History

libsec: sync with 9front

cinap_lenrek committed 9 years ago

Commit b4d00e31 parent a50be995 files · +339 −154Browse files

Unified · Split

5 files
  1. include/libsec.h +13 −2
  2. libsec/Makefile +1 −0
  3. libsec/chacha.c +110 −45
  4. libsec/salsa.c +96 −107
  5. libsec/scrypt.c +119 −0
include/libsec.h+13−2
@@ -89,6 +89,7 @@ enum · 88 unmodified lines
89 ChachaBsize= 64,89 ChachaBsize= 64,
90 ChachaKeylen= 256/8,90 ChachaKeylen= 256/8,
91 ChachaIVlen= 96/8,91 ChachaIVlen= 96/8,
92 XChachaIVlen= 192/8,
92};93};
93 94
94typedef struct Chachastate Chachastate;95typedef struct Chachastate Chachastate;
@@ -103,6 +104,7 @@ struct Chachastate · 8 unmodified lines
103 u32int iv[3];104 u32int iv[3];
104 };105 };
105 };106 };
107 u32int xkey[8];
106 int rounds;108 int rounds;
107 int ivwords;109 int ivwords;
108};110};
@@ -113,6 +115,8 @@ void chacha_setblock(Chachastate*, u64int); · 4 unmodified lines
113void chacha_encrypt(uchar*, ulong, Chachastate*);115void chacha_encrypt(uchar*, ulong, Chachastate*);
114void chacha_encrypt2(uchar*, uchar*, ulong, Chachastate*);116void chacha_encrypt2(uchar*, uchar*, ulong, Chachastate*);
115 117
118void hchacha(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
119
116void ccpoly_encrypt(uchar *dat, ulong ndat, uchar *aad, ulong naad, uchar tag[16], Chachastate *cs);120void ccpoly_encrypt(uchar *dat, ulong ndat, uchar *aad, ulong naad, uchar tag[16], Chachastate *cs);
117int ccpoly_decrypt(uchar *dat, ulong ndat, uchar *aad, ulong naad, uchar tag[16], Chachastate *cs);121int ccpoly_decrypt(uchar *dat, ulong ndat, uchar *aad, ulong naad, uchar tag[16], Chachastate *cs);
118 122
@@ -131,7 +135,7 @@ typedef struct Salsastate Salsastate; · 12 unmodified lines
131struct Salsastate135struct Salsastate
132{136{
133 u32int input[16];137 u32int input[16];
134 u32int key[8];138 u32int xkey[8];
135 int rounds;139 int rounds;
136 int ivwords;140 int ivwords;
137};141};
@@ -142,6 +146,8 @@ void salsa_setblock(Salsastate*, u64int); · 4 unmodified lines
142void salsa_encrypt(uchar*, ulong, Salsastate*);146void salsa_encrypt(uchar*, ulong, Salsastate*);
143void salsa_encrypt2(uchar*, uchar*, ulong, Salsastate*);147void salsa_encrypt2(uchar*, uchar*, ulong, Salsastate*);
144 148
149void salsa_core(u32int in[16], u32int out[16], int rounds);
150
145void hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);151void hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds);
146 152
147/*153/*
@@ -485,7 +491,7 @@ typedef struct ECpoint{ · 337 unmodified lines
485 int inf;491 int inf;
486 mpint *x;492 mpint *x;
487 mpint *y;493 mpint *y;
488 mpint *z;494 mpint *z; /* nil when using affine coordinates */
489} ECpoint;495} ECpoint;
490 496
491typedef ECpoint ECpub;497typedef ECpoint ECpub;
@@ -564,6 +570,11 @@ void curve25519_dh_finish(uchar x[32], uchar y[32], uchar z[32]); · 72 unmodified lines
564void pbkdf2_x(uchar *p, ulong plen, uchar *s, ulong slen, ulong rounds, uchar *d, ulong dlen,570void pbkdf2_x(uchar *p, ulong plen, uchar *s, ulong slen, ulong rounds, uchar *d, ulong dlen,
