poly1305-internal.c

   1 /* poly1305-internal.c
   2
   3    Copyright: 2012-2013 Andrew M. (floodyberry)
   4    Copyright: 2013 Nikos Mavrogiannopoulos
   5    Copyright: 2013 Niels Möller
   6
   7    This file is part of GNU Nettle.
   8
   9    GNU Nettle is free software: you can redistribute it and/or
  10    modify it under the terms of either:
  11
  12      * the GNU Lesser General Public License as published by the Free
  13        Software Foundation; either version 3 of the License, or (at your
  14        option) any later version.
  15
  16    or
  17
  18      * the GNU General Public License as published by the Free
  19        Software Foundation; either version 2 of the License, or (at your
  20        option) any later version.
  21
  22    or both in parallel, as here.
  23
  24    GNU Nettle is distributed in the hope that it will be useful,
  25    but WITHOUT ANY WARRANTY; without even the implied warranty of
  26    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  27    General Public License for more details.
  28
  29    You should have received copies of the GNU General Public License and
  30    the GNU Lesser General Public License along with this program.  If
  31    not, see http://www.gnu.org/licenses/.
  32 */
  33
  34 /* Based on https://github.com/floodyberry/poly1305-donna.
  35  * Modified for nettle by Nikos Mavrogiannopoulos and Niels Möller.
  36  * Original license notice:
  37  *
  38  * Permission is hereby granted, free of charge, to any person obtaining a
  39  * copy of this software and associated documentation files (the
  40  * "Software"), to deal in the Software without restriction, including
  41  * without limitation the rights to use, copy, modify, merge, publish,
  42  * distribute, sublicense, and/or sell copies of the Software, and to
  43  * permit persons to whom the Software is furnished to do so, subject to
  44  * the following conditions:
  45  *
  46  * The above copyright notice and this permission notice shall be included
  47  * in all copies or substantial portions of the Software.
  48  *
  49  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  50  * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  51  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
  52  * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
  53  * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
  54  * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
  55  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  56  */
  57
  58 #if HAVE_CONFIG_H
  59 #include "config.h"
  60 #endif
  61
  62 #include <assert.h>
  63 #include <string.h>
  64
  65 #include "poly1305.h"
  66 #include "poly1305-internal.h"
  67
  68 #include "macros.h"
  69
  70 #define mul32x32_64(a,b) ((uint64_t)(a) * (b))
  71
  72 #define r0 r.r32[0]
  73 #define r1 r.r32[1]
