pq_crypto-seal 0.1.0

data/ext/pq_crypto_seal/vendor/libaegis/src/common/cpu.c

@@ -0,0 +1,378 @@
+#include "cpu.h"
+#include "common.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef HAVE_ANDROID_GETCPUFEATURES
+#    include <cpu-features.h>
+#endif
+#ifdef __APPLE__
+#    include <mach/machine.h>
+#    include <sys/sysctl.h>
+#    include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_AUXV_H
+#    include <sys/auxv.h>
+#endif
+#if defined(_MSC_VER) && (defined(_M_X64) || defined(_M_IX86))
+#    include <intrin.h>
+#endif
+
+typedef struct CPUFeatures_ {
+    int initialized;
+    int has_neon;
+    int has_neon_aes;
+    int has_neon_sha3;
+    int has_sve2_aes;
+    int has_avx;
+    int has_avx2;
+    int has_avx512f;
+    int has_aesni;
+    int has_vaes;
+    int has_altivec;
+} CPUFeatures;
+
+static CPUFeatures _cpu_features;
+
+#define CPUID_EBX_AVX2    0x00000020
+#define CPUID_EBX_AVX512F 0x00010000
+
+#define CPUID_ECX_AESNI   0x02000000
+#define CPUID_ECX_XSAVE   0x04000000
+#define CPUID_ECX_OSXSAVE 0x08000000
+#define CPUID_ECX_AVX     0x10000000
+#define CPUID_ECX_VAES    0x00000200
+
+#define XCR0_SSE       0x00000002
+#define XCR0_AVX       0x00000004
+#define XCR0_OPMASK    0x00000020
+#define XCR0_ZMM_HI256 0x00000040
+#define XCR0_HI16_ZMM  0x00000080
+
+// Define hwcap values ourselves: building with an old auxv header where these
+// hwcap values are not defined should not prevent features from being enabled.
+
+// Arm hwcaps.
+#define AEGIS_ARM_HWCAP_NEON (1L << 12)
+#define AEGIS_ARM_HWCAP2_AES (1L << 0)
+
+// AArch64 hwcaps.
+#define AEGIS_AARCH64_HWCAP_ASIMD   (1L << 1)
+#define AEGIS_AARCH64_HWCAP_AES     (1L << 3)
+#define AEGIS_AARCH64_HWCAP_SHA3    (1L << 17)
+#define AEGIS_AARCH64_HWCAP2_SVEAES (1L << 2)
+
+#if defined(__APPLE__) && defined(CPU_TYPE_ARM64) && defined(CPU_SUBTYPE_ARM64E)
+// sysctlbyname() parameter documentation for instruction set characteristics:
+// https://developer.apple.com/documentation/kernel/1387446-sysctlbyname/determining_instruction_set_characteristics
+static inline int __attribute__((unused))
+_have_arm_feature(const char *feature)
+{
+    int64_t feature_present = 0;
+    size_t  size            = sizeof(feature_present);
+    if (sysctlbyname(feature, &feature_present, &size, NULL, 0) != 0) {
+        return 0;
+    }
+    return feature_present;
+}
+
+#elif (defined(__arm__) || defined(__aarch64__) || defined(_M_ARM64)) && defined(AT_HWCAP)
+static inline int
+_have_hwcap(int hwcap_id, int bit)
+{
+    unsigned long buf = 0;
+#    ifdef HAVE_GETAUXVAL
+    buf = getauxval(hwcap_id);
+#    elif defined(HAVE_ELF_AUX_INFO)
+    if (elf_aux_info(hwcap_id, (void *) &buf, (int) sizeof buf) != 0) {
+        return 0;
+    }
+#    endif
+    return (buf & bit) != 0;
+}
+#endif
+
+static int
+_runtime_arm_cpu_features(CPUFeatures *const cpu_features)
+{
+#ifndef __ARM_ARCH
+    return -1; /* LCOV_EXCL_LINE */
+#endif
+
+#if defined(__ARM_NEON) || defined(__aarch64__) || defined(_M_ARM64)
+    cpu_features->has_neon = 1;
+#elif defined(HAVE_ANDROID_GETCPUFEATURES) && defined(ANDROID_CPU_ARM_FEATURE_NEON)
+    cpu_features->has_neon = (android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_NEON) != 0x0;
+#elif (defined(__aarch64__) || defined(_M_ARM64)) && defined(AT_HWCAP)
+    cpu_features->has_neon = _have_hwcap(AT_HWCAP, AEGIS_AARCH64_HWCAP_ASIMD);
+#elif defined(__arm__) && defined(AT_HWCAP)
+    cpu_features->has_neon = _have_hwcap(AT_HWCAP, AEGIS_ARM_HWCAP_NEON);
+#endif
+
+    if (cpu_features->has_neon == 0) {
+        return 0;
+    }
+
+#if __ARM_FEATURE_CRYPTO || __ARM_FEATURE_AES
+    cpu_features->has_neon_aes = 1;
+#elif defined(_M_ARM64)
+    // Assuming all CPUs supported by Arm Windows have the crypto extensions.
