wolf SSL / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more

wolfcrypt/src/poly1305.c@13:f67a6c6013ca, 2017-08-22 (annotated)

Committer:
wolfSSL
Date:
Tue Aug 22 10:48:22 2017 +0000
Revision:
13:f67a6c6013ca
Parent:
11:cee25a834751 
wolfSSL3.12.0 with TLS1.3

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 11:cee25a834751 1 /* poly1305.c
wolfSSL 11:cee25a834751 2 *
wolfSSL 11:cee25a834751 3 * Copyright (C) 2006-2016 wolfSSL Inc.
wolfSSL 11:cee25a834751 4 *
wolfSSL 11:cee25a834751 5 * This file is part of wolfSSL.
wolfSSL 11:cee25a834751 6 *
wolfSSL 11:cee25a834751 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 11:cee25a834751 8 * it under the terms of the GNU General Public License as published by
wolfSSL 11:cee25a834751 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 11:cee25a834751 10 * (at your option) any later version.
wolfSSL 11:cee25a834751 11 *
wolfSSL 11:cee25a834751 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 11:cee25a834751 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 11:cee25a834751 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 11:cee25a834751 15 * GNU General Public License for more details.
wolfSSL 11:cee25a834751 16 *
wolfSSL 11:cee25a834751 17 * You should have received a copy of the GNU General Public License
wolfSSL 11:cee25a834751 18 * along with this program; if not, write to the Free Software
wolfSSL 11:cee25a834751 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 11:cee25a834751 20 */
wolfSSL 11:cee25a834751 21
wolfSSL 11:cee25a834751 22 /*
wolfSSL 11:cee25a834751 23 * Based off the public domain implementations by Andrew Moon
wolfSSL 11:cee25a834751 24 * and Daniel J. Bernstein
wolfSSL 11:cee25a834751 25 */
wolfSSL 11:cee25a834751 26
wolfSSL 11:cee25a834751 27 #ifdef HAVE_CONFIG_H
wolfSSL 11:cee25a834751 28 #include <config.h>
wolfSSL 11:cee25a834751 29 #endif
wolfSSL 11:cee25a834751 30
wolfSSL 11:cee25a834751 31 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 11:cee25a834751 32
wolfSSL 11:cee25a834751 33 #ifdef HAVE_POLY1305
wolfSSL 11:cee25a834751 34 #include <wolfssl/wolfcrypt/poly1305.h>
wolfSSL 11:cee25a834751 35 #include <wolfssl/wolfcrypt/error-crypt.h>
wolfSSL 11:cee25a834751 36 #include <wolfssl/wolfcrypt/logging.h>
wolfSSL 11:cee25a834751 37 #ifdef NO_INLINE
wolfSSL 11:cee25a834751 38 #include <wolfssl/wolfcrypt/misc.h>
wolfSSL 11:cee25a834751 39 #else
wolfSSL 11:cee25a834751 40 #define WOLFSSL_MISC_INCLUDED
wolfSSL 11:cee25a834751 41 #include <wolfcrypt/src/misc.c>
wolfSSL 11:cee25a834751 42 #endif
wolfSSL 11:cee25a834751 43 #ifdef CHACHA_AEAD_TEST
wolfSSL 11:cee25a834751 44 #include <stdio.h>
wolfSSL 11:cee25a834751 45 #endif
wolfSSL 11:cee25a834751 46
wolfSSL 11:cee25a834751 47 #ifdef _MSC_VER
wolfSSL 11:cee25a834751 48 /* 4127 warning constant while(1) */
wolfSSL 11:cee25a834751 49 #pragma warning(disable: 4127)
wolfSSL 11:cee25a834751 50 #endif
wolfSSL 11:cee25a834751 51
wolfSSL 11:cee25a834751 52 #if defined(POLY130564)
wolfSSL 11:cee25a834751 53
wolfSSL 11:cee25a834751 54 #if defined(_MSC_VER)
wolfSSL 11:cee25a834751 55 #define POLY1305_NOINLINE __declspec(noinline)
wolfSSL 11:cee25a834751 56 #elif defined(__GNUC__)
wolfSSL 11:cee25a834751 57 #define POLY1305_NOINLINE __attribute__((noinline))
wolfSSL 11:cee25a834751 58 #else
wolfSSL 11:cee25a834751 59 #define POLY1305_NOINLINE
wolfSSL 11:cee25a834751 60 #endif
wolfSSL 11:cee25a834751 61
wolfSSL 11:cee25a834751 62 #if defined(_MSC_VER)
wolfSSL 11:cee25a834751 63 #include <intrin.h>
wolfSSL 11:cee25a834751 64
wolfSSL 11:cee25a834751 65 typedef struct word128 {
wolfSSL 11:cee25a834751 66 word64 lo;
wolfSSL 11:cee25a834751 67 word64 hi;
wolfSSL 11:cee25a834751 68 } word128;
wolfSSL 11:cee25a834751 69
wolfSSL 11:cee25a834751 70 #define MUL(out, x, y) out.lo = _umul128((x), (y), &out.hi)
wolfSSL 11:cee25a834751 71 #define ADD(out, in) { word64 t = out.lo; out.lo += in.lo; \
wolfSSL 11:cee25a834751 72 out.hi += (out.lo < t) + in.hi; }
wolfSSL 11:cee25a834751 73 #define ADDLO(out, in) { word64 t = out.lo; out.lo += in; \
wolfSSL 11:cee25a834751 74 out.hi += (out.lo < t); }