565 DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);571 DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);
566 572
573/* scrypt password-based key derivation function */
574char* scrypt(uchar *p, ulong plen, uchar *s, ulong slen,
575 ulong N, ulong R, ulong P,
576 uchar *d, ulong dlen);
577
567/* hmac-based key derivation function (rfc5869) */578/* hmac-based key derivation function (rfc5869) */
568void hkdf_x(uchar *salt, ulong nsalt, uchar *info, ulong ninfo, uchar *key, ulong nkey, uchar *d, ulong dlen,579void hkdf_x(uchar *salt, ulong nsalt, uchar *info, ulong ninfo, uchar *key, ulong nkey, uchar *d, ulong dlen,
569 DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);580 DigestState* (*x)(uchar*, ulong, uchar*, ulong, uchar*, DigestState*), int xlen);
libsec/Makefile+1−0
@@ -58,6 +58,7 @@ OFILES=\ · 57 unmodified lines
58 rsagen.$O\58 rsagen.$O\
59 rsaprivtopub.$O\59 rsaprivtopub.$O\
60 salsa.$O\60 salsa.$O\
61 scrypt.$O\
61 secp256k1.$O\62 secp256k1.$O\
62 secp256r1.$O\63 secp256r1.$O\
63 secp384r1.$O\64 secp384r1.$O\
libsec/chacha.c+110−45
@@ -15,13 +15,13 @@ enum{ · 14 unmodified lines
15};15};
16 16
17/* little-endian data order */17/* little-endian data order */
18#define GET4(p) ((((((p)[3]<<8) | (p)[2])<<8) | (p)[1])<<8 | (p)[0])18#define GET4(p) ((p)[0]|((p)[1]<<8)|((p)[2]<<16)|((p)[3]<<24))
19#define PUT4(p, v) (((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v))19#define PUT4(p,v) (p)[0]=(v);(p)[1]=(v)>>8;(p)[2]=(v)>>16;(p)[3]=(v)>>24
20 20
21#define ROTATE(v,c) ((u32int)((v) << (c)) | ((v) >> (32 - (c))))21#define ROTATE(v,c) ((u32int)((v) << (c)) | ((v) >> (32 - (c))))
22 22
23#define QUARTERROUND(ia,ib,ic,id) { \23#define QUARTERROUND(ia,ib,ic,id) { \
24 u32int a, b, c, d, t;\24 u32int a, b, c, d, t; \
25 a = x[ia]; b = x[ib]; c = x[ic]; d = x[id]; \25 a = x[ia]; b = x[ib]; c = x[ic]; d = x[id]; \
26 a += b; t = d^a; d = ROTATE(t,16); \26 a += b; t = d^a; d = ROTATE(t,16); \
27 c += d; t = b^c; b = ROTATE(t,12); \27 c += d; t = b^c; b = ROTATE(t,12); \
@@ -32,12 +32,9 @@ enum{ · 4 unmodified lines
32 32
33#define ENCRYPT(s, x, y, d) {\33#define ENCRYPT(s, x, y, d) {\
34 u32int v; \34 u32int v; \
35 uchar *sp, *dp; \35 v = GET4(s); \
36 sp = (s); \
37 v = GET4(sp); \
38 v ^= (x)+(y); \36 v ^= (x)+(y); \
39 dp = (d); \37 PUT4(d, v); \
40 PUT4(dp, v); \
41}38}
42 39
43static uchar sigma[16] = "expand 32-byte k";40static uchar sigma[16] = "expand 32-byte k";
@@ -57,7 +54,8 @@ setupChachastate(Chachastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivle · 13 unmodified lines
57{54{
58 if(keylen != 256/8 && keylen != 128/8)55 if(keylen != 256/8 && keylen != 128/8)
59 sysfatal("invalid chacha key length");56 sysfatal("invalid chacha key length");
60 if(ivlen != 96/8 && ivlen != 64/8)57 if(ivlen != 64/8 && ivlen != 96/8
58 && ivlen != 128/8 && ivlen != 192/8) /* hchacha, xchacha */
61 sysfatal("invalid chacha iv length");59 sysfatal("invalid chacha iv length");
62 if(rounds == 0)60 if(rounds == 0)
63 rounds = 20;61 rounds = 20;