+    cpu_features->has_neon_aes = 1;
+#elif defined(__APPLE__) && defined(CPU_TYPE_ARM64) && defined(CPU_SUBTYPE_ARM64E)
+    cpu_features->has_neon_aes = _have_arm_feature("hw.optional.arm.FEAT_AES");
+#elif defined(HAVE_ANDROID_GETCPUFEATURES) && defined(ANDROID_CPU_ARM_FEATURE_AES)
+    cpu_features->has_neon_aes = (android_getCpuFeatures() & ANDROID_CPU_ARM_FEATURE_AES) != 0x0;
+#elif (defined(__aarch64__) || defined(_M_ARM64)) && defined(AT_HWCAP)
+    cpu_features->has_neon_aes = _have_hwcap(AT_HWCAP, AEGIS_AARCH64_HWCAP_AES);
+#elif defined(__arm__) && defined(AT_HWCAP2)
+    cpu_features->has_neon_aes = _have_hwcap(AT_HWCAP2, AEGIS_ARM_HWCAP2_AES);
+#endif
+
+    // The FEAT_SHA3 implementation assumes that FEAT_AES is also present.
+    if (cpu_features->has_neon_aes == 0) {
+        return 0;
+    }
+
+    // At the time of writing Windows does not provide a mechanism for
+    // detecting FEAT_SHA3, however FEAT_SHA3 is mandatory if FEAT_SVE_AES is
+    // also implemented, so test that instead.
+#if __ARM_FEATURE_SHA3
+    cpu_features->has_neon_sha3 = 1;
+#elif defined(_M_ARM64) && defined(PF_ARM_SVE_AES_INSTRUCTIONS_AVAILABLE)
+    cpu_features->has_neon_sha3 = IsProcessorFeaturePresent(PF_ARM_SVE_AES_INSTRUCTIONS_AVAILABLE);
+#elif defined(__APPLE__) && defined(CPU_TYPE_ARM64) && defined(CPU_SUBTYPE_ARM64E)
+    cpu_features->has_neon_sha3 = _have_arm_feature("hw.optional.arm.FEAT_SHA3");
+#elif (defined(__aarch64__) || defined(_M_ARM64)) && defined(AT_HWCAP)
+    cpu_features->has_neon_sha3 = _have_hwcap(AT_HWCAP, AEGIS_AARCH64_HWCAP_SHA3);
+#endif
+
+    // The FEAT_SVE_AES implementation assumes that FEAT_AES and FEAT_SHA3 are
+    // also present.
+    if (cpu_features->has_neon_sha3 == 0) {
+        return 0;
+    }
+
+    // At the time of writing Apple Silicon platforms do not provide a
+    // mechanism for detecting FEAT_SVE_AES.
