libsec: sync with 9front

cinap_lenrek committed 9 years ago

Commit b4d00e31 parent a50be995 files · +339 −154Browse files

Unified · Split

5 files

include/libsec.h +13 −2
libsec/Makefile +1 −0
libsec/chacha.c +110 −45
libsec/salsa.c +96 −107
libsec/scrypt.c +119 −0

@@ -89,6 +89,7 @@ enum · 88 unmodified lines
89	89	ChachaBsize= 64,
90	90	ChachaKeylen= 256/8,
91	91	ChachaIVlen= 96/8,
	92	+ XChachaIVlen= 192/8,
92	93	};
93	94
94	95	typedef struct Chachastate Chachastate;
@@ -103,6 +104,7 @@ struct Chachastate · 8 unmodified lines
103	104	u32int iv[3];
104	105	};
105	106	};
	107	+ u32int xkey[8];
106	108	int rounds;
107	109	int ivwords;
108	110	};
@@ -113,6 +115,8 @@ void chacha_setblock(Chachastate*, u64int); · 4 unmodified lines
113	115	void chacha_encrypt(uchar, ulong, Chachastate);
114	116	void chacha_encrypt2(uchar, uchar, ulong, Chachastate*);
115	117
	118	+void hchacha(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
	119	+
116	120	void ccpoly_encrypt(uchar dat, ulong ndat, uchar aad, ulong naad, uchar tag[16], Chachastate *cs);
117	121	int ccpoly_decrypt(uchar dat, ulong ndat, uchar aad, ulong naad, uchar tag[16], Chachastate *cs);
118	122
@@ -131,7 +135,7 @@ typedef struct Salsastate Salsastate; · 12 unmodified lines
131	135	struct Salsastate
132	136	{
133	137	u32int input[16];
134		− u32int key[8];
	138	+ u32int xkey[8];
135	139	int rounds;
136	140	int ivwords;
137	141	};
@@ -142,6 +146,8 @@ void salsa_setblock(Salsastate*, u64int); · 4 unmodified lines
142	146	void salsa_encrypt(uchar, ulong, Salsastate);
143	147	void salsa_encrypt2(uchar, uchar, ulong, Salsastate*);
144	148
	149	+void salsa_core(u32int in[16], u32int out[16], int rounds);
	150	+
145	151	void hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
146	152
147	153	/*
@@ -485,7 +491,7 @@ typedef struct ECpoint{ · 337 unmodified lines
485	491	int inf;
486	492	mpint *x;
487	493	mpint *y;
488		− mpint *z;
	494	+ mpint z; / nil when using affine coordinates */
489	495	} ECpoint;
490	496
491	497	typedef ECpoint ECpub;
@@ -564,6 +570,11 @@ void curve25519_dh_finish(uchar x[32], uchar y[32], uchar z[32]); · 72 unmodified lines
564	570	void pbkdf2_x(uchar p, ulong plen, uchar s, ulong slen, ulong rounds, uchar *d, ulong dlen,
565	571	DigestState* (x)(uchar, ulong, uchar, ulong, uchar, DigestState*), int xlen);
566	572
	573	+/* scrypt password-based key derivation function */
	574	+char* scrypt(uchar p, ulong plen, uchar s, ulong slen,
	575	+ ulong N, ulong R, ulong P,
	576	+ uchar *d, ulong dlen);
	577	+
567	578	/* hmac-based key derivation function (rfc5869) */
568	579	void hkdf_x(uchar salt, ulong nsalt, uchar info, ulong ninfo, uchar key, ulong nkey, uchar d, ulong dlen,
569	580	DigestState* (x)(uchar, ulong, uchar, ulong, uchar, DigestState*), int xlen);

libsec/Makefile+1−0

@@ -58,6 +58,7 @@ OFILES=\ · 57 unmodified lines
58	58	rsagen.$O\
59	59	rsaprivtopub.$O\
60	60	salsa.$O\
	61	+ scrypt.$O\
61	62	secp256k1.$O\
62	63	secp256r1.$O\
63	64	secp384r1.$O\

