Crypto++  8.2
Free C++ class library of cryptographic schemes
blake2.cpp
1 // blake2.cpp - written and placed in the public domain by Jeffrey Walton
2 // and Zooko Wilcox-O'Hearn. Based on Aumasson, Neves,
3 // Wilcox-O'Hearn and Winnerlein's reference BLAKE2
4 // implementation at http://github.com/BLAKE2/BLAKE2.
5 //
6 // The BLAKE2b and BLAKE2s numbers are consistent with the BLAKE2 team's
7 // numbers. However, we have an Altivec/POWER7 implementation of BLAKE2s,
8 // and a POWER8 implementation of BLAKE2b (BLAKE2 is missing them). The
9 // Altivec/POWER7 code is about 2x faster than C++ when using GCC 5.0 or
10 // above. The POWER8 code is about 2.5x faster than C++ when using GCC 5.0
11 // or above. If you use GCC 4.0 (PowerMac) or GCC 4.8 (GCC Compile Farm)
12 // then the PowerPC code will be slower than C++. Be sure to use GCC 5.0
13 // or above for PowerPC builds or disable Altivec for BLAKE2b and BLAKE2s
14 // if using the old compilers.
15 
16 #include "pch.h"
17 #include "config.h"
18 #include "cryptlib.h"
19 #include "argnames.h"
20 #include "algparam.h"
21 #include "blake2.h"
22 #include "cpu.h"
23 
24 // Uncomment for benchmarking C++ against SSE2 or NEON.
25 // Do so in both blake2.cpp and blake2-simd.cpp.
26 // #undef CRYPTOPP_SSE41_AVAILABLE
27 // #undef CRYPTOPP_ARM_NEON_AVAILABLE
28 // #undef CRYPTOPP_ALTIVEC_AVAILABLE
29 // #undef CRYPTOPP_POWER8_AVAILABLE
30 
31 // Disable NEON/ASIMD for Cortex-A53 and A57. The shifts are too slow and C/C++ is about
32 // 3 cpb faster than NEON/ASIMD. Also see http://github.com/weidai11/cryptopp/issues/367.
33 #if (defined(__aarch32__) || defined(__aarch64__)) && defined(CRYPTOPP_SLOW_ARMV8_SHIFT)
34 # undef CRYPTOPP_ARM_NEON_AVAILABLE
35 #endif
36 
37 // BLAKE2s bug on AIX 7.1 (POWER7) with XLC 12.01
38 // https://github.com/weidai11/cryptopp/issues/743
39 #if defined(__xlC__) && (__xlC__ < 0x0d01)
40 # define CRYPTOPP_DISABLE_ALTIVEC 1
41 # undef CRYPTOPP_POWER7_AVAILABLE
42 # undef CRYPTOPP_POWER8_AVAILABLE
43 # undef CRYPTOPP_ALTIVEC_AVAILABLE
44 #endif
45 
46 // Can't use GetAlignmentOf<word64>() because of C++11 and constexpr
47 // Can use 'const unsigned int' because of MSVC
48 #if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
49 # define ALIGN_SPEC32 16
50 # define ALIGN_SPEC64 16
51 #elif (CRYPTOPP_CXX11_ALIGNOF)
52 # define ALIGN_SPEC32 alignof(CryptoPP::word32)
53 # define ALIGN_SPEC64 alignof(CryptoPP::word64)
54 #else
55 # define ALIGN_SPEC32 4
56 # define ALIGN_SPEC64 8
57 #endif
58 
59 NAMESPACE_BEGIN(CryptoPP)
60 
61 // Export the tables to the SIMD files
62 extern const word32 BLAKE2S_IV[8];
63 extern const word64 BLAKE2B_IV[8];
64 
65 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
66 const word32 BLAKE2S_IV[8] = {
67  0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
68  0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
69 };
70 
71 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC64)
72 const word64 BLAKE2B_IV[8] = {
73  W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
74  W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
75  W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
76  W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)
77 };
78 
79 NAMESPACE_END
80 
81 ANONYMOUS_NAMESPACE_BEGIN
82 
83 using CryptoPP::byte;
84 using CryptoPP::word32;
85 using CryptoPP::word64;
87 
88 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
89 const byte BLAKE2S_SIGMA[10][16] = {
90  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
91  { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
92  { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
93  { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
94  { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
95  { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
96  { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
97  { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
98  { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
99  { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
100 };
101 
102 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
103 const byte BLAKE2B_SIGMA[12][16] = {
104  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
105  { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
106  { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
107  { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
