wolf SSL / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more

wolfcrypt/src/poly1305.c@7:481bce714567, 2017-05-02 (annotated)

Committer:
wolfSSL
Date:
Tue May 02 08:44:47 2017 +0000
Revision:
7:481bce714567
wolfSSL3.10.2

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 7:481bce714567 1 /* poly1305.c
wolfSSL 7:481bce714567 2 *
wolfSSL 7:481bce714567 3 * Copyright (C) 2006-2016 wolfSSL Inc.
wolfSSL 7:481bce714567 4 *
wolfSSL 7:481bce714567 5 * This file is part of wolfSSL.
wolfSSL 7:481bce714567 6 *
wolfSSL 7:481bce714567 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 7:481bce714567 8 * it under the terms of the GNU General Public License as published by
wolfSSL 7:481bce714567 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 7:481bce714567 10 * (at your option) any later version.
wolfSSL 7:481bce714567 11 *
wolfSSL 7:481bce714567 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 7:481bce714567 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 7:481bce714567 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 7:481bce714567 15 * GNU General Public License for more details.
wolfSSL 7:481bce714567 16 *
wolfSSL 7:481bce714567 17 * You should have received a copy of the GNU General Public License
wolfSSL 7:481bce714567 18 * along with this program; if not, write to the Free Software
wolfSSL 7:481bce714567 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 7:481bce714567 20 */
wolfSSL 7:481bce714567 21
wolfSSL 7:481bce714567 22 /*
wolfSSL 7:481bce714567 23 * Based off the public domain implementations by Andrew Moon
wolfSSL 7:481bce714567 24 * and Daniel J. Bernstein
wolfSSL 7:481bce714567 25 */
wolfSSL 7:481bce714567 26
wolfSSL 7:481bce714567 27 #ifdef HAVE_CONFIG_H
wolfSSL 7:481bce714567 28 #include <config.h>
wolfSSL 7:481bce714567 29 #endif
wolfSSL 7:481bce714567 30
wolfSSL 7:481bce714567 31 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 7:481bce714567 32
wolfSSL 7:481bce714567 33 #ifdef HAVE_POLY1305
wolfSSL 7:481bce714567 34 #include <wolfssl/wolfcrypt/poly1305.h>
wolfSSL 7:481bce714567 35 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 7:481bce714567 36 #include <wolfssl/wolfcrypt/logging.h>
wolfSSL 7:481bce714567 37 #ifdef NO_INLINE
wolfSSL 7:481bce714567 38 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 7:481bce714567 39 #else
wolfSSL 7:481bce714567 40 #define WOLFSSL_MISC_INCLUDED
wolfSSL 7:481bce714567 41 #include <wolfcrypt/src/misc.c>
wolfSSL 7:481bce714567 42 #endif
wolfSSL 7:481bce714567 43 #ifdef CHACHA_AEAD_TEST
wolfSSL 7:481bce714567 44 #include <stdio.h>
wolfSSL 7:481bce714567 45 #endif
wolfSSL 7:481bce714567 46
wolfSSL 7:481bce714567 47 #ifdef _MSC_VER
wolfSSL 7:481bce714567 48 /* 4127 warning constant while(1) */
wolfSSL 7:481bce714567 49 #pragma warning(disable: 4127)
wolfSSL 7:481bce714567 50 #endif
wolfSSL 7:481bce714567 51
wolfSSL 7:481bce714567 52 #if defined(POLY130564)
wolfSSL 7:481bce714567 53
wolfSSL 7:481bce714567 54 #if defined(_MSC_VER)
wolfSSL 7:481bce714567 55 #define POLY1305_NOINLINE __declspec(noinline)
wolfSSL 7:481bce714567 56 #elif defined(__GNUC__)
wolfSSL 7:481bce714567 57 #define POLY1305_NOINLINE __attribute__((noinline))
wolfSSL 7:481bce714567 58 #else
wolfSSL 7:481bce714567 59 #define POLY1305_NOINLINE
wolfSSL 7:481bce714567 60 #endif
wolfSSL 7:481bce714567 61
wolfSSL 7:481bce714567 62 #if defined(_MSC_VER)
wolfSSL 7:481bce714567 63 #include <intrin.h>
wolfSSL 7:481bce714567 64
wolfSSL 7:481bce714567 65 typedef struct word128 {
wolfSSL 7:481bce714567 66 word64 lo;
wolfSSL 7:481bce714567 67 word64 hi;
wolfSSL 7:481bce714567 68 } word128;
wolfSSL 7:481bce714567 69
wolfSSL 7:481bce714567 70 #define MUL(out, x, y) out.lo = _umul128((x), (y), &out.hi)
wolfSSL 7:481bce714567 71 #define ADD(out, in) { word64 t = out.lo; out.lo += in.lo; \
wolfSSL 7:481bce714567 72 out.hi += (out.lo < t) + in.hi; }
wolfSSL 7:481bce714567 73 #define ADDLO(out, in) { word64 t = out.lo; out.lo += in; \
wolfSSL 7:481bce714567 74 out.hi += (out.lo < t); }