libsec/chacha.c+110−45

@@ -15,13 +15,13 @@ enum{ · 14 unmodified lines
15	15	};
16	16
17	17	/* little-endian data order */
18		−#define GET4(p) ((((((p)[3]<<8) \| (p)[2])<<8) \| (p)[1])<<8 \| (p)[0])
19		−#define PUT4(p, v) (((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v))
	18	+#define GET4(p) ((p)[0]\|((p)[1]<<8)\|((p)[2]<<16)\|((p)[3]<<24))
	19	+#define PUT4(p,v) (p)[0]=(v);(p)[1]=(v)>>8;(p)[2]=(v)>>16;(p)[3]=(v)>>24
20	20
21	21	#define ROTATE(v,c) ((u32int)((v) << (c)) \| ((v) >> (32 - (c))))
22	22
23	23	#define QUARTERROUND(ia,ib,ic,id) { \
24		− u32int a, b, c, d, t;\
	24	+ u32int a, b, c, d, t; \
25	25	a = x[ia]; b = x[ib]; c = x[ic]; d = x[id]; \
26	26	a += b; t = d^a; d = ROTATE(t,16); \
27	27	c += d; t = b^c; b = ROTATE(t,12); \
@@ -32,12 +32,9 @@ enum{ · 4 unmodified lines
32	32
33	33	#define ENCRYPT(s, x, y, d) {\
34	34	u32int v; \
35		− uchar sp, dp; \
36		− sp = (s); \
37		− v = GET4(sp); \
	35	+ v = GET4(s); \
38	36	v ^= (x)+(y); \
39		− dp = (d); \
40		− PUT4(dp, v); \
	37	+ PUT4(d, v); \
41	38	}
42	39
43	40	static uchar sigma[16] = "expand 32-byte k";
@@ -57,7 +54,8 @@ setupChachastate(Chachastate s, uchar key, ulong keylen, uchar *iv, ulong ivle · 13 unmodified lines
57	54	{
58	55	if(keylen != 256/8 && keylen != 128/8)
59	56	sysfatal("invalid chacha key length");
60		− if(ivlen != 96/8 && ivlen != 64/8)
	57	+ if(ivlen != 64/8 && ivlen != 96/8
	58	+ && ivlen != 128/8 && ivlen != 192/8) /* hchacha, xchacha */
61	59	sysfatal("invalid chacha iv length");
62	60	if(rounds == 0)
63	61	rounds = 20;
@@ -70,7 +68,16 @@ setupChachastate(Chachastate s, uchar key, ulong keylen, uchar *iv, ulong ivle · 6 unmodified lines
70	68	load(&s->input[4], key, 4);
71	69	load(&s->input[8], key, 4);
72	70	}
73		− s->ivwords = ivlen/sizeof(u32int);
	71	+ s->xkey[0] = s->input[4];
	72	+ s->xkey[1] = s->input[5];
	73	+ s->xkey[2] = s->input[6];
	74	+ s->xkey[3] = s->input[7];
	75	+ s->xkey[4] = s->input[8];
	76	+ s->xkey[5] = s->input[9];
	77	+ s->xkey[6] = s->input[10];
	78	+ s->xkey[7] = s->input[11];
	79	+
	80	+ s->ivwords = ivlen/4;
74	81	s->input[12] = 0;
75	82	s->input[13] = 0;
76	83	if(iv == nil){
@@ -80,9 +87,88 @@ setupChachastate(Chachastate s, uchar key, ulong keylen, uchar *iv, ulong ivle · 3 unmodified lines
80	87	chacha_setiv(s, iv);
81	88	}
82	89
	90	+static void
	91	+dorounds(u32int x[Blockwords], int rounds)
	92	+{
	93	+ for(; rounds > 0; rounds -= 2) {
