ed25519_blake2b 0.1.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +9 -0
- data/CODE_OF_CONDUCT.md +74 -0
- data/Gemfile +6 -0
- data/Gemfile.lock +23 -0
- data/LICENSE +21 -0
- data/README.md +39 -0
- data/Rakefile +13 -0
- data/bin/console +14 -0
- data/bin/setup +8 -0
- data/ed25519_blake2b.gemspec +31 -0
- data/ext/ed25519_blake2b/blake2-config.h +72 -0
- data/ext/ed25519_blake2b/blake2-impl.h +160 -0
- data/ext/ed25519_blake2b/blake2.h +195 -0
- data/ext/ed25519_blake2b/blake2b-load-sse2.h +68 -0
- data/ext/ed25519_blake2b/blake2b-load-sse41.h +402 -0
- data/ext/ed25519_blake2b/blake2b-ref.c +373 -0
- data/ext/ed25519_blake2b/blake2b-round.h +157 -0
- data/ext/ed25519_blake2b/curve25519-donna-32bit.h +579 -0
- data/ext/ed25519_blake2b/curve25519-donna-64bit.h +413 -0
- data/ext/ed25519_blake2b/curve25519-donna-helpers.h +67 -0
- data/ext/ed25519_blake2b/curve25519-donna-sse2.h +1112 -0
- data/ext/ed25519_blake2b/ed25519-donna-32bit-sse2.h +513 -0
- data/ext/ed25519_blake2b/ed25519-donna-32bit-tables.h +61 -0
- data/ext/ed25519_blake2b/ed25519-donna-64bit-sse2.h +436 -0
- data/ext/ed25519_blake2b/ed25519-donna-64bit-tables.h +53 -0
- data/ext/ed25519_blake2b/ed25519-donna-64bit-x86-32bit.h +435 -0
- data/ext/ed25519_blake2b/ed25519-donna-64bit-x86.h +351 -0
- data/ext/ed25519_blake2b/ed25519-donna-basepoint-table.h +259 -0
- data/ext/ed25519_blake2b/ed25519-donna-batchverify.h +275 -0
- data/ext/ed25519_blake2b/ed25519-donna-impl-base.h +364 -0
- data/ext/ed25519_blake2b/ed25519-donna-impl-sse2.h +390 -0
- data/ext/ed25519_blake2b/ed25519-donna-portable-identify.h +103 -0
- data/ext/ed25519_blake2b/ed25519-donna-portable.h +135 -0
- data/ext/ed25519_blake2b/ed25519-donna.h +115 -0
- data/ext/ed25519_blake2b/ed25519-hash-custom.c +28 -0
- data/ext/ed25519_blake2b/ed25519-hash-custom.h +30 -0
- data/ext/ed25519_blake2b/ed25519-hash.h +219 -0
- data/ext/ed25519_blake2b/ed25519-randombytes-custom.h +10 -0
- data/ext/ed25519_blake2b/ed25519-randombytes.h +91 -0
- data/ext/ed25519_blake2b/ed25519.c +150 -0
- data/ext/ed25519_blake2b/ed25519.h +30 -0
- data/ext/ed25519_blake2b/extconf.rb +3 -0
- data/ext/ed25519_blake2b/fuzz/README.md +173 -0
- data/ext/ed25519_blake2b/fuzz/build-nix.php +134 -0
- data/ext/ed25519_blake2b/fuzz/curve25519-ref10.c +1272 -0
- data/ext/ed25519_blake2b/fuzz/curve25519-ref10.h +8 -0
- data/ext/ed25519_blake2b/fuzz/ed25519-donna-sse2.c +3 -0
- data/ext/ed25519_blake2b/fuzz/ed25519-donna.c +1 -0
- data/ext/ed25519_blake2b/fuzz/ed25519-donna.h +34 -0
- data/ext/ed25519_blake2b/fuzz/ed25519-ref10.c +4647 -0
- data/ext/ed25519_blake2b/fuzz/ed25519-ref10.h +9 -0
- data/ext/ed25519_blake2b/fuzz/fuzz-curve25519.c +172 -0
- data/ext/ed25519_blake2b/fuzz/fuzz-ed25519.c +219 -0
- data/ext/ed25519_blake2b/modm-donna-32bit.h +469 -0
- data/ext/ed25519_blake2b/modm-donna-64bit.h +361 -0
- data/ext/ed25519_blake2b/rbext.c +25 -0
