Crypto++  8.2
Free C++ class library of cryptographic schemes
blake2.cpp
1 // blake2.cpp - written and placed in the public domain by Jeffrey Walton
2 // and Zooko Wilcox-O'Hearn. Based on Aumasson, Neves,
3 // Wilcox-O'Hearn and Winnerlein's reference BLAKE2
4 // implementation at http://github.com/BLAKE2/BLAKE2.
5 //
6 // The BLAKE2b and BLAKE2s numbers are consistent with the BLAKE2 team's
7 // numbers. However, we have an Altivec/POWER7 implementation of BLAKE2s,
8 // and a POWER8 implementation of BLAKE2b (BLAKE2 is missing them). The
9 // Altivec/POWER7 code is about 2x faster than C++ when using GCC 5.0 or
10 // above. The POWER8 code is about 2.5x faster than C++ when using GCC 5.0
11 // or above. If you use GCC 4.0 (PowerMac) or GCC 4.8 (GCC Compile Farm)
12 // then the PowerPC code will be slower than C++. Be sure to use GCC 5.0
13 // or above for PowerPC builds or disable Altivec for BLAKE2b and BLAKE2s
14 // if using the old compilers.
15 
16 #include "pch.h"
17 #include "config.h"
18 #include "cryptlib.h"
19 #include "argnames.h"
20 #include "algparam.h"
21 #include "blake2.h"
22 #include "cpu.h"
23 
24 // Uncomment for benchmarking C++ against SSE2 or NEON.
25 // Do so in both blake2.cpp and blake2-simd.cpp.
26 // #undef CRYPTOPP_SSE41_AVAILABLE
27 // #undef CRYPTOPP_ARM_NEON_AVAILABLE
28 // #undef CRYPTOPP_ALTIVEC_AVAILABLE
29 // #undef CRYPTOPP_POWER8_AVAILABLE
30 
31 // Disable NEON/ASIMD for Cortex-A53 and A57. The shifts are too slow and C/C++ is about
32 // 3 cpb faster than NEON/ASIMD. Also see http://github.com/weidai11/cryptopp/issues/367.
33 #if (defined(__aarch32__) || defined(__aarch64__)) && defined(CRYPTOPP_SLOW_ARMV8_SHIFT)
34 # undef CRYPTOPP_ARM_NEON_AVAILABLE
35 #endif
36 
37 // BLAKE2s bug on AIX 7.1 (POWER7) with XLC 12.01
38 // https://github.com/weidai11/cryptopp/issues/743
39 #if defined(__xlC__) && (__xlC__ < 0x0d01)
40 # define CRYPTOPP_DISABLE_ALTIVEC 1
41 # undef CRYPTOPP_POWER7_AVAILABLE
42 # undef CRYPTOPP_POWER8_AVAILABLE
43 # undef CRYPTOPP_ALTIVEC_AVAILABLE
44 #endif
45 
46 // Can't use GetAlignmentOf<word64>() because of C++11 and constexpr
47 // Can use 'const unsigned int' because of MSVC 2013
48 #if (CRYPTOPP_BOOL_X86 || CRYPTOPP_BOOL_X32 || CRYPTOPP_BOOL_X64)
49 # define ALIGN_SPEC32 16
50 # define ALIGN_SPEC64 16
51 #else
52 # define ALIGN_SPEC32 4
53 # define ALIGN_SPEC64 8
54 #endif
55 
56 NAMESPACE_BEGIN(CryptoPP)
57 
58 // Export the tables to the SIMD files
59 extern const word32 BLAKE2S_IV[8];
60 extern const word64 BLAKE2B_IV[8];
61 
62 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
63 const word32 BLAKE2S_IV[8] = {
64  0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
65  0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
66 };
67 
68 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC64)
69 const word64 BLAKE2B_IV[8] = {
70  W64LIT(0x6a09e667f3bcc908), W64LIT(0xbb67ae8584caa73b),
71  W64LIT(0x3c6ef372fe94f82b), W64LIT(0xa54ff53a5f1d36f1),
72  W64LIT(0x510e527fade682d1), W64LIT(0x9b05688c2b3e6c1f),
73  W64LIT(0x1f83d9abfb41bd6b), W64LIT(0x5be0cd19137e2179)
74 };
75 
76 NAMESPACE_END
77 
78 ANONYMOUS_NAMESPACE_BEGIN
79 
80 using CryptoPP::byte;
81 using CryptoPP::word32;
82 using CryptoPP::word64;
84 
85 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
86 const byte BLAKE2S_SIGMA[10][16] = {
87  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
88  { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
89  { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
90  { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
91  { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
92  { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
93  { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