wolfSSL 7:481bce714567 75 #define SHR(in, shift) (__shiftright128(in.lo, in.hi, (shift)))
wolfSSL 7:481bce714567 76 #define LO(in) (in.lo)
wolfSSL 7:481bce714567 77
wolfSSL 7:481bce714567 78 #elif defined(__GNUC__)
wolfSSL 7:481bce714567 79 #if defined(__SIZEOF_INT128__)
wolfSSL 7:481bce714567 80 typedef unsigned __int128 word128;
wolfSSL 7:481bce714567 81 #else
wolfSSL 7:481bce714567 82 typedef unsigned word128 __attribute__((mode(TI)));
wolfSSL 7:481bce714567 83 #endif
wolfSSL 7:481bce714567 84
wolfSSL 7:481bce714567 85 #define MUL(out, x, y) out = ((word128)x * y)
wolfSSL 7:481bce714567 86 #define ADD(out, in) out += in
wolfSSL 7:481bce714567 87 #define ADDLO(out, in) out += in
wolfSSL 7:481bce714567 88 #define SHR(in, shift) (word64)(in >> (shift))
wolfSSL 7:481bce714567 89 #define LO(in) (word64)(in)
wolfSSL 7:481bce714567 90 #endif
wolfSSL 7:481bce714567 91
wolfSSL 7:481bce714567 92 static word64 U8TO64(const byte* p) {
wolfSSL 7:481bce714567 93 return
wolfSSL 7:481bce714567 94 (((word64)(p[0] & 0xff) ) |
wolfSSL 7:481bce714567 95 ((word64)(p[1] & 0xff) << 8) |
wolfSSL 7:481bce714567 96 ((word64)(p[2] & 0xff) << 16) |
wolfSSL 7:481bce714567 97 ((word64)(p[3] & 0xff) << 24) |
wolfSSL 7:481bce714567 98 ((word64)(p[4] & 0xff) << 32) |
wolfSSL 7:481bce714567 99 ((word64)(p[5] & 0xff) << 40) |
wolfSSL 7:481bce714567 100 ((word64)(p[6] & 0xff) << 48) |
wolfSSL 7:481bce714567 101 ((word64)(p[7] & 0xff) << 56));
wolfSSL 7:481bce714567 102 }
wolfSSL 7:481bce714567 103
wolfSSL 7:481bce714567 104 static void U64TO8(byte* p, word64 v) {
wolfSSL 7:481bce714567 105 p[0] = (v ) & 0xff;
wolfSSL 7:481bce714567 106 p[1] = (v >> 8) & 0xff;
wolfSSL 7:481bce714567 107 p[2] = (v >> 16) & 0xff;
wolfSSL 7:481bce714567 108 p[3] = (v >> 24) & 0xff;
wolfSSL 7:481bce714567 109 p[4] = (v >> 32) & 0xff;
wolfSSL 7:481bce714567 110 p[5] = (v >> 40) & 0xff;
wolfSSL 7:481bce714567 111 p[6] = (v >> 48) & 0xff;
wolfSSL 7:481bce714567 112 p[7] = (v >> 56) & 0xff;
wolfSSL 7:481bce714567 113 }
wolfSSL 7:481bce714567 114
wolfSSL 7:481bce714567 115 #else /* if not 64 bit then use 32 bit */
wolfSSL 7:481bce714567 116
wolfSSL 7:481bce714567 117 static word32 U8TO32(const byte *p) {
wolfSSL 7:481bce714567 118 return
wolfSSL 7:481bce714567 119 (((word32)(p[0] & 0xff) ) |
wolfSSL 7:481bce714567 120 ((word32)(p[1] & 0xff) << 8) |
wolfSSL 7:481bce714567 121 ((word32)(p[2] & 0xff) << 16) |
wolfSSL 7:481bce714567 122 ((word32)(p[3] & 0xff) << 24));
wolfSSL 7:481bce714567 123 }
wolfSSL 7:481bce714567 124
wolfSSL 7:481bce714567 125 static void U32TO8(byte *p, word32 v) {
wolfSSL 7:481bce714567 126 p[0] = (v ) & 0xff;
wolfSSL 7:481bce714567 127 p[1] = (v >> 8) & 0xff;
wolfSSL 7:481bce714567 128 p[2] = (v >> 16) & 0xff;
wolfSSL 7:481bce714567 129 p[3] = (v >> 24) & 0xff;
wolfSSL 7:481bce714567 130 }
wolfSSL 7:481bce714567 131 #endif
wolfSSL 7:481bce714567 132
wolfSSL 7:481bce714567 133
wolfSSL 7:481bce714567 134 static void U32TO64(word32 v, byte* p) {
wolfSSL 7:481bce714567 135 XMEMSET(p, 0, 8);
wolfSSL 7:481bce714567 136 p[0] = (v & 0xFF);
wolfSSL 7:481bce714567 137 p[1] = (v >> 8) & 0xFF;
wolfSSL 7:481bce714567 138 p[2] = (v >> 16) & 0xFF;
wolfSSL 7:481bce714567 139 p[3] = (v >> 24) & 0xFF;
wolfSSL 7:481bce714567 140 }
wolfSSL 7:481bce714567 141
wolfSSL 7:481bce714567 142
wolfSSL 7:481bce714567 143 static void poly1305_blocks(Poly1305* ctx, const unsigned char *m,
wolfSSL 7:481bce714567 144 size_t bytes) {
wolfSSL 7:481bce714567 145
wolfSSL 7:481bce714567 146 #ifdef POLY130564
wolfSSL 7:481bce714567 147
wolfSSL 7:481bce714567 148 const word64 hibit = (ctx->final) ? 0 : ((word64)1 << 40); /* 1 << 128 */
wolfSSL 7:481bce714567 149 word64 r0,r1,r2;
wolfSSL 7:481bce714567 150 word64 s1,s2;
wolfSSL 7:481bce714567 151 word64 h0,h1,h2;
wolfSSL 7:481bce714567 152 word64 c;
wolfSSL 7:481bce714567 153 word128 d0,d1,d2,d;
wolfSSL 7:481bce714567 154
wolfSSL 7:481bce714567 155 #else
wolfSSL 7:481bce714567 156
wolfSSL 7:481bce714567 157 const word32 hibit = (ctx->final) ? 0 : (1 << 24); /* 1 << 128 */
