIZE);
581 Compress(input);
582 length -= BLOCKSIZE, input += BLOCKSIZE;
583 }
584 }
585
586 // Copy tail bytes
587 if (length)
588 {
589 CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
590 std::memcpy(m_state.m_buf + m_state.m_len, input, length);
591 m_state.m_len += static_cast<unsigned int>(length);
592 }
593 }
594
595 void BLAKE2s::TruncatedFinal(byte *hash, size_t size)
596 {
597 CRYPTOPP_ASSERT(hash != NULLPTR);
598 this->ThrowIfInvalidTruncatedSize(size);
599 word32* f = m_state.f();
600
601 // Set last block unconditionally
602 f[0] = ~static_cast<word32>(0);
603
604 // Set last node if tree mode
605 if (m_treeMode)
606 f[1] = ~static_cast<word32>(0);
607
608 // Increment counter for tail bytes only
609 IncrementCounter(m_state.m_len);
610
611 std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
612 Compress(m_state.m_buf);
613
614 // Copy to caller buffer
615 std::memcpy(hash, m_state.h(), size);
616
617 Restart();
618 }
619
620 void BLAKE2b::TruncatedFinal(byte *hash, size_t size)
621 {
622 CRYPTOPP_ASSERT(hash != NULLPTR);
623 this->ThrowIfInvalidTruncatedSize(size);
624 word64* f = m_state.f();
625
626 // Set last block unconditionally
627 f[0] = ~static_cast<word64>(0);
628
629 // Set last node if tree mode
630 if (m_treeMode)
631 f[1] = ~static_cast<word64>(0);
632
633 // Increment counter for tail bytes only
634 IncrementCounter(m_state.m_len);
635
636 std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
637 Compress(m_state.m_buf);
638
639 // Copy to caller buffer
640 std::memcpy(hash, m_state.h(), size);
641
642 Restart();
643 }
644
645 void BLAKE2s::IncrementCounter(size_t count)
646 {
647 word32* t = m_state.t();
648 t[0] += static_cast<word32>(count);
649 t[1] += !!(t[0] < count);
650 }
651
652 void BLAKE2b::IncrementCounter(size_t count)
653 {
654 word64* t = m_state.t();
655 t[0] += static_cast<word64>(count);
656 t[1] += !!(t[0] < count);
657 }
658
659 void BLAKE2s::Compress(const byte *input)
660 {
661 #if CRYPTOPP_SSE41_AVAILABLE
662 if(HasSSE41())
663 {
664 return BLAKE2_Compress32_SSE4(input, m_state);
665 }
666 #endif
667 #if CRYPTOPP_ARM_NEON_AVAILABLE
668 if(HasNEON())
669 {
670 return BLAKE2_Compress32_NEON(input, m_state);
671 }
672 #endif
673 #if CRYPTOPP_POWER7_AVAILABLE
674 if(HasPower7())
675 {
676 return BLAKE2_Compress32_POWER7(input, m_state);
677 }
678 #elif CRYPTOPP_ALTIVEC_AVAILABLE
679 if(HasAltivec())
680 {
681 return BLAKE2_Compress32_ALTIVEC(input, m_state);
682 }
683 #endif
684 return BLAKE2_Compress32_CXX(input, m_state);
685 }
686
687 void BLAKE2b::Compress(const byte *input)
688 {
689 #if CRYPTOPP_SSE41_AVAILABLE
690 if(HasSSE41())
691 {
692 return BLAKE2_Compress64_SSE4(input, m_state);
693 }
694 #endif
695 #if CRYPTOPP_ARM_NEON_AVAILABLE
696 if(HasNEON())
697 {
698 return BLAKE2_Compress64_NEON(input, m_state);
699 }
700 #endif
701 #if CRYPTOPP_POWER8_AVAILABLE
702 if(HasPower8())
703 {
704 return BLAKE2_Compress64_POWER8(input, m_state);
705 }
706 #endif
707 return BLAKE2_Compress64_CXX(input, m_state);
708 }
709
710 void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state)
711 {
712 word64 m[16], v[16];
713
714 GetBlock<word64, LittleEndian, true> get1(input);
715 get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
716
717 GetBlock<word64, LittleEndian, true> get2(state.h());
718 get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
719
720 const word64* iv = BLAKE2B_IV;
721 const word64* tf = state.t();
722 v[ 8] = iv[0];
723 v[ 9] = iv[1];
724 v[10] = iv[2];
725 v[11] = iv[3];
726 v[12] = tf[0] ^ iv[4];
727 v[13] = tf[1] ^ iv[5];
728 v[14] = tf[2] ^ iv[6];
729 v[15] = tf[3] ^ iv[7];
730
731 BLAKE2B_ROUND<0>(m, v);
732 BLAKE2B_ROUND<1>(m, v);
733 BLAKE2B_ROUND<2>(m, v);
734 BLAKE2B_ROUND<3>(m, v);
735 BLAKE2B_ROUND<4>(m, v);
736 BLAKE2B_ROUND<5>(m, v);
737 BLAKE2B_ROUND<6>(m, v);
738 BLAKE2B_ROUND<7>(m, v);
739 BLAKE2B_ROUND<8>(m, v);
740 BLAKE2B_ROUND<9>(m, v);
741 BLAKE2B_ROUND<10>(m, v);
742 BLAKE2B_ROUND<11>(m, v);
743
744 word64* h = state.h();
745 for (unsigned int i = 0; i < 8; ++i)
746 h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
747 }
748
749 void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state)
750 {
751 word32 m[16], v[16];
752
753 GetBlock<word32, LittleEndian, true> get1(input);
754 get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
755
756 GetBlock<word32, LittleEndian, true> get2(state.h());
757 get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
758
759 const word32* iv = BLAKE2S_IV;
760 const word32* tf = state.t();
761 v[ 8] = iv[0];
762 v[ 9] = iv[1];
763 v[10] = iv[2];
764 v[11] = iv[3];
765 v[12] = tf[0] ^ iv[4];
766 v[13] = tf[1] ^ iv[5];
767 v[14] = tf[2] ^ iv[6];
768 v[15] = tf[3] ^ iv[7];
769
770 BLAKE2S_ROUND<0>(m, v);
771 BLAKE2S_ROUND<1>(m, v);
772 BLAKE2S_ROUND<2>(m, v);
773 BLAKE2S_ROUND<3>(m, v);
774 BLAKE2S_ROUND<4>(m, v);
775 BLAKE2S_ROUND<5>(m, v);
776 BLAKE2S_ROUND<6>(m, v);
777 BLAKE2S_ROUND<7>(m, v);
778 BLAKE2S_ROUND<8>(m, v);
779 BLAKE2S_ROUND<9>(m, v);
780
781 word32* h = state.h();
782 for (unsigned int i = 0; i < 8; ++i)
783 h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
784 }
785
786 NAMESPACE_END
ConstByteArrayParameter
Used to pass byte array input as part of a NameValuePairs object.