wolfSSL 11:cee25a834751 75 #define SHR(in, shift) (__shiftright128(in.lo, in.hi, (shift)))
wolfSSL 11:cee25a834751 76 #define LO(in) (in.lo)
wolfSSL 11:cee25a834751 77
wolfSSL 11:cee25a834751 78 #elif defined(__GNUC__)
wolfSSL 11:cee25a834751 79 #if defined(__SIZEOF_INT128__)
wolfSSL 11:cee25a834751 80 typedef unsigned __int128 word128;
wolfSSL 11:cee25a834751 81 #else
wolfSSL 11:cee25a834751 82 typedef unsigned word128 __attribute__((mode(TI)));
wolfSSL 11:cee25a834751 83 #endif
wolfSSL 11:cee25a834751 84
wolfSSL 11:cee25a834751 85 #define MUL(out, x, y) out = ((word128)x * y)
wolfSSL 11:cee25a834751 86 #define ADD(out, in) out += in
wolfSSL 11:cee25a834751 87 #define ADDLO(out, in) out += in
wolfSSL 11:cee25a834751 88 #define SHR(in, shift) (word64)(in >> (shift))
wolfSSL 11:cee25a834751 89 #define LO(in) (word64)(in)
wolfSSL 11:cee25a834751 90 #endif
wolfSSL 11:cee25a834751 91
wolfSSL 11:cee25a834751 92 static word64 U8TO64(const byte* p) {
wolfSSL 11:cee25a834751 93 return
wolfSSL 11:cee25a834751 94 (((word64)(p[0] & 0xff) ) |
wolfSSL 11:cee25a834751 95 ((word64)(p[1] & 0xff) << 8) |
wolfSSL 11:cee25a834751 96 ((word64)(p[2] & 0xff) << 16) |
wolfSSL 11:cee25a834751 97 ((word64)(p[3] & 0xff) << 24) |
wolfSSL 11:cee25a834751 98 ((word64)(p[4] & 0xff) << 32) |
wolfSSL 11:cee25a834751 99 ((word64)(p[5] & 0xff) << 40) |
wolfSSL 11:cee25a834751 100 ((word64)(p[6] & 0xff) << 48) |
wolfSSL 11:cee25a834751 101 ((word64)(p[7] & 0xff) << 56));
wolfSSL 11:cee25a834751 102 }
wolfSSL 11:cee25a834751 103
wolfSSL 11:cee25a834751 104 static void U64TO8(byte* p, word64 v) {
wolfSSL 11:cee25a834751 105 p[0] = (v ) & 0xff;
wolfSSL 11:cee25a834751 106 p[1] = (v >> 8) & 0xff;
wolfSSL 11:cee25a834751 107 p[2] = (v >> 16) & 0xff;
wolfSSL 11:cee25a834751 108 p[3] = (v >> 24) & 0xff;
wolfSSL 11:cee25a834751 109 p[4] = (v >> 32) & 0xff;
wolfSSL 11:cee25a834751 110 p[5] = (v >> 40) & 0xff;
wolfSSL 11:cee25a834751 111 p[6] = (v >> 48) & 0xff;
wolfSSL 11:cee25a834751 112 p[7] = (v >> 56) & 0xff;
wolfSSL 11:cee25a834751 113 }
wolfSSL 11:cee25a834751 114
wolfSSL 11:cee25a834751 115 #else /* if not 64 bit then use 32 bit */
wolfSSL 11:cee25a834751 116
wolfSSL 11:cee25a834751 117 static word32 U8TO32(const byte *p) {
wolfSSL 11:cee25a834751 118 return
wolfSSL 11:cee25a834751 119 (((word32)(p[0] & 0xff) ) |
wolfSSL 11:cee25a834751 120 ((word32)(p[1] & 0xff) << 8) |
wolfSSL 11:cee25a834751 121 ((word32)(p[2] & 0xff) << 16) |
wolfSSL 11:cee25a834751 122 ((word32)(p[3] & 0xff) << 24));
wolfSSL 11:cee25a834751 123 }
wolfSSL 11:cee25a834751 124
wolfSSL 11:cee25a834751 125 static void U32TO8(byte *p, word32 v) {
wolfSSL 11:cee25a834751 126 p[0] = (v ) & 0xff;
wolfSSL 11:cee25a834751 127 p[1] = (v >> 8) & 0xff;
wolfSSL 11:cee25a834751 128 p[2] = (v >> 16) & 0xff;
wolfSSL 11:cee25a834751 129 p[3] = (v >> 24) & 0xff;
wolfSSL 11:cee25a834751 130 }
wolfSSL 11:cee25a834751 131 #endif
wolfSSL 11:cee25a834751 132
wolfSSL 11:cee25a834751 133
wolfSSL 11:cee25a834751 134 static void U32TO64(word32 v, byte* p) {
wolfSSL 11:cee25a834751 135 XMEMSET(p, 0, 8);
wolfSSL 11:cee25a834751 136 p[0] = (v & 0xFF);
wolfSSL 11:cee25a834751 137 p[1] = (v >> 8) & 0xFF;
wolfSSL 11:cee25a834751 138 p[2] = (v >> 16) & 0xFF;
wolfSSL 11:cee25a834751 139 p[3] = (v >> 24) & 0xFF;
wolfSSL 11:cee25a834751 140 }
wolfSSL 11:cee25a834751 141
wolfSSL 11:cee25a834751 142
wolfSSL 11:cee25a834751 143 static void poly1305_blocks(Poly1305* ctx, const unsigned char *m,
wolfSSL 11:cee25a834751 144 size_t bytes) {
wolfSSL 11:cee25a834751 145
wolfSSL 11:cee25a834751 146 #ifdef POLY130564
wolfSSL 11:cee25a834751 147
wolfSSL 11:cee25a834751 148 const word64 hibit = (ctx->final) ? 0 : ((word64)1 << 40); /* 1 << 128 */
wolfSSL 11:cee25a834751 149 word64 r0,r1,r2;
wolfSSL 11:cee25a834751 150 word64 s1,s2;
wolfSSL 11:cee25a834751 151 word64 h0,h1,h2;
wolfSSL 11:cee25a834751 152 word64 c;
wolfSSL 11:cee25a834751 153 word128 d0,d1,d2,d;
wolfSSL 11:cee25a834751 154
wolfSSL 11:cee25a834751 155 #else
wolfSSL 11:cee25a834751 156
wolfSSL 11:cee25a834751 157 const word32 hibit = (ctx->final) ? 0 : (1 << 24); /* 1 << 128 */