- data/ext/ed25519_blake2b/regression.h +1024 -0
- data/lib/ed25519_blake2b/ed25519_blake2b.rb +4 -0
- data/lib/ed25519_blake2b/version.rb +3 -0
- metadata +147 -0
@@ -0,0 +1,135 @@
|
|
1
|
+
#include "ed25519-donna-portable-identify.h"
|
2
|
+
|
3
|
+
#define mul32x32_64(a,b) (((uint64_t)(a))*(b))
|
4
|
+
|
5
|
+
/* platform */
|
6
|
+
#if defined(COMPILER_MSVC)
|
7
|
+
#include <intrin.h>
|
8
|
+
#if !defined(_DEBUG)
|
9
|
+
#undef mul32x32_64
|
10
|
+
#define mul32x32_64(a,b) __emulu(a,b)
|
11
|
+
#endif
|
12
|
+
#undef inline
|
13
|
+
#define inline __forceinline
|
14
|
+
#define DONNA_INLINE __forceinline
|
15
|
+
#define DONNA_NOINLINE __declspec(noinline)
|
16
|
+
#define ALIGN(x) __declspec(align(x))
|
17
|
+
#define ROTL32(a,b) _rotl(a,b)
|
18
|
+
#define ROTR32(a,b) _rotr(a,b)
|
19
|
+
#else
|
20
|
+
#include <sys/param.h>
|
21
|
+
#define DONNA_INLINE inline __attribute__((always_inline))
|
22
|
+
#define DONNA_NOINLINE __attribute__((noinline))
|
23
|
+
#define ALIGN(x) __attribute__((aligned(x)))
|
24
|
+
#define ROTL32(a,b) (((a) << (b)) | ((a) >> (32 - b)))
|
25
|
+
#define ROTR32(a,b) (((a) >> (b)) | ((a) << (32 - b)))
|
26
|
+
#endif
|
27
|
+
|
28
|
+
/* uint128_t */
|
29
|
+
#if defined(CPU_64BITS) && !defined(ED25519_FORCE_32BIT)
|
30
|
+
#if defined(COMPILER_CLANG) && (COMPILER_CLANG >= 30100)
|
31
|
+
#define HAVE_NATIVE_UINT128
|
32
|
+
typedef unsigned __int128 uint128_t;
|
33
|
+
#elif defined(COMPILER_MSVC)
|
34
|
+
#define HAVE_UINT128
|
35
|
+
typedef struct uint128_t {
|
36
|
+
uint64_t lo, hi;
|
37
|
+
} uint128_t;
|
38
|
+
#define mul64x64_128(out,a,b) out.lo = _umul128(a,b,&out.hi);
|
39
|
+
#define shr128_pair(out,hi,lo,shift) out = __shiftright128(lo, hi, shift);
|
40
|
+
#define shl128_pair(out,hi,lo,shift) out = __shiftleft128(lo, hi, shift);
|
41
|
+
#define shr128(out,in,shift) shr128_pair(out, in.hi, in.lo, shift)
|
42
|
+
#define shl128(out,in,shift) shl128_pair(out, in.hi, in.lo, shift)
|
43
|
+
#define add128(a,b) { uint64_t p = a.lo; a.lo += b.lo; a.hi += b.hi + (a.lo < p); }
|
44
|
+
#define add128_64(a,b) { uint64_t p = a.lo; a.lo += b; a.hi += (a.lo < p); }
|
45
|
+
#define lo128(a) (a.lo)
|
46
|
+
#define hi128(a) (a.hi)
|
47
|
+
#elif defined(COMPILER_GCC) && !defined(HAVE_NATIVE_UINT128)
|
48
|
+
#if defined(__SIZEOF_INT128__)
|
49
|
+
#define HAVE_NATIVE_UINT128
|
50
|
+
typedef unsigned __int128 uint128_t;
|
51
|
+
#elif (COMPILER_GCC >= 40400)
|
52
|
+
#define HAVE_NATIVE_UINT128
|
53
|
+
typedef unsigned uint128_t __attribute__((mode(TI)));
|
54
|
+
#elif defined(CPU_X86_64)
|
55
|
+
#define HAVE_UINT128
|
56
|
+
typedef struct uint128_t {
|
57
|
+
uint64_t lo, hi;
|
58
|
+
} uint128_t;
|
59
|
+
#define mul64x64_128(out,a,b) __asm__ ("mulq %3" : "=a" (out.lo), "=d" (out.hi) : "a" (a), "rm" (b));
|
60
|
+
#define shr128_pair(out,hi,lo,shift) __asm__ ("shrdq %2,%1,%0" : "+r" (lo) : "r" (hi), "J" (shift)); out = lo;
