pq_crypto-seal 0.1.0

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis256x4/aegis256x4_neon_aes.c

@@ -0,0 +1,117 @@
+#if defined(__aarch64__) || defined(_M_ARM64)
+
+#    include <stddef.h>
+#    include <stdint.h>
+
+#    include "../common/common.h"
+#    include "aegis256x4.h"
+#    include "aegis256x4_neon_aes.h"
+
+#    ifndef __ARM_FEATURE_CRYPTO
+#        define __ARM_FEATURE_CRYPTO 1
+#    endif
+#    ifndef __ARM_FEATURE_AES
+#        define __ARM_FEATURE_AES 1
+#    endif
+
+#    include <arm_neon.h>
+
+#    ifdef __clang__
+#        pragma clang attribute push(__attribute__((target("neon,crypto,aes"))), \
+                                     apply_to = function)
+#    elif defined(__GNUC__)
+#        pragma GCC target("+simd+crypto")
+#    endif
+
+#    define AES_BLOCK_LENGTH 64
+
+typedef struct {
+    uint8x16_t b0;
+    uint8x16_t b1;
+    uint8x16_t b2;
+    uint8x16_t b3;
+} aes_block_t;
+
+static inline aes_block_t
+AES_BLOCK_XOR(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { veorq_u8(a.b0, b.b0), veorq_u8(a.b1, b.b1), veorq_u8(a.b2, b.b2),
+                           veorq_u8(a.b3, b.b3) };
+}
+
+static inline aes_block_t
+AES_BLOCK_AND(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { vandq_u8(a.b0, b.b0), vandq_u8(a.b1, b.b1), vandq_u8(a.b2, b.b2),
+                           vandq_u8(a.b3, b.b3) };
+}
+
+static inline aes_block_t
+AES_BLOCK_LOAD(const uint8_t *a)
+{
+    return (aes_block_t) { vld1q_u8(a), vld1q_u8(a + 16), vld1q_u8(a + 32), vld1q_u8(a + 48) };
+}
+
+static inline aes_block_t
+AES_BLOCK_LOAD_64x2(uint64_t a, uint64_t b)
+{
+    const uint8x16_t t = vreinterpretq_u8_u64(vsetq_lane_u64((a), vmovq_n_u64(b), 1));
+    return (aes_block_t) { t, t, t, t };
+}
+static inline void
+AES_BLOCK_STORE(uint8_t *a, const aes_block_t b)
+{
+    vst1q_u8(a, b.b0);
+    vst1q_u8(a + 16, b.b1);
+    vst1q_u8(a + 32, b.b2);
+    vst1q_u8(a + 48, b.b3);
+}
+
+static inline aes_block_t
+AES_ENC(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { veorq_u8(vaesmcq_u8(vaeseq_u8(vmovq_n_u8(0), a.b0)), b.b0),
+                           veorq_u8(vaesmcq_u8(vaeseq_u8(vmovq_n_u8(0), a.b1)), b.b1),
+                           veorq_u8(vaesmcq_u8(vaeseq_u8(vmovq_n_u8(0), a.b2)), b.b2),
+                           veorq_u8(vaesmcq_u8(vaeseq_u8(vmovq_n_u8(0), a.b3)), b.b3) };
+}
+
+static inline void
+aegis256x4_update(aes_block_t *const state, const aes_block_t d)
+{
+    aes_block_t tmp;
+
+    tmp      = state[5];
+    state[5] = AES_ENC(state[4], state[5]);
+    state[4] = AES_ENC(state[3], state[4]);
+    state[3] = AES_ENC(state[2], state[3]);
+    state[2] = AES_ENC(state[1], state[2]);
+    state[1] = AES_ENC(state[0], state[1]);
+    state[0] = AES_BLOCK_XOR(AES_ENC(tmp, state[0]), d);
+}
+
+#    include "aegis256x4_common.h"
+
+struct aegis256x4_implementation aegis256x4_neon_aes_implementation = {
+    .encrypt_detached        = encrypt_detached,
+    .decrypt_detached        = decrypt_detached,
+    .encrypt_unauthenticated = encrypt_unauthenticated,
+    .decrypt_unauthenticated = decrypt_unauthenticated,
+    .stream                  = stream,
+    .state_init              = state_init,
+    .state_encrypt_update    = state_encrypt_update,
+    .state_encrypt_final     = state_encrypt_final,
+    .state_decrypt_update    = state_decrypt_update,
+    .state_decrypt_final     = state_decrypt_final,
+    .state_mac_init          = state_mac_init,
+    .state_mac_update        = state_mac_update,
+    .state_mac_final         = state_mac_final,
+    .state_mac_reset         = state_mac_reset,
+    .state_mac_clone         = state_mac_clone,
+};
+
+#    ifdef __clang__
+#        pragma clang attribute pop
+#    endif
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis256x4/aegis256x4_neon_aes.h