wolfSSL 11:cee25a834751 158 word32 r0,r1,r2,r3,r4;
wolfSSL 11:cee25a834751 159 word32 s1,s2,s3,s4;
wolfSSL 11:cee25a834751 160 word32 h0,h1,h2,h3,h4;
wolfSSL 11:cee25a834751 161 word64 d0,d1,d2,d3,d4;
wolfSSL 11:cee25a834751 162 word32 c;
wolfSSL 11:cee25a834751 163
wolfSSL 11:cee25a834751 164 #endif
wolfSSL 11:cee25a834751 165
wolfSSL 11:cee25a834751 166 #ifdef POLY130564
wolfSSL 11:cee25a834751 167
wolfSSL 11:cee25a834751 168 r0 = ctx->r[0];
wolfSSL 11:cee25a834751 169 r1 = ctx->r[1];
wolfSSL 11:cee25a834751 170 r2 = ctx->r[2];
wolfSSL 11:cee25a834751 171
wolfSSL 11:cee25a834751 172 h0 = ctx->h[0];
wolfSSL 11:cee25a834751 173 h1 = ctx->h[1];
wolfSSL 11:cee25a834751 174 h2 = ctx->h[2];
wolfSSL 11:cee25a834751 175
wolfSSL 11:cee25a834751 176 s1 = r1 * (5 << 2);
wolfSSL 11:cee25a834751 177 s2 = r2 * (5 << 2);
wolfSSL 11:cee25a834751 178
wolfSSL 11:cee25a834751 179 while (bytes >= POLY1305_BLOCK_SIZE) {
wolfSSL 11:cee25a834751 180 word64 t0,t1;
wolfSSL 11:cee25a834751 181
wolfSSL 11:cee25a834751 182 /* h += m[i] */
wolfSSL 11:cee25a834751 183 t0 = U8TO64(&m[0]);
wolfSSL 11:cee25a834751 184 t1 = U8TO64(&m[8]);
wolfSSL 11:cee25a834751 185
wolfSSL 11:cee25a834751 186 h0 += (( t0 ) & 0xfffffffffff);
wolfSSL 11:cee25a834751 187 h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff);
wolfSSL 11:cee25a834751 188 h2 += (((t1 >> 24) ) & 0x3ffffffffff) | hibit;
wolfSSL 11:cee25a834751 189
wolfSSL 11:cee25a834751 190 /* h *= r */
wolfSSL 11:cee25a834751 191 MUL(d0, h0, r0); MUL(d, h1, s2); ADD(d0, d); MUL(d, h2, s1); ADD(d0, d);
wolfSSL 11:cee25a834751 192 MUL(d1, h0, r1); MUL(d, h1, r0); ADD(d1, d); MUL(d, h2, s2); ADD(d1, d);
wolfSSL 11:cee25a834751 193 MUL(d2, h0, r2); MUL(d, h1, r1); ADD(d2, d); MUL(d, h2, r0); ADD(d2, d);
wolfSSL 11:cee25a834751 194
wolfSSL 11:cee25a834751 195 /* (partial) h %= p */
wolfSSL 11:cee25a834751 196 c = SHR(d0, 44); h0 = LO(d0) & 0xfffffffffff;
wolfSSL 11:cee25a834751 197 ADDLO(d1, c); c = SHR(d1, 44); h1 = LO(d1) & 0xfffffffffff;
wolfSSL 11:cee25a834751 198 ADDLO(d2, c); c = SHR(d2, 42); h2 = LO(d2) & 0x3ffffffffff;
wolfSSL 11:cee25a834751 199 h0 += c * 5; c = (h0 >> 44); h0 = h0 & 0xfffffffffff;
wolfSSL 11:cee25a834751 200 h1 += c;
wolfSSL 11:cee25a834751 201
wolfSSL 11:cee25a834751 202 m += POLY1305_BLOCK_SIZE;
wolfSSL 11:cee25a834751 203 bytes -= POLY1305_BLOCK_SIZE;
wolfSSL 11:cee25a834751 204 }
wolfSSL 11:cee25a834751 205
wolfSSL 11:cee25a834751 206 ctx->h[0] = h0;
wolfSSL 11:cee25a834751 207 ctx->h[1] = h1;
wolfSSL 11:cee25a834751 208 ctx->h[2] = h2;
wolfSSL 11:cee25a834751 209
wolfSSL 11:cee25a834751 210 #else /* if not 64 bit then use 32 bit */
wolfSSL 11:cee25a834751 211
wolfSSL 11:cee25a834751 212 r0 = ctx->r[0];
wolfSSL 11:cee25a834751 213 r1 = ctx->r[1];
wolfSSL 11:cee25a834751 214 r2 = ctx->r[2];
wolfSSL 11:cee25a834751 215 r3 = ctx->r[3];
wolfSSL 11:cee25a834751 216 r4 = ctx->r[4];
wolfSSL 11:cee25a834751 217
wolfSSL 11:cee25a834751 218 s1 = r1 * 5;
wolfSSL 11:cee25a834751 219 s2 = r2 * 5;
wolfSSL 11:cee25a834751 220 s3 = r3 * 5;
wolfSSL 11:cee25a834751 221 s4 = r4 * 5;
wolfSSL 11:cee25a834751 222
wolfSSL 11:cee25a834751 223 h0 = ctx->h[0];
wolfSSL 11:cee25a834751 224 h1 = ctx->h[1];
wolfSSL 11:cee25a834751 225 h2 = ctx->h[2];
wolfSSL 11:cee25a834751 226 h3 = ctx->h[3];
wolfSSL 11:cee25a834751 227 h4 = ctx->h[4];
wolfSSL 11:cee25a834751 228
wolfSSL 11:cee25a834751 229 while (bytes >= POLY1305_BLOCK_SIZE) {
wolfSSL 11:cee25a834751 230 /* h += m[i] */
wolfSSL 11:cee25a834751 231 h0 += (U8TO32(m+ 0) ) & 0x3ffffff;
wolfSSL 11:cee25a834751 232 h1 += (U8TO32(m+ 3) >> 2) & 0x3ffffff;
wolfSSL 11:cee25a834751 233 h2 += (U8TO32(m+ 6) >> 4) & 0x3ffffff;
wolfSSL 11:cee25a834751 234 h3 += (U8TO32(m+ 9) >> 6) & 0x3ffffff;
wolfSSL 11:cee25a834751 235 h4 += (U8TO32(m+12) >> 8) | hibit;
wolfSSL 11:cee25a834751 236
wolfSSL 11:cee25a834751 237 /* h *= r */
wolfSSL 11:cee25a834751 238 d0 = ((word64)h0 * r0) + ((word64)h1 * s4) + ((word64)h2 * s3) +
wolfSSL 11:cee25a834751 239 ((word64)h3 * s2) + ((word64)h4 * s1);
wolfSSL 11:cee25a834751 240 d1 = ((word64)h0 * r1) + ((word64)h1 * r0) + ((word64)h2 * s4) +
wolfSSL 11:cee25a834751 241 ((word64)h3 * s3) + ((word64)h4 * s2);