|
61
|
+
#define shl128_pair(out,hi,lo,shift) __asm__ ("shldq %2,%1,%0" : "+r" (hi) : "r" (lo), "J" (shift)); out = hi;
|
62
|
+
#define shr128(out,in,shift) shr128_pair(out,in.hi, in.lo, shift)
|
63
|
+
#define shl128(out,in,shift) shl128_pair(out,in.hi, in.lo, shift)
|
64
|
+
#define add128(a,b) __asm__ ("addq %4,%2; adcq %5,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b.lo), "rm" (b.hi) : "cc");
|
65
|
+
#define add128_64(a,b) __asm__ ("addq %4,%2; adcq $0,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b) : "cc");
|
66
|
+
#define lo128(a) (a.lo)
|
67
|
+
#define hi128(a) (a.hi)
|
68
|
+
#endif
|
69
|
+
#endif
|
70
|
+
|
71
|
+
#if defined(HAVE_NATIVE_UINT128)
|
72
|
+
#define HAVE_UINT128
|
73
|
+
#define mul64x64_128(out,a,b) out = (uint128_t)a * b;
|
74
|
+
#define shr128_pair(out,hi,lo,shift) out = (uint64_t)((((uint128_t)hi << 64) | lo) >> (shift));
|
75
|
+
#define shl128_pair(out,hi,lo,shift) out = (uint64_t)(((((uint128_t)hi << 64) | lo) << (shift)) >> 64);
|
76
|
+
#define shr128(out,in,shift) out = (uint64_t)(in >> (shift));
|
77
|
+
#define shl128(out,in,shift) out = (uint64_t)((in << shift) >> 64);
|
78
|
+
#define add128(a,b) a += b;
|
79
|
+
#define add128_64(a,b) a += (uint64_t)b;
|
80
|
+
#define lo128(a) ((uint64_t)a)
|
81
|
+
#define hi128(a) ((uint64_t)(a >> 64))
|
82
|
+
#endif
|
83
|
+
|
84
|
+
#if !defined(HAVE_UINT128)
|
85
|
+
#error Need a uint128_t implementation!
|
86
|
+
#endif
|
87
|
+
#endif
|
88
|
+
|
89
|
+
/* endian */
|
90
|
+
#if !defined(ED25519_OPENSSLRNG)
|
91
|
+
static inline void U32TO8_LE(unsigned char *p, const uint32_t v) {
|
92
|
+
p[0] = (unsigned char)(v );
|
93
|
+
p[1] = (unsigned char)(v >> 8);
|
94
|
+
p[2] = (unsigned char)(v >> 16);
|
95
|
+
p[3] = (unsigned char)(v >> 24);
|
96
|
+
}
|
97
|
+
#endif
|
98
|
+
|
99
|
+
#if !defined(HAVE_UINT128)
|
100
|
+
static inline uint32_t U8TO32_LE(const unsigned char *p) {
|
101
|
+
return
|
102
|
+
(((uint32_t)(p[0]) ) |
|
103
|
+
((uint32_t)(p[1]) << 8) |
|
104
|
+
((uint32_t)(p[2]) << 16) |
|
105
|
+
((uint32_t)(p[3]) << 24));
|
106
|
+
}
|
107
|
+
#else
|
108
|
+
static inline uint64_t U8TO64_LE(const unsigned char *p) {
|
109
|
+
return
|
110
|
+
(((uint64_t)(p[0]) ) |
|
111
|
+
((uint64_t)(p[1]) << 8) |
|
112
|
+
((uint64_t)(p[2]) << 16) |
|
113
|
+
((uint64_t)(p[3]) << 24) |
|
114
|
+
((uint64_t)(p[4]) << 32) |
|
115
|
+
((uint64_t)(p[5]) << 40) |
|
116
|
+
((uint64_t)(p[6]) << 48) |
|
117
|
+
((uint64_t)(p[7]) << 56));
|
118
|
+
}
|
119
|
+
|
120
|
+
static inline void U64TO8_LE(unsigned char *p, const uint64_t v) {
|
121
|
+
p[0] = (unsigned char)(v );
|
122
|
+
p[1] = (unsigned char)(v >> 8);
|
123
|
+
p[2] = (unsigned char)(v >> 16);
|
124
|
+
p[3] = (unsigned char)(v >> 24);
|
125
|
+
p[4] = (unsigned char)(v >> 32);
|
126
|
+
p[5] = (unsigned char)(v >> 40);
|
127
|
+
p[6] = (unsigned char)(v >> 48);
|
128
|
+
p[7] = (unsigned char)(v >> 56);