94  { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
95  { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
96  { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
97 };
98 
99 CRYPTOPP_ALIGN_DATA(ALIGN_SPEC32)
100 const byte BLAKE2B_SIGMA[12][16] = {
101  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
102  { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
103  { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
104  { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
105  { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
106  { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
107  { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
108  { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
109  { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
110  { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 },
111  { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
112  { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
113 };
114 
115 template <unsigned int R, unsigned int N>
116 inline void BLAKE2B_G(const word64 m[16], word64& a, word64& b, word64& c, word64& d)
117 {
118  a = a + b + m[BLAKE2B_SIGMA[R][2*N+0]];
119  d = rotrConstant<32>(d ^ a);
120  c = c + d;
121  b = rotrConstant<24>(b ^ c);
122  a = a + b + m[BLAKE2B_SIGMA[R][2*N+1]];
123  d = rotrConstant<16>(d ^ a);
124  c = c + d;
125  b = rotrConstant<63>(b ^ c);
126 }
127 
128 template <unsigned int R>
129 inline void BLAKE2B_ROUND(const word64 m[16], word64 v[16])
130 {
131  BLAKE2B_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
132  BLAKE2B_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
133  BLAKE2B_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
134  BLAKE2B_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
135  BLAKE2B_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
136  BLAKE2B_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
137  BLAKE2B_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
138  BLAKE2B_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
139 }
140 
141 template <unsigned int R, unsigned int N>
142 inline void BLAKE2S_G(const word32 m[16], word32& a, word32& b, word32& c, word32& d)
143 {
144  a = a + b + m[BLAKE2S_SIGMA[R][2*N+0]];
145  d = rotrConstant<16>(d ^ a);
146  c = c + d;
147  b = rotrConstant<12>(b ^ c);
148  a = a + b + m[BLAKE2S_SIGMA[R][2*N+1]];
149  d = rotrConstant<8>(d ^ a);
150  c = c + d;
151  b = rotrConstant<7>(b ^ c);
152 }
153 
154 template <unsigned int R>
155 inline void BLAKE2S_ROUND(const word32 m[16], word32 v[])
156 {
157  BLAKE2S_G<R,0>(m,v[ 0],v[ 4],v[ 8],v[12]);
158  BLAKE2S_G<R,1>(m,v[ 1],v[ 5],v[ 9],v[13]);
159  BLAKE2S_G<R,2>(m,v[ 2],v[ 6],v[10],v[14]);
160  BLAKE2S_G<R,3>(m,v[ 3],v[ 7],v[11],v[15]);
161  BLAKE2S_G<R,4>(m,v[ 0],v[ 5],v[10],v[15]);
162  BLAKE2S_G<R,5>(m,v[ 1],v[ 6],v[11],v[12]);
163  BLAKE2S_G<R,6>(m,v[ 2],v[ 7],v[ 8],v[13]);
164  BLAKE2S_G<R,7>(m,v[ 3],v[ 4],v[ 9],v[14]);
165 }
166 
167 ANONYMOUS_NAMESPACE_END
168 
169 NAMESPACE_BEGIN(CryptoPP)
170 
171 void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state);
172 void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state);
173 
174 #if CRYPTOPP_SSE41_AVAILABLE
175 extern void BLAKE2_Compress32_SSE4(const byte* input, BLAKE2s_State& state);
176 extern void BLAKE2_Compress64_SSE4(const byte* input, BLAKE2b_State& state);
177 #endif
178 
179 #if CRYPTOPP_ARM_NEON_AVAILABLE
180 extern void BLAKE2_Compress32_NEON(const byte* input, BLAKE2s_State& state);
181 extern void BLAKE2_Compress64_NEON(const byte* input, BLAKE2b_State& state);
182 #endif
183 
184 #if CRYPTOPP_POWER8_AVAILABLE
185 extern void BLAKE2_Compress32_POWER8(const byte* input, BLAKE2s_State& state);