+#if __ARM_FEATURE_SVE2_AES
+    cpu_features->has_sve2_aes = 1;
+#elif defined(_M_ARM64) && defined(PF_ARM_SVE_AES_INSTRUCTIONS_AVAILABLE)
+    cpu_features->has_sve2_aes = IsProcessorFeaturePresent(PF_ARM_SVE_AES_INSTRUCTIONS_AVAILABLE);
+#elif (defined(__aarch64__) || defined(_M_ARM64)) && defined(AT_HWCAP)
+    cpu_features->has_sve2_aes = _have_hwcap(AT_HWCAP2, AEGIS_AARCH64_HWCAP2_SVEAES);
+#endif
+
+    return 0;
+}
+
+static void
+_cpuid(unsigned int cpu_info[4U], const unsigned int cpu_info_type)
+{
+#if defined(_MSC_VER) && (defined(_M_X64) || defined(_M_IX86)) && \
+    !defined(__cpuid) /* __cpuid is a function on MSVC, can be an incompatible macro elsewhere */
+    __cpuid((int *) cpu_info, cpu_info_type);
+#elif defined(HAVE_CPUID)
+    cpu_info[0] = cpu_info[1] = cpu_info[2] = cpu_info[3] = 0;
+#    ifdef __i386__
+    __asm__ __volatile__(
+        "pushfl; pushfl; "
+        "popl %0; "
+        "movl %0, %1; xorl %2, %0; "
+        "pushl %0; "
+        "popfl; pushfl; popl %0; popfl"
+        : "=&r"(cpu_info[0]), "=&r"(cpu_info[1])
+        : "i"(0x200000));
+    if (((cpu_info[0] ^ cpu_info[1]) & 0x200000) == 0x0) {
+        return; /* LCOV_EXCL_LINE */
+    }
+#    endif
+#    ifdef __i386__
+    __asm__ __volatile__("xchgl %%ebx, %k1; cpuid; xchgl %%ebx, %k1"
+                         : "=a"(cpu_info[0]), "=&r"(cpu_info[1]), "=c"(cpu_info[2]),
+                           "=d"(cpu_info[3])
+                         : "0"(cpu_info_type), "2"(0U));
+#    elif defined(__x86_64__)
+    __asm__ __volatile__("xchgq %%rbx, %q1; cpuid; xchgq %%rbx, %q1"
+                         : "=a"(cpu_info[0]), "=&r"(cpu_info[1]), "=c"(cpu_info[2]),
+                           "=d"(cpu_info[3])
+                         : "0"(cpu_info_type), "2"(0U));
+#    else
+    __asm__ __volatile__("cpuid"
+                         : "=a"(cpu_info[0]), "=b"(cpu_info[1]), "=c"(cpu_info[2]),
+                           "=d"(cpu_info[3])
+                         : "0"(cpu_info_type), "2"(0U));
+#    endif
+#else
+    (void) cpu_info_type;
+    cpu_info[0] = cpu_info[1] = cpu_info[2] = cpu_info[3] = 0;
+#endif
+}
+
+static int
+_runtime_intel_cpu_features(CPUFeatures *const cpu_features)
+{
+    unsigned int cpu_info[4];
+    uint32_t     xcr0 = 0U;
+
+    _cpuid(cpu_info, 0x0);
+    if (cpu_info[0] == 0U) {
+        return -1; /* LCOV_EXCL_LINE */
+    }
+    _cpuid(cpu_info, 0x00000001);
+
+    (void) xcr0;
+#ifdef HAVE_AVXINTRIN_H
+    if ((cpu_info[2] & (CPUID_ECX_AVX | CPUID_ECX_XSAVE | CPUID_ECX_OSXSAVE)) ==
+        (CPUID_ECX_AVX | CPUID_ECX_XSAVE | CPUID_ECX_OSXSAVE)) {
+        xcr0 = 0U;
+#    if defined(HAVE__XGETBV) || \
+        (defined(_MSC_VER) && defined(_XCR_XFEATURE_ENABLED_MASK) && _MSC_FULL_VER >= 160040219)
+        xcr0 = (uint32_t) _xgetbv(0);
+#    elif defined(_MSC_VER) && defined(_M_IX86)
+        /*
+         * Visual Studio documentation states that eax/ecx/edx don't need to
+         * be preserved in inline assembly code. But that doesn't seem to
+         * always hold true on Visual Studio 2010.