|
129
|
+
}
|
130
|
+
#endif
|
131
|
+
|
132
|
+
#include <stdlib.h>
|
133
|
+
#include <string.h>
|
134
|
+
|
135
|
+
|
@@ -0,0 +1,115 @@
|
|
1
|
+
/*
|
2
|
+
Public domain by Andrew M. <liquidsun@gmail.com>
|
3
|
+
Modified from the amd64-51-30k implementation by
|
4
|
+
Daniel J. Bernstein
|
5
|
+
Niels Duif
|
6
|
+
Tanja Lange
|
7
|
+
Peter Schwabe
|
8
|
+
Bo-Yin Yang
|
9
|
+
*/
|
10
|
+
|
11
|
+
|
12
|
+
#include "ed25519-donna-portable.h"
|
13
|
+
|
14
|
+
#if defined(ED25519_SSE2)
|
15
|
+
#else
|
16
|
+
#if defined(HAVE_UINT128) && !defined(ED25519_FORCE_32BIT)
|
17
|
+
#define ED25519_64BIT
|
18
|
+
#else
|
19
|
+
#define ED25519_32BIT
|
20
|
+
#endif
|
21
|
+
#endif
|
22
|
+
|
23
|
+
#if !defined(ED25519_NO_INLINE_ASM)
|
24
|
+
/* detect extra features first so un-needed functions can be disabled throughout */
|
25
|
+
#if defined(ED25519_SSE2)
|
26
|
+
#if defined(COMPILER_GCC) && defined(CPU_X86)
|
27
|
+
#define ED25519_GCC_32BIT_SSE_CHOOSE
|
28
|
+
#elif defined(COMPILER_GCC) && defined(CPU_X86_64)
|
29
|
+
#define ED25519_GCC_64BIT_SSE_CHOOSE
|
30
|
+
#endif
|
31
|
+
#else
|
32
|
+
#if defined(CPU_X86_64)
|
33
|
+
#if defined(COMPILER_GCC)
|
34
|
+
#if defined(ED25519_64BIT)
|
35
|
+
#define ED25519_GCC_64BIT_X86_CHOOSE
|
36
|
+
#else
|
37
|
+
#define ED25519_GCC_64BIT_32BIT_CHOOSE
|
38
|
+
#endif
|
39
|
+
#endif
|
40
|
+
#endif
|
41
|
+
#endif
|
42
|
+
#endif
|
43
|
+
|
44
|
+
#if defined(ED25519_SSE2)
|
45
|
+
#include "curve25519-donna-sse2.h"
|
46
|
+
#elif defined(ED25519_64BIT)
|
47
|
+
#include "curve25519-donna-64bit.h"
|
48
|
+
#else
|
49
|
+
#include "curve25519-donna-32bit.h"
|
50
|
+
#endif
|
51
|
+
|
52
|
+
#include "curve25519-donna-helpers.h"
|
53
|
+
|
54
|
+
/* separate uint128 check for 64 bit sse2 */
|
55
|
+
#if defined(HAVE_UINT128) && !defined(ED25519_FORCE_32BIT)
|
56
|
+
#include "modm-donna-64bit.h"
|
57
|
+
#else
|
58
|
+
#include "modm-donna-32bit.h"
|
59
|
+
#endif
|
60
|
+
|
61
|
+
typedef unsigned char hash_512bits[64];
|
62
|
+
|
63
|
+
/*
|
64
|
+
Timing safe memory compare
|
65
|
+
*/
|
66
|
+
static int
|
67
|
+
ed25519_verify(const unsigned char *x, const unsigned char *y, size_t len) {
|
68
|
+
size_t differentbits = 0;
|
69
|
+
while (len--)
|
70
|
+
differentbits |= (*x++ ^ *y++);
|
71
|
+
return (int) (1 & ((differentbits - 1) >> 8));
|
72
|
+
}
|
73
|
+
|
74
|
+
|
75
|
+
/*
|
76
|
+
* Arithmetic on the twisted Edwards curve -x^2 + y^2 = 1 + dx^2y^2
|
77
|
+
* with d = -(121665/121666) = 37095705934669439343138083508754565189542113879843219016388785533085940283555
|
78
|
+
* Base point: (15112221349535400772501151409588531511454012693041857206046113283949847762202,46316835694926478169428394003475163141307993866256225615783033603165251855960);
|
79
|
+
*/
|
80
|
+
|
81
|
+
typedef struct ge25519_t {
|
82
|
+
bignum25519 x, y, z, t;
|
83
|
+
} ge25519;
|
84
|
+
|
85
|
+
typedef struct ge25519_p1p1_t {