186 #elif CRYPTOPP_ALTIVEC_AVAILABLE
187 extern void BLAKE2_Compress32_ALTIVEC(const byte* input, BLAKE2s_State& state);
188 #endif
189 
190 #if CRYPTOPP_POWER8_AVAILABLE
191 extern void BLAKE2_Compress64_POWER8(const byte* input, BLAKE2b_State& state);
192 #endif
193 
194 unsigned int BLAKE2b::OptimalDataAlignment() const
195 {
196 #if defined(CRYPTOPP_SSE41_AVAILABLE)
197  if (HasSSE41())
198  return 16;
199  else
200 #endif
201 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
202  if (HasNEON())
203  return 4;
204  else
205 #endif
206 #if (CRYPTOPP_POWER8_AVAILABLE)
207  if (HasPower8())
208  return 16;
209  else
210 #endif
211  return GetAlignmentOf<word64>();
212 }
213 
214 std::string BLAKE2b::AlgorithmProvider() const
215 {
216 #if defined(CRYPTOPP_SSE41_AVAILABLE)
217  if (HasSSE41())
218  return "SSE4.1";
219  else
220 #endif
221 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
222  if (HasNEON())
223  return "NEON";
224  else
225 #endif
226 #if (CRYPTOPP_POWER8_AVAILABLE)
227  if (HasPower8())
228  return "Power8";
229  else
230 #endif
231  return "C++";
232 }
233 
234 unsigned int BLAKE2s::OptimalDataAlignment() const
235 {
236 #if defined(CRYPTOPP_SSE41_AVAILABLE)
237  if (HasSSE41())
238  return 16;
239  else
240 #endif
241 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
242  if (HasNEON())
243  return 4;
244  else
245 #endif
246 #if (CRYPTOPP_POWER8_AVAILABLE)
247  if (HasPower8())
248  return 16;
249  else
250 #elif (CRYPTOPP_ALTIVEC_AVAILABLE)
251  if (HasAltivec())
252  return 16;
253  else
254 #endif
255  return GetAlignmentOf<word32>();
256 }
257 
258 std::string BLAKE2s::AlgorithmProvider() const
259 {
260 #if defined(CRYPTOPP_SSE41_AVAILABLE)
261  if (HasSSE41())
262  return "SSE4.1";
263  else
264 #endif
265 #if (CRYPTOPP_ARM_NEON_AVAILABLE)
266  if (HasNEON())
267  return "NEON";
268  else
269 #endif
270 #if (CRYPTOPP_POWER8_AVAILABLE)
271  if (HasPower8())
272  return "Power8";
273  else
274 #elif (CRYPTOPP_ALTIVEC_AVAILABLE)
275  if (HasAltivec())
276  return "Altivec";
277  else
278 #endif
279  return "C++";
280 }
281 
282 void BLAKE2s_State::Reset()
283 {
284  std::memset(m_hft, 0x00, m_hft.SizeInBytes());
285  m_len = 0;
286 }
287 
288 void BLAKE2b_State::Reset()
289 {
290  std::memset(m_hft, 0x00, m_hft.SizeInBytes());
291  m_len = 0;
292 }
293 
294 BLAKE2s_ParameterBlock::BLAKE2s_ParameterBlock(size_t digestLen, size_t keyLen,
295  const byte* saltStr, size_t saltLen,
296  const byte* personalizationStr, size_t personalizationLen)
297 {
298  Reset(digestLen, keyLen);
299 
300  if (saltStr && saltLen)
301  memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
302 
303  if (personalizationStr && personalizationLen)
304  memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
305 }
306 
307 BLAKE2b_ParameterBlock::BLAKE2b_ParameterBlock(size_t digestLen, size_t keyLen,
308  const byte* saltStr, size_t saltLen,
309  const byte* personalizationStr, size_t personalizationLen)
310 {
311  Reset(digestLen, keyLen);
312 
313  if (saltStr && saltLen)
314  memcpy_s(salt(), SALTSIZE, saltStr, saltLen);
315 
316  if (personalizationStr && personalizationLen)
317  memcpy_s(personalization(), PERSONALIZATIONSIZE, personalizationStr, personalizationLen);
318 }
319 
320 void BLAKE2s_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
321 {
322  std::memset(m_data, 0x00, m_data.size());
323  m_data[DigestOff] = static_cast<byte>(digestLen);
324  m_data[KeyOff] = static_cast<byte>(keyLen);
325  m_data[FanoutOff] = m_data[DepthOff] = 1;
326 }
327 
328 void BLAKE2b_ParameterBlock::Reset(size_t digestLen, size_t keyLen)
329 {
330  std::memset(m_data, 0x00, m_data.size());
331  m_data[DigestOff] = static_cast<byte>(digestLen);