+         */
+        __asm {
+            push eax
+            push ecx
+            push edx
+            xor ecx, ecx
+            _asm _emit 0x0f _asm _emit 0x01 _asm _emit 0xd0
+            mov xcr0, eax
+            pop edx
+            pop ecx
+            pop eax
+        }
+#    elif defined(HAVE_AVX_ASM)
+        __asm__ __volatile__(".byte 0x0f, 0x01, 0xd0" /* XGETBV */
+                             : "=a"(xcr0)
+                             : "c"((uint32_t) 0U)
+                             : "%edx");
+#    endif
+        if ((xcr0 & (XCR0_SSE | XCR0_AVX)) == (XCR0_SSE | XCR0_AVX)) {
+            cpu_features->has_avx = 1;
+        }
+    }
+#endif
+
+#ifdef HAVE_WMMINTRIN_H
+    cpu_features->has_aesni = ((cpu_info[2] & CPUID_ECX_AESNI) != 0x0);
+#endif
+
+#ifdef HAVE_AVX2INTRIN_H
+    if (cpu_features->has_avx) {
+        unsigned int cpu_info7[4];
+
+        _cpuid(cpu_info7, 0x00000007);
+        cpu_features->has_avx2 = ((cpu_info7[1] & CPUID_EBX_AVX2) != 0x0);
+        cpu_features->has_vaes =
+            cpu_features->has_aesni && ((cpu_info7[2] & CPUID_ECX_VAES) != 0x0);
+    }
+#endif
+
+    cpu_features->has_avx512f = 0;
+#ifdef HAVE_AVX512FINTRIN_H
+    if (cpu_features->has_avx2) {
+        unsigned int cpu_info7[4];
+
+        _cpuid(cpu_info7, 0x00000007);
+        /* LCOV_EXCL_START */
+        if ((cpu_info7[1] & CPUID_EBX_AVX512F) == CPUID_EBX_AVX512F &&
+            (xcr0 & (XCR0_OPMASK | XCR0_ZMM_HI256 | XCR0_HI16_ZMM)) ==
+                (XCR0_OPMASK | XCR0_ZMM_HI256 | XCR0_HI16_ZMM)) {
+            cpu_features->has_avx512f = 1;
+        }
+        /* LCOV_EXCL_STOP */
+    }
+#endif
+
+    return 0;
+}
+
+static int
+_runtime_powerpc_cpu_features(CPUFeatures *const cpu_features)
+{
+    cpu_features->has_altivec = 0;
+#if defined(__ALTIVEC__) && defined(__CRYPTO__)
+    cpu_features->has_altivec = 1;
+#endif
+    return 0;
+}
+
+int
+aegis_runtime_get_cpu_features(void)
+{
+    int ret = -1;
+
+    memset(&_cpu_features, 0, sizeof _cpu_features);
+
+    ret &= _runtime_arm_cpu_features(&_cpu_features);
+    ret &= _runtime_intel_cpu_features(&_cpu_features);
+    ret &= _runtime_powerpc_cpu_features(&_cpu_features);
+    _cpu_features.initialized = 1;
+
+    return ret;
+}
+
+int
+aegis_runtime_has_neon(void)
+{
+    return _cpu_features.has_neon;
+}
+
+int
+aegis_runtime_has_neon_aes(void)
+{
+    return _cpu_features.has_neon_aes;
+}
+
+int
+aegis_runtime_has_neon_sha3(void)
+{
+    return _cpu_features.has_neon_sha3;
+}
+
+int
+aegis_runtime_has_sve2_aes(void)
+{
+    return _cpu_features.has_sve2_aes;
+}
+
+int
+aegis_runtime_has_avx(void)
+{
+    return _cpu_features.has_avx;
+}
+
+int
+aegis_runtime_has_avx2(void)
+{
+    return _cpu_features.has_avx2;
+}
+
+int
+aegis_runtime_has_avx512f(void)
+{
+    return _cpu_features.has_avx512f;
+}
+
+int
+aegis_runtime_has_aesni(void)
+{
+    return _cpu_features.has_aesni;
+}
+
+int
+aegis_runtime_has_vaes(void)
+{
+    return _cpu_features.has_vaes;
+}
+
+int
+aegis_runtime_has_altivec(void)
+{
+    return _cpu_features.has_altivec;
+}

data/ext/pq_crypto_seal/vendor/libaegis/src/common/cpu.h

@@ -0,0 +1,34 @@
+#ifndef cpu_H
+#define cpu_H
+
+#if defined(__ARM_FEATURE_CRYPTO) && defined(__ARM_FEATURE_AES) && defined(__ARM_NEON)