wolfSSL 11:cee25a834751 242 d2 = ((word64)h0 * r2) + ((word64)h1 * r1) + ((word64)h2 * r0) +
wolfSSL 11:cee25a834751 243 ((word64)h3 * s4) + ((word64)h4 * s3);
wolfSSL 11:cee25a834751 244 d3 = ((word64)h0 * r3) + ((word64)h1 * r2) + ((word64)h2 * r1) +
wolfSSL 11:cee25a834751 245 ((word64)h3 * r0) + ((word64)h4 * s4);
wolfSSL 11:cee25a834751 246 d4 = ((word64)h0 * r4) + ((word64)h1 * r3) + ((word64)h2 * r2) +
wolfSSL 11:cee25a834751 247 ((word64)h3 * r1) + ((word64)h4 * r0);
wolfSSL 11:cee25a834751 248
wolfSSL 11:cee25a834751 249 /* (partial) h %= p */
wolfSSL 11:cee25a834751 250 c = (word32)(d0 >> 26); h0 = (word32)d0 & 0x3ffffff;
wolfSSL 11:cee25a834751 251 d1 += c; c = (word32)(d1 >> 26); h1 = (word32)d1 & 0x3ffffff;
wolfSSL 11:cee25a834751 252 d2 += c; c = (word32)(d2 >> 26); h2 = (word32)d2 & 0x3ffffff;
wolfSSL 11:cee25a834751 253 d3 += c; c = (word32)(d3 >> 26); h3 = (word32)d3 & 0x3ffffff;
wolfSSL 11:cee25a834751 254 d4 += c; c = (word32)(d4 >> 26); h4 = (word32)d4 & 0x3ffffff;
wolfSSL 11:cee25a834751 255 h0 += c * 5; c = (h0 >> 26); h0 = h0 & 0x3ffffff;
wolfSSL 11:cee25a834751 256 h1 += c;
wolfSSL 11:cee25a834751 257
wolfSSL 11:cee25a834751 258 m += POLY1305_BLOCK_SIZE;
wolfSSL 11:cee25a834751 259 bytes -= POLY1305_BLOCK_SIZE;
wolfSSL 11:cee25a834751 260 }
wolfSSL 11:cee25a834751 261
wolfSSL 11:cee25a834751 262 ctx->h[0] = h0;
wolfSSL 11:cee25a834751 263 ctx->h[1] = h1;
wolfSSL 11:cee25a834751 264 ctx->h[2] = h2;
wolfSSL 11:cee25a834751 265 ctx->h[3] = h3;
wolfSSL 11:cee25a834751 266 ctx->h[4] = h4;
wolfSSL 11:cee25a834751 267
wolfSSL 11:cee25a834751 268 #endif /* end of 64 bit cpu blocks or 32 bit cpu */
wolfSSL 11:cee25a834751 269 }
wolfSSL 11:cee25a834751 270
wolfSSL 11:cee25a834751 271
wolfSSL 11:cee25a834751 272 int wc_Poly1305SetKey(Poly1305* ctx, const byte* key, word32 keySz) {
wolfSSL 11:cee25a834751 273
wolfSSL 11:cee25a834751 274 #if defined(POLY130564)
wolfSSL 11:cee25a834751 275 word64 t0,t1;
wolfSSL 11:cee25a834751 276 #endif
wolfSSL 11:cee25a834751 277
wolfSSL 11:cee25a834751 278 #ifdef CHACHA_AEAD_TEST
wolfSSL 11:cee25a834751 279 word32 k;
wolfSSL 11:cee25a834751 280 printf("Poly key used:\n");
wolfSSL 11:cee25a834751 281 for (k = 0; k < keySz; k++) {
wolfSSL 11:cee25a834751 282 printf("%02x", key[k]);
wolfSSL 11:cee25a834751 283 if ((k+1) % 8 == 0)
wolfSSL 11:cee25a834751 284 printf("\n");
wolfSSL 11:cee25a834751 285 }
wolfSSL 11:cee25a834751 286 printf("\n");
wolfSSL 11:cee25a834751 287 #endif
wolfSSL 11:cee25a834751 288
wolfSSL 11:cee25a834751 289 if (keySz != 32 || ctx == NULL)
wolfSSL 11:cee25a834751 290 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 291
wolfSSL 11:cee25a834751 292 #if defined(POLY130564)
wolfSSL 11:cee25a834751 293
wolfSSL 11:cee25a834751 294 /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
wolfSSL 11:cee25a834751 295 t0 = U8TO64(key + 0);
wolfSSL 11:cee25a834751 296 t1 = U8TO64(key + 8);
wolfSSL 11:cee25a834751 297
wolfSSL 11:cee25a834751 298 ctx->r[0] = ( t0 ) & 0xffc0fffffff;
wolfSSL 11:cee25a834751 299 ctx->r[1] = ((t0 >> 44) | (t1 << 20)) & 0xfffffc0ffff;
wolfSSL 11:cee25a834751 300 ctx->r[2] = ((t1 >> 24) ) & 0x00ffffffc0f;
wolfSSL 11:cee25a834751 301
wolfSSL 11:cee25a834751 302 /* h (accumulator) = 0 */
wolfSSL 11:cee25a834751 303 ctx->h[0] = 0;
wolfSSL 11:cee25a834751 304 ctx->h[1] = 0;
wolfSSL 11:cee25a834751 305 ctx->h[2] = 0;
wolfSSL 11:cee25a834751 306
wolfSSL 11:cee25a834751 307 /* save pad for later */
wolfSSL 11:cee25a834751 308 ctx->pad[0] = U8TO64(key + 16);
wolfSSL 11:cee25a834751 309 ctx->pad[1] = U8TO64(key + 24);
wolfSSL 11:cee25a834751 310
wolfSSL 11:cee25a834751 311 #else /* if not 64 bit then use 32 bit */
wolfSSL 11:cee25a834751 312
wolfSSL 11:cee25a834751 313 /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
wolfSSL 11:cee25a834751 314 ctx->r[0] = (U8TO32(key + 0) ) & 0x3ffffff;
wolfSSL 11:cee25a834751 315 ctx->r[1] = (U8TO32(key + 3) >> 2) & 0x3ffff03;
wolfSSL 11:cee25a834751 316 ctx->r[2] = (U8TO32(key + 6) >> 4) & 0x3ffc0ff;
wolfSSL 11:cee25a834751 317 ctx->r[3] = (U8TO32(key + 9) >> 6) & 0x3f03fff;