108  { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
109  { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
110  { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
111  { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
112  { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
113  { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
114  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
115  { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
116 };
117 
118 template <unsigned int R, unsigned int N>
119 inline void BLAKE2B_G(const word64 m[16], word64& a, word64& b, word64& c, word64& d)
120 {
121  a = a + b + m[BLAKE2B_SIGMA[R][2*N+0]];
122  d = rotrConstant<32>(d ^ a);
123  c = c + d;
124  b = rotrConstant<24>(b ^ c);
125  a = a + b + m[BLAKE2B_SIGMA[R][2*N+1]];
126  d = rotrConstant<16>(d ^ a);
127  c = c + d;
128  b = rotrConstant<63>(b ^ c);
129 }
130 
131 template <unsigned int R>
132 inline void BLAKE2B_ROUND(const word64 m[16], word64 v[16])
133 {
134  BLAKE2B_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
135  BLAKE2B_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
136  BLAKE2B_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
137  BLAKE2B_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
138  BLAKE2B_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
139  BLAKE2B_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
140  BLAKE2B_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
141  BLAKE2B_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
142 }
143 
144 template <unsigned int R, unsigned int N>
145 inline void BLAKE2S_G(const word32 m[16], word32& a, word32& b, word32& c, word32& d)
146 {
147  a = a + b + m[BLAKE2S_SIGMA[R][2*N+0]];
148  d = rotrConstant<16>(d ^ a);
149  c = c + d;
150  b = rotrConstant<12>(b ^ c);
151  a = a + b + m[BLAKE2S_SIGMA[R][2*N+1]];
152  d = rotrConstant<8>(d ^ a);
153  c = c + d;
154  b = rotrConstant<7>(b ^ c);
155 }
156 
157 template <unsigned int R>
158 inline void BLAKE2S_ROUND(const word32 m[16], word32 v[])
159 {
160  BLAKE2S_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
161  BLAKE2S_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
162  BLAKE2S_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
163  BLAKE2S_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
164  BLAKE2S_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
165  BLAKE2S_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
166  BLAKE2S_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
167  BLAKE2S_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
168 }
169 
170 ANONYMOUS_NAMESPACE_END
171 
172 NAMESPACE_BEGIN(CryptoPP)
173 
174 void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state);
175 void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state);
176 
177 #if CRYPTOPP_SSE41_AVAILABLE
178 extern void BLAKE2_Compress32_SSE4(const byte* input, BLAKE2s_State& state);
179 extern void BLAKE2_Compress64_SSE4(const byte* input, BLAKE2b_State& state);
180 #endif
181 
182 #if CRYPTOPP_ARM_NEON_AVAILABLE
183 extern void BLAKE2_Compress32_NEON(const byte* input, BLAKE2s_State& state);
184 extern void BLAKE2_Compress64_NEON(const byte* input, BLAKE2b_State& state);
185 #endif
186 
187 #if CRYPTOPP_POWER8_AVAILABLE
188 extern void BLAKE2_Compress32_POWER8(const byte* input, BLAKE2s_State& state);
189 #elif CRYPTOPP_ALTIVEC_AVAILABLE
190 extern void BLAKE2_Compress32_ALTIVEC(const byte* input, BLAKE2s_State& state);
191 #endif
192 
193 #if CRYPTOPP_POWER8_AVAILABLE
194 extern void BLAKE2_Compress64_POWER8(const byte* input, BLAKE2b_State& state);
195 #endif
196 
197 unsigned int BLAKE2b::OptimalDataAlignment() const
198 {
199 #if defined(CRYPTOPP_SSE41_AVAILABLE)
200  if (HasSSE41())
201  return 16;
202  else
203 #endif
204 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
205  if (HasNEON())
206  return 4;
207  else
208 #endif
209 #if (CRYPTOPP_POWER8_AVAILABLE)
210  if (HasPower8())
211  return 16;
212  else
213 #endif
214  return GetAlignmentOf<word64>();
215 }
216 
217 std::string BLAKE2b::AlgorithmProvider() const
218 {
219 #if defined(CRYPTOPP_SSE41_AVAILABLE)
220  if (HasSSE41())
221  return "SSE4.1";
222  else
223 #endif
224 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
225  if (HasNEON())
226  return "NEON";
227  else
228 #endif
229 #if (CRYPTOPP_POWER8_AVAILABLE)
230  if (HasPower8())
231  return "Power8";
232  else