+#    define HAS_HW_AES
+#elif defined(__AES__) && defined(__AVX__)
+#    define HAS_HW_AES
+#elif defined(__ALTIVEC__) && defined(__CRYPTO__)
+#    define HAS_HW_AES
+#endif
+
+int aegis_runtime_get_cpu_features(void);
+
+int aegis_runtime_has_neon(void);
+
+int aegis_runtime_has_neon_aes(void);
+
+int aegis_runtime_has_neon_sha3(void);
+
+int aegis_runtime_has_sve2_aes(void);
+
+int aegis_runtime_has_avx(void);
+
+int aegis_runtime_has_avx2(void);
+
+int aegis_runtime_has_avx512f(void);
+
+int aegis_runtime_has_aesni(void);
+
+int aegis_runtime_has_vaes(void);
+
+int aegis_runtime_has_altivec(void);
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/common/keccak.c

@@ -0,0 +1,187 @@
+#include "keccak.h"
+#include "common.h"
+
+#define KECCAK_ROUNDS 12
+
+static inline uint64_t
+ROTL64(uint64_t x, int b)
+{
+    return (x << b) | (x >> (64 - b));
+}
+
+static const uint64_t RC[24] = {
+    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL, 0x8000000080008000ULL,
+    0x000000000000808bULL, 0x0000000080000001ULL, 0x8000000080008081ULL, 0x8000000000008009ULL,
+    0x000000000000008aULL, 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
+    0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL, 0x8000000000008003ULL,
+    0x8000000000008002ULL, 0x8000000000000080ULL, 0x000000000000800aULL, 0x800000008000000aULL,
+    0x8000000080008081ULL, 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,
+};
+
+static void
+keccakf(uint64_t st[25])
+{
+    int      round;
+    int      i;
+    int      j;
+    uint64_t t;
+    uint64_t bc[5];
+
+    for (round = 24 - KECCAK_ROUNDS; round < 24; round++) {
+        /* Theta */
+        for (i = 0; i < 5; i++) {
+            bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
+        }
+        for (i = 0; i < 5; i++) {
+            t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
+            for (j = 0; j < 25; j += 5) {
+                st[j + i] ^= t;
+            }
+        }
+
+        /* Rho Pi */
+        t = st[1];
+        {
+            static const int piln[24] = {
+                10, 7,  11, 17, 18, 3, 5,  16, 8,  21, 24, 4,
+                15, 23, 19, 13, 12, 2, 20, 14, 22, 9,  6,  1,
+            };
+            static const int rotc[24] = {
+                1,  3,  6,  10, 15, 21, 28, 36, 45, 55, 2,  14,
+                27, 41, 56, 8,  25, 43, 62, 18, 39, 61, 20, 44,
+            };
+            for (i = 0; i < 24; i++) {
+                j     = piln[i];
+                bc[0] = st[j];
+                st[j] = ROTL64(t, rotc[i]);
+                t     = bc[0];
+            }
+        }
+
+        /* Chi */
+        for (j = 0; j < 25; j += 5) {
+            for (i = 0; i < 5; i++) {
+                bc[i] = st[j + i];
+            }
+            for (i = 0; i < 5; i++) {
+                st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
+            }
+        }
+
+        /* Iota */
+        st[0] ^= RC[round];
+    }
+}
+
+static inline uint64_t
+load64_le(const uint8_t src[8])
+{
+    uint64_t w;
+    w = (uint64_t) src[0];
+    w |= (uint64_t) src[1] << 8;
+    w |= (uint64_t) src[2] << 16;
+    w |= (uint64_t) src[3] << 24;
+    w |= (uint64_t) src[4] << 32;
+    w |= (uint64_t) src[5] << 40;