@@ -70,7 +68,16 @@ setupChachastate(Chachastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivle · 6 unmodified lines
70 load(&s->input[4], key, 4);68 load(&s->input[4], key, 4);
71 load(&s->input[8], key, 4);69 load(&s->input[8], key, 4);
72 }70 }
73 s->ivwords = ivlen/sizeof(u32int);71 s->xkey[0] = s->input[4];
72 s->xkey[1] = s->input[5];
73 s->xkey[2] = s->input[6];
74 s->xkey[3] = s->input[7];
75 s->xkey[4] = s->input[8];
76 s->xkey[5] = s->input[9];
77 s->xkey[6] = s->input[10];
78 s->xkey[7] = s->input[11];
79
80 s->ivwords = ivlen/4;
74 s->input[12] = 0;81 s->input[12] = 0;
75 s->input[13] = 0;82 s->input[13] = 0;
76 if(iv == nil){83 if(iv == nil){
@@ -80,9 +87,88 @@ setupChachastate(Chachastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivle · 3 unmodified lines
80 chacha_setiv(s, iv);87 chacha_setiv(s, iv);
81}88}
82 89
90static void
91dorounds(u32int x[Blockwords], int rounds)
92{
93 for(; rounds > 0; rounds -= 2) {
94 QUARTERROUND(0, 4, 8,12)
95 QUARTERROUND(1, 5, 9,13)
96 QUARTERROUND(2, 6,10,14)
97 QUARTERROUND(3, 7,11,15)
98
99 QUARTERROUND(0, 5,10,15)
100 QUARTERROUND(1, 6,11,12)
101 QUARTERROUND(2, 7, 8,13)
102 QUARTERROUND(3, 4, 9,14)
103 }
104}
105
106static void
107hchachablock(uchar h[32], Chachastate *s)
108{
109 u32int x[16];
110
111 x[0] = s->input[0];
112 x[1] = s->input[1];
113 x[2] = s->input[2];
114 x[3] = s->input[3];
115 x[4] = s->input[4];
116 x[5] = s->input[5];
117 x[6] = s->input[6];
118 x[7] = s->input[7];
119 x[8] = s->input[8];
120 x[9] = s->input[9];
121 x[10] = s->input[10];
122 x[11] = s->input[11];
123 x[12] = s->input[12];
124 x[13] = s->input[13];
125 x[14] = s->input[14];
126 x[15] = s->input[15];
127
128 dorounds(x, s->rounds);
129
130 PUT4(h+0*4, x[0]);
131 PUT4(h+1*4, x[1]);
132 PUT4(h+2*4, x[2]);
133 PUT4(h+3*4, x[3]);
134 PUT4(h+4*4, x[12]);
135 PUT4(h+5*4, x[13]);
136 PUT4(h+6*4, x[14]);
137 PUT4(h+7*4, x[15]);
138}
139
83void140void
84chacha_setiv(Chachastate *s, uchar *iv)141chacha_setiv(Chachastate *s, uchar *iv)
85{142{
143 if(s->ivwords == 192/32){
144 /* xchacha with 192-bit iv */
145 u32int counter[2];
146 uchar h[32];
147
148 s->input[4] = s->xkey[0];
149 s->input[5] = s->xkey[1];
150 s->input[6] = s->xkey[2];
151 s->input[7] = s->xkey[3];
152 s->input[8] = s->xkey[4];
153 s->input[9] = s->xkey[5];
154 s->input[10] = s->xkey[6];
155 s->input[11] = s->xkey[7];
156
157 counter[0] = s->input[12];
158 counter[1] = s->input[13];
159
160 load(&s->input[12], iv, 4);
161
162 hchachablock(h, s);
163 load(&s->input[4], h, 8);
164 memset(h, 0, 32);
165
166 s->input[12] = counter[0];
167 s->input[13] = counter[1];
168
169 load(&s->input[14], iv+16, 2);
170 return;
171 }
86 load(&s->input[16 - s->ivwords], iv, s->ivwords);172 load(&s->input[16 - s->ivwords], iv, s->ivwords);
87}173}
88 174
@@ -90,7 +176,7 @@ void · 1 unmodified line
90chacha_setblock(Chachastate *s, u64int blockno)176chacha_setblock(Chachastate *s, u64int blockno)
91{177{
92 s->input[12] = blockno;178 s->input[12] = blockno;
93 if(s->ivwords == 2)179 if(s->ivwords != 3)
94 s->input[13] = blockno>>32;180 s->input[13] = blockno>>32;
