ed25519_blake2b 0.1.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (61) hide show
  1. checksums.yaml +7 -0
  2. data/.gitignore +9 -0
  3. data/CODE_OF_CONDUCT.md +74 -0
  4. data/Gemfile +6 -0
  5. data/Gemfile.lock +23 -0
  6. data/LICENSE +21 -0
  7. data/README.md +39 -0
  8. data/Rakefile +13 -0
  9. data/bin/console +14 -0
  10. data/bin/setup +8 -0
  11. data/ed25519_blake2b.gemspec +31 -0
  12. data/ext/ed25519_blake2b/blake2-config.h +72 -0
  13. data/ext/ed25519_blake2b/blake2-impl.h +160 -0
  14. data/ext/ed25519_blake2b/blake2.h +195 -0
  15. data/ext/ed25519_blake2b/blake2b-load-sse2.h +68 -0
  16. data/ext/ed25519_blake2b/blake2b-load-sse41.h +402 -0
  17. data/ext/ed25519_blake2b/blake2b-ref.c +373 -0
  18. data/ext/ed25519_blake2b/blake2b-round.h +157 -0
  19. data/ext/ed25519_blake2b/curve25519-donna-32bit.h +579 -0
  20. data/ext/ed25519_blake2b/curve25519-donna-64bit.h +413 -0
  21. data/ext/ed25519_blake2b/curve25519-donna-helpers.h +67 -0
  22. data/ext/ed25519_blake2b/curve25519-donna-sse2.h +1112 -0
  23. data/ext/ed25519_blake2b/ed25519-donna-32bit-sse2.h +513 -0
  24. data/ext/ed25519_blake2b/ed25519-donna-32bit-tables.h +61 -0
  25. data/ext/ed25519_blake2b/ed25519-donna-64bit-sse2.h +436 -0
  26. data/ext/ed25519_blake2b/ed25519-donna-64bit-tables.h +53 -0
  27. data/ext/ed25519_blake2b/ed25519-donna-64bit-x86-32bit.h +435 -0
  28. data/ext/ed25519_blake2b/ed25519-donna-64bit-x86.h +351 -0
  29. data/ext/ed25519_blake2b/ed25519-donna-basepoint-table.h +259 -0
  30. data/ext/ed25519_blake2b/ed25519-donna-batchverify.h +275 -0
  31. data/ext/ed25519_blake2b/ed25519-donna-impl-base.h +364 -0
  32. data/ext/ed25519_blake2b/ed25519-donna-impl-sse2.h +390 -0
  33. data/ext/ed25519_blake2b/ed25519-donna-portable-identify.h +103 -0
  34. data/ext/ed25519_blake2b/ed25519-donna-portable.h +135 -0
  35. data/ext/ed25519_blake2b/ed25519-donna.h +115 -0
  36. data/ext/ed25519_blake2b/ed25519-hash-custom.c +28 -0
  37. data/ext/ed25519_blake2b/ed25519-hash-custom.h +30 -0
  38. data/ext/ed25519_blake2b/ed25519-hash.h +219 -0
  39. data/ext/ed25519_blake2b/ed25519-randombytes-custom.h +10 -0
  40. data/ext/ed25519_blake2b/ed25519-randombytes.h +91 -0
  41. data/ext/ed25519_blake2b/ed25519.c +150 -0
  42. data/ext/ed25519_blake2b/ed25519.h +30 -0
  43. data/ext/ed25519_blake2b/extconf.rb +3 -0
  44. data/ext/ed25519_blake2b/fuzz/README.md +173 -0
  45. data/ext/ed25519_blake2b/fuzz/build-nix.php +134 -0
  46. data/ext/ed25519_blake2b/fuzz/curve25519-ref10.c +1272 -0
  47. data/ext/ed25519_blake2b/fuzz/curve25519-ref10.h +8 -0
  48. data/ext/ed25519_blake2b/fuzz/ed25519-donna-sse2.c +3 -0