|
86
|
+
bignum25519 x, y, z, t;
|
87
|
+
} ge25519_p1p1;
|
88
|
+
|
89
|
+
typedef struct ge25519_niels_t {
|
90
|
+
bignum25519 ysubx, xaddy, t2d;
|
91
|
+
} ge25519_niels;
|
92
|
+
|
93
|
+
typedef struct ge25519_pniels_t {
|
94
|
+
bignum25519 ysubx, xaddy, z, t2d;
|
95
|
+
} ge25519_pniels;
|
96
|
+
|
97
|
+
#include "ed25519-donna-basepoint-table.h"
|
98
|
+
|
99
|
+
#if defined(ED25519_64BIT)
|
100
|
+
#include "ed25519-donna-64bit-tables.h"
|
101
|
+
#include "ed25519-donna-64bit-x86.h"
|
102
|
+
#else
|
103
|
+
#include "ed25519-donna-32bit-tables.h"
|
104
|
+
#include "ed25519-donna-64bit-x86-32bit.h"
|
105
|
+
#endif
|
106
|
+
|
107
|
+
|
108
|
+
#if defined(ED25519_SSE2)
|
109
|
+
#include "ed25519-donna-32bit-sse2.h"
|
110
|
+
#include "ed25519-donna-64bit-sse2.h"
|
111
|
+
#include "ed25519-donna-impl-sse2.h"
|
112
|
+
#else
|
113
|
+
#include "ed25519-donna-impl-base.h"
|
114
|
+
#endif
|
115
|
+
|
@@ -0,0 +1,28 @@
|
|
1
|
+
#include <stdlib.h>
|
2
|
+
#include "ed25519-hash-custom.h"
|
3
|
+
#include "blake2.h"
|
4
|
+
|
5
|
+
void ed25519_hash_init (ed25519_hash_context * ctx)
|
6
|
+
{
|
7
|
+
ctx->blake2 = (blake2b_state *) malloc(sizeof(blake2b_state));
|
8
|
+
blake2b_init(ctx->blake2, 64);
|
9
|
+
}
|
10
|
+
|
11
|
+
void ed25519_hash_update (ed25519_hash_context * ctx, uint8_t const * in, size_t inlen)
|
12
|
+
{
|
13
|
+
blake2b_update(ctx->blake2, in, inlen);
|
14
|
+
}
|
15
|
+
|
16
|
+
void ed25519_hash_final (ed25519_hash_context * ctx, uint8_t * out)
|
17
|
+
{
|
18
|
+
blake2b_final (ctx->blake2, out, 64);
|
19
|
+
free(ctx->blake2);
|
20
|
+
}
|
21
|
+
|
22
|
+
void ed25519_hash (uint8_t * out, uint8_t const * in, size_t inlen)
|
23
|
+
{
|
24
|
+
ed25519_hash_context ctx;
|
25
|
+
ed25519_hash_init (&ctx);
|
26
|
+
ed25519_hash_update (&ctx, in, inlen);
|
27
|
+
ed25519_hash_final (&ctx, out);
|
28
|
+
}
|
@@ -0,0 +1,30 @@
|
|
1
|
+
/*
|
2
|
+
a custom hash must have a 512bit digest and implement:
|
3
|
+
|
4
|
+
struct ed25519_hash_context;
|
5
|
+
|
6
|
+
void ed25519_hash_init(ed25519_hash_context *ctx);
|
7
|
+
void ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen);
|
8
|
+
void ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash);
|
9
|
+
void ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen);
|
10
|
+
*/
|
11
|
+
|
12
|
+
#include <stdint.h>
|
13
|
+
#include <stddef.h>
|
14
|
+
|
15
|
+
typedef struct {
|
16
|
+
uint8_t *output;
|
17
|
+
} Blake2;
|
18
|
+
|
19
|
+
typedef struct ed25519_hash_context_t
|
20
|
+
{
|
21
|
+
void *blake2;
|
22
|
+
} ed25519_hash_context;
|
23
|
+
|
24
|
+
void ed25519_hash_init (ed25519_hash_context * ctx);
|
25
|
+
|
26
|
+
void ed25519_hash_update (ed25519_hash_context * ctx, uint8_t const * in, size_t inlen);
|
27
|
+
|
28
|
+
void ed25519_hash_final (ed25519_hash_context * ctx, uint8_t * out);
|
29
|
+
|
30
|
+
void ed25519_hash (uint8_t * out, uint8_t const * in, size_t inlen);