wolfSSL 7:481bce714567 158 word32 r0,r1,r2,r3,r4;
wolfSSL 7:481bce714567 159 word32 s1,s2,s3,s4;
wolfSSL 7:481bce714567 160 word32 h0,h1,h2,h3,h4;
wolfSSL 7:481bce714567 161 word64 d0,d1,d2,d3,d4;
wolfSSL 7:481bce714567 162 word32 c;
wolfSSL 7:481bce714567 163
wolfSSL 7:481bce714567 164 #endif
wolfSSL 7:481bce714567 165
wolfSSL 7:481bce714567 166 #ifdef POLY130564
wolfSSL 7:481bce714567 167
wolfSSL 7:481bce714567 168 r0 = ctx->r[0];
wolfSSL 7:481bce714567 169 r1 = ctx->r[1];
wolfSSL 7:481bce714567 170 r2 = ctx->r[2];
wolfSSL 7:481bce714567 171
wolfSSL 7:481bce714567 172 h0 = ctx->h[0];
wolfSSL 7:481bce714567 173 h1 = ctx->h[1];
wolfSSL 7:481bce714567 174 h2 = ctx->h[2];
wolfSSL 7:481bce714567 175
wolfSSL 7:481bce714567 176 s1 = r1 * (5 << 2);
wolfSSL 7:481bce714567 177 s2 = r2 * (5 << 2);
wolfSSL 7:481bce714567 178
wolfSSL 7:481bce714567 179 while (bytes >= POLY1305_BLOCK_SIZE) {
wolfSSL 7:481bce714567 180 word64 t0,t1;
wolfSSL 7:481bce714567 181
wolfSSL 7:481bce714567 182 /* h += m[i] */
wolfSSL 7:481bce714567 183 t0 = U8TO64(&m[0]);
wolfSSL 7:481bce714567 184 t1 = U8TO64(&m[8]);
wolfSSL 7:481bce714567 185
wolfSSL 7:481bce714567 186 h0 += (( t0 ) & 0xfffffffffff);
wolfSSL 7:481bce714567 187 h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff);
wolfSSL 7:481bce714567 188 h2 += (((t1 >> 24) ) & 0x3ffffffffff) | hibit;
wolfSSL 7:481bce714567 189
wolfSSL 7:481bce714567 190 /* h *= r */
wolfSSL 7:481bce714567 191 MUL(d0, h0, r0); MUL(d, h1, s2); ADD(d0, d); MUL(d, h2, s1); ADD(d0, d);
wolfSSL 7:481bce714567 192 MUL(d1, h0, r1); MUL(d, h1, r0); ADD(d1, d); MUL(d, h2, s2); ADD(d1, d);
wolfSSL 7:481bce714567 193 MUL(d2, h0, r2); MUL(d, h1, r1); ADD(d2, d); MUL(d, h2, r0); ADD(d2, d);
wolfSSL 7:481bce714567 194
wolfSSL 7:481bce714567 195 /* (partial) h %= p */
wolfSSL 7:481bce714567 196 c = SHR(d0, 44); h0 = LO(d0) & 0xfffffffffff;
wolfSSL 7:481bce714567 197 ADDLO(d1, c); c = SHR(d1, 44); h1 = LO(d1) & 0xfffffffffff;
wolfSSL 7:481bce714567 198 ADDLO(d2, c); c = SHR(d2, 42); h2 = LO(d2) & 0x3ffffffffff;
wolfSSL 7:481bce714567 199 h0 += c * 5; c = (h0 >> 44); h0 = h0 & 0xfffffffffff;
wolfSSL 7:481bce714567 200 h1 += c;
wolfSSL 7:481bce714567 201
wolfSSL 7:481bce714567 202 m += POLY1305_BLOCK_SIZE;
wolfSSL 7:481bce714567 203 bytes -= POLY1305_BLOCK_SIZE;
wolfSSL 7:481bce714567 204 }
wolfSSL 7:481bce714567 205
wolfSSL 7:481bce714567 206 ctx->h[0] = h0;
wolfSSL 7:481bce714567 207 ctx->h[1] = h1;
wolfSSL 7:481bce714567 208 ctx->h[2] = h2;
wolfSSL 7:481bce714567 209
wolfSSL 7:481bce714567 210 #else /* if not 64 bit then use 32 bit */
wolfSSL 7:481bce714567 211
wolfSSL 7:481bce714567 212 r0 = ctx->r[0];
wolfSSL 7:481bce714567 213 r1 = ctx->r[1];
wolfSSL 7:481bce714567 214 r2 = ctx->r[2];
wolfSSL 7:481bce714567 215 r3 = ctx->r[3];
wolfSSL 7:481bce714567 216 r4 = ctx->r[4];
wolfSSL 7:481bce714567 217
wolfSSL 7:481bce714567 218 s1 = r1 * 5;
wolfSSL 7:481bce714567 219 s2 = r2 * 5;
wolfSSL 7:481bce714567 220 s3 = r3 * 5;
wolfSSL 7:481bce714567 221 s4 = r4 * 5;
wolfSSL 7:481bce714567 222
wolfSSL 7:481bce714567 223 h0 = ctx->h[0];
wolfSSL 7:481bce714567 224 h1 = ctx->h[1];
wolfSSL 7:481bce714567 225 h2 = ctx->h[2];
wolfSSL 7:481bce714567 226 h3 = ctx->h[3];
wolfSSL 7:481bce714567 227 h4 = ctx->h[4];
wolfSSL 7:481bce714567 228
wolfSSL 7:481bce714567 229 while (bytes >= POLY1305_BLOCK_SIZE) {
wolfSSL 7:481bce714567 230 /* h += m[i] */
wolfSSL 7:481bce714567 231 h0 += (U8TO32(m+ 0) ) & 0x3ffffff;
wolfSSL 7:481bce714567 232 h1 += (U8TO32(m+ 3) >> 2) & 0x3ffffff;
wolfSSL 7:481bce714567 233 h2 += (U8TO32(m+ 6) >> 4) & 0x3ffffff;
wolfSSL 7:481bce714567 234 h3 += (U8TO32(m+ 9) >> 6) & 0x3ffffff;
wolfSSL 7:481bce714567 235 h4 += (U8TO32(m+12) >> 8) | hibit;
wolfSSL 7:481bce714567 236
wolfSSL 7:481bce714567 237 /* h *= r */
wolfSSL 7:481bce714567 238 d0 = ((word64)h0 * r0) + ((word64)h1 * s4) + ((word64)h2 * s3) +
wolfSSL 7:481bce714567 239 ((word64)h3 * s2) + ((word64)h4 * s1);
wolfSSL 7:481bce714567 240 d1 = ((word64)h0 * r1) + ((word64)h1 * r0) + ((word64)h2 * s4) +