95}181}
96 182
@@ -98,9 +184,8 @@ static void · 1 unmodified line
98encryptblock(Chachastate *s, uchar *src, uchar *dst)184encryptblock(Chachastate *s, uchar *src, uchar *dst)
99{185{
100 u32int x[Blockwords];186 u32int x[Blockwords];
101 int i, rounds;187 int i;
102 188
103 rounds = s->rounds;
104 x[0] = s->input[0];189 x[0] = s->input[0];
105 x[1] = s->input[1];190 x[1] = s->input[1];
106 x[2] = s->input[2];191 x[2] = s->input[2];
@@ -117,37 +202,8 @@ encryptblock(Chachastate *s, uchar *src, uchar *dst) · 10 unmodified lines
117 x[13] = s->input[13];202 x[13] = s->input[13];
118 x[14] = s->input[14];203 x[14] = s->input[14];
119 x[15] = s->input[15];204 x[15] = s->input[15];
205 dorounds(x, s->rounds);
120 206
121 for(i = rounds; i > 0; i -= 2) {
122 QUARTERROUND(0, 4, 8,12)
123 QUARTERROUND(1, 5, 9,13)
124 QUARTERROUND(2, 6,10,14)
125 QUARTERROUND(3, 7,11,15)
126
127 QUARTERROUND(0, 5,10,15)
128 QUARTERROUND(1, 6,11,12)
129 QUARTERROUND(2, 7, 8,13)
130 QUARTERROUND(3, 4, 9,14)
131 }
132
133#ifdef FULL_UNROLL
134 ENCRYPT(src+0*4, x[0], s->input[0], dst+0*4);
135 ENCRYPT(src+1*4, x[1], s->input[1], dst+1*4);
136 ENCRYPT(src+2*4, x[2], s->input[2], dst+2*4);
137 ENCRYPT(src+3*4, x[3], s->input[3], dst+3*4);
138 ENCRYPT(src+4*4, x[4], s->input[4], dst+4*4);
139 ENCRYPT(src+5*4, x[5], s->input[5], dst+5*4);
140 ENCRYPT(src+6*4, x[6], s->input[6], dst+6*4);
141 ENCRYPT(src+7*4, x[7], s->input[7], dst+7*4);
142 ENCRYPT(src+8*4, x[8], s->input[8], dst+8*4);
143 ENCRYPT(src+9*4, x[9], s->input[9], dst+9*4);
144 ENCRYPT(src+10*4, x[10], s->input[10], dst+10*4);
145 ENCRYPT(src+11*4, x[11], s->input[11], dst+11*4);
146 ENCRYPT(src+12*4, x[12], s->input[12], dst+12*4);
147 ENCRYPT(src+13*4, x[13], s->input[13], dst+13*4);
148 ENCRYPT(src+14*4, x[14], s->input[14], dst+14*4);
149 ENCRYPT(src+15*4, x[15], s->input[15], dst+15*4);
150#else
151 for(i=0; i<nelem(x); i+=4){207 for(i=0; i<nelem(x); i+=4){
152 ENCRYPT(src, x[i], s->input[i], dst);208 ENCRYPT(src, x[i], s->input[i], dst);
153 ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);209 ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);
@@ -156,9 +212,8 @@ encryptblock(Chachastate *s, uchar *src, uchar *dst) · 2 unmodified lines
156 src += 16;212 src += 16;
157 dst += 16;213 dst += 16;
158 }214 }
159#endif
160 215
161 if(++s->input[12] == 0 && s->ivwords == 2)216 if(++s->input[12] == 0 && s->ivwords != 3)
162 s->input[13]++;217 s->input[13]++;
163}218}
164 219
@@ -184,3 +239,13 @@ chacha_encrypt(uchar *buf, ulong bytes, Chachastate *s) · 19 unmodified lines
184{239{
185 chacha_encrypt2(buf, buf, bytes, s);240 chacha_encrypt2(buf, buf, bytes, s);
186}241}
242
243void
244hchacha(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)
245{
246 Chachastate s[1];
247
248 setupChachastate(s, key, keylen, nonce, 16, rounds);
249 hchachablock(h, s);
250 memset(s, 0, sizeof(s));
251}
libsec/salsa.c+96−107
@@ -1,24 +1,17 @@
1#include "os.h"1#include "os.h"
2#include <libsec.h>2#include <libsec.h>
3 3
4enum{
5 Blockwords= SalsaBsize/sizeof(u32int)