  49. data/ext/ed25519_blake2b/fuzz/ed25519-donna.c +1 -0
  50. data/ext/ed25519_blake2b/fuzz/ed25519-donna.h +34 -0
  51. data/ext/ed25519_blake2b/fuzz/ed25519-ref10.c +4647 -0
  52. data/ext/ed25519_blake2b/fuzz/ed25519-ref10.h +9 -0
  53. data/ext/ed25519_blake2b/fuzz/fuzz-curve25519.c +172 -0
  54. data/ext/ed25519_blake2b/fuzz/fuzz-ed25519.c +219 -0
  55. data/ext/ed25519_blake2b/modm-donna-32bit.h +469 -0
  56. data/ext/ed25519_blake2b/modm-donna-64bit.h +361 -0
  57. data/ext/ed25519_blake2b/rbext.c +25 -0
  58. data/ext/ed25519_blake2b/regression.h +1024 -0
  59. data/lib/ed25519_blake2b/ed25519_blake2b.rb +4 -0
  60. data/lib/ed25519_blake2b/version.rb +3 -0
  61. metadata +147 -0
@@ -0,0 +1,135 @@
1
+ #include "ed25519-donna-portable-identify.h"
2
+
3
+ #define mul32x32_64(a,b) (((uint64_t)(a))*(b))
4
+
5
+ /* platform */
6
+ #if defined(COMPILER_MSVC)
7
+ #include <intrin.h>
8
+ #if !defined(_DEBUG)
9
+ #undef mul32x32_64
10
+ #define mul32x32_64(a,b) __emulu(a,b)
11
+ #endif
12
+ #undef inline
13
+ #define inline __forceinline
14
+ #define DONNA_INLINE __forceinline
15
+ #define DONNA_NOINLINE __declspec(noinline)
16
+ #define ALIGN(x) __declspec(align(x))
17
+ #define ROTL32(a,b) _rotl(a,b)
18
+ #define ROTR32(a,b) _rotr(a,b)
19
+ #else
20
+ #include <sys/param.h>
21
+ #define DONNA_INLINE inline __attribute__((always_inline))
22
+ #define DONNA_NOINLINE __attribute__((noinline))
23
+ #define ALIGN(x) __attribute__((aligned(x)))
24
+ #define ROTL32(a,b) (((a) << (b)) | ((a) >> (32 - b)))
25
+ #define ROTR32(a,b) (((a) >> (b)) | ((a) << (32 - b)))
26
+ #endif
27
+
28
+ /* uint128_t */
29
+ #if defined(CPU_64BITS) && !defined(ED25519_FORCE_32BIT)
30
+ #if defined(COMPILER_CLANG) && (COMPILER_CLANG >= 30100)
31
+ #define HAVE_NATIVE_UINT128
32
+ typedef unsigned __int128 uint128_t;
33
+ #elif defined(COMPILER_MSVC)
34
+ #define HAVE_UINT128
35
+ typedef struct uint128_t {
36
+ uint64_t lo, hi;
37
+ } uint128_t;
38
+ #define mul64x64_128(out,a,b) out.lo = _umul128(a,b,&out.hi);
39
+ #define shr128_pair(out,hi,lo,shift) out = __shiftright128(lo, hi, shift);
40
+ #define shl128_pair(out,hi,lo,shift) out = __shiftleft128(lo, hi, shift);
41
+ #define shr128(out,in,shift) shr128_pair(out, in.hi, in.lo, shift)
42
+ #define shl128(out,in,shift) shl128_pair(out, in.hi, in.lo, shift)
43
+ #define add128(a,b) { uint64_t p = a.lo; a.lo += b.lo; a.hi += b.hi + (a.lo < p); }
44
+ #define add128_64(a,b) { uint64_t p = a.lo; a.lo += b; a.hi += (a.lo < p); }
45
+ #define lo128(a) (a.lo)
46
+ #define hi128(a) (a.hi)
47
+ #elif defined(COMPILER_GCC) && !defined(HAVE_NATIVE_UINT128)
48
+ #if defined(__SIZEOF_INT128__)
49
+ #define HAVE_NATIVE_UINT128
50