wolfSSL 7:481bce714567 241 ((word64)h3 * s3) + ((word64)h4 * s2);
wolfSSL 7:481bce714567 242 d2 = ((word64)h0 * r2) + ((word64)h1 * r1) + ((word64)h2 * r0) +
wolfSSL 7:481bce714567 243 ((word64)h3 * s4) + ((word64)h4 * s3);
wolfSSL 7:481bce714567 244 d3 = ((word64)h0 * r3) + ((word64)h1 * r2) + ((word64)h2 * r1) +
wolfSSL 7:481bce714567 245 ((word64)h3 * r0) + ((word64)h4 * s4);
wolfSSL 7:481bce714567 246 d4 = ((word64)h0 * r4) + ((word64)h1 * r3) + ((word64)h2 * r2) +
wolfSSL 7:481bce714567 247 ((word64)h3 * r1) + ((word64)h4 * r0);
wolfSSL 7:481bce714567 248
wolfSSL 7:481bce714567 249 /* (partial) h %= p */
wolfSSL 7:481bce714567 250 c = (word32)(d0 >> 26); h0 = (word32)d0 & 0x3ffffff;
wolfSSL 7:481bce714567 251 d1 += c; c = (word32)(d1 >> 26); h1 = (word32)d1 & 0x3ffffff;
wolfSSL 7:481bce714567 252 d2 += c; c = (word32)(d2 >> 26); h2 = (word32)d2 & 0x3ffffff;
wolfSSL 7:481bce714567 253 d3 += c; c = (word32)(d3 >> 26); h3 = (word32)d3 & 0x3ffffff;
wolfSSL 7:481bce714567 254 d4 += c; c = (word32)(d4 >> 26); h4 = (word32)d4 & 0x3ffffff;
wolfSSL 7:481bce714567 255 h0 += c * 5; c = (h0 >> 26); h0 = h0 & 0x3ffffff;
wolfSSL 7:481bce714567 256 h1 += c;
wolfSSL 7:481bce714567 257
wolfSSL 7:481bce714567 258 m += POLY1305_BLOCK_SIZE;
wolfSSL 7:481bce714567 259 bytes -= POLY1305_BLOCK_SIZE;
wolfSSL 7:481bce714567 260 }
wolfSSL 7:481bce714567 261
wolfSSL 7:481bce714567 262 ctx->h[0] = h0;
wolfSSL 7:481bce714567 263 ctx->h[1] = h1;
wolfSSL 7:481bce714567 264 ctx->h[2] = h2;
wolfSSL 7:481bce714567 265 ctx->h[3] = h3;
wolfSSL 7:481bce714567 266 ctx->h[4] = h4;
wolfSSL 7:481bce714567 267
wolfSSL 7:481bce714567 268 #endif /* end of 64 bit cpu blocks or 32 bit cpu */
wolfSSL 7:481bce714567 269 }
wolfSSL 7:481bce714567 270
wolfSSL 7:481bce714567 271
wolfSSL 7:481bce714567 272 int wc_Poly1305SetKey(Poly1305* ctx, const byte* key, word32 keySz) {
wolfSSL 7:481bce714567 273
wolfSSL 7:481bce714567 274 #if defined(POLY130564)
wolfSSL 7:481bce714567 275 word64 t0,t1;
wolfSSL 7:481bce714567 276 #endif
wolfSSL 7:481bce714567 277
wolfSSL 7:481bce714567 278 #ifdef CHACHA_AEAD_TEST
wolfSSL 7:481bce714567 279 word32 k;
wolfSSL 7:481bce714567 280 printf("Poly key used:\n");
wolfSSL 7:481bce714567 281 for (k = 0; k < keySz; k++) {
wolfSSL 7:481bce714567 282 printf("%02x", key[k]);
wolfSSL 7:481bce714567 283 if ((k+1) % 8 == 0)
wolfSSL 7:481bce714567 284 printf("\n");
wolfSSL 7:481bce714567 285 }
wolfSSL 7:481bce714567 286 printf("\n");
wolfSSL 7:481bce714567 287 #endif
wolfSSL 7:481bce714567 288
wolfSSL 7:481bce714567 289 if (keySz != 32 || ctx == NULL)
wolfSSL 7:481bce714567 290 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 291
wolfSSL 7:481bce714567 292 #if defined(POLY130564)
wolfSSL 7:481bce714567 293
wolfSSL 7:481bce714567 294 /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
wolfSSL 7:481bce714567 295 t0 = U8TO64(key + 0);
wolfSSL 7:481bce714567 296 t1 = U8TO64(key + 8);
wolfSSL 7:481bce714567 297
wolfSSL 7:481bce714567 298 ctx->r[0] = ( t0 ) & 0xffc0fffffff;
wolfSSL 7:481bce714567 299 ctx->r[1] = ((t0 >> 44) | (t1 << 20)) & 0xfffffc0ffff;
wolfSSL 7:481bce714567 300 ctx->r[2] = ((t1 >> 24) ) & 0x00ffffffc0f;
wolfSSL 7:481bce714567 301
wolfSSL 7:481bce714567 302 /* h (accumulator) = 0 */
wolfSSL 7:481bce714567 303 ctx->h[0] = 0;
wolfSSL 7:481bce714567 304 ctx->h[1] = 0;
wolfSSL 7:481bce714567 305 ctx->h[2] = 0;
wolfSSL 7:481bce714567 306
wolfSSL 7:481bce714567 307 /* save pad for later */
wolfSSL 7:481bce714567 308 ctx->pad[0] = U8TO64(key + 16);
wolfSSL 7:481bce714567 309 ctx->pad[1] = U8TO64(key + 24);
wolfSSL 7:481bce714567 310
wolfSSL 7:481bce714567 311 #else /* if not 64 bit then use 32 bit */
wolfSSL 7:481bce714567 312
wolfSSL 7:481bce714567 313 /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
wolfSSL 7:481bce714567 314 ctx->r[0] = (U8TO32(key + 0) ) & 0x3ffffff;
wolfSSL 7:481bce714567 315 ctx->r[1] = (U8TO32(key + 3) >> 2) & 0x3ffff03;
wolfSSL 7:481bce714567 316 ctx->r[2] = (U8TO32(key + 6) >> 4) & 0x3ffc0ff;
wolfSSL 7:481bce714567 317 ctx->r[3] = (U8TO32(key + 9) >> 6) & 0x3f03fff;