233 #endif
234  return "C++";
235 }
236 
237 unsigned int BLAKE2s::OptimalDataAlignment() const
238 {
239 #if defined(CRYPTOPP_SSE41_AVAILABLE)
240  if (HasSSE41())
241  return 16;
242  else
243 #endif
244 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
245  if (HasNEON())
246  return 4;
247  else
248 #endif
249 #if (CRYPTOPP_POWER8_AVAILABLE)
250  if (HasPower8())
251  return 16;
252  else
253 #elif (CRYPTOPP_ALTIVEC_AVAILABLE)
254  if (HasAltivec())
255  return 16;
256  else
257 #endif
258  return GetAlignmentOf<word32>();
259 }
260 
261 std::string BLAKE2s::AlgorithmProvider() const
262 {
263 #if defined(CRYPTOPP_SSE41_AVAILABLE)
264  if (HasSSE41())
265  return "SSE4.1";
266  else
267 #endif
268 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
269  if (HasNEON())
270  return "NEON";
271  else
272 #endif
273 #if (CRYPTOPP_POWER8_AVAILABLE)
274  if (HasPower8())
275  return "Power8";
276  else
277 #elif (CRYPTOPP_ALTIVEC_AVAILABLE)
278  if (HasAltivec())
279  return "Altivec";
280  else
281 #endif
282  return "C++";
283 }
284 
285 void BLAKE2s_State::Reset()
286 {
287  std::memset(m_hft, 0x00, m_hft.SizeInBytes());
288  m_len = 0;
289 }
290 
291 void BLAKE2b_State::Reset()
292 {
293  std::memset(m_hft, 0x00, m_hft.SizeInBytes());
294  m_len = 0;
295 }
296 
297 BLAKE2s_ParameterBlock::BLAKE2s_ParameterBlock(size_t digestLen, size_t keyLen,
298  const byte* saltStr, size_t saltLen,
299  const byte* personalizationStr, size_t personalizationLen)
300 {
301  Reset(digestLen, keyLen);
302 
303  if (saltStr && saltLen)
304  memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
305 
306  if (personalizationStr && personalizationLen)
307  memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
308 }
309 
310 BLAKE2b_ParameterBlock::BLAKE2b_ParameterBlock(size_t digestLen, size_t keyLen,
311  const byte* saltStr, size_t saltLen,
312  const byte* personalizationStr, size_t personalizationLen)
313 {
314  Reset(digestLen, keyLen);
315 
316  if (saltStr && saltLen)
317  memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
318 
319  if (personalizationStr && personalizationLen)
320  memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
321 }
322 
323 void BLAKE2s_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
324 {
325  std::memset(m_data, 0x00, m_data.size());
326  m_data[DigestOff] = static_cast<byte>(digestLen);
327  m_data[KeyOff] = static_cast<byte>(keyLen);
328  m_data[FanoutOff] = m_data[DepthOff] = 1;
329 }
330 
331 void BLAKE2b_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
332 {
333  std::memset(m_data, 0x00, m_data.size());
334  m_data[DigestOff] = static_cast<byte>(digestLen);
335  m_data[KeyOff] = static_cast<byte>(keyLen);
336  m_data[FanoutOff] = m_data[DepthOff] = 1;
337 }
338 
339 BLAKE2s::BLAKE2s(bool treeMode, unsigned int digestSize)
340  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
341 {
342  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
343 
344  UncheckedSetKey(NULLPTR, 0, MakeParameters
345  (Name::DigestSize(), (int)digestSize)
346  (Name::TreeMode(), treeMode));
347 }
348 
349 BLAKE2b::BLAKE2b(bool treeMode, unsigned int digestSize)
350  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
351 {
352  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
353 
354  UncheckedSetKey(NULLPTR, 0, MakeParameters
355  (Name::DigestSize(), (int)digestSize)
356  (Name::TreeMode(), treeMode));
357 }
358 
359 BLAKE2s::BLAKE2s(unsigned int digestSize)
360  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
361 {
362  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
363 
364  UncheckedSetKey(NULLPTR, 0, MakeParameters
365  (Name::DigestSize(), (int)digestSize)
366  (Name::TreeMode(), false));
367 }
368 
369 BLAKE2b::BLAKE2b(unsigned int digestSize)
370  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
371 {
372  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
373 
374  UncheckedSetKey(NULLPTR, 0, MakeParameters
375  (Name::DigestSize(), (int)digestSize)
376  (Name::TreeMode(), false));
377 }
378 
379 BLAKE2s::BLAKE2s(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
380  const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
381  : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
382 {
383  CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
384  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
385  CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