	94	+ QUARTERROUND(0, 4, 8,12)
	95	+ QUARTERROUND(1, 5, 9,13)
	96	+ QUARTERROUND(2, 6,10,14)
	97	+ QUARTERROUND(3, 7,11,15)
	98	+
	99	+ QUARTERROUND(0, 5,10,15)
	100	+ QUARTERROUND(1, 6,11,12)
	101	+ QUARTERROUND(2, 7, 8,13)
	102	+ QUARTERROUND(3, 4, 9,14)
	103	+ }
	104	+}
	105	+
	106	+static void
	107	+hchachablock(uchar h[32], Chachastate *s)
	108	+{
	109	+ u32int x[16];
	110	+
	111	+ x[0] = s->input[0];
	112	+ x[1] = s->input[1];
	113	+ x[2] = s->input[2];
	114	+ x[3] = s->input[3];
	115	+ x[4] = s->input[4];
	116	+ x[5] = s->input[5];
	117	+ x[6] = s->input[6];
	118	+ x[7] = s->input[7];
	119	+ x[8] = s->input[8];
	120	+ x[9] = s->input[9];
	121	+ x[10] = s->input[10];
	122	+ x[11] = s->input[11];
	123	+ x[12] = s->input[12];
	124	+ x[13] = s->input[13];
	125	+ x[14] = s->input[14];
	126	+ x[15] = s->input[15];
	127	+
	128	+ dorounds(x, s->rounds);
	129	+
	130	+ PUT4(h+0*4, x[0]);
	131	+ PUT4(h+1*4, x[1]);
	132	+ PUT4(h+2*4, x[2]);
	133	+ PUT4(h+3*4, x[3]);
	134	+ PUT4(h+4*4, x[12]);
	135	+ PUT4(h+5*4, x[13]);
	136	+ PUT4(h+6*4, x[14]);
	137	+ PUT4(h+7*4, x[15]);
	138	+}
	139	+
83	140	void
84	141	chacha_setiv(Chachastate s, uchar iv)
85	142	{
	143	+ if(s->ivwords == 192/32){
	144	+ /* xchacha with 192-bit iv */
	145	+ u32int counter[2];
	146	+ uchar h[32];
	147	+
	148	+ s->input[4] = s->xkey[0];
	149	+ s->input[5] = s->xkey[1];
	150	+ s->input[6] = s->xkey[2];
	151	+ s->input[7] = s->xkey[3];
	152	+ s->input[8] = s->xkey[4];
	153	+ s->input[9] = s->xkey[5];
	154	+ s->input[10] = s->xkey[6];
	155	+ s->input[11] = s->xkey[7];
	156	+
	157	+ counter[0] = s->input[12];
	158	+ counter[1] = s->input[13];
	159	+
	160	+ load(&s->input[12], iv, 4);
	161	+
	162	+ hchachablock(h, s);
	163	+ load(&s->input[4], h, 8);
	164	+ memset(h, 0, 32);
	165	+
	166	+ s->input[12] = counter[0];
	167	+ s->input[13] = counter[1];
	168	+
	169	+ load(&s->input[14], iv+16, 2);
	170	+ return;
	171	+ }
86	172	load(&s->input[16 - s->ivwords], iv, s->ivwords);
87	173	}
88	174
@@ -90,7 +176,7 @@ void · 1 unmodified line
90	176	chacha_setblock(Chachastate *s, u64int blockno)
91	177	{
92	178	s->input[12] = blockno;
93		− if(s->ivwords == 2)
	179	+ if(s->ivwords != 3)
94	180	s->input[13] = blockno>>32;
95	181	}
96	182
@@ -98,9 +184,8 @@ static void · 1 unmodified line
98	184	encryptblock(Chachastate s, uchar src, uchar *dst)
99	185	{
100	186	u32int x[Blockwords];
101		− int i, rounds;
	187	+ int i;