+ typedef unsigned __int128 uint128_t;
51
+ #elif (COMPILER_GCC >= 40400)
52
+ #define HAVE_NATIVE_UINT128
53
+ typedef unsigned uint128_t __attribute__((mode(TI)));
54
+ #elif defined(CPU_X86_64)
55
+ #define HAVE_UINT128
56
+ typedef struct uint128_t {
57
+ uint64_t lo, hi;
58
+ } uint128_t;
59
+ #define mul64x64_128(out,a,b) __asm__ ("mulq %3" : "=a" (out.lo), "=d" (out.hi) : "a" (a), "rm" (b));
60
+ #define shr128_pair(out,hi,lo,shift) __asm__ ("shrdq %2,%1,%0" : "+r" (lo) : "r" (hi), "J" (shift)); out = lo;
61
+ #define shl128_pair(out,hi,lo,shift) __asm__ ("shldq %2,%1,%0" : "+r" (hi) : "r" (lo), "J" (shift)); out = hi;
62
+ #define shr128(out,in,shift) shr128_pair(out,in.hi, in.lo, shift)
63
+ #define shl128(out,in,shift) shl128_pair(out,in.hi, in.lo, shift)
64
+ #define add128(a,b) __asm__ ("addq %4,%2; adcq %5,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b.lo), "rm" (b.hi) : "cc");
65
+ #define add128_64(a,b) __asm__ ("addq %4,%2; adcq $0,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b) : "cc");
66
+ #define lo128(a) (a.lo)
67
+ #define hi128(a) (a.hi)
68
+ #endif
69
+ #endif
70
+
71
+ #if defined(HAVE_NATIVE_UINT128)
72
+ #define HAVE_UINT128
73
+ #define mul64x64_128(out,a,b) out = (uint128_t)a * b;
74
+ #define shr128_pair(out,hi,lo,shift) out = (uint64_t)((((uint128_t)hi << 64) | lo) >> (shift));
75
+ #define shl128_pair(out,hi,lo,shift) out = (uint64_t)(((((uint128_t)hi << 64) | lo) << (shift)) >> 64);
76
+ #define shr128(out,in,shift) out = (uint64_t)(in >> (shift));
77
+ #define shl128(out,in,shift) out = (uint64_t)((in << shift) >> 64);
78
+ #define add128(a,b) a += b;
79
+ #define add128_64(a,b) a += (uint64_t)b;
80
+ #define lo128(a) ((uint64_t)a)
81
+ #define hi128(a) ((uint64_t)(a >> 64))
82
+ #endif
83
+
84
+ #if !defined(HAVE_UINT128)
85
+ #error Need a uint128_t implementation!
86
+ #endif
87
+ #endif
88
+
89
+ /* endian */
90
+ #if !defined(ED25519_OPENSSLRNG)
91
+ static inline void U32TO8_LE(unsigned char *p, const uint32_t v) {
92
+ p[0] = (unsigned char)(v );
93
+ p[1] = (unsigned char)(v >> 8);
94
+ p[2] = (unsigned char)(v >> 16);
95
+ p[3] = (unsigned char)(v >> 24);
96
+ }
97
+ #endif
98
+
99
+ #if !defined(HAVE_UINT128)
100
+ static inline uint32_t U8TO32_LE(const unsigned char *p) {
101
+ return
102
+ (((uint32_t)(p[0]) ) |
103
+ ((uint32_t)(p[1]) << 8) |
104
+ ((uint32_t)(p[2]) << 16) |
105
+ ((uint32_t)(p[3]) << 24));
106
+ }
107
+ #else
108
+ static inline uint64_t U8TO64_LE(const unsigned char *p) {
109
+ return
110
+ (((uint64_t)(p[0]) ) |
111
+ ((uint64_t)(p[1]) << 8) |
112
+ ((uint64_t)(p[2]) << 16) |
113
+ ((uint64_t)(p[3]) << 24) |
114
+ ((uint64_t)(p[4]) << 32) |
115