wolfSSL 11:cee25a834751 318 ctx->r[4] = (U8TO32(key + 12) >> 8) & 0x00fffff;
wolfSSL 11:cee25a834751 319
wolfSSL 11:cee25a834751 320 /* h = 0 */
wolfSSL 11:cee25a834751 321 ctx->h[0] = 0;
wolfSSL 11:cee25a834751 322 ctx->h[1] = 0;
wolfSSL 11:cee25a834751 323 ctx->h[2] = 0;
wolfSSL 11:cee25a834751 324 ctx->h[3] = 0;
wolfSSL 11:cee25a834751 325 ctx->h[4] = 0;
wolfSSL 11:cee25a834751 326
wolfSSL 11:cee25a834751 327 /* save pad for later */
wolfSSL 11:cee25a834751 328 ctx->pad[0] = U8TO32(key + 16);
wolfSSL 11:cee25a834751 329 ctx->pad[1] = U8TO32(key + 20);
wolfSSL 11:cee25a834751 330 ctx->pad[2] = U8TO32(key + 24);
wolfSSL 11:cee25a834751 331 ctx->pad[3] = U8TO32(key + 28);
wolfSSL 11:cee25a834751 332
wolfSSL 11:cee25a834751 333 #endif
wolfSSL 11:cee25a834751 334
wolfSSL 11:cee25a834751 335 ctx->leftover = 0;
wolfSSL 11:cee25a834751 336 ctx->final = 0;
wolfSSL 11:cee25a834751 337
wolfSSL 11:cee25a834751 338 return 0;
wolfSSL 11:cee25a834751 339 }
wolfSSL 11:cee25a834751 340
wolfSSL 11:cee25a834751 341
wolfSSL 11:cee25a834751 342 int wc_Poly1305Final(Poly1305* ctx, byte* mac) {
wolfSSL 11:cee25a834751 343
wolfSSL 11:cee25a834751 344 #if defined(POLY130564)
wolfSSL 11:cee25a834751 345
wolfSSL 11:cee25a834751 346 word64 h0,h1,h2,c;
wolfSSL 11:cee25a834751 347 word64 g0,g1,g2;
wolfSSL 11:cee25a834751 348 word64 t0,t1;
wolfSSL 11:cee25a834751 349
wolfSSL 11:cee25a834751 350 #else
wolfSSL 11:cee25a834751 351
wolfSSL 11:cee25a834751 352 word32 h0,h1,h2,h3,h4,c;
wolfSSL 11:cee25a834751 353 word32 g0,g1,g2,g3,g4;
wolfSSL 11:cee25a834751 354 word64 f;
wolfSSL 11:cee25a834751 355 word32 mask;
wolfSSL 11:cee25a834751 356
wolfSSL 11:cee25a834751 357 #endif
wolfSSL 11:cee25a834751 358
wolfSSL 11:cee25a834751 359 if (ctx == NULL)
wolfSSL 11:cee25a834751 360 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 361
wolfSSL 11:cee25a834751 362 #if defined(POLY130564)
wolfSSL 11:cee25a834751 363
wolfSSL 11:cee25a834751 364 /* process the remaining block */
wolfSSL 11:cee25a834751 365 if (ctx->leftover) {
wolfSSL 11:cee25a834751 366 size_t i = ctx->leftover;
wolfSSL 11:cee25a834751 367 ctx->buffer[i] = 1;
wolfSSL 11:cee25a834751 368 for (i = i + 1; i < POLY1305_BLOCK_SIZE; i++)
wolfSSL 11:cee25a834751 369 ctx->buffer[i] = 0;
wolfSSL 11:cee25a834751 370 ctx->final = 1;
wolfSSL 11:cee25a834751 371 poly1305_blocks(ctx, ctx->buffer, POLY1305_BLOCK_SIZE);
wolfSSL 11:cee25a834751 372 }
wolfSSL 11:cee25a834751 373
wolfSSL 11:cee25a834751 374 /* fully carry h */
wolfSSL 11:cee25a834751 375 h0 = ctx->h[0];
wolfSSL 11:cee25a834751 376 h1 = ctx->h[1];
wolfSSL 11:cee25a834751 377 h2 = ctx->h[2];
wolfSSL 11:cee25a834751 378
wolfSSL 11:cee25a834751 379 c = (h1 >> 44); h1 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 380 h2 += c; c = (h2 >> 42); h2 &= 0x3ffffffffff;
wolfSSL 11:cee25a834751 381 h0 += c * 5; c = (h0 >> 44); h0 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 382 h1 += c; c = (h1 >> 44); h1 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 383 h2 += c; c = (h2 >> 42); h2 &= 0x3ffffffffff;
wolfSSL 11:cee25a834751 384 h0 += c * 5; c = (h0 >> 44); h0 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 385 h1 += c;
wolfSSL 11:cee25a834751 386
wolfSSL 11:cee25a834751 387 /* compute h + -p */
wolfSSL 11:cee25a834751 388 g0 = h0 + 5; c = (g0 >> 44); g0 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 389 g1 = h1 + c; c = (g1 >> 44); g1 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 390 g2 = h2 + c - ((word64)1 << 42);
wolfSSL 11:cee25a834751 391
wolfSSL 11:cee25a834751 392 /* select h if h < p, or h + -p if h >= p */
wolfSSL 11:cee25a834751 393 c = (g2 >> ((sizeof(word64) * 8) - 1)) - 1;
wolfSSL 11:cee25a834751 394 g0 &= c;
wolfSSL 11:cee25a834751 395 g1 &= c;
wolfSSL 11:cee25a834751 396 g2 &= c;
wolfSSL 11:cee25a834751 397 c = ~c;
wolfSSL 11:cee25a834751 398 h0 = (h0 & c) | g0;
wolfSSL 11:cee25a834751 399 h1 = (h1 & c) | g1;
wolfSSL 11:cee25a834751 400 h2 = (h2 & c) | g2;
wolfSSL 11:cee25a834751 401
wolfSSL 11:cee25a834751 402 /* h = (h + pad) */
wolfSSL 11:cee25a834751 403 t0 = ctx->pad[0];
wolfSSL 11:cee25a834751 404 t1 = ctx->pad[1];