386  CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
387 
388  UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
389  (Name::DigestSize(),(int)digestSize)
390  (Name::TreeMode(),treeMode)
391  (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
392  (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
393 }
394 
395 BLAKE2b::BLAKE2b(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
396  const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
397  : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
398 {
399  CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
400  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
401  CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
402  CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
403 
404  UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
405  (Name::DigestSize(),(int)digestSize)
406  (Name::TreeMode(),treeMode)
407  (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
408  (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
409 }
410 
411 void BLAKE2s::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
412 {
413  if (key && length)
414  {
415  m_key.New(BLOCKSIZE);
416  std::memcpy(m_key, key, length);
417  std::memset(m_key + length, 0x00, BLOCKSIZE - length);
418  m_keyLength = length;
419  }
420  else
421  {
422  m_key.resize(0);
423  m_keyLength = 0;
424  }
425 
426  m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
427  Name::DigestSize(), static_cast<int>(m_digestSize)));
428 
429  m_state.Reset();
430  m_block.Reset(m_digestSize, m_keyLength);
431  (void)params.GetValue(Name::TreeMode(), m_treeMode);
432 
434  if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
435  memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
436 
437  if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
438  memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
439 
440  Restart();
441 }
442 
443 void BLAKE2b::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
444 {
445  if (key && length)
446  {
447  m_key.New(BLOCKSIZE);
448  std::memcpy(m_key, key, length);
449  std::memset(m_key + length, 0x00, BLOCKSIZE - length);
450  m_keyLength = length;
451  }
452  else
453  {
454  m_key.resize(0);
455  m_keyLength = 0;
456  }
457 
458  m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
459  Name::DigestSize(), static_cast<int>(m_digestSize)));
460 
461  m_state.Reset();
462  m_block.Reset(m_digestSize, m_keyLength);
463  (void)params.GetValue(Name::TreeMode(), m_treeMode);
464 
466  if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
467  memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
468 
469  if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
470  memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
471 
472  Restart();
473 }
474 
476 {
477  static const word32 zero[2] = {0,0};
478  Restart(m_block, zero);
479 }
480 
482 {
483  static const word64 zero[2] = {0,0};
484  Restart(m_block, zero);
485 }
486 
487 void BLAKE2s::Restart(const BLAKE2s_ParameterBlock& block, const word32 counter[2])
488 {
489  // We take a counter as a parameter to allow customized state.
490  m_state.Reset();
491  if (counter != NULLPTR)
492  {
493  word32* t = m_state.t();
494  t[0] = counter[0];
495  t[1] = counter[1];
496  }
497 
498  // We take a parameter block as a parameter to allow customized state.
499  // Avoid the copy of the parameter block when we are passing our own block.
500  if (block.data() == m_block.data())
501  m_block.Reset(m_digestSize, m_keyLength);
502  else
503  {
504  std::memcpy(m_block.data(), block.data(), m_block.size());
505  m_block.m_data[BLAKE2s_ParameterBlock::DigestOff] = (byte)m_digestSize;
506  m_block.m_data[BLAKE2s_ParameterBlock::KeyOff] = (byte)m_keyLength;
507  }
508 
509  const word32* iv = BLAKE2S_IV;
510  PutBlock<word32, LittleEndian, true> put(m_block.data(), m_state.h());
511  put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
512 
513  // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
514  // The key is padded to a full Blocksize with 0. Key it during Restart to
515  // avoid FirstPut and friends. Key size == 0 means no key.
516  if (m_keyLength)
517  Update(m_key, BLOCKSIZE);
518 }
519 
520 void BLAKE2b::Restart(const BLAKE2b_ParameterBlock& block, const word64 counter[2])
521 {
522  // We take a counter as a parameter to allow customized state.