@@ -0,0 +1,9 @@
+#ifndef aegis256x4_neon_aes_H
+#define aegis256x4_neon_aes_H
+
+#include "../common/common.h"
+#include "implementations.h"
+
+extern struct aegis256x4_implementation aegis256x4_neon_aes_implementation;
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis256x4/aegis256x4_soft.c

@@ -0,0 +1,99 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "../common/common.h"
+#include "../common/cpu.h"
+
+#ifndef HAS_HW_AES
+
+#    include "../common/softaes.h"
+#    include "aegis256x4.h"
+#    include "aegis256x4_soft.h"
+
+#    define AES_BLOCK_LENGTH 64
+
+typedef struct {
+    SoftAesBlock b0;
+    SoftAesBlock b1;
+    SoftAesBlock b2;
+    SoftAesBlock b3;
+} aes_block_t;
+
+static inline aes_block_t
+AES_BLOCK_XOR(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { softaes_block_xor(a.b0, b.b0), softaes_block_xor(a.b1, b.b1),
+                           softaes_block_xor(a.b2, b.b2), softaes_block_xor(a.b3, b.b3) };
+}
+
+static inline aes_block_t
+AES_BLOCK_AND(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { softaes_block_and(a.b0, b.b0), softaes_block_and(a.b1, b.b1),
+                           softaes_block_and(a.b2, b.b2), softaes_block_and(a.b3, b.b3) };
+}
+
+static inline aes_block_t
+AES_BLOCK_LOAD(const uint8_t *a)
+{
+    return (aes_block_t) { softaes_block_load(a), softaes_block_load(a + 16),
+                           softaes_block_load(a + 32), softaes_block_load(a + 48) };
+}
+
+static inline aes_block_t
+AES_BLOCK_LOAD_64x2(uint64_t a, uint64_t b)
+{
+    const SoftAesBlock t = softaes_block_load64x2(a, b);
+    return (aes_block_t) { t, t, t, t };
+}
+static inline void
+AES_BLOCK_STORE(uint8_t *a, const aes_block_t b)
+{
+    softaes_block_store(a, b.b0);
+    softaes_block_store(a + 16, b.b1);
+    softaes_block_store(a + 32, b.b2);
+    softaes_block_store(a + 48, b.b3);
+}
+
+static inline aes_block_t
+AES_ENC(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { softaes_block_encrypt(a.b0, b.b0), softaes_block_encrypt(a.b1, b.b1),
+                           softaes_block_encrypt(a.b2, b.b2), softaes_block_encrypt(a.b3, b.b3) };
+}
+
+static inline void
+aegis256x4_update(aes_block_t *const state, const aes_block_t d)
+{
+    aes_block_t tmp;
+
+    tmp      = state[5];
+    state[5] = AES_ENC(state[4], state[5]);
+    state[4] = AES_ENC(state[3], state[4]);
+    state[3] = AES_ENC(state[2], state[3]);
+    state[2] = AES_ENC(state[1], state[2]);
+    state[1] = AES_ENC(state[0], state[1]);
+    state[0] = AES_BLOCK_XOR(AES_ENC(tmp, state[0]), d);
+}
+
+#    include "aegis256x4_common.h"
+
+struct aegis256x4_implementation aegis256x4_soft_implementation = {
+    .encrypt_detached        = encrypt_detached,
+    .decrypt_detached        = decrypt_detached,
+    .encrypt_unauthenticated = encrypt_unauthenticated,
+    .decrypt_unauthenticated = decrypt_unauthenticated,
+    .stream                  = stream,
+    .state_init              = state_init,
+    .state_encrypt_update    = state_encrypt_update,
+    .state_encrypt_final     = state_encrypt_final,
+    .state_decrypt_update    = state_decrypt_update,
+    .state_decrypt_final     = state_decrypt_final,
+    .state_mac_init          = state_mac_init,
+    .state_mac_update        = state_mac_update,
+    .state_mac_final         = state_mac_final,
+    .state_mac_reset         = state_mac_reset,
+    .state_mac_clone         = state_mac_clone,
+};
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis256x4/aegis256x4_soft.h