332  m_data[KeyOff] = static_cast<byte>(keyLen);
333  m_data[FanoutOff] = m_data[DepthOff] = 1;
334 }
335 
336 BLAKE2s::BLAKE2s(bool treeMode, unsigned int digestSize)
337  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
338 {
339  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
340 
341  UncheckedSetKey(NULLPTR, 0, MakeParameters
342  (Name::DigestSize(), (int)digestSize)
343  (Name::TreeMode(), treeMode));
344 }
345 
346 BLAKE2b::BLAKE2b(bool treeMode, unsigned int digestSize)
347  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(treeMode)
348 {
349  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
350 
351  UncheckedSetKey(NULLPTR, 0, MakeParameters
352  (Name::DigestSize(), (int)digestSize)
353  (Name::TreeMode(), treeMode));
354 }
355 
356 BLAKE2s::BLAKE2s(unsigned int digestSize)
357  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
358 {
359  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
360 
361  UncheckedSetKey(NULLPTR, 0, MakeParameters
362  (Name::DigestSize(), (int)digestSize)
363  (Name::TreeMode(), false));
364 }
365 
366 BLAKE2b::BLAKE2b(unsigned int digestSize)
367  : m_digestSize(digestSize), m_keyLength(0), m_treeMode(false)
368 {
369  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
370 
371  UncheckedSetKey(NULLPTR, 0, MakeParameters
372  (Name::DigestSize(), (int)digestSize)
373  (Name::TreeMode(), false));
374 }
375 
376 BLAKE2s::BLAKE2s(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
377  const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
378  : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
379 {
380  CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
381  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
382  CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
383  CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
384 
385  UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
386  (Name::DigestSize(),(int)digestSize)
387  (Name::TreeMode(),treeMode)
388  (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
389  (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
390 }
391 
392 BLAKE2b::BLAKE2b(const byte *key, size_t keyLength, const byte* salt, size_t saltLength,
393  const byte* personalization, size_t personalizationLength, bool treeMode, unsigned int digestSize)
394  : m_digestSize(digestSize), m_keyLength(static_cast<unsigned int>(keyLength)), m_treeMode(treeMode)
395 {
396  CRYPTOPP_ASSERT(keyLength <= MAX_KEYLENGTH);
397  CRYPTOPP_ASSERT(digestSize <= DIGESTSIZE);
398  CRYPTOPP_ASSERT(saltLength <= SALTSIZE);
399  CRYPTOPP_ASSERT(personalizationLength <= PERSONALIZATIONSIZE);
400 
401  UncheckedSetKey(key, static_cast<unsigned int>(keyLength), MakeParameters
402  (Name::DigestSize(),(int)digestSize)
403  (Name::TreeMode(),treeMode)
404  (Name::Salt(), ConstByteArrayParameter(salt, saltLength))
405  (Name::Personalization(), ConstByteArrayParameter(personalization, personalizationLength)));
406 }
407 
408 void BLAKE2s::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
409 {
410  if (key && length)
411  {
412  m_key.New(BLOCKSIZE);
413  std::memcpy(m_key, key, length);
414  std::memset(m_key + length, 0x00, BLOCKSIZE - length);
415  m_keyLength = length;
416  }
417  else
418  {
419  m_key.resize(0);
420  m_keyLength = 0;
421  }
422 
423  m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
424  Name::DigestSize(), static_cast<int>(m_digestSize)));
425 
426  m_state.Reset();
427  m_block.Reset(m_digestSize, m_keyLength);
428  (void)params.GetValue(Name::TreeMode(), m_treeMode);
429 
431  if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
432  memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
433 
434  if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