wolfSSL 7:481bce714567 318 ctx->r[4] = (U8TO32(key + 12) >> 8) & 0x00fffff;
wolfSSL 7:481bce714567 319
wolfSSL 7:481bce714567 320 /* h = 0 */
wolfSSL 7:481bce714567 321 ctx->h[0] = 0;
wolfSSL 7:481bce714567 322 ctx->h[1] = 0;
wolfSSL 7:481bce714567 323 ctx->h[2] = 0;
wolfSSL 7:481bce714567 324 ctx->h[3] = 0;
wolfSSL 7:481bce714567 325 ctx->h[4] = 0;
wolfSSL 7:481bce714567 326
wolfSSL 7:481bce714567 327 /* save pad for later */
wolfSSL 7:481bce714567 328 ctx->pad[0] = U8TO32(key + 16);
wolfSSL 7:481bce714567 329 ctx->pad[1] = U8TO32(key + 20);
wolfSSL 7:481bce714567 330 ctx->pad[2] = U8TO32(key + 24);
wolfSSL 7:481bce714567 331 ctx->pad[3] = U8TO32(key + 28);
wolfSSL 7:481bce714567 332
wolfSSL 7:481bce714567 333 #endif
wolfSSL 7:481bce714567 334
wolfSSL 7:481bce714567 335 ctx->leftover = 0;
wolfSSL 7:481bce714567 336 ctx->final = 0;
wolfSSL 7:481bce714567 337
wolfSSL 7:481bce714567 338 return 0;
wolfSSL 7:481bce714567 339 }
wolfSSL 7:481bce714567 340
wolfSSL 7:481bce714567 341
wolfSSL 7:481bce714567 342 int wc_Poly1305Final(Poly1305* ctx, byte* mac) {
wolfSSL 7:481bce714567 343
wolfSSL 7:481bce714567 344 #if defined(POLY130564)
wolfSSL 7:481bce714567 345
wolfSSL 7:481bce714567 346 word64 h0,h1,h2,c;
wolfSSL 7:481bce714567 347 word64 g0,g1,g2;
wolfSSL 7:481bce714567 348 word64 t0,t1;
wolfSSL 7:481bce714567 349
wolfSSL 7:481bce714567 350 #else
wolfSSL 7:481bce714567 351
wolfSSL 7:481bce714567 352 word32 h0,h1,h2,h3,h4,c;
wolfSSL 7:481bce714567 353 word32 g0,g1,g2,g3,g4;
wolfSSL 7:481bce714567 354 word64 f;
wolfSSL 7:481bce714567 355 word32 mask;
wolfSSL 7:481bce714567 356
wolfSSL 7:481bce714567 357 #endif
wolfSSL 7:481bce714567 358
wolfSSL 7:481bce714567 359 if (ctx == NULL)
wolfSSL 7:481bce714567 360 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 361
wolfSSL 7:481bce714567 362 #if defined(POLY130564)
wolfSSL 7:481bce714567 363
wolfSSL 7:481bce714567 364 /* process the remaining block */
wolfSSL 7:481bce714567 365 if (ctx->leftover) {
wolfSSL 7:481bce714567 366 size_t i = ctx->leftover;
wolfSSL 7:481bce714567 367 ctx->buffer[i] = 1;
wolfSSL 7:481bce714567 368 for (i = i + 1; i < POLY1305_BLOCK_SIZE; i++)
wolfSSL 7:481bce714567 369 ctx->buffer[i] = 0;
wolfSSL 7:481bce714567 370 ctx->final = 1;
wolfSSL 7:481bce714567 371 poly1305_blocks(ctx, ctx->buffer, POLY1305_BLOCK_SIZE);
wolfSSL 7:481bce714567 372 }
wolfSSL 7:481bce714567 373
wolfSSL 7:481bce714567 374 /* fully carry h */
wolfSSL 7:481bce714567 375 h0 = ctx->h[0];
wolfSSL 7:481bce714567 376 h1 = ctx->h[1];
wolfSSL 7:481bce714567 377 h2 = ctx->h[2];
wolfSSL 7:481bce714567 378
wolfSSL 7:481bce714567 379 c = (h1 >> 44); h1 &= 0xfffffffffff;
wolfSSL 7:481bce714567 380 h2 += c; c = (h2 >> 42); h2 &= 0x3ffffffffff;
wolfSSL 7:481bce714567 381 h0 += c * 5; c = (h0 >> 44); h0 &= 0xfffffffffff;
wolfSSL 7:481bce714567 382 h1 += c; c = (h1 >> 44); h1 &= 0xfffffffffff;
wolfSSL 7:481bce714567 383 h2 += c; c = (h2 >> 42); h2 &= 0x3ffffffffff;
wolfSSL 7:481bce714567 384 h0 += c * 5; c = (h0 >> 44); h0 &= 0xfffffffffff;
wolfSSL 7:481bce714567 385 h1 += c;
wolfSSL 7:481bce714567 386
wolfSSL 7:481bce714567 387 /* compute h + -p */
wolfSSL 7:481bce714567 388 g0 = h0 + 5; c = (g0 >> 44); g0 &= 0xfffffffffff;
wolfSSL 7:481bce714567 389 g1 = h1 + c; c = (g1 >> 44); g1 &= 0xfffffffffff;
wolfSSL 7:481bce714567 390 g2 = h2 + c - ((word64)1 << 42);
wolfSSL 7:481bce714567 391
wolfSSL 7:481bce714567 392 /* select h if h < p, or h + -p if h >= p */
wolfSSL 7:481bce714567 393 c = (g2 >> ((sizeof(word64) * 8) - 1)) - 1;
wolfSSL 7:481bce714567 394 g0 &= c;
wolfSSL 7:481bce714567 395 g1 &= c;
wolfSSL 7:481bce714567 396 g2 &= c;
wolfSSL 7:481bce714567 397 c = ~c;
wolfSSL 7:481bce714567 398 h0 = (h0 & c) | g0;
wolfSSL 7:481bce714567 399 h1 = (h1 & c) | g1;
wolfSSL 7:481bce714567 400 h2 = (h2 & c) | g2;
wolfSSL 7:481bce714567 401
wolfSSL 7:481bce714567 402 /* h = (h + pad) */
wolfSSL 7:481bce714567 403 t0 = ctx->pad[0];
wolfSSL 7:481bce714567 404 t1 = ctx->pad[1];
wolfSSL 7:481bce714567 405