+ ((uint64_t)(p[5]) << 40) |
116
+ ((uint64_t)(p[6]) << 48) |
117
+ ((uint64_t)(p[7]) << 56));
118
+ }
119
+
120
+ static inline void U64TO8_LE(unsigned char *p, const uint64_t v) {
121
+ p[0] = (unsigned char)(v );
122
+ p[1] = (unsigned char)(v >> 8);
123
+ p[2] = (unsigned char)(v >> 16);
124
+ p[3] = (unsigned char)(v >> 24);
125
+ p[4] = (unsigned char)(v >> 32);
126
+ p[5] = (unsigned char)(v >> 40);
127
+ p[6] = (unsigned char)(v >> 48);
128
+ p[7] = (unsigned char)(v >> 56);
129
+ }
130
+ #endif
131
+
132
+ #include <stdlib.h>
133
+ #include <string.h>
134
+
135
+
@@ -0,0 +1,115 @@
1
+ /*
2
+ Public domain by Andrew M. <liquidsun@gmail.com>
3
+ Modified from the amd64-51-30k implementation by
4
+ Daniel J. Bernstein
5
+ Niels Duif
6
+ Tanja Lange
7
+ Peter Schwabe
8
+ Bo-Yin Yang
9
+ */
10
+
11
+
12
+ #include "ed25519-donna-portable.h"
13
+
14
+ #if defined(ED25519_SSE2)
15
+ #else
16
+ #if defined(HAVE_UINT128) && !defined(ED25519_FORCE_32BIT)
17
+ #define ED25519_64BIT
18
+ #else
19
+ #define ED25519_32BIT
20
+ #endif
21
+ #endif
22
+
23
+ #if !defined(ED25519_NO_INLINE_ASM)
24
+ /* detect extra features first so un-needed functions can be disabled throughout */
25
+ #if defined(ED25519_SSE2)
26
+ #if defined(COMPILER_GCC) && defined(CPU_X86)
27
+ #define ED25519_GCC_32BIT_SSE_CHOOSE
28
+ #elif defined(COMPILER_GCC) && defined(CPU_X86_64)
29
+ #define ED25519_GCC_64BIT_SSE_CHOOSE
30
+ #endif
31
+ #else
32
+ #if defined(CPU_X86_64)
33
+ #if defined(COMPILER_GCC)
34
+ #if defined(ED25519_64BIT)
35
+ #define ED25519_GCC_64BIT_X86_CHOOSE
36
+ #else
37
+ #define ED25519_GCC_64BIT_32BIT_CHOOSE
38
+ #endif
39
+ #endif
40
+ #endif
41
+ #endif
42
+ #endif
43
+
44
+ #if defined(ED25519_SSE2)
45
+ #include "curve25519-donna-sse2.h"
46
+ #elif defined(ED25519_64BIT)
47
+ #include "curve25519-donna-64bit.h"
48
+ #else
49
+ #include "curve25519-donna-32bit.h"
50
+ #endif
51
+
52
+ #include "curve25519-donna-helpers.h"
53
+
54
+ /* separate uint128 check for 64 bit sse2 */
55
+ #if defined(HAVE_UINT128) && !defined(ED25519_FORCE_32BIT)
56
+ #include "modm-donna-64bit.h"
57
+ #else
58
+ #include "modm-donna-32bit.h"
59
+ #endif
60
+
61
+ typedef unsigned char hash_512bits[64];
62
+
63
+ /*
64
+ Timing safe memory compare
65
+ */
66
+ static int
67
+ ed25519_verify(const unsigned char *x, const unsigned char *y, size_t len) {
68
+ size_t differentbits = 0;
69
+ while (len--)
70
+ differentbits |= (*x++ ^ *y++);
71
+ return (int) (1 & ((differentbits - 1) >> 8));
72
+ }
73
+
74
+
75
+ /*
76
+ * Arithmetic on the twisted Edwards curve -x^2 + y^2 = 1 + dx^2y^2
77
+ * with d = -(121665/121666) = 37095705934669439343138083508754565189542113879843219016388785533085940283555