102	188
103		− rounds = s->rounds;
104	189	x[0] = s->input[0];
105	190	x[1] = s->input[1];
106	191	x[2] = s->input[2];
@@ -117,37 +202,8 @@ encryptblock(Chachastate s, uchar src, uchar *dst) · 10 unmodified lines
117	202	x[13] = s->input[13];
118	203	x[14] = s->input[14];
119	204	x[15] = s->input[15];
	205	+ dorounds(x, s->rounds);
120	206
121		− for(i = rounds; i > 0; i -= 2) {
122		− QUARTERROUND(0, 4, 8,12)
123		− QUARTERROUND(1, 5, 9,13)
124		− QUARTERROUND(2, 6,10,14)
125		− QUARTERROUND(3, 7,11,15)
126		−
127		− QUARTERROUND(0, 5,10,15)
128		− QUARTERROUND(1, 6,11,12)
129		− QUARTERROUND(2, 7, 8,13)
130		− QUARTERROUND(3, 4, 9,14)
131		− }
132		−
133		−#ifdef FULL_UNROLL
134		− ENCRYPT(src+04, x[0], s->input[0], dst+04);
135		− ENCRYPT(src+14, x[1], s->input[1], dst+14);
136		− ENCRYPT(src+24, x[2], s->input[2], dst+24);
137		− ENCRYPT(src+34, x[3], s->input[3], dst+34);
138		− ENCRYPT(src+44, x[4], s->input[4], dst+44);
139		− ENCRYPT(src+54, x[5], s->input[5], dst+54);
140		− ENCRYPT(src+64, x[6], s->input[6], dst+64);
141		− ENCRYPT(src+74, x[7], s->input[7], dst+74);
142		− ENCRYPT(src+84, x[8], s->input[8], dst+84);
143		− ENCRYPT(src+94, x[9], s->input[9], dst+94);
144		− ENCRYPT(src+104, x[10], s->input[10], dst+104);
145		− ENCRYPT(src+114, x[11], s->input[11], dst+114);
146		− ENCRYPT(src+124, x[12], s->input[12], dst+124);
147		− ENCRYPT(src+134, x[13], s->input[13], dst+134);
148		− ENCRYPT(src+144, x[14], s->input[14], dst+144);
149		− ENCRYPT(src+154, x[15], s->input[15], dst+154);
150		−#else
151	207	for(i=0; i<nelem(x); i+=4){
152	208	ENCRYPT(src, x[i], s->input[i], dst);
153	209	ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);
@@ -156,9 +212,8 @@ encryptblock(Chachastate s, uchar src, uchar *dst) · 2 unmodified lines
156	212	src += 16;
157	213	dst += 16;
158	214	}
159		−#endif
160	215
161		− if(++s->input[12] == 0 && s->ivwords == 2)
	216	+ if(++s->input[12] == 0 && s->ivwords != 3)
162	217	s->input[13]++;
163	218	}
164	219
@@ -184,3 +239,13 @@ chacha_encrypt(uchar buf, ulong bytes, Chachastate s) · 19 unmodified lines
184	239	{
185	240	chacha_encrypt2(buf, buf, bytes, s);
186	241	}
	242	+
	243	+void
	244	+hchacha(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)
	245	+{
	246	+ Chachastate s[1];
	247	+
	248	+ setupChachastate(s, key, keylen, nonce, 16, rounds);
	249	+ hchachablock(h, s);
	250	+ memset(s, 0, sizeof(s));
	251	+}