wolfSSL 11:cee25a834751 405
wolfSSL 11:cee25a834751 406 h0 += (( t0 ) & 0xfffffffffff) ;
wolfSSL 11:cee25a834751 407 c = (h0 >> 44); h0 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 408 h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff) + c;
wolfSSL 11:cee25a834751 409 c = (h1 >> 44); h1 &= 0xfffffffffff;
wolfSSL 11:cee25a834751 410 h2 += (((t1 >> 24) ) & 0x3ffffffffff) + c;
wolfSSL 11:cee25a834751 411 h2 &= 0x3ffffffffff;
wolfSSL 11:cee25a834751 412
wolfSSL 11:cee25a834751 413 /* mac = h % (2^128) */
wolfSSL 11:cee25a834751 414 h0 = ((h0 ) | (h1 << 44));
wolfSSL 11:cee25a834751 415 h1 = ((h1 >> 20) | (h2 << 24));
wolfSSL 11:cee25a834751 416
wolfSSL 11:cee25a834751 417 U64TO8(mac + 0, h0);
wolfSSL 11:cee25a834751 418 U64TO8(mac + 8, h1);
wolfSSL 11:cee25a834751 419
wolfSSL 11:cee25a834751 420 /* zero out the state */
wolfSSL 11:cee25a834751 421 ctx->h[0] = 0;
wolfSSL 11:cee25a834751 422 ctx->h[1] = 0;
wolfSSL 11:cee25a834751 423 ctx->h[2] = 0;
wolfSSL 11:cee25a834751 424 ctx->r[0] = 0;
wolfSSL 11:cee25a834751 425 ctx->r[1] = 0;
wolfSSL 11:cee25a834751 426 ctx->r[2] = 0;
wolfSSL 11:cee25a834751 427 ctx->pad[0] = 0;
wolfSSL 11:cee25a834751 428 ctx->pad[1] = 0;
wolfSSL 11:cee25a834751 429
wolfSSL 11:cee25a834751 430 #else /* if not 64 bit then use 32 bit */
wolfSSL 11:cee25a834751 431
wolfSSL 11:cee25a834751 432 /* process the remaining block */
wolfSSL 11:cee25a834751 433 if (ctx->leftover) {
wolfSSL 11:cee25a834751 434 size_t i = ctx->leftover;
wolfSSL 11:cee25a834751 435 ctx->buffer[i++] = 1;
wolfSSL 11:cee25a834751 436 for (; i < POLY1305_BLOCK_SIZE; i++)
wolfSSL 11:cee25a834751 437 ctx->buffer[i] = 0;
wolfSSL 11:cee25a834751 438 ctx->final = 1;
wolfSSL 11:cee25a834751 439 poly1305_blocks(ctx, ctx->buffer, POLY1305_BLOCK_SIZE);
wolfSSL 11:cee25a834751 440 }
wolfSSL 11:cee25a834751 441
wolfSSL 11:cee25a834751 442 /* fully carry h */
wolfSSL 11:cee25a834751 443 h0 = ctx->h[0];
wolfSSL 11:cee25a834751 444 h1 = ctx->h[1];
wolfSSL 11:cee25a834751 445 h2 = ctx->h[2];
wolfSSL 11:cee25a834751 446 h3 = ctx->h[3];
wolfSSL 11:cee25a834751 447 h4 = ctx->h[4];
wolfSSL 11:cee25a834751 448
wolfSSL 11:cee25a834751 449 c = h1 >> 26; h1 = h1 & 0x3ffffff;
wolfSSL 11:cee25a834751 450 h2 += c; c = h2 >> 26; h2 = h2 & 0x3ffffff;
wolfSSL 11:cee25a834751 451 h3 += c; c = h3 >> 26; h3 = h3 & 0x3ffffff;
wolfSSL 11:cee25a834751 452 h4 += c; c = h4 >> 26; h4 = h4 & 0x3ffffff;
wolfSSL 11:cee25a834751 453 h0 += c * 5; c = h0 >> 26; h0 = h0 & 0x3ffffff;
wolfSSL 11:cee25a834751 454 h1 += c;
wolfSSL 11:cee25a834751 455
wolfSSL 11:cee25a834751 456 /* compute h + -p */
wolfSSL 11:cee25a834751 457 g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;
wolfSSL 11:cee25a834751 458 g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;
wolfSSL 11:cee25a834751 459 g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;
wolfSSL 11:cee25a834751 460 g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;
wolfSSL 11:cee25a834751 461 g4 = h4 + c - (1 << 26);
wolfSSL 11:cee25a834751 462
wolfSSL 11:cee25a834751 463 /* select h if h < p, or h + -p if h >= p */
wolfSSL 11:cee25a834751 464 mask = (g4 >> ((sizeof(word32) * 8) - 1)) - 1;
wolfSSL 11:cee25a834751 465 g0 &= mask;
wolfSSL 11:cee25a834751 466 g1 &= mask;
wolfSSL 11:cee25a834751 467 g2 &= mask;
wolfSSL 11:cee25a834751 468 g3 &= mask;
wolfSSL 11:cee25a834751 469 g4 &= mask;
wolfSSL 11:cee25a834751 470 mask = ~mask;
wolfSSL 11:cee25a834751 471 h0 = (h0 & mask) | g0;
wolfSSL 11:cee25a834751 472 h1 = (h1 & mask) | g1;
wolfSSL 11:cee25a834751 473 h2 = (h2 & mask) | g2;
wolfSSL 11:cee25a834751 474 h3 = (h3 & mask) | g3;
wolfSSL 11:cee25a834751 475 h4 = (h4 & mask) | g4;
wolfSSL 11:cee25a834751 476
wolfSSL 11:cee25a834751 477 /* h = h % (2^128) */
wolfSSL 11:cee25a834751 478 h0 = ((h0 ) | (h1 << 26)) & 0xffffffff;
wolfSSL 11:cee25a834751 479 h1 = ((h1 >> 6) | (h2 << 20)) & 0xffffffff;
wolfSSL 11:cee25a834751 480 h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;
wolfSSL 11:cee25a834751 481 h3 = ((h3 >> 18) | (h4 << 8)) & 0xffffffff;
wolfSSL 11:cee25a834751 482
wolfSSL 11:cee25a834751 483 /* mac = (h + pad) % (2^128) */
