Fabcoin Core  0.16.2
P2P Digital Currency
poly1305.cpp
Go to the documentation of this file.
1 // poly1305.cpp - written and placed in the public domain by Jeffrey Walton and Jean-Pierre Munch
2 // Based on Andy Polyakov's Base-2^26 scalar multiplication implementation for OpenSSL.
3 // Copyright assigned to the Crypto++ project
4 
5 #include "pch.h"
6 #include "cryptlib.h"
7 #include "aes.h"
8 #include "cpu.h"
9 #include "poly1305.h"
10 
11 NAMESPACE_BEGIN(CryptoPP)
12 
13 #define CONSTANT_TIME_CARRY(a,b) ((a ^ ((a ^ b) | ((a - b) ^ b))) >> (sizeof(a) * 8 - 1))
14 
15 template <class T>
16 void Poly1305_Base<T>::UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
17 {
18  if (key && length)
19  {
20  // key is {k,r} pair, r is 16 bytes
21  length = SaturatingSubtract(length, (unsigned)BLOCKSIZE);
22  m_cipher.SetKey(key, length);
23  key += length;
24 
25  // Rbar is clamped and little endian
26  m_r[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 0) & 0x0fffffff;
27  m_r[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 4) & 0x0ffffffc;
28  m_r[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 8) & 0x0ffffffc;
29  m_r[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, key + 12) & 0x0ffffffc;
30 
31  m_used = false;
32  }
33 
34  ConstByteArrayParameter t;
35  if (params.GetValue(Name::IV(), t) && t.begin() && t.size())
36  {
37  SecByteBlock nk(16);
38  m_cipher.ProcessBlock(t.begin(), nk);
39 
40  m_n[0] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, nk + 0);
41  m_n[1] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, nk + 4);
42  m_n[2] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, nk + 8);
43  m_n[3] = GetWord<word32>(false, LITTLE_ENDIAN_ORDER, nk + 12);
44 
45  m_used = false;
46  }
47 
48  Restart();
49 }
50 
51 template <class T>
52 void Poly1305_Base<T>::Update(const byte *input, size_t length)
53 {
54  CRYPTOPP_ASSERT((input && length) || !length);
55  if (!length) return;
56 
57  size_t rem, num = m_idx;
58  if (num)
59  {
60  rem = BLOCKSIZE - num;
61  if (length >= rem)
62  {
63  // Process
64  memcpy_s(m_acc + num, BLOCKSIZE - num, input, rem);
65  HashBlocks(m_acc, BLOCKSIZE, 1);
66  input += rem;
67  length -= rem;
68  }
69  else
70  {
71  // Accumulate
72  memcpy_s(m_acc + num, BLOCKSIZE - num, input, length);
73  m_idx = num + length;
74  return;
75  }
76  }
77 
78  rem = length % BLOCKSIZE;
79  length -= rem;
80 
81  if (length >= BLOCKSIZE) {
82  HashBlocks(input, length, 1);
83  input += length;
84  }
85 
86  if (rem)
87  memcpy(m_acc, input, rem);
88 
89  m_idx = rem;
90 }
91 
92 template <class T>
93 void Poly1305_Base<T>::HashBlocks(const byte *input, size_t length, word32 padbit)
94 {
95  word32 r0, r1, r2, r3;
96  word32 s1, s2, s3;
97  word32 h0, h1, h2, h3, h4, c;
98  word64 d0, d1, d2, d3;
99 
100  r0 = m_r[0]; r1 = m_r[1];
101  r2 = m_r[2]; r3 = m_r[3];
102 
103  s1 = r1 + (r1 >> 2);
104  s2 = r2 + (r2 >> 2);
105  s3 = r3 + (r3 >> 2);
106 
107  h0 = m_h[0]; h1 = m_h[1]; h2 = m_h[2];
108  h3 = m_h[3]; h4 = m_h[4];
109 
110  while (length >= BLOCKSIZE)
111  {
112  // h += m[i]
113  h0 = (word32)(d0 = (word64)h0 + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 0));
114  h1 = (word32)(d1 = (word64)h1 + (d0 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 4));
115  h2 = (word32)(d2 = (word64)h2 + (d1 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 8));
116  h3 = (word32)(d3 = (word64)h3 + (d2 >> 32) + GetWord<word32>(false, LITTLE_ENDIAN_ORDER, input + 12));
117  h4 += (word32)(d3 >> 32) + padbit;
118 
119  // h *= r "%" p
120  d0 = ((word64)h0 * r0) +
121  ((word64)h1 * s3) +
122  ((word64)h2 * s2) +
123  ((word64)h3 * s1);
124  d1 = ((word64)h0 * r1) +
125  ((word64)h1 * r0) +
126  ((word64)h2 * s3) +
127  ((word64)h3 * s2) +
128  (h4 * s1);
129  d2 = ((word64)h0 * r2) +
130  ((word64)h1 * r1) +
131  ((word64)h2 * r0) +
132  ((word64)h3 * s3) +
133  (h4 * s2);
134  d3 = ((word64)h0 * r3) +