libsec/salsa.c+96−107

@@ -1,24 +1,17 @@
1	1	#include "os.h"
2	2	#include <libsec.h>
3	3
4		−enum{
5		− Blockwords= SalsaBsize/sizeof(u32int)
6		−};
7		−
8	4	/* little-endian data order */
9		−#define GET4(p) ((((((p)[3]<<8) \| (p)[2])<<8) \| (p)[1])<<8 \| (p)[0])
10		−#define PUT4(p, v) (((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v))
	5	+#define GET4(p) ((p)[0]\|((p)[1]<<8)\|((p)[2]<<16)\|((p)[3]<<24))
	6	+#define PUT4(p,v) (p)[0]=(v);(p)[1]=(v)>>8;(p)[2]=(v)>>16;(p)[3]=(v)>>24
11	7
12	8	#define ROTATE(v,c) (t = v, (u32int)(t << (c)) \| (t >> (32 - (c))))
13	9
14	10	#define ENCRYPT(s, x, y, d) {\
15	11	u32int v; \
16		− uchar sp, dp; \
17		− sp = (s); \
18		− v = GET4(sp); \
	12	+ v = GET4(s); \
19	13	v ^= (x)+(y); \
20		− dp = (d); \
21		− PUT4(dp, v); \
	14	+ PUT4(d, v); \
22	15	}
23	16
24	17	static uchar sigma[16] = "expand 32-byte k";
@@ -38,7 +31,8 @@ setupSalsastate(Salsastate s, uchar key, ulong keylen, uchar *iv, ulong ivlen, · 13 unmodified lines
38	31	{
39	32	if(keylen != 256/8 && keylen != 128/8)
40	33	sysfatal("invalid salsa key length");
41		− if(ivlen != 64/8 && ivlen != 128/8 && ivlen != 192/8)
	34	+ if(ivlen != 64/8
	35	+ && ivlen != 128/8 && ivlen != 192/8) /* hsalsa, xsalsa */
42	36	sysfatal("invalid salsa iv length");
43	37	if(rounds == 0)
44	38	rounds = 20;
@@ -58,14 +52,14 @@ setupSalsastate(Salsastate s, uchar key, ulong keylen, uchar *iv, ulong ivlen, · 13 unmodified lines
58	52	load(&s->input[11], key, 4);
59	53	load(&s->input[15], tau +4*3, 1);
60	54	}
61		− s->key[0] = s->input[1];
62		− s->key[1] = s->input[2];
63		− s->key[2] = s->input[3];
64		− s->key[3] = s->input[4];
65		− s->key[4] = s->input[11];
66		− s->key[5] = s->input[12];
67		− s->key[6] = s->input[13];
68		− s->key[7] = s->input[14];
	55	+ s->xkey[0] = s->input[1];
	56	+ s->xkey[1] = s->input[2];
	57	+ s->xkey[2] = s->input[3];
	58	+ s->xkey[3] = s->input[4];
	59	+ s->xkey[4] = s->input[11];
	60	+ s->xkey[5] = s->input[12];
	61	+ s->xkey[6] = s->input[13];
	62	+ s->xkey[7] = s->input[14];
69	63
70	64	s->ivwords = ivlen/4;
71	65	s->input[8] = 0;
@@ -78,30 +72,11 @@ setupSalsastate(Salsastate s, uchar key, ulong keylen, uchar *iv, ulong ivlen, · 6 unmodified lines
78	72	}
79	73
80	74	static void
81		−hsalsablock(uchar h[32], Salsastate *s)
	75	+dorounds(u32int x[16], int rounds)
82	76	{
83		− u32int x[Blockwords], t;
84		− int i, rounds;
	77	+ u32int t;
85	78
86		− rounds = s->rounds;
87		− x[0] = s->input[0];
88		− x[1] = s->input[1];
89		− x[2] = s->input[2];
90		− x[3] = s->input[3];
91		− x[4] = s->input[4];
92		− x[5] = s->input[5];
93		− x[6] = s->input[6];
94		− x[7] = s->input[7];
95		− x[8] = s->input[8];
96		− x[9] = s->input[9];
97		− x[10] = s->input[10];
98		− x[11] = s->input[11];
99		− x[12] = s->input[12];
100		− x[13] = s->input[13];
101		− x[14] = s->input[14];
102		− x[15] = s->input[15];
103		−
104		− for(i = rounds; i > 0; i -= 2) {
	79	+ for(; rounds > 0; rounds -= 2) {
105	80	x[4] ^= ROTATE( x[0]+x[12], 7);
106	81	x[8] ^= ROTATE( x[4]+ x[0], 9);
107	82	x[12] ^= ROTATE( x[8]+ x[4],13);