78
+ * Base point: (15112221349535400772501151409588531511454012693041857206046113283949847762202,46316835694926478169428394003475163141307993866256225615783033603165251855960);
79
+ */
80
+
81
+ typedef struct ge25519_t {
82
+ bignum25519 x, y, z, t;
83
+ } ge25519;
84
+
85
+ typedef struct ge25519_p1p1_t {
86
+ bignum25519 x, y, z, t;
87
+ } ge25519_p1p1;
88
+
89
+ typedef struct ge25519_niels_t {
90
+ bignum25519 ysubx, xaddy, t2d;
91
+ } ge25519_niels;
92
+
93
+ typedef struct ge25519_pniels_t {
94
+ bignum25519 ysubx, xaddy, z, t2d;
95
+ } ge25519_pniels;
96
+
97
+ #include "ed25519-donna-basepoint-table.h"
98
+
99
+ #if defined(ED25519_64BIT)
100
+ #include "ed25519-donna-64bit-tables.h"
101
+ #include "ed25519-donna-64bit-x86.h"
102
+ #else
103
+ #include "ed25519-donna-32bit-tables.h"
104
+ #include "ed25519-donna-64bit-x86-32bit.h"
105
+ #endif
106
+
107
+
108
+ #if defined(ED25519_SSE2)
109
+ #include "ed25519-donna-32bit-sse2.h"
110
+ #include "ed25519-donna-64bit-sse2.h"
111
+ #include "ed25519-donna-impl-sse2.h"
112
+ #else
113
+ #include "ed25519-donna-impl-base.h"
114
+ #endif
115
+
@@ -0,0 +1,28 @@
1
+ #include <stdlib.h>
2
+ #include "ed25519-hash-custom.h"
3
+ #include "blake2.h"
4
+
5
+ void ed25519_hash_init (ed25519_hash_context * ctx)
6
+ {
7
+ ctx->blake2 = (blake2b_state *) malloc(sizeof(blake2b_state));
8
+ blake2b_init(ctx->blake2, 64);
9
+ }
10
+
11
+ void ed25519_hash_update (ed25519_hash_context * ctx, uint8_t const * in, size_t inlen)
12
+ {
13
+ blake2b_update(ctx->blake2, in, inlen);
14
+ }
15
+
16
+ void ed25519_hash_final (ed25519_hash_context * ctx, uint8_t * out)
17
+ {
18
+ blake2b_final (ctx->blake2, out, 64);
19
+ free(ctx->blake2);
20
+ }
21
+
22
+ void ed25519_hash (uint8_t * out, uint8_t const * in, size_t inlen)
23
+ {
24
+ ed25519_hash_context ctx;
25
+ ed25519_hash_init (&ctx);
26
+ ed25519_hash_update (&ctx, in, inlen);
27
+ ed25519_hash_final (&ctx, out);
28
+ }
@@ -0,0 +1,30 @@
1
+ /*
2
+ a custom hash must have a 512bit digest and implement:
3
+
4
+ struct ed25519_hash_context;
5
+
6
+ void ed25519_hash_init(ed25519_hash_context *ctx);
7
+ void ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen);
8
+ void ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash);
9
+ void ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen);
10
+ */
11
+
12
+ #include <stdint.h>
13
+ #include <stddef.h>
14
+
15
+ typedef struct {
16
+ uint8_t *output;
17
+ } Blake2;
18
+
19
+ typedef struct ed25519_hash_context_t
20
+ {
21
+ void *blake2;
22
+ } ed25519_hash_context;
23
+
24
+ void ed25519_hash_init (ed25519_hash_context * ctx);
25
+
26