523  m_state.Reset();
524  if (counter != NULLPTR)
525  {
526  word64* t = m_state.t();
527  t[0] = counter[0];
528  t[1] = counter[1];
529  }
530 
531  // We take a parameter block as a parameter to allow customized state.
532  // Avoid the copy of the parameter block when we are passing our own block.
533  if (block.data() == m_block.data())
534  m_block.Reset(m_digestSize, m_keyLength);
535  else
536  {
537  std::memcpy(m_block.data(), block.data(), m_block.size());
538  m_block.m_data[BLAKE2b_ParameterBlock::DigestOff] = (byte)m_digestSize;
539  m_block.m_data[BLAKE2b_ParameterBlock::KeyOff] = (byte)m_keyLength;
540  }
541 
542  const word64* iv = BLAKE2B_IV;
543  PutBlock<word64, LittleEndian, true> put(m_block.data(), m_state.h());
544  put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
545 
546  // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
547  // The key is padded to a full Blocksize with 0. Key it during Restart to
548  // avoid FirstPut and friends. Key size == 0 means no key.
549  if (m_keyLength)
550  Update(m_key, BLOCKSIZE);
551 }
552 
553 void BLAKE2s::Update(const byte *input, size_t length)
554 {
555  CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
556 
557  if (length > BLOCKSIZE - m_state.m_len)
558  {
559  if (m_state.m_len != 0)
560  {
561  // Complete current block
562  const size_t fill = BLOCKSIZE - m_state.m_len;
563  std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
564 
565  IncrementCounter(BLOCKSIZE);
566  Compress(m_state.m_buf);
567  m_state.m_len = 0;
568 
569  length -= fill, input += fill;
570  }
571 
572  // Compress in-place to avoid copies
573  while (length > BLOCKSIZE)
574  {
575  IncrementCounter(BLOCKSIZE);
576  Compress(input);
577  length -= BLOCKSIZE, input += BLOCKSIZE;
578  }
579  }
580 
581  // Copy tail bytes
582  if (length)
583  {
584  CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
585  std::memcpy(m_state.m_buf+m_state.m_len, input, length);
586  m_state.m_len += static_cast<unsigned int>(length);
587  }
588 }
589 
590 void BLAKE2b::Update(const byte *input, size_t length)
591 {
592  CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
593 
594  if (length > BLOCKSIZE - m_state.m_len)
595  {
596  if (m_state.m_len != 0)
597  {
598  // Complete current block
599  const size_t fill = BLOCKSIZE - m_state.m_len;
600  std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
601 
602  IncrementCounter(BLOCKSIZE);
603  Compress(m_state.m_buf);
604  m_state.m_len = 0;
605 
606  length -= fill, input += fill;
607  }
608 
609  // Compress in-place to avoid copies
610  while (length > BLOCKSIZE)
611  {
612  CRYPTOPP_ASSERT(m_state.m_len == 0);
613  IncrementCounter(BLOCKSIZE);
614  Compress(input);
615  length -= BLOCKSIZE, input += BLOCKSIZE;
616  }
617  }
618 
619  // Copy tail bytes
620  if (length)
621  {
622  CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
623  std::memcpy(m_state.m_buf + m_state.m_len, input, length);
624  m_state.m_len += static_cast<unsigned int>(length);
625  }
626 }
627 
628 void BLAKE2s::TruncatedFinal(byte *hash, size_t size)
629 {
630  CRYPTOPP_ASSERT(hash != NULLPTR);
631  this->ThrowIfInvalidTruncatedSize(size);
632  word32* f = m_state.f();
633 
634  // Set last block unconditionally
635  f[0] = ~static_cast<word32>(0);
636 
637  // Set last node if tree mode
638  if (m_treeMode)
639  f[1] = ~static_cast<word32>(0);
640 
641  // Increment counter for tail bytes only
642  IncrementCounter(m_state.m_len);
643 
644  std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
645  Compress(m_state.m_buf);
646 
647  // Copy to caller buffer
648  std::memcpy(hash, m_state.h(), size);
649 
650  Restart();
651 }
652 
653 void BLAKE2b::TruncatedFinal(byte *hash, size_t size)
654 {
655  CRYPTOPP_ASSERT(hash != NULLPTR);
656  this->ThrowIfInvalidTruncatedSize(size);
657  word64* f = m_state.f();
658 
659  // Set last block unconditionally
660  f[0] = ~static_cast<word64>(0);
661 
662  // Set last node if tree mode