  74 #define r2 r.r32[2]
  75 #define r3 r.r32[3]
  76 #define r4 r.r32[4]
  77 #define s1 r.r32[5]
  78 #define s2 s32[0]
  79 #define s3 s32[1]
  80 #define s4 s32[2]
  81
  82 #define h0 h.h32[0]
  83 #define h1 h.h32[1]
  84 #define h2 h.h32[2]
  85 #define h3 h.h32[3]
  86 #define h4 hh
  87
  88 /* For fat builds */
  89 #if HAVE_NATIVE_poly1305_set_key
  90 void
  91 _nettle_poly1305_set_key_c(struct poly1305_ctx *ctx,
  92                const uint8_t key[16]);
  93 # define _nettle_poly1305_set_key _nettle_poly1305_set_key_c
  94 #endif
  95
  96 #if HAVE_NATIVE_poly1305_block
  97 void
  98 _nettle_poly1305_block_c(struct poly1305_ctx *ctx, const uint8_t *m,
  99                unsigned t4);
 100 # define _nettle_poly1305_block _nettle_poly1305_block_c
 101 #endif
 102
 103 #if HAVE_NATIVE_poly1305_digest
 104 void
 105 _nettle_poly1305_digest_c(struct poly1305_ctx *ctx,
 106                union nettle_block16 *s);
 107 # define _nettle_poly1305_digest _nettle_poly1305_digest_c
 108 #endif
 109
 110 void
 111 _nettle_poly1305_set_key(struct poly1305_ctx *ctx, const uint8_t key[16])
 112 {
 113   uint32_t t0,t1,t2,t3;
 114
 115   t0 = LE_READ_UINT32(key);
 116   t1 = LE_READ_UINT32(key+4);
 117   t2 = LE_READ_UINT32(key+8);
 118   t3 = LE_READ_UINT32(key+12);
 119
 120   ctx->r0 = t0 & 0x3ffffff; t0 >>= 26; t0 |= t1 << 6;
 121   ctx->r1 = t0 & 0x3ffff03; t1 >>= 20; t1 |= t2 << 12;
 122   ctx->r2 = t1 & 0x3ffc0ff; t2 >>= 14; t2 |= t3 << 18;
 123   ctx->r3 = t2 & 0x3f03fff; t3 >>= 8;
 124   ctx->r4 = t3 & 0x00fffff;
 125
 126   ctx->s1 = ctx->r1 * 5;
 127   ctx->s2 = ctx->r2 * 5;
 128   ctx->s3 = ctx->r3 * 5;
 129   ctx->s4 = ctx->r4 * 5;
 130
 131   ctx->h0 = 0;
 132   ctx->h1 = 0;
 133   ctx->h2 = 0;
 134   ctx->h3 = 0;
 135   ctx->h4 = 0;
 136 }
 137
 138 void
 139 _nettle_poly1305_block (struct poly1305_ctx *ctx, const uint8_t *m, unsigned t4)
 140 {
 141   uint32_t t0,t1,t2,t3;
 142   uint32_t b;
 143   uint64_t t[5];
 144   uint64_t c;
 145
 146   t0 = LE_READ_UINT32(m);
 147   t1 = LE_READ_UINT32(m+4);
 148   t2 = LE_READ_UINT32(m+8);
 149   t3 = LE_READ_UINT32(m+12);
 150
 151   ctx->h0 += t0 & 0x3ffffff;
 152   ctx->h1 += ((((uint64_t)t1 << 32) | t0) >> 26) & 0x3ffffff;
 153   ctx->h2 += ((((uint64_t)t2 << 32) | t1) >> 20) & 0x3ffffff;
 154   ctx->h3 += ((((uint64_t)t3 << 32) | t2) >> 14) & 0x3ffffff;
 155   ctx->h4 += (t3 >> 8) | ((uint32_t) t4 << 24);
 156
 157   /* poly1305_donna_mul: */
 158   t[0]  = mul32x32_64(ctx->h0,ctx->r0) + mul32x32_64(ctx->h1,ctx->s4) + mul32x32_64(ctx->h2,ctx->s3) + mul32x32_64(ctx->h3,ctx->s2) + mul32x32_64(ctx->h4,ctx->s1);
 159   t[1]  = mul32x32_64(ctx->h0,ctx->r1) + mul32x32_64(ctx->h1,ctx->r0) + mul32x32_64(ctx->h2,ctx->s4) + mul32x32_64(ctx->h3,ctx->s3) + mul32x32_64(ctx->h4,ctx->s2);