435  memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
436 
437  Restart();
438 }
439 
440 void BLAKE2b::UncheckedSetKey(const byte *key, unsigned int length, const CryptoPP::NameValuePairs& params)
441 {
442  if (key && length)
443  {
444  m_key.New(BLOCKSIZE);
445  std::memcpy(m_key, key, length);
446  std::memset(m_key + length, 0x00, BLOCKSIZE - length);
447  m_keyLength = length;
448  }
449  else
450  {
451  m_key.resize(0);
452  m_keyLength = 0;
453  }
454 
455  m_digestSize = static_cast<unsigned int>(params.GetIntValueWithDefault(
456  Name::DigestSize(), static_cast<int>(m_digestSize)));
457 
458  m_state.Reset();
459  m_block.Reset(m_digestSize, m_keyLength);
460  (void)params.GetValue(Name::TreeMode(), m_treeMode);
461 
463  if (params.GetValue(Name::Salt(), t) && t.begin() && t.size())
464  memcpy_s(m_block.salt(), SALTSIZE, t.begin(), t.size());
465 
466  if (params.GetValue(Name::Personalization(), t) && t.begin() && t.size())
467  memcpy_s(m_block.personalization(), PERSONALIZATIONSIZE, t.begin(), t.size());
468 
469  Restart();
470 }
471 
473 {
474  static const word32 zero[2] = {0,0};
475  Restart(m_block, zero);
476 }
477 
479 {
480  static const word64 zero[2] = {0,0};
481  Restart(m_block, zero);
482 }
483 
484 void BLAKE2s::Restart(const BLAKE2s_ParameterBlock& block, const word32 counter[2])
485 {
486  // We take a counter as a parameter to allow customized state.
487  m_state.Reset();
488  if (counter != NULLPTR)
489  {
490  word32* t = m_state.t();
491  t[0] = counter[0];
492  t[1] = counter[1];
493  }
494 
495  // We take a parameter block as a parameter to allow customized state.
496  // Avoid the copy of the parameter block when we are passing our own block.
497  if (block.data() == m_block.data())
498  m_block.Reset(m_digestSize, m_keyLength);
499  else
500  {
501  std::memcpy(m_block.data(), block.data(), m_block.size());
502  m_block.m_data[BLAKE2s_ParameterBlock::DigestOff] = (byte)m_digestSize;
503  m_block.m_data[BLAKE2s_ParameterBlock::KeyOff] = (byte)m_keyLength;
504  }
505 
506  const word32* iv = BLAKE2S_IV;
507  PutBlock<word32, LittleEndian, true> put(m_block.data(), m_state.h());
508  put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
509 
510  // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
511  // The key is padded to a full Blocksize with 0. Key it during Restart to
512  // avoid FirstPut and friends. Key size == 0 means no key.
513  if (m_keyLength)
514  Update(m_key, BLOCKSIZE);
515 }
516 
517 void BLAKE2b::Restart(const BLAKE2b_ParameterBlock& block, const word64 counter[2])
518 {
519  // We take a counter as a parameter to allow customized state.
520  m_state.Reset();
521  if (counter != NULLPTR)
522  {
523  word64* t = m_state.t();
524  t[0] = counter[0];
525  t[1] = counter[1];
526  }
527 
528  // We take a parameter block as a parameter to allow customized state.
529  // Avoid the copy of the parameter block when we are passing our own block.
530  if (block.data() == m_block.data())
531  m_block.Reset(m_digestSize, m_keyLength);
532  else
533  {
534  std::memcpy(m_block.data(), block.data(), m_block.size());
535  m_block.m_data[BLAKE2b_ParameterBlock::DigestOff] = (byte)m_digestSize;
536  m_block.m_data[BLAKE2b_ParameterBlock::KeyOff] = (byte)m_keyLength;
537  }
538 
539  const word64* iv = BLAKE2B_IV;
540  PutBlock<word64, LittleEndian, true> put(m_block.data(), m_state.h());
541  put(iv[0])(iv[1])(iv[2])(iv[3])(iv[4])(iv[5])(iv[6])(iv[7]);
542 
543  // When BLAKE2 is keyed, the input stream is simply {key || 0 || message}.
544  // The key is padded to a full Blocksize with 0. Key it during Restart to
545  // avoid FirstPut and friends. Key size == 0 means no key.