663  if (m_treeMode)
664  f[1] = ~static_cast<word64>(0);
665 
666  // Increment counter for tail bytes only
667  IncrementCounter(m_state.m_len);
668 
669  std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
670  Compress(m_state.m_buf);
671 
672  // Copy to caller buffer
673  std::memcpy(hash, m_state.h(), size);
674 
675  Restart();
676 }
677 
678 void BLAKE2s::IncrementCounter(size_t count)
679 {
680  word32* t = m_state.t();
681  t[0] += static_cast<word32>(count);
682  t[1] += !!(t[0] < count);
683 }
684 
685 void BLAKE2b::IncrementCounter(size_t count)
686 {
687  word64* t = m_state.t();
688  t[0] += static_cast<word64>(count);
689  t[1] += !!(t[0] < count);
690 }
691 
692 void BLAKE2s::Compress(const byte *input)
693 {
694 #if CRYPTOPP_SSE41_AVAILABLE
695  if(HasSSE41())
696  {
697  return BLAKE2_Compress32_SSE4(input, m_state);
698  }
699 #endif
700 #if CRYPTOPP_ARM_NEON_AVAILABLE
701  if(HasNEON())
702  {
703  return BLAKE2_Compress32_NEON(input, m_state);
704  }
705 #endif
706 #if CRYPTOPP_POWER8_AVAILABLE
707  if(HasPower8())
708  {
709  return BLAKE2_Compress32_POWER8(input, m_state);
710  }
711 #elif CRYPTOPP_ALTIVEC_AVAILABLE
712  if(HasAltivec())
713  {
714  return BLAKE2_Compress32_ALTIVEC(input, m_state);
715  }
716 #endif
717  return BLAKE2_Compress32_CXX(input, m_state);
718 }
719 
720 void BLAKE2b::Compress(const byte *input)
721 {
722 #if CRYPTOPP_SSE41_AVAILABLE
723  if(HasSSE41())
724  {
725  return BLAKE2_Compress64_SSE4(input, m_state);
726  }
727 #endif
728 #if CRYPTOPP_ARM_NEON_AVAILABLE
729  if(HasNEON())
730  {
731  return BLAKE2_Compress64_NEON(input, m_state);
732  }
733 #endif
734 #if CRYPTOPP_POWER8_AVAILABLE
735  if(HasPower8())
736  {
737  return BLAKE2_Compress64_POWER8(input, m_state);
738  }
739 #endif
740  return BLAKE2_Compress64_CXX(input, m_state);
741 }
742 
743 void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state)
744 {
745  word64 m[16], v[16];
746 
748  get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
749 
750  GetBlock<word64, LittleEndian, true> get2(state.h());
751  get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
752 
753  const word64* iv = BLAKE2B_IV;
754  const word64* tf = state.t();
755  v[ 8] = iv[0];
756  v[ 9] = iv[1];
757  v[10] = iv[2];
758  v[11] = iv[3];
759  v[12] = tf[0] ^ iv[4];
760  v[13] = tf[1] ^ iv[5];
761  v[14] = tf[2] ^ iv[6];
762  v[15] = tf[3] ^ iv[7];
763 
764  BLAKE2B_ROUND<0>(m, v);
765  BLAKE2B_ROUND<1>(m, v);
766  BLAKE2B_ROUND<2>(m, v);
767  BLAKE2B_ROUND<3>(m, v);
768  BLAKE2B_ROUND<4>(m, v);
769  BLAKE2B_ROUND<5>(m, v);
770  BLAKE2B_ROUND<6>(m, v);
771  BLAKE2B_ROUND<7>(m, v);
772  BLAKE2B_ROUND<8>(m, v);
773  BLAKE2B_ROUND<9>(m, v);
774  BLAKE2B_ROUND<10>(m, v);
775  BLAKE2B_ROUND<11>(m, v);
776 
777  word64* h = state.h();
778  for (unsigned int i = 0; i < 8; ++i)
779  h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
780 }
781 
782 void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state)
783 {
784  word32 m[16], v[16];
785 
787  get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
788 
789  GetBlock<word32, LittleEndian, true> get2(state.h());
790  get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
791 
792  const word32* iv = BLAKE2S_IV;
793  const word32* tf = state.t();
794  v[ 8] = iv[0];
795  v[ 9] = iv[1];
796  v[10] = iv[2];
797  v[11] = iv[3];
798  v[12] = tf[0] ^ iv[4];
799  v[13] = tf[1] ^ iv[5];
800  v[14] = tf[2] ^ iv[6];
801  v[15] = tf[3] ^ iv[7];
802 
803  BLAKE2S_ROUND<0>(m, v);
804  BLAKE2S_ROUND<1>(m, v);
805  BLAKE2S_ROUND<2>(m, v);
806  BLAKE2S_ROUND<3>(m, v);
807  BLAKE2S_ROUND<4>(m, v);
808  BLAKE2S_ROUND<5>(m, v);
809  BLAKE2S_ROUND<6>(m, v);
810  BLAKE2S_ROUND<7>(m, v);
811  BLAKE2S_ROUND<8>(m, v);
812  BLAKE2S_ROUND<9>(m, v);
813 
814  word32* h = state.h();
815  for (unsigned int i = 0; i < 8; ++i)
816  h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
817 }
818 
819 NAMESPACE_END
Used to pass byte array input as part of a NameValuePairs object.