wolfSSL 11:cee25a834751 484 f = (word64)h0 + ctx->pad[0] ; h0 = (word32)f;
wolfSSL 11:cee25a834751 485 f = (word64)h1 + ctx->pad[1] + (f >> 32); h1 = (word32)f;
wolfSSL 11:cee25a834751 486 f = (word64)h2 + ctx->pad[2] + (f >> 32); h2 = (word32)f;
wolfSSL 11:cee25a834751 487 f = (word64)h3 + ctx->pad[3] + (f >> 32); h3 = (word32)f;
wolfSSL 11:cee25a834751 488
wolfSSL 11:cee25a834751 489 U32TO8(mac + 0, h0);
wolfSSL 11:cee25a834751 490 U32TO8(mac + 4, h1);
wolfSSL 11:cee25a834751 491 U32TO8(mac + 8, h2);
wolfSSL 11:cee25a834751 492 U32TO8(mac + 12, h3);
wolfSSL 11:cee25a834751 493
wolfSSL 11:cee25a834751 494 /* zero out the state */
wolfSSL 11:cee25a834751 495 ctx->h[0] = 0;
wolfSSL 11:cee25a834751 496 ctx->h[1] = 0;
wolfSSL 11:cee25a834751 497 ctx->h[2] = 0;
wolfSSL 11:cee25a834751 498 ctx->h[3] = 0;
wolfSSL 11:cee25a834751 499 ctx->h[4] = 0;
wolfSSL 11:cee25a834751 500 ctx->r[0] = 0;
wolfSSL 11:cee25a834751 501 ctx->r[1] = 0;
wolfSSL 11:cee25a834751 502 ctx->r[2] = 0;
wolfSSL 11:cee25a834751 503 ctx->r[3] = 0;
wolfSSL 11:cee25a834751 504 ctx->r[4] = 0;
wolfSSL 11:cee25a834751 505 ctx->pad[0] = 0;
wolfSSL 11:cee25a834751 506 ctx->pad[1] = 0;
wolfSSL 11:cee25a834751 507 ctx->pad[2] = 0;
wolfSSL 11:cee25a834751 508 ctx->pad[3] = 0;
wolfSSL 11:cee25a834751 509
wolfSSL 11:cee25a834751 510 #endif
wolfSSL 11:cee25a834751 511
wolfSSL 11:cee25a834751 512 return 0;
wolfSSL 11:cee25a834751 513 }
wolfSSL 11:cee25a834751 514
wolfSSL 11:cee25a834751 515
wolfSSL 11:cee25a834751 516 int wc_Poly1305Update(Poly1305* ctx, const byte* m, word32 bytes) {
wolfSSL 11:cee25a834751 517
wolfSSL 11:cee25a834751 518 size_t i;
wolfSSL 11:cee25a834751 519
wolfSSL 11:cee25a834751 520 #ifdef CHACHA_AEAD_TEST
wolfSSL 11:cee25a834751 521 word32 k;
wolfSSL 11:cee25a834751 522 printf("Raw input to poly:\n");
wolfSSL 11:cee25a834751 523 for (k = 0; k < bytes; k++) {
wolfSSL 11:cee25a834751 524 printf("%02x", m[k]);
wolfSSL 11:cee25a834751 525 if ((k+1) % 16 == 0)
wolfSSL 11:cee25a834751 526 printf("\n");
wolfSSL 11:cee25a834751 527 }
wolfSSL 11:cee25a834751 528 printf("\n");
wolfSSL 11:cee25a834751 529 #endif
wolfSSL 11:cee25a834751 530
wolfSSL 11:cee25a834751 531 if (ctx == NULL)
wolfSSL 11:cee25a834751 532 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 533
wolfSSL 11:cee25a834751 534 /* handle leftover */
wolfSSL 11:cee25a834751 535 if (ctx->leftover) {
wolfSSL 11:cee25a834751 536 size_t want = (POLY1305_BLOCK_SIZE - ctx->leftover);
wolfSSL 11:cee25a834751 537 if (want > bytes)
wolfSSL 11:cee25a834751 538 want = bytes;
wolfSSL 11:cee25a834751 539 for (i = 0; i < want; i++)
wolfSSL 11:cee25a834751 540 ctx->buffer[ctx->leftover + i] = m[i];
wolfSSL 11:cee25a834751 541 bytes -= (word32)want;
wolfSSL 11:cee25a834751 542 m += want;
wolfSSL 11:cee25a834751 543 ctx->leftover += want;
wolfSSL 11:cee25a834751 544 if (ctx->leftover < POLY1305_BLOCK_SIZE)
wolfSSL 11:cee25a834751 545 return 0;
wolfSSL 11:cee25a834751 546 poly1305_blocks(ctx, ctx->buffer, POLY1305_BLOCK_SIZE);
wolfSSL 11:cee25a834751 547 ctx->leftover = 0;
wolfSSL 11:cee25a834751 548 }
wolfSSL 11:cee25a834751 549
wolfSSL 11:cee25a834751 550 /* process full blocks */
wolfSSL 11:cee25a834751 551 if (bytes >= POLY1305_BLOCK_SIZE) {
wolfSSL 11:cee25a834751 552 size_t want = (bytes & ~(POLY1305_BLOCK_SIZE - 1));
wolfSSL 11:cee25a834751 553 poly1305_blocks(ctx, m, want);
wolfSSL 11:cee25a834751 554 m += want;
wolfSSL 11:cee25a834751 555 bytes -= (word32)want;
wolfSSL 11:cee25a834751 556 }
wolfSSL 11:cee25a834751 557
wolfSSL 11:cee25a834751 558 /* store leftover */
wolfSSL 11:cee25a834751 559 if (bytes) {
wolfSSL 11:cee25a834751 560 for (i = 0; i < bytes; i++)
wolfSSL 11:cee25a834751 561 ctx->buffer[ctx->leftover + i] = m[i];
wolfSSL 11:cee25a834751 562 ctx->leftover += bytes;
wolfSSL 11:cee25a834751 563 }
wolfSSL 11:cee25a834751 564 return 0;
wolfSSL 11:cee25a834751 565 }
wolfSSL 11:cee25a834751 566
wolfSSL 11:cee25a834751 567
wolfSSL 11:cee25a834751 568 /* Takes in an initialized Poly1305 struct that has a key loaded and creates
wolfSSL 11:cee25a834751 569 a MAC (tag) using recent TLS AEAD padding scheme.