 160   t[2]  = mul32x32_64(ctx->h0,ctx->r2) + mul32x32_64(ctx->h1,ctx->r1) + mul32x32_64(ctx->h2,ctx->r0) + mul32x32_64(ctx->h3,ctx->s4) + mul32x32_64(ctx->h4,ctx->s3);
 161   t[3]  = mul32x32_64(ctx->h0,ctx->r3) + mul32x32_64(ctx->h1,ctx->r2) + mul32x32_64(ctx->h2,ctx->r1) + mul32x32_64(ctx->h3,ctx->r0) + mul32x32_64(ctx->h4,ctx->s4);
 162   t[4]  = mul32x32_64(ctx->h0,ctx->r4) + mul32x32_64(ctx->h1,ctx->r3) + mul32x32_64(ctx->h2,ctx->r2) + mul32x32_64(ctx->h3,ctx->r1) + mul32x32_64(ctx->h4,ctx->r0);
 163
 164   ctx->h0 = (uint32_t)t[0] & 0x3ffffff; c =           (t[0] >> 26);
 165   t[1] += c;      ctx->h1 = (uint32_t)t[1] & 0x3ffffff; b = (uint32_t)(t[1] >> 26);
 166   t[2] += b;      ctx->h2 = (uint32_t)t[2] & 0x3ffffff; b = (uint32_t)(t[2] >> 26);
 167   t[3] += b;      ctx->h3 = (uint32_t)t[3] & 0x3ffffff; b = (uint32_t)(t[3] >> 26);
 168   t[4] += b;      ctx->h4 = (uint32_t)t[4] & 0x3ffffff; b = (uint32_t)(t[4] >> 26);
 169   ctx->h0 += b * 5;
 170 }
 171
 172 /* Adds digest to the nonce */
 173 void
 174 _nettle_poly1305_digest (struct poly1305_ctx *ctx, union nettle_block16 *s)
 175 {
 176   uint32_t b, nb;
 177   uint64_t f0,f1,f2,f3;
 178   uint32_t g0,g1,g2,g3,g4;
 179
 180   b = ctx->h0 >> 26; ctx->h0 = ctx->h0 & 0x3ffffff;
 181   ctx->h1 +=     b; b = ctx->h1 >> 26; ctx->h1 = ctx->h1 & 0x3ffffff;
 182   ctx->h2 +=     b; b = ctx->h2 >> 26; ctx->h2 = ctx->h2 & 0x3ffffff;
 183   ctx->h3 +=     b; b = ctx->h3 >> 26; ctx->h3 = ctx->h3 & 0x3ffffff;
 184   ctx->h4 +=     b; b = ctx->h4 >> 26; ctx->h4 = ctx->h4 & 0x3ffffff;
 185   ctx->h0 += b * 5; b = ctx->h0 >> 26; ctx->h0 = ctx->h0 & 0x3ffffff;
 186   ctx->h1 +=     b;
 187
 188   g0 = ctx->h0 + 5; b = g0 >> 26; g0 &= 0x3ffffff;
 189   g1 = ctx->h1 + b; b = g1 >> 26; g1 &= 0x3ffffff;
 190   g2 = ctx->h2 + b; b = g2 >> 26; g2 &= 0x3ffffff;
 191   g3 = ctx->h3 + b; b = g3 >> 26; g3 &= 0x3ffffff;
 192   g4 = ctx->h4 + b - (1 << 26);
 193
 194   b = (g4 >> 31) - 1;
 195   nb = ~b;
 196   ctx->h0 = (ctx->h0 & nb) | (g0 & b);
 197   ctx->h1 = (ctx->h1 & nb) | (g1 & b);
 198   ctx->h2 = (ctx->h2 & nb) | (g2 & b);
 199   ctx->h3 = (ctx->h3 & nb) | (g3 & b);
 200   ctx->h4 = (ctx->h4 & nb) | (g4 & b);
 201
 202   /* FIXME: Take advantage of s being aligned as an unsigned long. */
 203   f0 = ((ctx->h0    )|(ctx->h1<<26)) + (uint64_t)LE_READ_UINT32(s->b);
 204   f1 = ((ctx->h1>> 6)|(ctx->h2<<20)) + (uint64_t)LE_READ_UINT32(s->b+4);
 205   f2 = ((ctx->h2>>12)|(ctx->h3<<14)) + (uint64_t)LE_READ_UINT32(s->b+8);
 206   f3 = ((ctx->h3>>18)|(ctx->h4<< 8)) + (uint64_t)LE_READ_UINT32(s->b+12);
 207
 208   LE_WRITE_UINT32(s->b, f0);
 209   f1 += (f0 >> 32);
 210   LE_WRITE_UINT32(s->b+4, f1);
 211   f2 += (f1 >> 32);
 212   LE_WRITE_UINT32(s->b+8, f2);
 213   f3 += (f2 >> 32);
 214   LE_WRITE_UINT32(s->b+12, f3);
 215
 216   ctx->h0 = 0;
 217   ctx->h1 = 0;
 218   ctx->h2 = 0;
 219   ctx->h3 = 0;
 220   ctx->h4 = 0;
 221 }