+ void ed25519_hash_update (ed25519_hash_context * ctx, uint8_t const * in, size_t inlen);
27
+
28
+ void ed25519_hash_final (ed25519_hash_context * ctx, uint8_t * out);
29
+
30
+ void ed25519_hash (uint8_t * out, uint8_t const * in, size_t inlen);
@@ -0,0 +1,219 @@
1
+ #if defined(ED25519_REFHASH)
2
+
3
+ /* reference/slow SHA-512. really, do not use this */
4
+
5
+ #define HASH_BLOCK_SIZE 128
6
+ #define HASH_DIGEST_SIZE 64
7
+
8
+ typedef struct sha512_state_t {
9
+ uint64_t H[8];
10
+ uint64_t T[2];
11
+ uint32_t leftover;
12
+ uint8_t buffer[HASH_BLOCK_SIZE];
13
+ } sha512_state;
14
+
15
+ typedef sha512_state ed25519_hash_context;
16
+
17
+ static const uint64_t sha512_constants[80] = {
18
+ 0x428a2f98d728ae22ull, 0x7137449123ef65cdull, 0xb5c0fbcfec4d3b2full, 0xe9b5dba58189dbbcull,
19
+ 0x3956c25bf348b538ull, 0x59f111f1b605d019ull, 0x923f82a4af194f9bull, 0xab1c5ed5da6d8118ull,
20
+ 0xd807aa98a3030242ull, 0x12835b0145706fbeull, 0x243185be4ee4b28cull, 0x550c7dc3d5ffb4e2ull,
21
+ 0x72be5d74f27b896full, 0x80deb1fe3b1696b1ull, 0x9bdc06a725c71235ull, 0xc19bf174cf692694ull,
22
+ 0xe49b69c19ef14ad2ull, 0xefbe4786384f25e3ull, 0x0fc19dc68b8cd5b5ull, 0x240ca1cc77ac9c65ull,
23
+ 0x2de92c6f592b0275ull, 0x4a7484aa6ea6e483ull, 0x5cb0a9dcbd41fbd4ull, 0x76f988da831153b5ull,
24
+ 0x983e5152ee66dfabull, 0xa831c66d2db43210ull, 0xb00327c898fb213full, 0xbf597fc7beef0ee4ull,
25
+ 0xc6e00bf33da88fc2ull, 0xd5a79147930aa725ull, 0x06ca6351e003826full, 0x142929670a0e6e70ull,
26
+ 0x27b70a8546d22ffcull, 0x2e1b21385c26c926ull, 0x4d2c6dfc5ac42aedull, 0x53380d139d95b3dfull,
27
+ 0x650a73548baf63deull, 0x766a0abb3c77b2a8ull, 0x81c2c92e47edaee6ull, 0x92722c851482353bull,
28
+ 0xa2bfe8a14cf10364ull, 0xa81a664bbc423001ull, 0xc24b8b70d0f89791ull, 0xc76c51a30654be30ull,
29
+ 0xd192e819d6ef5218ull, 0xd69906245565a910ull, 0xf40e35855771202aull, 0x106aa07032bbd1b8ull,
30
+ 0x19a4c116b8d2d0c8ull, 0x1e376c085141ab53ull, 0x2748774cdf8eeb99ull, 0x34b0bcb5e19b48a8ull,
31
+ 0x391c0cb3c5c95a63ull, 0x4ed8aa4ae3418acbull, 0x5b9cca4f7763e373ull, 0x682e6ff3d6b2b8a3ull,
32
+ 0x748f82ee5defb2fcull, 0x78a5636f43172f60ull, 0x84c87814a1f0ab72ull, 0x8cc702081a6439ecull,
33
+ 0x90befffa23631e28ull, 0xa4506cebde82bde9ull, 0xbef9a3f7b2c67915ull, 0xc67178f2e372532bull,
34
+ 0xca273eceea26619cull, 0xd186b8c721c0c207ull, 0xeada7dd6cde0eb1eull, 0xf57d4f7fee6ed178ull,
35
+ 0x06f067aa72176fbaull, 0x0a637dc5a2c898a6ull, 0x113f9804bef90daeull, 0x1b710b35131c471bull,
36
+ 0x28db77f523047d84ull, 0x32caab7b40c72493ull, 0x3c9ebe0a15c9bebcull, 0x431d67c49c100d4cull,
37
+ 0x4cc5d4becb3e42b6ull, 0x597f299cfc657e2aull, 0x5fcb6fab3ad6faecull, 0x6c44198c4a475817ull
38
+ };
39
+
40
+ static uint64_t
41
+ sha512_ROTR64(uint64_t x, int k) {