@@ -135,6 +110,31 @@ hsalsablock(uchar h[32], Salsastate *s) · 27 unmodified lines
135	110	x[14] ^= ROTATE(x[13]+x[12],13);
136	111	x[15] ^= ROTATE(x[14]+x[13],18);
137	112	}
	113	+}
	114	+
	115	+static void
	116	+hsalsablock(uchar h[32], Salsastate *s)
	117	+{
	118	+ u32int x[16];
	119	+
	120	+ x[0] = s->input[0];
	121	+ x[1] = s->input[1];
	122	+ x[2] = s->input[2];
	123	+ x[3] = s->input[3];
	124	+ x[4] = s->input[4];
	125	+ x[5] = s->input[5];
	126	+ x[6] = s->input[6];
	127	+ x[7] = s->input[7];
	128	+ x[8] = s->input[8];
	129	+ x[9] = s->input[9];
	130	+ x[10] = s->input[10];
	131	+ x[11] = s->input[11];
	132	+ x[12] = s->input[12];
	133	+ x[13] = s->input[13];
	134	+ x[14] = s->input[14];
	135	+ x[15] = s->input[15];
	136	+
	137	+ dorounds(x, s->rounds);
138	138
139	139	PUT4(h+0*4, x[0]);
140	140	PUT4(h+1*4, x[5]);
@@ -150,7 +150,7 @@ void · 9 unmodified lines
150	150	salsa_setiv(Salsastate s, uchar iv)
151	151	{
152	152	if(s->ivwords == 128/32){
153		− /* hsalsa 128-bit iv */
	153	+ /* hsalsa with 128-bit iv */
154	154	load(&s->input[6], iv, 4);
155	155	return;
156	156	}
@@ -162,14 +162,14 @@ salsa_setiv(Salsastate s, uchar iv) · 5 unmodified lines
162	162	counter[0] = s->input[8];
163	163	counter[1] = s->input[9];
164	164
165		− s->input[1] = s->key[0];
166		− s->input[2] = s->key[1];
167		− s->input[3] = s->key[2];
168		− s->input[4] = s->key[3];
169		− s->input[11] = s->key[4];
170		− s->input[12] = s->key[5];
171		− s->input[13] = s->key[6];
172		− s->input[14] = s->key[7];
	165	+ s->input[1] = s->xkey[0];
	166	+ s->input[2] = s->xkey[1];
	167	+ s->input[3] = s->xkey[2];
	168	+ s->input[4] = s->xkey[3];
	169	+ s->input[11] = s->xkey[4];
	170	+ s->input[12] = s->xkey[5];
	171	+ s->input[13] = s->xkey[6];
	172	+ s->input[14] = s->xkey[7];
173	173
174	174	load(&s->input[6], iv, 4);
175	175
@@ -197,10 +197,9 @@ salsa_setblock(Salsastate *s, u64int blockno) · 21 unmodified lines
197	197	static void
198	198	encryptblock(Salsastate s, uchar src, uchar *dst)
199	199	{
200		− u32int x[Blockwords], t;
201		− int i, rounds;
	200	+ u32int x[16];
	201	+ int i;
202	202
203		− rounds = s->rounds;
204	203	x[0] = s->input[0];
205	204	x[1] = s->input[1];
206	205	x[2] = s->input[2];
@@ -218,59 +217,8 @@ encryptblock(Salsastate s, uchar src, uchar *dst) · 11 unmodified lines
218	217	x[14] = s->input[14];
219	218	x[15] = s->input[15];
220	219
221		− for(i = rounds; i > 0; i -= 2) {
222		− x[4] ^= ROTATE( x[0]+x[12], 7);
223		− x[8] ^= ROTATE( x[4]+ x[0], 9);
224		− x[12] ^= ROTATE( x[8]+ x[4],13);
225		− x[0] ^= ROTATE(x[12]+ x[8],18);
226		− x[9] ^= ROTATE( x[5]+ x[1], 7);
227		− x[13] ^= ROTATE( x[9]+ x[5], 9);
228		− x[1] ^= ROTATE(x[13]+ x[9],13);
229		− x[5] ^= ROTATE( x[1]+x[13],18);
230		− x[14] ^= ROTATE(x[10]+ x[6], 7);
231		− x[2] ^= ROTATE(x[14]+x[10], 9);
232		− x[6] ^= ROTATE( x[2]+x[14],13);
233		− x[10] ^= ROTATE( x[6]+ x[2],18);
234		− x[3] ^= ROTATE(x[15]+x[11], 7);
235		− x[7] ^= ROTATE( x[3]+x[15], 9);
236		− x[11] ^= ROTATE( x[7]+ x[3],13);
237		− x[15] ^= ROTATE(x[11]+ x[7],18);
238		− x[1] ^= ROTATE( x[0]+ x[3], 7);
239		− x[2] ^= ROTATE( x[1]+ x[0], 9);