+    w |= (uint64_t) src[6] << 48;
+    w |= (uint64_t) src[7] << 56;
+    return w;
+}
+
+static inline void
+store64_le(uint8_t dst[8], uint64_t w)
+{
+    dst[0] = (uint8_t) w;
+    w >>= 8;
+    dst[1] = (uint8_t) w;
+    w >>= 8;
+    dst[2] = (uint8_t) w;
+    w >>= 8;
+    dst[3] = (uint8_t) w;
+    w >>= 8;
+    dst[4] = (uint8_t) w;
+    w >>= 8;
+    dst[5] = (uint8_t) w;
+    w >>= 8;
+    dst[6] = (uint8_t) w;
+    w >>= 8;
+    dst[7] = (uint8_t) w;
+}
+
+static void
+keccak_absorb_once(uint64_t st[25], size_t rate, const uint8_t *in, size_t inlen)
+{
+    size_t i;
+
+    memset(st, 0, 25 * sizeof(uint64_t));
+    for (i = 0; i + 8 <= inlen; i += 8) {
+        st[i / 8] ^= load64_le(in + i);
+    }
+    if (i < inlen) {
+        uint8_t tail[8];
+        size_t  rem = inlen - i;
+        memset(tail, 0, sizeof tail);
+        memcpy(tail, in + i, rem);
+        st[i / 8] ^= load64_le(tail);
+    }
+    st[inlen / 8] ^= (uint64_t) 0x1F << (8 * (inlen % 8));
+    st[(rate - 1) / 8] ^= (uint64_t) 0x80 << (8 * ((rate - 1) % 8));
+    keccakf(st);
+}
+
+static void
+keccak_squeeze_once(uint8_t *out, size_t outlen, const uint64_t st[25])
+{
+    size_t i;
+
+    for (i = 0; i + 8 <= outlen; i += 8) {
+        store64_le(out + i, st[i / 8]);
+    }
+    if (i < outlen) {
+        uint8_t tail[8];
+        store64_le(tail, st[i / 8]);
+        memcpy(out + i, tail, outlen - i);
+    }
+}
+
+void
+aegis_kdf_128(uint8_t *out, size_t outlen, const uint8_t *context, size_t context_len,
+              const uint8_t *key, size_t key_len, const uint8_t *file_id, size_t file_id_len)
+{
+    uint64_t st[25];
+    uint8_t  buf[168];
+    size_t   total = context_len + key_len + file_id_len;
+
+    if (total >= 168 || outlen > 168) {
+        memset(out, 0, outlen);
+        return;
+    }
+
+    memcpy(buf, context, context_len);
+    memcpy(buf + context_len, key, key_len);
+    memcpy(buf + context_len + key_len, file_id, file_id_len);
+
+    keccak_absorb_once(st, 168, buf, total);
+    keccak_squeeze_once(out, outlen, st);
+}
+
+void
+aegis_kdf_256(uint8_t *out, size_t outlen, const uint8_t *context, size_t context_len,
+              const uint8_t *key, size_t key_len, const uint8_t *file_id, size_t file_id_len)
+{
+    uint64_t st[25];
+    uint8_t  buf[136];
+    size_t   total = context_len + key_len + file_id_len;
+
+    if (total >= 136 || outlen > 136) {
+        memset(out, 0, outlen);
+        return;
+    }
+
+    memcpy(buf, context, context_len);
+    memcpy(buf + context_len, key, key_len);
+    memcpy(buf + context_len + key_len, file_id, file_id_len);
+
+    keccak_absorb_once(st, 136, buf, total);
+    keccak_squeeze_once(out, outlen, st);
+}

data/ext/pq_crypto_seal/vendor/libaegis/src/common/keccak.h

@@ -0,0 +1,13 @@
+#ifndef keccak_H
+#define keccak_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+void aegis_kdf_128(uint8_t *out, size_t outlen, const uint8_t *context, size_t context_len,
+                   const uint8_t *key, size_t key_len, const uint8_t *file_id, size_t file_id_len);
+
+void aegis_kdf_256(uint8_t *out, size_t outlen, const uint8_t *context, size_t context_len,
+                   const uint8_t *key, size_t key_len, const uint8_t *file_id, size_t file_id_len);
+
+#endif