@@ -0,0 +1,9 @@
+#ifndef aegis256x4_soft_H
+#define aegis256x4_soft_H
+
+#include "../common/common.h"
+#include "implementations.h"
+
+extern struct aegis256x4_implementation aegis256x4_soft_implementation;
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis256x4/implementations.h

@@ -0,0 +1,42 @@
+#ifndef aegis256x4_implementations_H
+#define aegis256x4_implementations_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "aegis256x4.h"
+
+/* Namespacing to avoid conflicts with libsodium */
+#define aegis256x4_soft_implementation     libaegis_aegis256x4_soft_implementation
+#define aegis256x4_aesni_implementation    libaegis_aegis256x4_aesni_implementation
+#define aegis256x4_neon_aes_implementation libaegis_aegis256x4_neon_aes_implementation
+#define aegis256x4_altivec_implementation  libaegis_aegis256x4_altivec_implementation
+#define aegis256x4_avx2_implementation     libaegis_aegis256x4_avx2_implementation
+#define aegis256x4_avx512_implementation   libaegis_aegis256x4_avx512_implementation
+
+typedef struct aegis256x4_implementation {
+    int (*encrypt_detached)(uint8_t *c, uint8_t *mac, size_t maclen, const uint8_t *m, size_t mlen,
+                            const uint8_t *ad, size_t adlen, const uint8_t *npub, const uint8_t *k);
+    int (*decrypt_detached)(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac,
+                            size_t maclen, const uint8_t *ad, size_t adlen, const uint8_t *npub,
+                            const uint8_t *k);
+    void (*stream)(uint8_t *out, size_t len, const uint8_t *npub, const uint8_t *k);
+    void (*encrypt_unauthenticated)(uint8_t *c, const uint8_t *m, size_t mlen, const uint8_t *npub,
+                                    const uint8_t *k);
+    void (*decrypt_unauthenticated)(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *npub,
+                                    const uint8_t *k);
+    void (*state_init)(aegis256x4_state *st_, const uint8_t *ad, size_t adlen, const uint8_t *npub,
+                       const uint8_t *k);
+    int (*state_encrypt_update)(aegis256x4_state *st_, uint8_t *c, const uint8_t *m, size_t mlen);
+    int (*state_encrypt_final)(aegis256x4_state *st_, uint8_t *mac, size_t maclen);
+    int (*state_decrypt_update)(aegis256x4_state *st_, uint8_t *m, const uint8_t *c, size_t clen);
+    int (*state_decrypt_final)(aegis256x4_state *st_, const uint8_t *mac, size_t maclen);
+    void (*state_mac_init)(aegis256x4_mac_state *st_, const uint8_t *npub, const uint8_t *k);
+    int (*state_mac_update)(aegis256x4_mac_state *st_, const uint8_t *ad, size_t adlen);
+    int (*state_mac_final)(aegis256x4_mac_state *st_, uint8_t *mac, size_t maclen);
+    void (*state_mac_reset)(aegis256x4_mac_state *st);
+    void (*state_mac_clone)(aegis256x4_mac_state *dst, const aegis256x4_mac_state *src);
+
+} aegis256x4_implementation;
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/common/common.c