6};
7
8/* little-endian data order */4/* little-endian data order */
9#define GET4(p) ((((((p)[3]<<8) | (p)[2])<<8) | (p)[1])<<8 | (p)[0])5#define GET4(p) ((p)[0]|((p)[1]<<8)|((p)[2]<<16)|((p)[3]<<24))
10#define PUT4(p, v) (((p)[0]=v), (v>>=8), ((p)[1]=v), (v>>=8), ((p)[2]=v), (v>>=8), ((p)[3]=v))6#define PUT4(p,v) (p)[0]=(v);(p)[1]=(v)>>8;(p)[2]=(v)>>16;(p)[3]=(v)>>24
11 7
12#define ROTATE(v,c) (t = v, (u32int)(t << (c)) | (t >> (32 - (c))))8#define ROTATE(v,c) (t = v, (u32int)(t << (c)) | (t >> (32 - (c))))
13 9
14#define ENCRYPT(s, x, y, d) {\10#define ENCRYPT(s, x, y, d) {\
15 u32int v; \11 u32int v; \
16 uchar *sp, *dp; \12 v = GET4(s); \
17 sp = (s); \
18 v = GET4(sp); \
19 v ^= (x)+(y); \13 v ^= (x)+(y); \
20 dp = (d); \14 PUT4(d, v); \
21 PUT4(dp, v); \
22}15}
23 16
24static uchar sigma[16] = "expand 32-byte k";17static uchar sigma[16] = "expand 32-byte k";
@@ -38,7 +31,8 @@ setupSalsastate(Salsastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivlen, · 13 unmodified lines
38{31{
39 if(keylen != 256/8 && keylen != 128/8)32 if(keylen != 256/8 && keylen != 128/8)
40 sysfatal("invalid salsa key length");33 sysfatal("invalid salsa key length");
41 if(ivlen != 64/8 && ivlen != 128/8 && ivlen != 192/8)34 if(ivlen != 64/8
35 && ivlen != 128/8 && ivlen != 192/8) /* hsalsa, xsalsa */
42 sysfatal("invalid salsa iv length");36 sysfatal("invalid salsa iv length");
43 if(rounds == 0)37 if(rounds == 0)
44 rounds = 20;38 rounds = 20;
@@ -58,14 +52,14 @@ setupSalsastate(Salsastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivlen, · 13 unmodified lines
58 load(&s->input[11], key, 4);52 load(&s->input[11], key, 4);
59 load(&s->input[15], tau +4*3, 1);53 load(&s->input[15], tau +4*3, 1);
60 }54 }
61 s->key[0] = s->input[1];55 s->xkey[0] = s->input[1];
62 s->key[1] = s->input[2];56 s->xkey[1] = s->input[2];
63 s->key[2] = s->input[3];57 s->xkey[2] = s->input[3];
64 s->key[3] = s->input[4];58 s->xkey[3] = s->input[4];
65 s->key[4] = s->input[11];59 s->xkey[4] = s->input[11];
66 s->key[5] = s->input[12];60 s->xkey[5] = s->input[12];
67 s->key[6] = s->input[13];61 s->xkey[6] = s->input[13];
68 s->key[7] = s->input[14];62 s->xkey[7] = s->input[14];
69 63
70 s->ivwords = ivlen/4;64 s->ivwords = ivlen/4;
71 s->input[8] = 0;65 s->input[8] = 0;
@@ -78,30 +72,11 @@ setupSalsastate(Salsastate *s, uchar *key, ulong keylen, uchar *iv, ulong ivlen, · 6 unmodified lines
78}72}
79 73
80static void74static void
81hsalsablock(uchar h[32], Salsastate *s)75dorounds(u32int x[16], int rounds)
82{76{
83 u32int x[Blockwords], t;77 u32int t;
84 int i, rounds;
85 78
86 rounds = s->rounds;79 for(; rounds > 0; rounds -= 2) {
87 x[0] = s->input[0];
88 x[1] = s->input[1];
89 x[2] = s->input[2];
90 x[3] = s->input[3];
91 x[4] = s->input[4];
92 x[5] = s->input[5];
93 x[6] = s->input[6];
94 x[7] = s->input[7];
95 x[8] = s->input[8];
96 x[9] = s->input[9];
97 x[10] = s->input[10];
98 x[11] = s->input[11];
99 x[12] = s->input[12];
100 x[13] = s->input[13];
101 x[14] = s->input[14];
102 x[15] = s->input[15];
103
104 for(i = rounds; i > 0; i -= 2) {