wolfSSL 7:481bce714567 406 h0 += (( t0 ) & 0xfffffffffff) ;
wolfSSL 7:481bce714567 407 c = (h0 >> 44); h0 &= 0xfffffffffff;
wolfSSL 7:481bce714567 408 h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff) + c;
wolfSSL 7:481bce714567 409 c = (h1 >> 44); h1 &= 0xfffffffffff;
wolfSSL 7:481bce714567 410 h2 += (((t1 >> 24) ) & 0x3ffffffffff) + c;
wolfSSL 7:481bce714567 411 h2 &= 0x3ffffffffff;
wolfSSL 7:481bce714567 412
wolfSSL 7:481bce714567 413 /* mac = h % (2^128) */
wolfSSL 7:481bce714567 414 h0 = ((h0 ) | (h1 << 44));
wolfSSL 7:481bce714567 415 h1 = ((h1 >> 20) | (h2 << 24));
wolfSSL 7:481bce714567 416
wolfSSL 7:481bce714567 417 U64TO8(mac + 0, h0);
wolfSSL 7:481bce714567 418 U64TO8(mac + 8, h1);
wolfSSL 7:481bce714567 419
wolfSSL 7:481bce714567 420 /* zero out the state */
wolfSSL 7:481bce714567 421 ctx->h[0] = 0;
wolfSSL 7:481bce714567 422 ctx->h[1] = 0;
wolfSSL 7:481bce714567 423 ctx->h[2] = 0;
wolfSSL 7:481bce714567 424 ctx->r[0] = 0;
wolfSSL 7:481bce714567 425 ctx->r[1] = 0;
wolfSSL 7:481bce714567 426 ctx->r[2] = 0;
wolfSSL 7:481bce714567 427 ctx->pad[0] = 0;
wolfSSL 7:481bce714567 428 ctx->pad[1] = 0;
wolfSSL 7:481bce714567 429
wolfSSL 7:481bce714567 430 #else /* if not 64 bit then use 32 bit */
wolfSSL 7:481bce714567 431
wolfSSL 7:481bce714567 432 /* process the remaining block */
wolfSSL 7:481bce714567 433 if (ctx->leftover) {
wolfSSL 7:481bce714567 434 size_t i = ctx->leftover;
wolfSSL 7:481bce714567 435 ctx->buffer[i++] = 1;
wolfSSL 7:481bce714567 436 for (; i < POLY1305_BLOCK_SIZE; i++)
wolfSSL 7:481bce714567 437 ctx->buffer[i] = 0;
wolfSSL 7:481bce714567 438 ctx->final = 1;
wolfSSL 7:481bce714567 439 poly1305_blocks(ctx, ctx->buffer, POLY1305_BLOCK_SIZE);
wolfSSL 7:481bce714567 440 }
wolfSSL 7:481bce714567 441
wolfSSL 7:481bce714567 442 /* fully carry h */
wolfSSL 7:481bce714567 443 h0 = ctx->h[0];
wolfSSL 7:481bce714567 444 h1 = ctx->h[1];
wolfSSL 7:481bce714567 445 h2 = ctx->h[2];
wolfSSL 7:481bce714567 446 h3 = ctx->h[3];
wolfSSL 7:481bce714567 447 h4 = ctx->h[4];
wolfSSL 7:481bce714567 448
wolfSSL 7:481bce714567 449 c = h1 >> 26; h1 = h1 & 0x3ffffff;
wolfSSL 7:481bce714567 450 h2 += c; c = h2 >> 26; h2 = h2 & 0x3ffffff;
wolfSSL 7:481bce714567 451 h3 += c; c = h3 >> 26; h3 = h3 & 0x3ffffff;
wolfSSL 7:481bce714567 452 h4 += c; c = h4 >> 26; h4 = h4 & 0x3ffffff;
wolfSSL 7:481bce714567 453 h0 += c * 5; c = h0 >> 26; h0 = h0 & 0x3ffffff;
wolfSSL 7:481bce714567 454 h1 += c;
wolfSSL 7:481bce714567 455
wolfSSL 7:481bce714567 456 /* compute h + -p */
wolfSSL 7:481bce714567 457 g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;
wolfSSL 7:481bce714567 458 g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;
wolfSSL 7:481bce714567 459 g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;
wolfSSL 7:481bce714567 460 g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;
wolfSSL 7:481bce714567 461 g4 = h4 + c - (1 << 26);
wolfSSL 7:481bce714567 462
wolfSSL 7:481bce714567 463 /* select h if h < p, or h + -p if h >= p */
wolfSSL 7:481bce714567 464 mask = (g4 >> ((sizeof(word32) * 8) - 1)) - 1;
wolfSSL 7:481bce714567 465 g0 &= mask;
wolfSSL 7:481bce714567 466 g1 &= mask;
wolfSSL 7:481bce714567 467 g2 &= mask;
wolfSSL 7:481bce714567 468 g3 &= mask;
wolfSSL 7:481bce714567 469 g4 &= mask;
wolfSSL 7:481bce714567 470 mask = ~mask;
wolfSSL 7:481bce714567 471 h0 = (h0 & mask) | g0;
wolfSSL 7:481bce714567 472 h1 = (h1 & mask) | g1;
wolfSSL 7:481bce714567 473 h2 = (h2 & mask) | g2;
wolfSSL 7:481bce714567 474 h3 = (h3 & mask) | g3;
wolfSSL 7:481bce714567 475 h4 = (h4 & mask) | g4;
wolfSSL 7:481bce714567 476
wolfSSL 7:481bce714567 477 /* h = h % (2^128) */
wolfSSL 7:481bce714567 478 h0 = ((h0 ) | (h1 << 26)) & 0xffffffff;
wolfSSL 7:481bce714567 479 h1 = ((h1 >> 6) | (h2 << 20)) & 0xffffffff;
wolfSSL 7:481bce714567 480 h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;
wolfSSL 7:481bce714567 481 h3 = ((h3 >> 18) | (h4 << 8)) & 0xffffffff;
wolfSSL 7:481bce714567 482
wolfSSL 7:481bce714567 483 /* mac = (h + pad) % (2^128) */