@@ -0,0 +1,81 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "common.h"
+#include "cpu.h"
+
+static volatile uint16_t optblocker_u16;
+
+static inline int
+aegis_verify_n(const uint8_t *x_, const uint8_t *y_, const int n)
+{
+    const volatile uint8_t *volatile x = (const volatile uint8_t *volatile) x_;
+    const volatile uint8_t *volatile y = (const volatile uint8_t *volatile) y_;
+    volatile uint16_t d                = 0U;
+    int               i;
+
+    for (i = 0; i < n; i++) {
+        d |= x[i] ^ y[i];
+    }
+#if defined(__GNUC__) || defined(__clang__)
+    __asm__("" : "+r"(d) :);
+#endif
+    d--;
+    d = ((d >> 13) ^ optblocker_u16) >> 2;
+
+    return (int) d - 1;
+}
+
+int
+aegis_verify_16(const uint8_t *x, const uint8_t *y)
+{
+    return aegis_verify_n(x, y, 16);
+}
+
+int
+aegis_verify_32(const uint8_t *x, const uint8_t *y)
+{
+    return aegis_verify_n(x, y, 32);
+}
+
+extern int aegis128l_pick_best_implementation(void);
+extern int aegis128x2_pick_best_implementation(void);
+extern int aegis128x4_pick_best_implementation(void);
+extern int aegis256_pick_best_implementation(void);
+extern int aegis256x2_pick_best_implementation(void);
+extern int aegis256x4_pick_best_implementation(void);
+
+int
+aegis_init(void)
+{
+    static int initialized = 0;
+
+    if (initialized) {
+        return 0;
+    }
+    if (aegis_runtime_get_cpu_features() != 0) {
+        return 0;
+    }
+    if (aegis128l_pick_best_implementation() != 0 || aegis128x2_pick_best_implementation() != 0 ||
+        aegis128x4_pick_best_implementation() != 0 || aegis256_pick_best_implementation() != 0 ||
+        aegis256x2_pick_best_implementation() != 0 || aegis256x4_pick_best_implementation() != 0) {
+        return -1;
+    }
+    initialized = 1;
+
+    return 0;
+}
+
+#if defined(_MSC_VER)
+#    pragma section(".CRT$XCU", read)
+static void __cdecl _do_aegis_init(void);
+__declspec(allocate(".CRT$XCU")) void (*aegis_init_constructor)(void) = _do_aegis_init;
+#else
+static void _do_aegis_init(void) __attribute__((constructor));
+#endif
+
+static void
+_do_aegis_init(void)
+{
+    (void) aegis_init();
+}