42
+ return (x >> k) | (x << (64 - k));
43
+ }
44
+
45
+ static uint64_t
46
+ sha512_LOAD64_BE(const uint8_t *p) {
47
+ return
48
+ ((uint64_t)p[0] << 56) |
49
+ ((uint64_t)p[1] << 48) |
50
+ ((uint64_t)p[2] << 40) |
51
+ ((uint64_t)p[3] << 32) |
52
+ ((uint64_t)p[4] << 24) |
53
+ ((uint64_t)p[5] << 16) |
54
+ ((uint64_t)p[6] << 8) |
55
+ ((uint64_t)p[7] );
56
+ }
57
+
58
+ static void
59
+ sha512_STORE64_BE(uint8_t *p, uint64_t v) {
60
+ p[0] = (uint8_t)(v >> 56);
61
+ p[1] = (uint8_t)(v >> 48);
62
+ p[2] = (uint8_t)(v >> 40);
63
+ p[3] = (uint8_t)(v >> 32);
64
+ p[4] = (uint8_t)(v >> 24);
65
+ p[5] = (uint8_t)(v >> 16);
66
+ p[6] = (uint8_t)(v >> 8);
67
+ p[7] = (uint8_t)(v );
68
+ }
69
+
70
+ #define Ch(x,y,z) (z ^ (x & (y ^ z)))
71
+ #define Maj(x,y,z) (((x | y) & z) | (x & y))
72
+ #define S0(x) (sha512_ROTR64(x, 28) ^ sha512_ROTR64(x, 34) ^ sha512_ROTR64(x, 39))
73
+ #define S1(x) (sha512_ROTR64(x, 14) ^ sha512_ROTR64(x, 18) ^ sha512_ROTR64(x, 41))
74
+ #define G0(x) (sha512_ROTR64(x, 1) ^ sha512_ROTR64(x, 8) ^ (x >> 7))
75
+ #define G1(x) (sha512_ROTR64(x, 19) ^ sha512_ROTR64(x, 61) ^ (x >> 6))
76
+ #define W0(in,i) (sha512_LOAD64_BE(&in[i * 8]))
77
+ #define W1(i) (G1(w[i - 2]) + w[i - 7] + G0(w[i - 15]) + w[i - 16])
78
+ #define STEP(i) \
79
+ t1 = S0(r[0]) + Maj(r[0], r[1], r[2]); \
80
+ t0 = r[7] + S1(r[4]) + Ch(r[4], r[5], r[6]) + sha512_constants[i] + w[i]; \
81
+ r[7] = r[6]; \
82
+ r[6] = r[5]; \
83
+ r[5] = r[4]; \
84
+ r[4] = r[3] + t0; \
85
+ r[3] = r[2]; \
86
+ r[2] = r[1]; \
87
+ r[1] = r[0]; \
88
+ r[0] = t0 + t1;
89
+
90
+ static void
91
+ sha512_blocks(sha512_state *S, const uint8_t *in, size_t blocks) {
92
+ uint64_t r[8], w[80], t0, t1;
93
+ size_t i;
94
+
95
+ for (i = 0; i < 8; i++) r[i] = S->H[i];
96
+
97
+ while (blocks--) {
98
+ for (i = 0; i < 16; i++) { w[i] = W0(in, i); }
99
+ for (i = 16; i < 80; i++) { w[i] = W1(i); }
100
+ for (i = 0; i < 80; i++) { STEP(i); }
101
+ for (i = 0; i < 8; i++) { r[i] += S->H[i]; S->H[i] = r[i]; }
102
+ S->T[0] += HASH_BLOCK_SIZE * 8;
103
+ S->T[1] += (!S->T[0]) ? 1 : 0;
104
+ in += HASH_BLOCK_SIZE;
105
+ }
106
+ }
107
+
108
+ static void
109
+ ed25519_hash_init(sha512_state *S) {
110
+ S->H[0] = 0x6a09e667f3bcc908ull;
111
+ S->H[1] = 0xbb67ae8584caa73bull;
112
+ S->H[2] = 0x3c6ef372fe94f82bull;
113
+ S->H[3] = 0xa54ff53a5f1d36f1ull;
114
+ S->H[4] = 0x510e527fade682d1ull;
115
+ S->H[5] = 0x9b05688c2b3e6c1full;
116
+ S->H[6] = 0x1f83d9abfb41bd6bull;
117
+ S->H[7] = 0x5be0cd19137e2179ull;
118
+ S->T[0] = 0;
119
+ S->T[1] = 0;
120
+ S->leftover = 0;
121
+ }
122
+
123
+ static void
124
+ ed25519_hash_update(sha512_state *S, const uint8_t *in, size_t inlen) {
125