wolfSSL 11:cee25a834751 570 ctx : Initialized Poly1305 struct to use
wolfSSL 11:cee25a834751 571 additional : Additional data to use
wolfSSL 11:cee25a834751 572 addSz : Size of additional buffer
wolfSSL 11:cee25a834751 573 input : Input buffer to create tag from
wolfSSL 11:cee25a834751 574 sz : Size of input buffer
wolfSSL 11:cee25a834751 575 tag : Buffer to hold created tag
wolfSSL 11:cee25a834751 576 tagSz : Size of input tag buffer (must be at least
wolfSSL 11:cee25a834751 577 WC_POLY1305_MAC_SZ(16))
wolfSSL 11:cee25a834751 578 */
wolfSSL 11:cee25a834751 579 int wc_Poly1305_MAC(Poly1305* ctx, byte* additional, word32 addSz,
wolfSSL 11:cee25a834751 580 byte* input, word32 sz, byte* tag, word32 tagSz)
wolfSSL 11:cee25a834751 581 {
wolfSSL 11:cee25a834751 582 int ret;
wolfSSL 11:cee25a834751 583 byte padding[WC_POLY1305_PAD_SZ - 1];
wolfSSL 11:cee25a834751 584 word32 paddingLen;
wolfSSL 11:cee25a834751 585 byte little64[8];
wolfSSL 11:cee25a834751 586
wolfSSL 11:cee25a834751 587 XMEMSET(padding, 0, sizeof(padding));
wolfSSL 11:cee25a834751 588
wolfSSL 11:cee25a834751 589 /* sanity check on arguments */
wolfSSL 11:cee25a834751 590 if (ctx == NULL || input == NULL || tag == NULL ||
wolfSSL 11:cee25a834751 591 tagSz < WC_POLY1305_MAC_SZ) {
wolfSSL 11:cee25a834751 592 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 593 }
wolfSSL 11:cee25a834751 594
wolfSSL 11:cee25a834751 595 /* additional allowed to be 0 */
wolfSSL 11:cee25a834751 596 if (addSz > 0) {
wolfSSL 11:cee25a834751 597 if (additional == NULL)
wolfSSL 11:cee25a834751 598 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 599
wolfSSL 11:cee25a834751 600 /* additional data plus padding */
wolfSSL 11:cee25a834751 601 if ((ret = wc_Poly1305Update(ctx, additional, addSz)) != 0) {
wolfSSL 11:cee25a834751 602 return ret;
wolfSSL 11:cee25a834751 603 }
wolfSSL 11:cee25a834751 604 paddingLen = -((int)addSz) & (WC_POLY1305_PAD_SZ - 1);
wolfSSL 11:cee25a834751 605 if (paddingLen) {
wolfSSL 11:cee25a834751 606 if ((ret = wc_Poly1305Update(ctx, padding, paddingLen)) != 0) {
wolfSSL 11:cee25a834751 607 return ret;
wolfSSL 11:cee25a834751 608 }
wolfSSL 11:cee25a834751 609 }
wolfSSL 11:cee25a834751 610 }
wolfSSL 11:cee25a834751 611
wolfSSL 11:cee25a834751 612 /* input plus padding */
wolfSSL 11:cee25a834751 613 if ((ret = wc_Poly1305Update(ctx, input, sz)) != 0) {
wolfSSL 11:cee25a834751 614 return ret;
wolfSSL 11:cee25a834751 615 }
wolfSSL 11:cee25a834751 616 paddingLen = -((int)sz) & (WC_POLY1305_PAD_SZ - 1);
wolfSSL 11:cee25a834751 617 if (paddingLen) {
wolfSSL 11:cee25a834751 618 if ((ret = wc_Poly1305Update(ctx, padding, paddingLen)) != 0) {
wolfSSL 11:cee25a834751 619 return ret;
wolfSSL 11:cee25a834751 620 }
wolfSSL 11:cee25a834751 621 }
wolfSSL 11:cee25a834751 622
wolfSSL 11:cee25a834751 623 /* size of additional data and input as little endian 64 bit types */
wolfSSL 11:cee25a834751 624 U32TO64(addSz, little64);
wolfSSL 11:cee25a834751 625 ret = wc_Poly1305Update(ctx, little64, sizeof(little64));
wolfSSL 11:cee25a834751 626 if (ret)
wolfSSL 11:cee25a834751 627 {
wolfSSL 11:cee25a834751 628 return ret;
wolfSSL 11:cee25a834751 629 }
wolfSSL 11:cee25a834751 630
wolfSSL 11:cee25a834751 631 U32TO64(sz, little64);
wolfSSL 11:cee25a834751 632 ret = wc_Poly1305Update(ctx, little64, sizeof(little64));
wolfSSL 11:cee25a834751 633 if (ret)
wolfSSL 11:cee25a834751 634 {
wolfSSL 11:cee25a834751 635 return ret;
wolfSSL 11:cee25a834751 636 }
wolfSSL 11:cee25a834751 637
wolfSSL 11:cee25a834751 638 /* Finalize the auth tag */
wolfSSL 11:cee25a834751 639 ret = wc_Poly1305Final(ctx, tag);
wolfSSL 11:cee25a834751 640
wolfSSL 11:cee25a834751 641 return ret;
wolfSSL 11:cee25a834751 642
wolfSSL 11:cee25a834751 643 }
wolfSSL 11:cee25a834751 644 #endif /* HAVE_POLY1305 */
wolfSSL 11:cee25a834751 645
wolfSSL 11:cee25a834751 646