data/ext/pq_crypto_seal/vendor/libaegis/src/common/common.h

@@ -0,0 +1,144 @@
+#ifndef common_H
+#define common_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#if defined(__wasm__) && !defined(__wasi__)
+static int errno;
+#    define memcpy(A, B, C) __builtin_memcpy((A), (B), (C))
+#    define memset(A, B, C) __builtin_memset((A), (B), (C))
+#    define memcmp(A, B, C) __builtin_memcmp((A), (B), (C))
+#else
+#    include <errno.h>
+#    include <stdlib.h>
+#    include <string.h>
+#endif
+
+#include "aegis.h"
+
+#ifdef __linux__
+#    define HAVE_SYS_AUXV_H
+#    define HAVE_GETAUXVAL
+#endif
+#ifdef __ANDROID_API__
+#    if __ANDROID_API__ < 18
+#        undef HAVE_GETAUXVAL
+#    endif
+#    define HAVE_ANDROID_GETCPUFEATURES
+#endif
+#if defined(__i386__) || defined(_M_IX86) || defined(__x86_64__) || defined(_M_AMD64)
+#    define HAVE_CPUID
+#    define NATIVE_LITTLE_ENDIAN
+#    if defined(__clang__) || defined(__GNUC__)
+#        define HAVE_AVX_ASM
+#    endif
+#    define HAVE_AVXINTRIN_H
+#    define HAVE_AVX2INTRIN_H
+#    define HAVE_AVX512FINTRIN_H
+#    define HAVE_TMMINTRIN_H
+#    define HAVE_WMMINTRIN_H
+#    define HAVE_VAESINTRIN_H
+#    ifdef __GNUC__
+#        if !__has_include(<vaesintrin.h>)
+#            undef HAVE_VAESINTRIN_H
+#        endif
+#    endif
+
+/* target pragmas don't define these flags on clang-cl (an alternative clang driver for Windows) */
+#    if defined(__clang__) && defined(_MSC_BUILD) && defined(_MSC_VER) && \
+        (defined(_M_IX86) || defined(_M_AMD64)) && !defined(__SSE3__)
+#        undef __SSE3__
+#        undef __SSSE3__
+#        undef __SSE4_1__
+#        undef __AVX__
+#        undef __AVX2__
+#        undef __AVX512F__
+#        undef __AES__
+#        undef __VAES__
+
+#        define __SSE3__    1
+#        define __SSSE3__   1
+#        define __SSE4_1__  1
+#        define __AVX__     1
+#        define __AVX2__    1
+#        define __AVX512F__ 1
+#        define __AES__     1
+#        define __VAES__    1
+#    endif
+
+#endif
+
+#ifdef DISABLE_AVX2
+#    undef HAVE_AVXINTRIN_H
+#    undef HAVE_AVX2INTRIN_H
+#    undef HAVE_AVX512FINTRIN_H
+#    undef HAVE_VAESINTRIN_H
+#endif
+#ifdef DISABLE_AVX512
+#    undef HAVE_AVX512FINTRIN_H
+#endif
+
+#if defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#    ifndef NATIVE_LITTLE_ENDIAN
+#        define NATIVE_LITTLE_ENDIAN
+#    endif
+#endif
+
+#if defined(__INTEL_COMPILER) || defined(_MSC_VER)
+#    define CRYPTO_ALIGN(x) __declspec(align(x))
+#else
+#    define CRYPTO_ALIGN(x) __attribute__((aligned(x)))
+#endif
+
+#define LOAD32_LE(SRC) load32_le(SRC)
+static inline uint32_t
+load32_le(const uint8_t src[4])
+{
+#ifdef NATIVE_LITTLE_ENDIAN
+    uint32_t w;
+    memcpy(&w, src, sizeof w);
+    return w;
+#else
+    uint32_t w = (uint32_t) src[0];
+    w |= (uint32_t) src[1] << 8;
+    w |= (uint32_t) src[2] << 16;
+    w |= (uint32_t) src[3] << 24;
+    return w;
+#endif
+}
+
+#define STORE32_LE(DST, W) store32_le((DST), (W))
+static inline void
+store32_le(uint8_t dst[4], uint32_t w)
+{
+#ifdef NATIVE_LITTLE_ENDIAN
+    memcpy(dst, &w, sizeof w);
+#else
+    dst[0] = (uint8_t) w;
+    w >>= 8;
+    dst[1] = (uint8_t) w;
+    w >>= 8;
+    dst[2] = (uint8_t) w;
+    w >>= 8;
+    dst[3] = (uint8_t) w;
+#endif
+}
+
+#define ROTL32(X, B) rotl32((X), (B))
+static inline uint32_t
+rotl32(const uint32_t x, const int b)
+{
+    return (x << b) | (x >> (32 - b));
+}
+
+#define COMPILER_ASSERT(X) (void) sizeof(char[(X) ? 1 : -1])
+
+#ifndef ERANGE
+#    define ERANGE 34
+#endif
+#ifndef EINVAL
+#    define EINVAL 22
+#endif
+
+#endif