|
@@ -0,0 +1,219 @@
|
|
1
|
+
#if defined(ED25519_REFHASH)
|
2
|
+
|
3
|
+
/* reference/slow SHA-512. really, do not use this */
|
4
|
+
|
5
|
+
#define HASH_BLOCK_SIZE 128
|
6
|
+
#define HASH_DIGEST_SIZE 64
|
7
|
+
|
8
|
+
typedef struct sha512_state_t {
|
9
|
+
uint64_t H[8];
|
10
|
+
uint64_t T[2];
|
11
|
+
uint32_t leftover;
|
12
|
+
uint8_t buffer[HASH_BLOCK_SIZE];
|
13
|
+
} sha512_state;
|
14
|
+
|
15
|
+
typedef sha512_state ed25519_hash_context;
|
16
|
+
|
17
|
+
static const uint64_t sha512_constants[80] = {
|
18
|
+
0x428a2f98d728ae22ull, 0x7137449123ef65cdull, 0xb5c0fbcfec4d3b2full, 0xe9b5dba58189dbbcull,
|
19
|
+
0x3956c25bf348b538ull, 0x59f111f1b605d019ull, 0x923f82a4af194f9bull, 0xab1c5ed5da6d8118ull,
|
20
|
+
0xd807aa98a3030242ull, 0x12835b0145706fbeull, 0x243185be4ee4b28cull, 0x550c7dc3d5ffb4e2ull,
|
21
|
+
0x72be5d74f27b896full, 0x80deb1fe3b1696b1ull, 0x9bdc06a725c71235ull, 0xc19bf174cf692694ull,
|
22
|
+
0xe49b69c19ef14ad2ull, 0xefbe4786384f25e3ull, 0x0fc19dc68b8cd5b5ull, 0x240ca1cc77ac9c65ull,
|
23
|
+
0x2de92c6f592b0275ull, 0x4a7484aa6ea6e483ull, 0x5cb0a9dcbd41fbd4ull, 0x76f988da831153b5ull,
|
24
|
+
0x983e5152ee66dfabull, 0xa831c66d2db43210ull, 0xb00327c898fb213full, 0xbf597fc7beef0ee4ull,
|
25
|
+
0xc6e00bf33da88fc2ull, 0xd5a79147930aa725ull, 0x06ca6351e003826full, 0x142929670a0e6e70ull,
|
26
|
+
0x27b70a8546d22ffcull, 0x2e1b21385c26c926ull, 0x4d2c6dfc5ac42aedull, 0x53380d139d95b3dfull,
|
27
|
+
0x650a73548baf63deull, 0x766a0abb3c77b2a8ull, 0x81c2c92e47edaee6ull, 0x92722c851482353bull,
|
28
|
+
0xa2bfe8a14cf10364ull, 0xa81a664bbc423001ull, 0xc24b8b70d0f89791ull, 0xc76c51a30654be30ull,
|
29
|
+
0xd192e819d6ef5218ull, 0xd69906245565a910ull, 0xf40e35855771202aull, 0x106aa07032bbd1b8ull,
|
30
|
+
0x19a4c116b8d2d0c8ull, 0x1e376c085141ab53ull, 0x2748774cdf8eeb99ull, 0x34b0bcb5e19b48a8ull,
|
31
|
+
0x391c0cb3c5c95a63ull, 0x4ed8aa4ae3418acbull, 0x5b9cca4f7763e373ull, 0x682e6ff3d6b2b8a3ull,
|
32
|
+
0x748f82ee5defb2fcull, 0x78a5636f43172f60ull, 0x84c87814a1f0ab72ull, 0x8cc702081a6439ecull,
|
33
|
+
0x90befffa23631e28ull, 0xa4506cebde82bde9ull, 0xbef9a3f7b2c67915ull, 0xc67178f2e372532bull,
|
34
|
+
0xca273eceea26619cull, 0xd186b8c721c0c207ull, 0xeada7dd6cde0eb1eull, 0xf57d4f7fee6ed178ull,
|
35
|
+
0x06f067aa72176fbaull, 0x0a637dc5a2c898a6ull, 0x113f9804bef90daeull, 0x1b710b35131c471bull,
|
36
|
+
0x28db77f523047d84ull, 0x32caab7b40c72493ull, 0x3c9ebe0a15c9bebcull, 0x431d67c49c100d4cull,
|
37
|
+
0x4cc5d4becb3e42b6ull, 0x597f299cfc657e2aull, 0x5fcb6fab3ad6faecull, 0x6c44198c4a475817ull
|
38
|
+
};
|
39
|
+
|
40
|
+
static uint64_t
|
41
|
+
sha512_ROTR64(uint64_t x, int k) {
|
42
|
+
return (x >> k) | (x << (64 - k));
|
43
|
+
}
|
44
|
+
|
45
|
+
static uint64_t
|
46
|
+
sha512_LOAD64_BE(const uint8_t *p) {
|
47
|
+
return
|
48
|
+
((uint64_t)p[0] << 56) |
|
49
|
+
((uint64_t)p[1] << 48) |
|
50
|
+
((uint64_t)p[2] << 40) |