240		− x[3] ^= ROTATE( x[2]+ x[1],13);
241		− x[0] ^= ROTATE( x[3]+ x[2],18);
242		− x[6] ^= ROTATE( x[5]+ x[4], 7);
243		− x[7] ^= ROTATE( x[6]+ x[5], 9);
244		− x[4] ^= ROTATE( x[7]+ x[6],13);
245		− x[5] ^= ROTATE( x[4]+ x[7],18);
246		− x[11] ^= ROTATE(x[10]+ x[9], 7);
247		− x[8] ^= ROTATE(x[11]+x[10], 9);
248		− x[9] ^= ROTATE( x[8]+x[11],13);
249		− x[10] ^= ROTATE( x[9]+ x[8],18);
250		− x[12] ^= ROTATE(x[15]+x[14], 7);
251		− x[13] ^= ROTATE(x[12]+x[15], 9);
252		− x[14] ^= ROTATE(x[13]+x[12],13);
253		− x[15] ^= ROTATE(x[14]+x[13],18);
254		− }
	220	+ dorounds(x, s->rounds);
255	221
256		−#ifdef FULL_UNROLL
257		− ENCRYPT(src+04, x[0], s->input[0], dst+04);
258		− ENCRYPT(src+14, x[1], s->input[1], dst+14);
259		− ENCRYPT(src+24, x[2], s->input[2], dst+24);
260		− ENCRYPT(src+34, x[3], s->input[3], dst+34);
261		− ENCRYPT(src+44, x[4], s->input[4], dst+44);
262		− ENCRYPT(src+54, x[5], s->input[5], dst+54);
263		− ENCRYPT(src+64, x[6], s->input[6], dst+64);
264		− ENCRYPT(src+74, x[7], s->input[7], dst+74);
265		− ENCRYPT(src+84, x[8], s->input[8], dst+84);
266		− ENCRYPT(src+94, x[9], s->input[9], dst+94);
267		− ENCRYPT(src+104, x[10], s->input[10], dst+104);
268		− ENCRYPT(src+114, x[11], s->input[11], dst+114);
269		− ENCRYPT(src+124, x[12], s->input[12], dst+124);
270		− ENCRYPT(src+134, x[13], s->input[13], dst+134);
271		− ENCRYPT(src+144, x[14], s->input[14], dst+144);
272		− ENCRYPT(src+154, x[15], s->input[15], dst+154);
273		−#else
274	222	for(i=0; i<nelem(x); i+=4){
275	223	ENCRYPT(src, x[i], s->input[i], dst);
276	224	ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);
@@ -279,7 +227,6 @@ encryptblock(Salsastate s, uchar src, uchar *dst) · 2 unmodified lines
279	227	src += 16;
280	228	dst += 16;
281	229	}
282		−#endif
283	230
284	231	if(++s->input[8] == 0)
285	232	s->input[9]++;
@@ -308,6 +255,48 @@ salsa_encrypt(uchar buf, ulong bytes, Salsastate s) · 22 unmodified lines
308	255	salsa_encrypt2(buf, buf, bytes, s);
309	256	}
310	257
	258	+void
	259	+salsa_core(u32int in[16], u32int out[16], int rounds)
	260	+{
	261	+ u32int x[16];
	262	+
	263	+ x[0] = in[0];
	264	+ x[1] = in[1];
	265	+ x[2] = in[2];
	266	+ x[3] = in[3];
	267	+ x[4] = in[4];
	268	+ x[5] = in[5];
	269	+ x[6] = in[6];
	270	+ x[7] = in[7];
	271	+ x[8] = in[8];
	272	+ x[9] = in[9];
	273	+ x[10] = in[10];
	274	+ x[11] = in[11];
	275	+ x[12] = in[12];
	276	+ x[13] = in[13];
	277	+ x[14] = in[14];
	278	+ x[15] = in[15];
	279	+
	280	+ dorounds(x, rounds);
	281	+
	282	+ out[0] = x[0] + in[0];
	283	+ out[1] = x[1] + in[1];
	284	+ out[2] = x[2] + in[2];
	285	+ out[3] = x[3] + in[3];
	286	+ out[4] = x[4] + in[4];
	287	+ out[5] = x[5] + in[5];
	288	+ out[6] = x[6] + in[6];
	289	+ out[7] = x[7] + in[7];
	290	+ out[8] = x[8] + in[8];
	291	+ out[9] = x[9] + in[9];
	292	+ out[10] = x[10] + in[10];
	293	+ out[11] = x[11] + in[11];
	294	+ out[12] = x[12] + in[12];
	295	+ out[13] = x[13] + in[13];
	296	+ out[14] = x[14] + in[14];
	297	+ out[15] = x[15] + in[15];
	298	+}
	299	+
311	300	void
312	301	hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)
313	302	{