546  if (m_keyLength)
547  Update(m_key, BLOCKSIZE);
548 }
549 
550 void BLAKE2s::Update(const byte *input, size_t length)
551 {
552  CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
553 
554  if (length > BLOCKSIZE - m_state.m_len)
555  {
556  if (m_state.m_len != 0)
557  {
558  // Complete current block
559  const size_t fill = BLOCKSIZE - m_state.m_len;
560  std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
561 
562  IncrementCounter(BLOCKSIZE);
563  Compress(m_state.m_buf);
564  m_state.m_len = 0;
565 
566  length -= fill, input += fill;
567  }
568 
569  // Compress in-place to avoid copies
570  while (length > BLOCKSIZE)
571  {
572  IncrementCounter(BLOCKSIZE);
573  Compress(input);
574  length -= BLOCKSIZE, input += BLOCKSIZE;
575  }
576  }
577 
578  // Copy tail bytes
579  if (length)
580  {
581  CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
582  std::memcpy(m_state.m_buf+m_state.m_len, input, length);
583  m_state.m_len += static_cast<unsigned int>(length);
584  }
585 }
586 
587 void BLAKE2b::Update(const byte *input, size_t length)
588 {
589  CRYPTOPP_ASSERT(input != NULLPTR || length == 0);
590 
591  if (length > BLOCKSIZE - m_state.m_len)
592  {
593  if (m_state.m_len != 0)
594  {
595  // Complete current block
596  const size_t fill = BLOCKSIZE - m_state.m_len;
597  std::memcpy(m_state.m_buf+m_state.m_len, input, fill);
598 
599  IncrementCounter(BLOCKSIZE);
600  Compress(m_state.m_buf);
601  m_state.m_len = 0;
602 
603  length -= fill, input += fill;
604  }
605 
606  // Compress in-place to avoid copies
607  while (length > BLOCKSIZE)
608  {
609  CRYPTOPP_ASSERT(m_state.m_len == 0);
610  IncrementCounter(BLOCKSIZE);
611  Compress(input);
612  length -= BLOCKSIZE, input += BLOCKSIZE;
613  }
614  }
615 
616  // Copy tail bytes
617  if (length)
618  {
619  CRYPTOPP_ASSERT(length <= BLOCKSIZE - m_state.m_len);
620  std::memcpy(m_state.m_buf + m_state.m_len, input, length);
621  m_state.m_len += static_cast<unsigned int>(length);
622  }
623 }
624 
625 void BLAKE2s::TruncatedFinal(byte *hash, size_t size)
626 {
627  CRYPTOPP_ASSERT(hash != NULLPTR);
628  this->ThrowIfInvalidTruncatedSize(size);
629  word32* f = m_state.f();
630 
631  // Set last block unconditionally
632  f[0] = ~static_cast<word32>(0);
633 
634  // Set last node if tree mode
635  if (m_treeMode)
636  f[1] = ~static_cast<word32>(0);
637 
638  // Increment counter for tail bytes only
639  IncrementCounter(m_state.m_len);
640 
641  std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
642  Compress(m_state.m_buf);
643 
644  // Copy to caller buffer
645  std::memcpy(hash, m_state.h(), size);
646 
647  Restart();
648 }
649 
650 void BLAKE2b::TruncatedFinal(byte *hash, size_t size)
651 {
652  CRYPTOPP_ASSERT(hash != NULLPTR);
653  this->ThrowIfInvalidTruncatedSize(size);
654  word64* f = m_state.f();
655 
656  // Set last block unconditionally
657  f[0] = ~static_cast<word64>(0);
658 
659  // Set last node if tree mode
660  if (m_treeMode)
661  f[1] = ~static_cast<word64>(0);
662 
663  // Increment counter for tail bytes only
664  IncrementCounter(m_state.m_len);
665 
666  std::memset(m_state.m_buf + m_state.m_len, 0x00, BLOCKSIZE - m_state.m_len);
667  Compress(m_state.m_buf);
668 
669  // Copy to caller buffer
670  std::memcpy(hash, m_state.h(), size);
671 
672  Restart();
673 }
674 
675 void BLAKE2s::IncrementCounter(size_t count)
676 {
677  word32* t = m_state.t();
678  t[0] += static_cast<word32>(count);
679  t[1] += !!(t[0] < count);
680 }
681 