wolfSSL 7:481bce714567 484 f = (word64)h0 + ctx->pad[0] ; h0 = (word32)f;
wolfSSL 7:481bce714567 485 f = (word64)h1 + ctx->pad[1] + (f >> 32); h1 = (word32)f;
wolfSSL 7:481bce714567 486 f = (word64)h2 + ctx->pad[2] + (f >> 32); h2 = (word32)f;
wolfSSL 7:481bce714567 487 f = (word64)h3 + ctx->pad[3] + (f >> 32); h3 = (word32)f;
wolfSSL 7:481bce714567 488
wolfSSL 7:481bce714567 489 U32TO8(mac + 0, h0);
wolfSSL 7:481bce714567 490 U32TO8(mac + 4, h1);
wolfSSL 7:481bce714567 491 U32TO8(mac + 8, h2);
wolfSSL 7:481bce714567 492 U32TO8(mac + 12, h3);
wolfSSL 7:481bce714567 493
wolfSSL 7:481bce714567 494 /* zero out the state */
wolfSSL 7:481bce714567 495 ctx->h[0] = 0;
wolfSSL 7:481bce714567 496 ctx->h[1] = 0;
wolfSSL 7:481bce714567 497 ctx->h[2] = 0;
wolfSSL 7:481bce714567 498 ctx->h[3] = 0;
wolfSSL 7:481bce714567 499 ctx->h[4] = 0;
wolfSSL 7:481bce714567 500 ctx->r[0] = 0;
wolfSSL 7:481bce714567 501 ctx->r[1] = 0;
wolfSSL 7:481bce714567 502 ctx->r[2] = 0;
wolfSSL 7:481bce714567 503 ctx->r[3] = 0;
wolfSSL 7:481bce714567 504 ctx->r[4] = 0;
wolfSSL 7:481bce714567 505 ctx->pad[0] = 0;
wolfSSL 7:481bce714567 506 ctx->pad[1] = 0;
wolfSSL 7:481bce714567 507 ctx->pad[2] = 0;
wolfSSL 7:481bce714567 508 ctx->pad[3] = 0;
wolfSSL 7:481bce714567 509
wolfSSL 7:481bce714567 510 #endif
wolfSSL 7:481bce714567 511
wolfSSL 7:481bce714567 512 return 0;
wolfSSL 7:481bce714567 513 }
wolfSSL 7:481bce714567 514
wolfSSL 7:481bce714567 515
wolfSSL 7:481bce714567 516 int wc_Poly1305Update(Poly1305* ctx, const byte* m, word32 bytes) {
wolfSSL 7:481bce714567 517
wolfSSL 7:481bce714567 518 size_t i;
wolfSSL 7:481bce714567 519
wolfSSL 7:481bce714567 520 #ifdef CHACHA_AEAD_TEST
wolfSSL 7:481bce714567 521 word32 k;
wolfSSL 7:481bce714567 522 printf("Raw input to poly:\n");
wolfSSL 7:481bce714567 523 for (k = 0; k < bytes; k++) {
wolfSSL 7:481bce714567 524 printf("%02x", m[k]);
wolfSSL 7:481bce714567 525 if ((k+1) % 16 == 0)
wolfSSL 7:481bce714567 526 printf("\n");
wolfSSL 7:481bce714567 527 }
wolfSSL 7:481bce714567 528 printf("\n");
wolfSSL 7:481bce714567 529 #endif
wolfSSL 7:481bce714567 530
wolfSSL 7:481bce714567 531 if (ctx == NULL)
wolfSSL 7:481bce714567 532 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 533
wolfSSL 7:481bce714567 534 /* handle leftover */
wolfSSL 7:481bce714567 535 if (ctx->leftover) {
wolfSSL 7:481bce714567 536 size_t want = (POLY1305_BLOCK_SIZE - ctx->leftover);
wolfSSL 7:481bce714567 537 if (want > bytes)
wolfSSL 7:481bce714567 538 want = bytes;
wolfSSL 7:481bce714567 539 for (i = 0; i < want; i++)
wolfSSL 7:481bce714567 540 ctx->buffer[ctx->leftover + i] = m[i];
wolfSSL 7:481bce714567 541 bytes -= (word32)want;
wolfSSL 7:481bce714567 542 m += want;
wolfSSL 7:481bce714567 543 ctx->leftover += want;
wolfSSL 7:481bce714567 544 if (ctx->leftover < POLY1305_BLOCK_SIZE)
wolfSSL 7:481bce714567 545 return 0;
wolfSSL 7:481bce714567 546 poly1305_blocks(ctx, ctx->buffer, POLY1305_BLOCK_SIZE);
wolfSSL 7:481bce714567 547 ctx->leftover = 0;
wolfSSL 7:481bce714567 548 }
wolfSSL 7:481bce714567 549
wolfSSL 7:481bce714567 550 /* process full blocks */
wolfSSL 7:481bce714567 551 if (bytes >= POLY1305_BLOCK_SIZE) {
wolfSSL 7:481bce714567 552 size_t want = (bytes & ~(POLY1305_BLOCK_SIZE - 1));
wolfSSL 7:481bce714567 553 poly1305_blocks(ctx, m, want);
wolfSSL 7:481bce714567 554 m += want;
wolfSSL 7:481bce714567 555 bytes -= (word32)want;
wolfSSL 7:481bce714567 556 }
wolfSSL 7:481bce714567 557
wolfSSL 7:481bce714567 558 /* store leftover */
wolfSSL 7:481bce714567 559 if (bytes) {
wolfSSL 7:481bce714567 560 for (i = 0; i < bytes; i++)
wolfSSL 7:481bce714567 561 ctx->buffer[ctx->leftover + i] = m[i];
wolfSSL 7:481bce714567 562 ctx->leftover += bytes;
wolfSSL 7:481bce714567 563 }
wolfSSL 7:481bce714567 564 return 0;
wolfSSL 7:481bce714567 565 }
wolfSSL 7:481bce714567 566
wolfSSL 7:481bce714567 567
wolfSSL 7:481bce714567 568 /* Takes in an initialized Poly1305 struct that has a key loaded and creates
wolfSSL 7:481bce714567 569 a MAC (tag) using recent TLS AEAD padding scheme.