Definition: algparam.h:20
argnames.h
Standard names for retrieving values by name when working with NameValuePairs.
Name::DigestSize
const char * DigestSize()
int, in bytes
Definition: argnames.h:79
Name::TreeMode
const char * TreeMode()
byte
Definition: argnames.h:90
BLAKE2b::Update
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: blake2.cpp:557
BLAKE2b_ParameterBlock
BLAKE2b parameter block.
Definition: blake2.h:111
algparam.h
Classes for working with NameValuePairs.
HasAltivec
bool HasAltivec()
Determine if a PowerPC processor has Altivec available.
Definition: cpu.h:614
BLAKE2s::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: blake2.cpp:248
BLAKE2b::OptimalDataAlignment
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition: blake2.cpp:184
ConstByteArrayParameter::size
size_t size() const
Length of the memory block.
Definition: algparam.h:84
SecBlock::SizeInBytes
size_type SizeInBytes() const
Provides the number of bytes in the SecBlock.
Definition: secblock.h:811
SecBlock::resize
void resize(size_type newSize)
Change size and preserve contents.
Definition: secblock.h:1031
BLAKE2b::AlgorithmProvider
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: blake2.cpp:204
cryptlib.h
Abstract base classes that provide a uniform interface to this library.
memcpy_s
void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
Bounds checking replacement for memcpy()
Definition: misc.h:411
BLAKE2s::TruncatedFinal
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition: blake2.cpp:595
BLAKE2s_ParameterBlock
BLAKE2s parameter block.
Definition: blake2.h:60
config.h
Library configuration file.
BLAKE2s::BLAKE2s
BLAKE2s(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2s hash.
Definition: blake2.cpp:326
SecBlock::New
void New(size_type newSize)
Change size without preserving contents.
Definition: secblock.h:965
LITTLE_ENDIAN_ORDER
byte order is little-endian
Definition: cryptlib.h:145
HasPower7
bool HasPower7()
Determine if a PowerPC processor has Power7 available.
Definition: cpu.h:627
ConstByteArrayParameter::begin
const byte * begin() const
Pointer to the first byte in the memory block.
Definition: algparam.h:80
MakeParameters
AlgorithmParameters MakeParameters(const char *name, const T &value, bool throwIfNotUsed=true)
Create an object that implements NameValuePairs.
Definition: algparam.h:502
HasPower8
bool HasPower8()
Determine if a PowerPC processor has Power8 available.
Definition: cpu.h:640
ConditionalByteReverse
T ConditionalByteReverse(ByteOrder order, T value)
Reverses bytes in a value depending upon endianness.
Definition: misc.h:2081
Name::Salt
const char * Salt()
ConstByteArrayParameter.
Definition: argnames.h:87
pch.h
Precompiled header file.
blake2.h
Classes for BLAKE2b and BLAKE2s message digests and keyed message digests.
BLAKE2s::Update
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: blake2.cpp:520
Name::Personalization
const char * Personalization()
ConstByteArrayParameter.
Definition: argnames.h:85
CRYPTOPP_ASSERT
#define CRYPTOPP_ASSERT(exp)
Debugging and diagnostic assertion.
Definition: trap.h:69
cpu.h
Functions for CPU features and intrinsics.
BLAKE2s::Restart
void Restart()
Restart the hash.
Definition: blake2.cpp:442
BLAKE2s_State
BLAKE2s state information.
Definition: blake2.h:163
BLAKE2b_State
BLAKE2b state information.
Definition: blake2.h:196
rotrConstant
T rotrConstant(T x)
Performs a right rotate.
Definition: misc.h:1493
GetBlock
Access a block of memory.
Definition: misc.h:2422
BLAKE2b::TruncatedFinal
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition: blake2.cpp:620
HasSSE41
bool HasSSE41()
Determines SSE4.1 availability.
Definition: cpu.h:142
PutBlock
Access a block of memory.
Definition: misc.h:2463
CryptoPP
Crypto++ library namespace.
BLAKE2b::BLAKE2b
BLAKE2b(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2b hash.
Definition: blake2.cpp:336
BLAKE2s::OptimalDataAlignment
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition: blake2.cpp:224
SecBlock::size
size_type size() const
Provides the count of elements in the SecBlock.
Definition: secblock.h:797
HasNEON
bool HasNEON()
Determine if an ARM processor has Advanced SIMD available.
Definition: cpu.h:387
BLAKE2b::Restart
void Restart()
Restart the hash.
Definition: blake2.cpp:448