105 x[4] ^= ROTATE( x[0]+x[12], 7);80 x[4] ^= ROTATE( x[0]+x[12], 7);
106 x[8] ^= ROTATE( x[4]+ x[0], 9);81 x[8] ^= ROTATE( x[4]+ x[0], 9);
107 x[12] ^= ROTATE( x[8]+ x[4],13);82 x[12] ^= ROTATE( x[8]+ x[4],13);
@@ -135,6 +110,31 @@ hsalsablock(uchar h[32], Salsastate *s) · 27 unmodified lines
135 x[14] ^= ROTATE(x[13]+x[12],13);110 x[14] ^= ROTATE(x[13]+x[12],13);
136 x[15] ^= ROTATE(x[14]+x[13],18);111 x[15] ^= ROTATE(x[14]+x[13],18);
137 }112 }
113}
114
115static void
116hsalsablock(uchar h[32], Salsastate *s)
117{
118 u32int x[16];
119
120 x[0] = s->input[0];
121 x[1] = s->input[1];
122 x[2] = s->input[2];
123 x[3] = s->input[3];
124 x[4] = s->input[4];
125 x[5] = s->input[5];
126 x[6] = s->input[6];
127 x[7] = s->input[7];
128 x[8] = s->input[8];
129 x[9] = s->input[9];
130 x[10] = s->input[10];
131 x[11] = s->input[11];
132 x[12] = s->input[12];
133 x[13] = s->input[13];
134 x[14] = s->input[14];
135 x[15] = s->input[15];
136
137 dorounds(x, s->rounds);
138 138
139 PUT4(h+0*4, x[0]);139 PUT4(h+0*4, x[0]);
140 PUT4(h+1*4, x[5]);140 PUT4(h+1*4, x[5]);
@@ -150,7 +150,7 @@ void · 9 unmodified lines
150salsa_setiv(Salsastate *s, uchar *iv)150salsa_setiv(Salsastate *s, uchar *iv)
151{151{
152 if(s->ivwords == 128/32){152 if(s->ivwords == 128/32){
153 /* hsalsa 128-bit iv */153 /* hsalsa with 128-bit iv */
154 load(&s->input[6], iv, 4);154 load(&s->input[6], iv, 4);
155 return;155 return;
156 }156 }
@@ -162,14 +162,14 @@ salsa_setiv(Salsastate *s, uchar *iv) · 5 unmodified lines
162 counter[0] = s->input[8];162 counter[0] = s->input[8];
163 counter[1] = s->input[9];163 counter[1] = s->input[9];
164 164
165 s->input[1] = s->key[0];165 s->input[1] = s->xkey[0];
166 s->input[2] = s->key[1];166 s->input[2] = s->xkey[1];
167 s->input[3] = s->key[2];167 s->input[3] = s->xkey[2];
168 s->input[4] = s->key[3];168 s->input[4] = s->xkey[3];
169 s->input[11] = s->key[4];169 s->input[11] = s->xkey[4];
170 s->input[12] = s->key[5];170 s->input[12] = s->xkey[5];
171 s->input[13] = s->key[6];171 s->input[13] = s->xkey[6];
172 s->input[14] = s->key[7];172 s->input[14] = s->xkey[7];
173 173
174 load(&s->input[6], iv, 4);174 load(&s->input[6], iv, 4);
175 175
@@ -197,10 +197,9 @@ salsa_setblock(Salsastate *s, u64int blockno) · 21 unmodified lines
197static void197static void
198encryptblock(Salsastate *s, uchar *src, uchar *dst)198encryptblock(Salsastate *s, uchar *src, uchar *dst)
199{199{
200 u32int x[Blockwords], t;200 u32int x[16];
201 int i, rounds;201 int i;
202 202
203 rounds = s->rounds;
204 x[0] = s->input[0];203 x[0] = s->input[0];
205 x[1] = s->input[1];204 x[1] = s->input[1];
206 x[2] = s->input[2];205 x[2] = s->input[2];
@@ -218,59 +217,8 @@ encryptblock(Salsastate *s, uchar *src, uchar *dst) · 11 unmodified lines
218 x[14] = s->input[14];217 x[14] = s->input[14];
219 x[15] = s->input[15];218 x[15] = s->input[15];
220 219
221 for(i = rounds; i > 0; i -= 2) {220 dorounds(x, s->rounds);
222 x[4] ^= ROTATE( x[0]+x[12], 7);
223 x[8] ^= ROTATE( x[4]+ x[0], 9);
224 x[12] ^= ROTATE( x[8]+ x[4],13);