135  ((word64)h1 * r2) +
136  ((word64)h2 * r1) +
137  ((word64)h3 * r0) +
138  (h4 * s3);
139  h4 = (h4 * r0);
140 
141  // a) h4:h0 = h4<<128 + d3<<96 + d2<<64 + d1<<32 + d0
142  h0 = (word32)d0;
143  h1 = (word32)(d1 += d0 >> 32);
144  h2 = (word32)(d2 += d1 >> 32);
145  h3 = (word32)(d3 += d2 >> 32);
146  h4 += (word32)(d3 >> 32);
147 
148  // b) (h4:h0 += (h4:h0>>130) * 5) %= 2^130
149  c = (h4 >> 2) + (h4 & ~3U);
150  h4 &= 3;
151  h0 += c;
152  h1 += (c = CONSTANT_TIME_CARRY(h0,c));
153  h2 += (c = CONSTANT_TIME_CARRY(h1,c));
154  h3 += (c = CONSTANT_TIME_CARRY(h2,c));
155  h4 += CONSTANT_TIME_CARRY(h3,c);
156 
157  input += BLOCKSIZE;
158  length -= BLOCKSIZE;
159  }
160 
161  m_h[0] = h0; m_h[1] = h1; m_h[2] = h2;
162  m_h[3] = h3; m_h[4] = h4;
163 }
164 
165 template <class T>
166 void Poly1305_Base<T>::TruncatedFinal(byte *mac, size_t size)
167 {
168  CRYPTOPP_ASSERT(mac); // Pointer is valid
169  CRYPTOPP_ASSERT(!m_used); // Nonce is fresh
170 
171  ThrowIfInvalidTruncatedSize(size);
172 
173  size_t num = m_idx;
174  if (num)
175  {
176  m_acc[num++] = 1; /* pad bit */
177  while (num < BLOCKSIZE)
178  m_acc[num++] = 0;
179  HashBlocks(m_acc, BLOCKSIZE, 0);
180  }
181 
182  HashFinal(mac, size);
183 
184  // Restart
185  m_used = true;
186  Restart();
187 }
188 
189 template <class T>
190 void Poly1305_Base<T>::HashFinal(byte *mac, size_t size)
191 {
192  word32 h0, h1, h2, h3, h4;
193  word32 g0, g1, g2, g3, g4;
194  word32 mask;
195  word64 t;
196 
197  h0 = m_h[0];
198  h1 = m_h[1];
199  h2 = m_h[2];
200  h3 = m_h[3];
201  h4 = m_h[4];
202 
203  // compare to modulus by computing h + -p
204  g0 = (word32)(t = (word64)h0 + 5);
205  g1 = (word32)(t = (word64)h1 + (t >> 32));
206  g2 = (word32)(t = (word64)h2 + (t >> 32));
207  g3 = (word32)(t = (word64)h3 + (t >> 32));
208  g4 = h4 + (word32)(t >> 32);
209 
210  // if there was carry into 131st bit, h3:h0 = g3:g0
211  mask = 0 - (g4 >> 2);
212  g0 &= mask; g1 &= mask;
213  g2 &= mask; g3 &= mask;
214  mask = ~mask;
215  h0 = (h0 & mask) | g0; h1 = (h1 & mask) | g1;
216  h2 = (h2 & mask) | g2; h3 = (h3 & mask) | g3;
217 
218  // mac = (h + nonce) % (2^128)
219  h0 = (word32)(t = (word64)h0 + m_n[0]);
220  h1 = (word32)(t = (word64)h1 + (t >> 32) + m_n[1]);
221  h2 = (word32)(t = (word64)h2 + (t >> 32) + m_n[2]);
222  h3 = (word32)(t = (word64)h3 + (t >> 32) + m_n[3]);
223 
224  if (size >= BLOCKSIZE)
225  {
226  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 0, h0);
227  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 4, h1);
228  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 8, h2);
229  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, mac + 12, h3);
230  }
231  else
232  {
233  FixedSizeAlignedSecBlock<byte, BLOCKSIZE> m;
234  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 0, h0);
235  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 4, h1);
236  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 8, h2);
237  PutWord<word32>(false, LITTLE_ENDIAN_ORDER, m + 12, h3);
238  memcpy(mac, m, size);
239  }
240 }
241 
242 template <class T>
243 void Poly1305_Base<T>::Resynchronize(const byte *nonce, int nonceLength)
244 {
245  CRYPTOPP_ASSERT(nonceLength == -1 || nonceLength == (int)BLOCKSIZE);
246  nonceLength == -1 ? nonceLength = BLOCKSIZE : nonceLength;
247  this->UncheckedSetKey(NULL, 0, MakeParameters(Name::IV(), ConstByteArrayParameter(nonce, nonceLength)));
248 }
249 
250 template <class T>
251 void Poly1305_Base<T>::GetNextIV(RandomNumberGenerator &rng, byte *iv)
252 {
253  rng.GenerateBlock(iv, BLOCKSIZE);
254 }
255 
256 template <class T>
257 void Poly1305_Base<T>::Restart()
258 {
259  m_h[0] = m_h[1] = m_h[2] = m_h[3] = m_h[4] = 0;
260  // m_r[0] = m_r[1] = m_r[2] = m_r[3] = 0;
261  m_idx = 0;
262 }
263 
264 template class Poly1305<AES>;
265 
266 NAMESPACE_END
ConstByteArrayParameter
Used to pass byte array input as part of a NameValuePairs object.