682 void BLAKE2b::IncrementCounter(size_t count)
683 {
684  word64* t = m_state.t();
685  t[0] += static_cast<word64>(count);
686  t[1] += !!(t[0] < count);
687 }
688 
689 void BLAKE2s::Compress(const byte *input)
690 {
691 #if CRYPTOPP_SSE41_AVAILABLE
692  if(HasSSE41())
693  {
694  return BLAKE2_Compress32_SSE4(input, m_state);
695  }
696 #endif
697 #if CRYPTOPP_ARM_NEON_AVAILABLE
698  if(HasNEON())
699  {
700  return BLAKE2_Compress32_NEON(input, m_state);
701  }
702 #endif
703 #if CRYPTOPP_POWER8_AVAILABLE
704  if(HasPower8())
705  {
706  return BLAKE2_Compress32_POWER8(input, m_state);
707  }
708 #elif CRYPTOPP_ALTIVEC_AVAILABLE
709  if(HasAltivec())
710  {
711  return BLAKE2_Compress32_ALTIVEC(input, m_state);
712  }
713 #endif
714  return BLAKE2_Compress32_CXX(input, m_state);
715 }
716 
717 void BLAKE2b::Compress(const byte *input)
718 {
719 #if CRYPTOPP_SSE41_AVAILABLE
720  if(HasSSE41())
721  {
722  return BLAKE2_Compress64_SSE4(input, m_state);
723  }
724 #endif
725 #if CRYPTOPP_ARM_NEON_AVAILABLE
726  if(HasNEON())
727  {
728  return BLAKE2_Compress64_NEON(input, m_state);
729  }
730 #endif
731 #if CRYPTOPP_POWER8_AVAILABLE
732  if(HasPower8())
733  {
734  return BLAKE2_Compress64_POWER8(input, m_state);
735  }
736 #endif
737  return BLAKE2_Compress64_CXX(input, m_state);
738 }
739 
740 void BLAKE2_Compress64_CXX(const byte* input, BLAKE2b_State& state)
741 {
742  word64 m[16], v[16];
743 
745  get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
746 
747  GetBlock<word64, LittleEndian, true> get2(state.h());
748  get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
749 
750  const word64* iv = BLAKE2B_IV;
751  const word64* tf = state.t();
752  v[ 8] = iv[0];
753  v[ 9] = iv[1];
754  v[10] = iv[2];
755  v[11] = iv[3];
756  v[12] = tf[0] ^ iv[4];
757  v[13] = tf[1] ^ iv[5];
758  v[14] = tf[2] ^ iv[6];
759  v[15] = tf[3] ^ iv[7];
760 
761  BLAKE2B_ROUND<0>(m, v);
762  BLAKE2B_ROUND<1>(m, v);
763  BLAKE2B_ROUND<2>(m, v);
764  BLAKE2B_ROUND<3>(m, v);
765  BLAKE2B_ROUND<4>(m, v);
766  BLAKE2B_ROUND<5>(m, v);
767  BLAKE2B_ROUND<6>(m, v);
768  BLAKE2B_ROUND<7>(m, v);
769  BLAKE2B_ROUND<8>(m, v);
770  BLAKE2B_ROUND<9>(m, v);
771  BLAKE2B_ROUND<10>(m, v);
772  BLAKE2B_ROUND<11>(m, v);
773 
774  word64* h = state.h();
775  for (unsigned int i = 0; i < 8; ++i)
776  h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
777 }
778 
779 void BLAKE2_Compress32_CXX(const byte* input, BLAKE2s_State& state)
780 {
781  word32 m[16], v[16];
782 
784  get1(m[0])(m[1])(m[2])(m[3])(m[4])(m[5])(m[6])(m[7])(m[8])(m[9])(m[10])(m[11])(m[12])(m[13])(m[14])(m[15]);
785 
786  GetBlock<word32, LittleEndian, true> get2(state.h());
787  get2(v[0])(v[1])(v[2])(v[3])(v[4])(v[5])(v[6])(v[7]);
788 
789  const word32* iv = BLAKE2S_IV;
790  const word32* tf = state.t();
791  v[ 8] = iv[0];
792  v[ 9] = iv[1];
793  v[10] = iv[2];
794  v[11] = iv[3];
795  v[12] = tf[0] ^ iv[4];
796  v[13] = tf[1] ^ iv[5];
797  v[14] = tf[2] ^ iv[6];
798  v[15] = tf[3] ^ iv[7];
799 
800  BLAKE2S_ROUND<0>(m, v);
801  BLAKE2S_ROUND<1>(m, v);
802  BLAKE2S_ROUND<2>(m, v);
803  BLAKE2S_ROUND<3>(m, v);
804  BLAKE2S_ROUND<4>(m, v);
805  BLAKE2S_ROUND<5>(m, v);
806  BLAKE2S_ROUND<6>(m, v);
807  BLAKE2S_ROUND<7>(m, v);
808  BLAKE2S_ROUND<8>(m, v);
809  BLAKE2S_ROUND<9>(m, v);
810 
811  word32* h = state.h();
812  for (unsigned int i = 0; i < 8; ++i)
813  h[i] = h[i] ^ ConditionalByteReverse(LITTLE_ENDIAN_ORDER, v[i] ^ v[i + 8]);
814 }
815 
816 NAMESPACE_END
Used to pass byte array input as part of a NameValuePairs object.