225 x[0] ^= ROTATE(x[12]+ x[8],18);
226 x[9] ^= ROTATE( x[5]+ x[1], 7);
227 x[13] ^= ROTATE( x[9]+ x[5], 9);
228 x[1] ^= ROTATE(x[13]+ x[9],13);
229 x[5] ^= ROTATE( x[1]+x[13],18);
230 x[14] ^= ROTATE(x[10]+ x[6], 7);
231 x[2] ^= ROTATE(x[14]+x[10], 9);
232 x[6] ^= ROTATE( x[2]+x[14],13);
233 x[10] ^= ROTATE( x[6]+ x[2],18);
234 x[3] ^= ROTATE(x[15]+x[11], 7);
235 x[7] ^= ROTATE( x[3]+x[15], 9);
236 x[11] ^= ROTATE( x[7]+ x[3],13);
237 x[15] ^= ROTATE(x[11]+ x[7],18);
238 x[1] ^= ROTATE( x[0]+ x[3], 7);
239 x[2] ^= ROTATE( x[1]+ x[0], 9);
240 x[3] ^= ROTATE( x[2]+ x[1],13);
241 x[0] ^= ROTATE( x[3]+ x[2],18);
242 x[6] ^= ROTATE( x[5]+ x[4], 7);
243 x[7] ^= ROTATE( x[6]+ x[5], 9);
244 x[4] ^= ROTATE( x[7]+ x[6],13);
245 x[5] ^= ROTATE( x[4]+ x[7],18);
246 x[11] ^= ROTATE(x[10]+ x[9], 7);
247 x[8] ^= ROTATE(x[11]+x[10], 9);
248 x[9] ^= ROTATE( x[8]+x[11],13);
249 x[10] ^= ROTATE( x[9]+ x[8],18);
250 x[12] ^= ROTATE(x[15]+x[14], 7);
251 x[13] ^= ROTATE(x[12]+x[15], 9);
252 x[14] ^= ROTATE(x[13]+x[12],13);
253 x[15] ^= ROTATE(x[14]+x[13],18);
254 }
255 221
256#ifdef FULL_UNROLL
257 ENCRYPT(src+0*4, x[0], s->input[0], dst+0*4);
258 ENCRYPT(src+1*4, x[1], s->input[1], dst+1*4);
259 ENCRYPT(src+2*4, x[2], s->input[2], dst+2*4);
260 ENCRYPT(src+3*4, x[3], s->input[3], dst+3*4);
261 ENCRYPT(src+4*4, x[4], s->input[4], dst+4*4);
262 ENCRYPT(src+5*4, x[5], s->input[5], dst+5*4);
263 ENCRYPT(src+6*4, x[6], s->input[6], dst+6*4);
264 ENCRYPT(src+7*4, x[7], s->input[7], dst+7*4);
265 ENCRYPT(src+8*4, x[8], s->input[8], dst+8*4);
266 ENCRYPT(src+9*4, x[9], s->input[9], dst+9*4);
267 ENCRYPT(src+10*4, x[10], s->input[10], dst+10*4);
268 ENCRYPT(src+11*4, x[11], s->input[11], dst+11*4);
269 ENCRYPT(src+12*4, x[12], s->input[12], dst+12*4);
270 ENCRYPT(src+13*4, x[13], s->input[13], dst+13*4);
271 ENCRYPT(src+14*4, x[14], s->input[14], dst+14*4);
272 ENCRYPT(src+15*4, x[15], s->input[15], dst+15*4);
273#else
274 for(i=0; i<nelem(x); i+=4){222 for(i=0; i<nelem(x); i+=4){
275 ENCRYPT(src, x[i], s->input[i], dst);223 ENCRYPT(src, x[i], s->input[i], dst);
276 ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);224 ENCRYPT(src+4, x[i+1], s->input[i+1], dst+4);
@@ -279,7 +227,6 @@ encryptblock(Salsastate *s, uchar *src, uchar *dst) · 2 unmodified lines
279 src += 16;227 src += 16;
280 dst += 16;228 dst += 16;
281 }229 }
282#endif
283 230
284 if(++s->input[8] == 0)231 if(++s->input[8] == 0)
285 s->input[9]++;232 s->input[9]++;
@@ -308,6 +255,48 @@ salsa_encrypt(uchar *buf, ulong bytes, Salsastate *s) · 22 unmodified lines
308 salsa_encrypt2(buf, buf, bytes, s);255 salsa_encrypt2(buf, buf, bytes, s);
309}256}
310 257
258void
259salsa_core(u32int in[16], u32int out[16], int rounds)
260{
261 u32int x[16];
262
263 x[0] = in[0];
264 x[1] = in[1];
265 x[2] = in[2];
266 x[3] = in[3];
267 x[4] = in[4];
268 x[5] = in[5];
269 x[6] = in[6];
270 x[7] = in[7];
271 x[8] = in[8];
272 x[9] = in[9];
273 x[10] = in[10];
274 x[11] = in[11];
275 x[12] = in[12];
276 x[13] = in[13];
277 x[14] = in[14];
278 x[15] = in[15];
279
280 dorounds(x, rounds);
281