wolfSSL 7:481bce714567 570 ctx : Initialized Poly1305 struct to use
wolfSSL 7:481bce714567 571 additional : Additional data to use
wolfSSL 7:481bce714567 572 addSz : Size of additional buffer
wolfSSL 7:481bce714567 573 input : Input buffer to create tag from
wolfSSL 7:481bce714567 574 sz : Size of input buffer
wolfSSL 7:481bce714567 575 tag : Buffer to hold created tag
wolfSSL 7:481bce714567 576 tagSz : Size of input tag buffer (must be at least
wolfSSL 7:481bce714567 577 WC_POLY1305_MAC_SZ(16))
wolfSSL 7:481bce714567 578 */
wolfSSL 7:481bce714567 579 int wc_Poly1305_MAC(Poly1305* ctx, byte* additional, word32 addSz,
wolfSSL 7:481bce714567 580 byte* input, word32 sz, byte* tag, word32 tagSz)
wolfSSL 7:481bce714567 581 {
wolfSSL 7:481bce714567 582 int ret;
wolfSSL 7:481bce714567 583 byte padding[WC_POLY1305_PAD_SZ - 1];
wolfSSL 7:481bce714567 584 word32 paddingLen;
wolfSSL 7:481bce714567 585 byte little64[8];
wolfSSL 7:481bce714567 586
wolfSSL 7:481bce714567 587 XMEMSET(padding, 0, sizeof(padding));
wolfSSL 7:481bce714567 588
wolfSSL 7:481bce714567 589 /* sanity check on arguments */
wolfSSL 7:481bce714567 590 if (ctx == NULL || input == NULL || tag == NULL ||
wolfSSL 7:481bce714567 591 tagSz < WC_POLY1305_MAC_SZ) {
wolfSSL 7:481bce714567 592 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 593 }
wolfSSL 7:481bce714567 594
wolfSSL 7:481bce714567 595 if (additional == NULL && addSz > 0) {
wolfSSL 7:481bce714567 596 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 597 }
wolfSSL 7:481bce714567 598
wolfSSL 7:481bce714567 599 /* additional data plus padding */
wolfSSL 7:481bce714567 600 if ((ret = wc_Poly1305Update(ctx, additional, addSz)) != 0) {
wolfSSL 7:481bce714567 601 return ret;
wolfSSL 7:481bce714567 602 }
wolfSSL 7:481bce714567 603 paddingLen = -addSz & (WC_POLY1305_PAD_SZ - 1);
wolfSSL 7:481bce714567 604 if (paddingLen) {
wolfSSL 7:481bce714567 605 if ((ret = wc_Poly1305Update(ctx, padding, paddingLen)) != 0) {
wolfSSL 7:481bce714567 606 return ret;
wolfSSL 7:481bce714567 607 }
wolfSSL 7:481bce714567 608 }
wolfSSL 7:481bce714567 609
wolfSSL 7:481bce714567 610 /* input plus padding */
wolfSSL 7:481bce714567 611 if ((ret = wc_Poly1305Update(ctx, input, sz)) != 0) {
wolfSSL 7:481bce714567 612 return ret;
wolfSSL 7:481bce714567 613 }
wolfSSL 7:481bce714567 614 paddingLen = -sz & (WC_POLY1305_PAD_SZ - 1);
wolfSSL 7:481bce714567 615 if (paddingLen) {
wolfSSL 7:481bce714567 616 if ((ret = wc_Poly1305Update(ctx, padding, paddingLen)) != 0) {
wolfSSL 7:481bce714567 617 return ret;
wolfSSL 7:481bce714567 618 }
wolfSSL 7:481bce714567 619 }
wolfSSL 7:481bce714567 620
wolfSSL 7:481bce714567 621 /* size of additional data and input as little endian 64 bit types */
wolfSSL 7:481bce714567 622 U32TO64(addSz, little64);
wolfSSL 7:481bce714567 623 ret = wc_Poly1305Update(ctx, little64, sizeof(little64));
wolfSSL 7:481bce714567 624 if (ret)
wolfSSL 7:481bce714567 625 {
wolfSSL 7:481bce714567 626 return ret;
wolfSSL 7:481bce714567 627 }
wolfSSL 7:481bce714567 628
wolfSSL 7:481bce714567 629 U32TO64(sz, little64);
wolfSSL 7:481bce714567 630 ret = wc_Poly1305Update(ctx, little64, sizeof(little64));
wolfSSL 7:481bce714567 631 if (ret)
wolfSSL 7:481bce714567 632 {
wolfSSL 7:481bce714567 633 return ret;
wolfSSL 7:481bce714567 634 }
wolfSSL 7:481bce714567 635
wolfSSL 7:481bce714567 636 /* Finalize the auth tag */
wolfSSL 7:481bce714567 637 ret = wc_Poly1305Final(ctx, tag);
wolfSSL 7:481bce714567 638
wolfSSL 7:481bce714567 639 return ret;
wolfSSL 7:481bce714567 640
wolfSSL 7:481bce714567 641 }
wolfSSL 7:481bce714567 642 #endif /* HAVE_POLY1305 */
wolfSSL 7:481bce714567 643
wolfSSL 7:481bce714567 644