libsec/scrypt.c+119−0

@@ -0,0 +1,119 @@
	1	+#include "os.h"
	2	+#include <libsec.h>
	3	+
	4	+#define movw(w, S, D) memmove(D, S, (w)*4)
	5	+
	6	+static void
	7	+xorw(ulong w, u32int S, u32int D)
	8	+{
	9	+ for(w /= 8; w; w--, D += 8, S += 8){
	10	+ D[0] ^= S[0];
	11	+ D[1] ^= S[1];
	12	+ D[2] ^= S[2];
	13	+ D[3] ^= S[3];
	14	+ D[4] ^= S[4];
	15	+ D[5] ^= S[5];
	16	+ D[6] ^= S[6];
	17	+ D[7] ^= S[7];
	18	+ }
	19	+}
	20	+
	21	+static void
	22	+scryptBlockMix(ulong R, u32int B, u32int Y)
	23	+{
	24	+ u32int X[16];
	25	+ ulong i;
	26	+
	27	+ R *= 2;
	28	+ movw(16, &B[(R-1)*16], X);
	29	+ for(i = 0; i < R; i += 2){
	30	+ xorw(16, &B[i*16], X);
	31	+ salsa_core(X, X, 8);
	32	+ movw(16, X, &Y[i*8]);
	33	+
	34	+ xorw(16, &B[(i+1)*16], X);
	35	+ salsa_core(X, X, 8);
	36	+ movw(16, X, &Y[i8 + R8]);
	37	+ }
	38	+}
	39	+
	40	+static void
	41	+scryptROMix(ulong R, ulong N, u32int V, u32int X, uchar *B)
	42	+{
	43	+ ulong w, i, d;
	44	+ u32int *Y;
	45	+
	46	+ w = R*32;
	47	+ for(i=0; i<w; i++, B+=4)
	48	+ X[i] = B[0] \| (B[1]<<8) \| (B[2]<<16) \| (B[3]<<24);
	49	+
	50	+ Y = &X[w];
	51	+ for(i=0; i<N; i += 2){
	52	+ movw(w, X, &V[i*w]);
	53	+ scryptBlockMix(R, X, Y);
	54	+
	55	+ movw(w, Y, &V[(i+1)*w]);
	56	+ scryptBlockMix(R, Y, X);
	57	+ }
	58	+ for(i=0; i<N; i += 2){
	59	+ xorw(w, &V[(X[w-16] & (N-1))*w], X);
	60	+ scryptBlockMix(R, X, Y);
	61	+
	62	+ xorw(w, &V[(Y[w-16] & (N-1))*w], Y);
	63	+ scryptBlockMix(R, Y, X);
	64	+ }
	65	+
	66	+ B -= w*4;
	67	+ for(i=0; i<w; i++, B+=4)
	68	+ d = X[i], B[0]=d, B[1]=d>>8, B[2]=d>>16, B[3]=d>>24;
	69	+}
	70	+
	71	+char*
	72	+scrypt(p, plen, s, slen, N, R, P, d, dlen)
	73	+ ulong plen, slen, dlen, N, R, P;
	74	+ uchar p, s, *d;
	75	+{
	76	+ static char oom[] = "out of memory";
	77	+
	78	+ ulong rb, i;
	79	+ u32int V, X;
	80	+ uchar *B;
	81	+
	82	+ if(P < 1)
	83	+ return "invalid parallelization parameter P";
	84	+ if(R < 1 \|\| R >= (1UL<<(31-7))/P)
	85	+ return "invalid block size parameter R";
	86	+ if(N < 2 \|\| (N & (N-1)) != 0 \|\| N >= (1UL<<(31-7))/R)
	87	+ return "invalid cpu/memory cost parameter N";
	88	+
	89	+ rb = R<<7;
	90	+ if((B = malloc(P*rb)) == nil)
	91	+ return oom;
	92	+ if((V = malloc(N*rb)) == nil){
	93	+ free(B);
	94	+ return oom;
	95	+ }
	96	+ if((X = malloc(2*rb)) == nil){
	97	+ free(V);
	98	+ free(B);
	99	+ return oom;
	100	+ }
	101	+
	102	+ pbkdf2_x(p, plen, s, slen, 1, B, P*rb, hmac_sha2_256, SHA2_256dlen);
	103	+
	104	+ for(i=0; i<P; i++)
	105	+ scryptROMix(R, N, V, X, &B[i*rb]);
	106	+
	107	+ memset(X, 0, 2*rb);
	108	+ free(X);
	109	+
	110	+ memset(V, 0, N*rb);
	111	+ free(V);
	112	+
	113	+ pbkdf2_x(p, plen, B, P*rb, 1, d, dlen, hmac_sha2_256, SHA2_256dlen);
	114	+
	115	+ memset(B, 0, P*rb);
	116	+ free(B);
	117	+
	118	+ return nil;
	119	+}

libsec: sync with 9front

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code