282 out[0] = x[0] + in[0];
283 out[1] = x[1] + in[1];
284 out[2] = x[2] + in[2];
285 out[3] = x[3] + in[3];
286 out[4] = x[4] + in[4];
287 out[5] = x[5] + in[5];
288 out[6] = x[6] + in[6];
289 out[7] = x[7] + in[7];
290 out[8] = x[8] + in[8];
291 out[9] = x[9] + in[9];
292 out[10] = x[10] + in[10];
293 out[11] = x[11] + in[11];
294 out[12] = x[12] + in[12];
295 out[13] = x[13] + in[13];
296 out[14] = x[14] + in[14];
297 out[15] = x[15] + in[15];
298}
299
311void300void
312hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)301hsalsa(uchar h[32], uchar *key, ulong keylen, uchar nonce[16], int rounds)
313{302{
libsec/scrypt.c+119−0
@@ -0,0 +1,119 @@
1#include "os.h"
2#include <libsec.h>
3
4#define movw(w, S, D) memmove(D, S, (w)*4)
5
6static void
7xorw(ulong w, u32int *S, u32int *D)
8{
9 for(w /= 8; w; w--, D += 8, S += 8){
10 D[0] ^= S[0];
11 D[1] ^= S[1];
12 D[2] ^= S[2];
13 D[3] ^= S[3];
14 D[4] ^= S[4];
15 D[5] ^= S[5];
16 D[6] ^= S[6];
17 D[7] ^= S[7];
18 }
19}
20
21static void
22scryptBlockMix(ulong R, u32int *B, u32int *Y)
23{
24 u32int X[16];
25 ulong i;
26
27 R *= 2;
28 movw(16, &B[(R-1)*16], X);
29 for(i = 0; i < R; i += 2){
30 xorw(16, &B[i*16], X);
31 salsa_core(X, X, 8);
32 movw(16, X, &Y[i*8]);
33
34 xorw(16, &B[(i+1)*16], X);
35 salsa_core(X, X, 8);
36 movw(16, X, &Y[i*8 + R*8]);
37 }
38}
39
40static void
41scryptROMix(ulong R, ulong N, u32int *V, u32int *X, uchar *B)
42{
43 ulong w, i, d;
44 u32int *Y;
45
46 w = R*32;
47 for(i=0; i<w; i++, B+=4)
48 X[i] = B[0] | (B[1]<<8) | (B[2]<<16) | (B[3]<<24);
49
50 Y = &X[w];
51 for(i=0; i<N; i += 2){
52 movw(w, X, &V[i*w]);
53 scryptBlockMix(R, X, Y);
54
55 movw(w, Y, &V[(i+1)*w]);
56 scryptBlockMix(R, Y, X);
57 }
58 for(i=0; i<N; i += 2){
59 xorw(w, &V[(X[w-16] & (N-1))*w], X);
60 scryptBlockMix(R, X, Y);
61
62 xorw(w, &V[(Y[w-16] & (N-1))*w], Y);
63 scryptBlockMix(R, Y, X);
64 }
65
66 B -= w*4;
67 for(i=0; i<w; i++, B+=4)
68 d = X[i], B[0]=d, B[1]=d>>8, B[2]=d>>16, B[3]=d>>24;
69}
70
71char*
72scrypt(p, plen, s, slen, N, R, P, d, dlen)
73 ulong plen, slen, dlen, N, R, P;
74 uchar *p, *s, *d;
75{
76 static char oom[] = "out of memory";
77
78 ulong rb, i;
79 u32int *V, *X;
80 uchar *B;
81
82 if(P < 1)
83 return "invalid parallelization parameter P";
84 if(R < 1 || R >= (1UL<<(31-7))/P)
85 return "invalid block size parameter R";
86 if(N < 2 || (N & (N-1)) != 0 || N >= (1UL<<(31-7))/R)
87 return "invalid cpu/memory cost parameter N";
88
89 rb = R<<7;
90 if((B = malloc(P*rb)) == nil)
91 return oom;
92 if((V = malloc(N*rb)) == nil){
93 free(B);
94 return oom;
95 }
96 if((X = malloc(2*rb)) == nil){
97 free(V);
98 free(B);
99 return oom;
100 }
101
102 pbkdf2_x(p, plen, s, slen, 1, B, P*rb, hmac_sha2_256, SHA2_256dlen);
103
104 for(i=0; i<P; i++)
105 scryptROMix(R, N, V, X, &B[i*rb]);
106
107 memset(X, 0, 2*rb);
108 free(X);
109
110 memset(V, 0, N*rb);
111 free(V);
112
113 pbkdf2_x(p, plen, B, P*rb, 1, d, dlen, hmac_sha2_256, SHA2_256dlen);
114
115 memset(B, 0, P*rb);
116 free(B);
117
118 return nil;
119}

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t