Definition: algparam.h:29
g4
#define g4(tab, w)
Definition: skipjack.cpp:59
byte
uint8_t byte
Definition: Common.h:57
RandomNumberGenerator::GenerateBlock
virtual void GenerateBlock(byte *output, size_t size)
Generate random array of bytes.
Definition: cryptlib.cpp:326
h3
#define h3(tab, w)
Definition: skipjack.cpp:75
s2
static const std::string s2("AAD")
g1
#define g1(tab, w)
Definition: skipjack.cpp:56
NAMESPACE_BEGIN
#define NAMESPACE_BEGIN(x)
Definition: config.h:200
cryptlib.h
Abstract base classes that provide a uniform interface to this library.
memcpy_s
void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
Bounds checking replacement for memcpy()
Definition: misc.h:366
g3
#define g3(tab, w)
Definition: skipjack.cpp:58
Poly1305_Base::UncheckedSetKey
void UncheckedSetKey(const byte *key, unsigned int length, const NameValuePairs &params)
Sets the key for this object without performing parameter validation.
Definition: poly1305.cpp:16
ConstByteArrayParameter::size
size_t size() const
Length of the memory block.
Definition: algparam.h:93
c
#define c(i)
RandomNumberGenerator
Interface for random number generators.
Definition: cryptlib.h:1188
ConstByteArrayParameter::begin
const byte * begin() const
Pointer to the first byte in the memory block.
Definition: algparam.h:89
Poly1305_Base::HashFinal
void HashFinal(byte *mac, size_t length)
Definition: poly1305.cpp:190
LITTLE_ENDIAN_ORDER
byte order is little-endian
Definition: cryptlib.h:126
r1
#define r1(i)
NameValuePairs::GetValue
bool GetValue(const char *name, T &value) const
Get a named value.
Definition: cryptlib.h:337
Poly1305_Base::TruncatedFinal
void TruncatedFinal(byte *mac, size_t size)
Computes the hash of the current message.
Definition: poly1305.cpp:166
MakeParameters
AlgorithmParameters MakeParameters(const char *name, const T &value, bool throwIfNotUsed=true)
Create an object that implements NameValuePairs.
Definition: algparam.h:498
g0
#define g0(tab, w)
Definition: skipjack.cpp:55
aes.h
Class file for the AES cipher (Rijndael)
r2
#define r2(i)
h1
#define h1(tab, w)
Definition: skipjack.cpp:73
SaturatingSubtract
T1 SaturatingSubtract(const T1 &a, const T2 &b)
Performs a saturating subtract clamped at 0.
Definition: misc.h:847
word64
unsigned long long word64
Definition: config.h:240
Poly1305_Base::Resynchronize
void Resynchronize(const byte *iv, int ivLength=-1)
Resynchronize with an IV.
Definition: poly1305.cpp:243
Poly1305
Poly1305 message authentication code.
Definition: poly1305.h:147
Poly1305_Base::GetNextIV
void GetNextIV(RandomNumberGenerator &rng, byte *iv)
Retrieves a secure IV for the next message.
Definition: poly1305.cpp:251
CRYPTOPP_ASSERT
#define CRYPTOPP_ASSERT(exp)
Definition: trap.h:92
cpu.h
Functions for CPU features and intrinsics.
h0
#define h0(tab, w)
Definition: skipjack.cpp:72
size
uint8_t const size_t const size
Definition: sha3.h:20
memcpy
void * memcpy(void *a, const void *b, size_t c)
Definition: glibc_compat.cpp:17
Poly1305_Base::HashBlocks
void HashBlocks(const byte *input, size_t length, word32 padbit)
Definition: poly1305.cpp:93
NAMESPACE_END
#define NAMESPACE_END
Definition: config.h:201
poly1305.h
Classes for Poly1305 message authentication code.
g2
#define g2(tab, w)
Definition: skipjack.cpp:57
h2
#define h2(tab, w)
Definition: skipjack.cpp:74
word32
unsigned int word32
Definition: config.h:231
s1
#define s1(x)
Definition: sha256.c:70
CONSTANT_TIME_CARRY
#define CONSTANT_TIME_CARRY(a, b)
Definition: poly1305.cpp:13
h4
#define h4(tab, w)
Definition: skipjack.cpp:76
Poly1305_Base::Update
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: poly1305.cpp:52
Poly1305_Base::Restart
void Restart()
Restart the hash.
Definition: poly1305.cpp:257
NameValuePairs
Interface for retrieving values given their names.
Definition: cryptlib.h:279
Generated on Mon Oct 22 2018 15:15:32 for Fabcoin Core by   doxygen 1.8.11