|
51
|
+
((uint64_t)p[3] << 32) |
|
52
|
+
((uint64_t)p[4] << 24) |
|
53
|
+
((uint64_t)p[5] << 16) |
|
54
|
+
((uint64_t)p[6] << 8) |
|
55
|
+
((uint64_t)p[7] );
|
56
|
+
}
|
57
|
+
|
58
|
+
static void
|
59
|
+
sha512_STORE64_BE(uint8_t *p, uint64_t v) {
|
60
|
+
p[0] = (uint8_t)(v >> 56);
|
61
|
+
p[1] = (uint8_t)(v >> 48);
|
62
|
+
p[2] = (uint8_t)(v >> 40);
|
63
|
+
p[3] = (uint8_t)(v >> 32);
|
64
|
+
p[4] = (uint8_t)(v >> 24);
|
65
|
+
p[5] = (uint8_t)(v >> 16);
|
66
|
+
p[6] = (uint8_t)(v >> 8);
|
67
|
+
p[7] = (uint8_t)(v );
|
68
|
+
}
|
69
|
+
|
70
|
+
#define Ch(x,y,z) (z ^ (x & (y ^ z)))
|
71
|
+
#define Maj(x,y,z) (((x | y) & z) | (x & y))
|
72
|
+
#define S0(x) (sha512_ROTR64(x, 28) ^ sha512_ROTR64(x, 34) ^ sha512_ROTR64(x, 39))
|
73
|
+
#define S1(x) (sha512_ROTR64(x, 14) ^ sha512_ROTR64(x, 18) ^ sha512_ROTR64(x, 41))
|
74
|
+
#define G0(x) (sha512_ROTR64(x, 1) ^ sha512_ROTR64(x, 8) ^ (x >> 7))
|
75
|
+
#define G1(x) (sha512_ROTR64(x, 19) ^ sha512_ROTR64(x, 61) ^ (x >> 6))
|
76
|
+
#define W0(in,i) (sha512_LOAD64_BE(&in[i * 8]))
|
77
|
+
#define W1(i) (G1(w[i - 2]) + w[i - 7] + G0(w[i - 15]) + w[i - 16])
|
78
|
+
#define STEP(i) \
|
79
|
+
t1 = S0(r[0]) + Maj(r[0], r[1], r[2]); \
|
80
|
+
t0 = r[7] + S1(r[4]) + Ch(r[4], r[5], r[6]) + sha512_constants[i] + w[i]; \
|
81
|
+
r[7] = r[6]; \
|
82
|
+
r[6] = r[5]; \
|
83
|
+
r[5] = r[4]; \
|
84
|
+
r[4] = r[3] + t0; \
|
85
|
+
r[3] = r[2]; \
|
86
|
+
r[2] = r[1]; \
|
87
|
+
r[1] = r[0]; \
|
88
|
+
r[0] = t0 + t1;
|
89
|
+
|
90
|
+
static void
|
91
|
+
sha512_blocks(sha512_state *S, const uint8_t *in, size_t blocks) {
|
92
|
+
uint64_t r[8], w[80], t0, t1;
|
93
|
+
size_t i;
|
94
|
+
|
95
|
+
for (i = 0; i < 8; i++) r[i] = S->H[i];
|
96
|
+
|
97
|
+
while (blocks--) {
|
98
|
+
for (i = 0; i < 16; i++) { w[i] = W0(in, i); }
|
99
|
+
for (i = 16; i < 80; i++) { w[i] = W1(i); }
|
100
|
+
for (i = 0; i < 80; i++) { STEP(i); }
|
101
|
+
for (i = 0; i < 8; i++) { r[i] += S->H[i]; S->H[i] = r[i]; }
|
102
|
+
S->T[0] += HASH_BLOCK_SIZE * 8;
|
103
|
+
S->T[1] += (!S->T[0]) ? 1 : 0;
|
104
|
+
in += HASH_BLOCK_SIZE;
|
105
|
+
}
|
106
|
+
}
|
107
|
+
|
108
|
+
static void
|
109
|
+
ed25519_hash_init(sha512_state *S) {
|
110
|
+
S->H[0] = 0x6a09e667f3bcc908ull;
|
111
|
+
S->H[1] = 0xbb67ae8584caa73bull;
|
112
|
+
S->H[2] = 0x3c6ef372fe94f82bull;
|
113
|
+
S->H[3] = 0xa54ff53a5f1d36f1ull;
|
114
|
+
S->H[4] = 0x510e527fade682d1ull;
|
115
|
+
S->H[5] = 0x9b05688c2b3e6c1full;
|
116
|
+
S->H[6] = 0x1f83d9abfb41bd6bull;
|
117
|
+
S->H[7] = 0x5be0cd19137e2179ull;
|
118
|
+
S->T[0] = 0;
|
119
|
+
S->T[1] = 0;
|
120
|
+
S->leftover = 0;
|
121
|
+
}
|
122
|
+
|
123
|
+
static void
|
124
|
+
ed25519_hash_update(sha512_state *S, const uint8_t *in, size_t inlen) {
|
125
|
+
size_t blocks, want;
|
126
|
+
|
127
|
+
/* handle the previous data */
|
128
|
+
if (S->leftover) {
|
129
|
+
want = (HASH_BLOCK_SIZE - S->leftover);