Definition: algparam.h:20
Standard names for retrieving values by name when working with NameValuePairs.
const char * DigestSize()
int, in bytes
Definition: argnames.h:79
const char * TreeMode()
byte
Definition: argnames.h:90
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: blake2.cpp:590
BLAKE2b parameter block.
Definition: blake2.h:111
Classes for working with NameValuePairs.
bool HasAltivec()
Determine if a PowerPC processor has Altivec available.
Definition: cpu.h:614
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: blake2.cpp:261
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition: blake2.cpp:197
size_t size() const
Length of the memory block.
Definition: algparam.h:84
size_type SizeInBytes() const
Provides the number of bytes in the SecBlock.
Definition: secblock.h:811
void resize(size_type newSize)
Change size and preserve contents.
Definition: secblock.h:1031
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: blake2.cpp:217
Abstract base classes that provide a uniform interface to this library.
void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
Bounds checking replacement for memcpy()
Definition: misc.h:443
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition: blake2.cpp:628
BLAKE2s parameter block.
Definition: blake2.h:60
Library configuration file.
BLAKE2s(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2s hash.
Definition: blake2.cpp:339
void New(size_type newSize)
Change size without preserving contents.
Definition: secblock.h:965
byte order is little-endian
Definition: cryptlib.h:145
const byte * begin() const
Pointer to the first byte in the memory block.
Definition: algparam.h:80
AlgorithmParameters MakeParameters(const char *name, const T &value, bool throwIfNotUsed=true)
Create an object that implements NameValuePairs.
Definition: algparam.h:502
bool HasPower8()
Determine if a PowerPC processor has Power8 available.
Definition: cpu.h:640
T ConditionalByteReverse(ByteOrder order, T value)
Reverses bytes in a value depending upon endianness.
Definition: misc.h:2113
const char * Salt()
ConstByteArrayParameter.
Definition: argnames.h:87
Precompiled header file.
Classes for BLAKE2b and BLAKE2s message digests and keyed message digests.
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: blake2.cpp:553
const char * Personalization()
ConstByteArrayParameter.
Definition: argnames.h:85
#define CRYPTOPP_ASSERT(exp)
Debugging and diagnostic assertion.
Definition: trap.h:69
Functions for CPU features and intrinsics.
void Restart()
Restart the hash.
Definition: blake2.cpp:475
BLAKE2s state information.
Definition: blake2.h:163
BLAKE2b state information.
Definition: blake2.h:196
T rotrConstant(T x)
Performs a right rotate.
Definition: misc.h:1525
Access a block of memory.
Definition: misc.h:2454
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition: blake2.cpp:653
bool HasSSE41()
Determines SSE4.1 availability.
Definition: cpu.h:142
Access a block of memory.
Definition: misc.h:2495
Crypto++ library namespace.
BLAKE2b(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2b hash.
Definition: blake2.cpp:349
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition: blake2.cpp:237
size_type size() const
Provides the count of elements in the SecBlock.
Definition: secblock.h:797
bool HasNEON()
Determine if an ARM processor has Advanced SIMD available.
Definition: cpu.h:387
void Restart()
Restart the hash.
Definition: blake2.cpp:481