Definition: algparam.h:20
Standard names for retrieving values by name when working with NameValuePairs.
const char * DigestSize()
int, in bytes
Definition: argnames.h:79
const char * TreeMode()
byte
Definition: argnames.h:90
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: blake2.cpp:587
BLAKE2b parameter block.
Definition: blake2.h:111
Classes for working with NameValuePairs.
bool HasAltivec()
Determine if a PowerPC processor has Altivec available.
Definition: cpu.h:614
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: blake2.cpp:258
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition: blake2.cpp:194
size_t size() const
Length of the memory block.
Definition: algparam.h:84
size_type SizeInBytes() const
Provides the number of bytes in the SecBlock.
Definition: secblock.h:811
void resize(size_type newSize)
Change size and preserve contents.
Definition: secblock.h:1031
std::string AlgorithmProvider() const
Retrieve the provider of this algorithm.
Definition: blake2.cpp:214
Abstract base classes that provide a uniform interface to this library.
void memcpy_s(void *dest, size_t sizeInBytes, const void *src, size_t count)
Bounds checking replacement for memcpy()
Definition: misc.h:478
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition: blake2.cpp:625
BLAKE2s parameter block.
Definition: blake2.h:60
Library configuration file.
BLAKE2s(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2s hash.
Definition: blake2.cpp:336
void New(size_type newSize)
Change size without preserving contents.
Definition: secblock.h:965
byte order is little-endian
Definition: cryptlib.h:145
const byte * begin() const
Pointer to the first byte in the memory block.
Definition: algparam.h:80
AlgorithmParameters MakeParameters(const char *name, const T &value, bool throwIfNotUsed=true)
Create an object that implements NameValuePairs.
Definition: algparam.h:504
bool HasPower8()
Determine if a PowerPC processor has Power8 available.
Definition: cpu.h:640
T ConditionalByteReverse(ByteOrder order, T value)
Reverses bytes in a value depending upon endianness.
Definition: misc.h:2191
const char * Salt()
ConstByteArrayParameter.
Definition: argnames.h:87
Precompiled header file.
Classes for BLAKE2b and BLAKE2s message digests and keyed message digests.
void Update(const byte *input, size_t length)
Updates a hash with additional input.
Definition: blake2.cpp:550
const char * Personalization()
ConstByteArrayParameter.
Definition: argnames.h:85
#define CRYPTOPP_ASSERT(exp)
Debugging and diagnostic assertion.
Definition: trap.h:69
Functions for CPU features and intrinsics.
void Restart()
Restart the hash.
Definition: blake2.cpp:472
BLAKE2s state information.
Definition: blake2.h:163
BLAKE2b state information.
Definition: blake2.h:196
T rotrConstant(T x)
Performs a right rotate.
Definition: misc.h:1577
Access a block of memory.
Definition: misc.h:2532
void TruncatedFinal(byte *hash, size_t size)
Computes the hash of the current message.
Definition: blake2.cpp:650
bool HasSSE41()
Determines SSE4.1 availability.
Definition: cpu.h:142
Access a block of memory.
Definition: misc.h:2573
Crypto++ library namespace.
BLAKE2b(bool treeMode=false, unsigned int digestSize=DIGESTSIZE)
Construct a BLAKE2b hash.
Definition: blake2.cpp:346
unsigned int OptimalDataAlignment() const
Provides input and output data alignment for optimal performance.
Definition: blake2.cpp:234
size_type size() const
Provides the count of elements in the SecBlock.
Definition: secblock.h:797
bool HasNEON()
Determine if an ARM processor has Advanced SIMD available.
Definition: cpu.h:387
void Restart()
Restart the hash.
Definition: blake2.cpp:478