|
130
|
+
want = (want < inlen) ? want : inlen;
|
131
|
+
memcpy(S->buffer + S->leftover, in, want);
|
132
|
+
S->leftover += (uint32_t)want;
|
133
|
+
if (S->leftover < HASH_BLOCK_SIZE)
|
134
|
+
return;
|
135
|
+
in += want;
|
136
|
+
inlen -= want;
|
137
|
+
sha512_blocks(S, S->buffer, 1);
|
138
|
+
}
|
139
|
+
|
140
|
+
/* handle the current data */
|
141
|
+
blocks = (inlen & ~(HASH_BLOCK_SIZE - 1));
|
142
|
+
S->leftover = (uint32_t)(inlen - blocks);
|
143
|
+
if (blocks) {
|
144
|
+
sha512_blocks(S, in, blocks / HASH_BLOCK_SIZE);
|
145
|
+
in += blocks;
|
146
|
+
}
|
147
|
+
|
148
|
+
/* handle leftover data */
|
149
|
+
if (S->leftover)
|
150
|
+
memcpy(S->buffer, in, S->leftover);
|
151
|
+
}
|
152
|
+
|
153
|
+
static void
|
154
|
+
ed25519_hash_final(sha512_state *S, uint8_t *hash) {
|
155
|
+
uint64_t t0 = S->T[0] + (S->leftover * 8), t1 = S->T[1];
|
156
|
+
|
157
|
+
S->buffer[S->leftover] = 0x80;
|
158
|
+
if (S->leftover <= 111) {
|
159
|
+
memset(S->buffer + S->leftover + 1, 0, 111 - S->leftover);
|
160
|
+
} else {
|
161
|
+
memset(S->buffer + S->leftover + 1, 0, 127 - S->leftover);
|
162
|
+
sha512_blocks(S, S->buffer, 1);
|
163
|
+
memset(S->buffer, 0, 112);
|
164
|
+
}
|
165
|
+
|
166
|
+
sha512_STORE64_BE(S->buffer + 112, t1);
|
167
|
+
sha512_STORE64_BE(S->buffer + 120, t0);
|
168
|
+
sha512_blocks(S, S->buffer, 1);
|
169
|
+
|
170
|
+
sha512_STORE64_BE(&hash[ 0], S->H[0]);
|
171
|
+
sha512_STORE64_BE(&hash[ 8], S->H[1]);
|
172
|
+
sha512_STORE64_BE(&hash[16], S->H[2]);
|
173
|
+
sha512_STORE64_BE(&hash[24], S->H[3]);
|
174
|
+
sha512_STORE64_BE(&hash[32], S->H[4]);
|
175
|
+
sha512_STORE64_BE(&hash[40], S->H[5]);
|
176
|
+
sha512_STORE64_BE(&hash[48], S->H[6]);
|
177
|
+
sha512_STORE64_BE(&hash[56], S->H[7]);
|
178
|
+
}
|
179
|
+
|
180
|
+
static void
|
181
|
+
ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen) {
|
182
|
+
ed25519_hash_context ctx;
|
183
|
+
ed25519_hash_init(&ctx);
|
184
|
+
ed25519_hash_update(&ctx, in, inlen);
|
185
|
+
ed25519_hash_final(&ctx, hash);
|
186
|
+
}
|
187
|
+
|
188
|
+
#elif defined(ED25519_CUSTOMHASH)
|
189
|
+
|
190
|
+
#include "ed25519-hash-custom.h"
|
191
|
+
|
192
|
+
#else
|
193
|
+
|
194
|
+
#include <openssl/sha.h>
|
195
|
+
|
196
|
+
typedef SHA512_CTX ed25519_hash_context;
|
197
|
+
|
198
|
+
static void
|
199
|
+
ed25519_hash_init(ed25519_hash_context *ctx) {
|
200
|
+
SHA512_Init(ctx);
|
201
|
+
}
|
202
|
+
|
203
|
+
static void
|
204
|
+
ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen) {
|
205
|
+
SHA512_Update(ctx, in, inlen);
|
206
|
+
}
|
207
|
+
|
208
|
+
static void
|
209
|
+
ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash) {
|
210
|
+
SHA512_Final(hash, ctx);
|
211
|
+
}
|
212
|
+
|
213
|
+
static void
|
214
|
+
ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen) {
|
215
|
+
SHA512(in, inlen, hash);
|
216
|
+
}
|
217
|
+
|
218
|
+
#endif
|
219
|
+
|