+ size_t blocks, want;
126
+
127
+ /* handle the previous data */
128
+ if (S->leftover) {
129
+ want = (HASH_BLOCK_SIZE - S->leftover);
130
+ want = (want < inlen) ? want : inlen;
131
+ memcpy(S->buffer + S->leftover, in, want);
132
+ S->leftover += (uint32_t)want;
133
+ if (S->leftover < HASH_BLOCK_SIZE)
134
+ return;
135
+ in += want;
136
+ inlen -= want;
137
+ sha512_blocks(S, S->buffer, 1);
138
+ }
139
+
140
+ /* handle the current data */
141
+ blocks = (inlen & ~(HASH_BLOCK_SIZE - 1));
142
+ S->leftover = (uint32_t)(inlen - blocks);
143
+ if (blocks) {
144
+ sha512_blocks(S, in, blocks / HASH_BLOCK_SIZE);
145
+ in += blocks;
146
+ }
147
+
148
+ /* handle leftover data */
149
+ if (S->leftover)
150
+ memcpy(S->buffer, in, S->leftover);
151
+ }
152
+
153
+ static void
154
+ ed25519_hash_final(sha512_state *S, uint8_t *hash) {
155
+ uint64_t t0 = S->T[0] + (S->leftover * 8), t1 = S->T[1];
156
+
157
+ S->buffer[S->leftover] = 0x80;
158
+ if (S->leftover <= 111) {
159
+ memset(S->buffer + S->leftover + 1, 0, 111 - S->leftover);
160
+ } else {
161
+ memset(S->buffer + S->leftover + 1, 0, 127 - S->leftover);
162
+ sha512_blocks(S, S->buffer, 1);
163
+ memset(S->buffer, 0, 112);
164
+ }
165
+
166
+ sha512_STORE64_BE(S->buffer + 112, t1);
167
+ sha512_STORE64_BE(S->buffer + 120, t0);
168
+ sha512_blocks(S, S->buffer, 1);
169
+
170
+ sha512_STORE64_BE(&hash[ 0], S->H[0]);
171
+ sha512_STORE64_BE(&hash[ 8], S->H[1]);
172
+ sha512_STORE64_BE(&hash[16], S->H[2]);
173
+ sha512_STORE64_BE(&hash[24], S->H[3]);
174
+ sha512_STORE64_BE(&hash[32], S->H[4]);
175
+ sha512_STORE64_BE(&hash[40], S->H[5]);
176
+ sha512_STORE64_BE(&hash[48], S->H[6]);
177
+ sha512_STORE64_BE(&hash[56], S->H[7]);
178
+ }
179
+
180
+ static void
181
+ ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen) {
182
+ ed25519_hash_context ctx;
183
+ ed25519_hash_init(&ctx);
184
+ ed25519_hash_update(&ctx, in, inlen);
185
+ ed25519_hash_final(&ctx, hash);
186
+ }
187
+
188
+ #elif defined(ED25519_CUSTOMHASH)
189
+
190
+ #include "ed25519-hash-custom.h"
191
+
192
+ #else
193
+
194
+ #include <openssl/sha.h>
195
+
196
+ typedef SHA512_CTX ed25519_hash_context;
197
+
198
+ static void
199
+ ed25519_hash_init(ed25519_hash_context *ctx) {
200
+ SHA512_Init(ctx);
201
+ }
202
+
203
+ static void
204
+ ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen) {
205
+ SHA512_Update(ctx, in, inlen);
206
+ }
207
+
208
+ static void
209
+ ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash) {
210
+ SHA512_Final(hash, ctx);
211
+ }
212
+
213
+ static void
214
+ ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen) {
215
+ SHA512(in, inlen, hash);
216
+ }
217
+
218
+ #endif
219
+