X-Git-Url: https://git.distorted.org.uk/~mdw/catacomb/blobdiff_plain/47af781c8f727c45d0f74584f5f67521a4cbdfcb..a9a5bfa088ebf3b16dec488c384ad24762184ed0:/symm/poly1305.c diff --git a/symm/poly1305.c b/symm/poly1305.c index 27889574..df389395 100644 --- a/symm/poly1305.c +++ b/symm/poly1305.c @@ -33,6 +33,7 @@ #include #include "poly1305.h" +#include "rsvr.h" /*----- Global variables --------------------------------------------------*/ @@ -183,7 +184,7 @@ static void mul_r(const poly1305_ctx *ctx, felt z, const felt x) #endif -/*----- Low-level implementation for 32/64-bit targets --------------------*/ +/*----- Low-level implementation for 16/32-bit targets --------------------*/ #ifndef POLY1305_IMPL # define POLY1305_IMPL 11 @@ -536,28 +537,15 @@ static void update_full(poly1305_ctx *ctx, const octet *p) ctx->count++; } +static const rsvr_policy pol = { 0, 16, 16 }; + void poly1305_hash(poly1305_ctx *ctx, const void *p, size_t sz) { - const octet *pp = p; - size_t n; - - if (ctx->nbuf) { - if (sz < 16 - ctx->nbuf) { - memcpy(ctx->buf + ctx->nbuf, p, sz); - ctx->nbuf += sz; - return; - } - n = 16 - ctx->nbuf; - memcpy(ctx->buf + ctx->nbuf, pp, n); - update_full(ctx, ctx->buf); - pp += n; sz -= n; - } - while (sz >= 16) { - update_full(ctx, pp); - pp += 16; sz -= 16; - } - if (sz) memcpy(ctx->buf, pp, sz); - ctx->nbuf = sz; + rsvr_state st; + const octet *q = p; + + rsvr_setup(&st, &pol, &ctx->buf, &ctx->nbuf, p, sz); + RSVR_DO(&st) while ((q = RSVR_NEXT(&st, 16)) != 0) update_full(ctx, q); } /* --- @poly1305_flush@ --- * @@ -571,6 +559,7 @@ void poly1305_hash(poly1305_ctx *ctx, const void *p, size_t sz) * far is a whole number of blocks. Flushing is performed * automatically by @poly1305_done@, but it may be necessary to * force it by hand when using @poly1305_concat@. + * (Alternatively, you might use @poly1305_flushzero@ instead.) * * Flushing a partial block has an observable effect on the * computation: the resulting state is (with high probability) @@ -604,7 +593,29 @@ void poly1305_flush(poly1305_ctx *ctx) #endif mul_r(ctx, ctx->u.P.h, t); - ctx->count++; + ctx->nbuf = 0; ctx->count++; +} + +/* --- @poly1305_flushzero@ --- * + * + * Arguments: @poly1305_ctx *ctx@ = MAC context to flush + * + * Returns: --- + * + * Use: Forces any buffered message data in the context to be + * processed, by hashing between zero and fifteen additional + * zero bytes. Like @poly1305_flush@, this has no effect if the + * the message processed so far is a whole number of blocks. + * Unlike @poly1305_flush@, the behaviour if the message is not + * a whole number of blocks is equivalent to actually hashing + * some extra data. + */ + +void poly1305_flushzero(poly1305_ctx *ctx) +{ + if (!ctx->nbuf) return; + memset(ctx->buf + ctx->nbuf, 0, 16 - ctx->nbuf); + update_full(ctx, ctx->buf); ctx->nbuf = 0; } @@ -850,8 +861,10 @@ void poly1305_done(poly1305_ctx *ctx, void *h) #ifdef TEST_RIG +#include #include +#include "ct.h" #include "rijndael-ecb.h" static int vrf_hash(dstr v[]) @@ -866,6 +879,7 @@ static int vrf_hash(dstr v[]) if (v[3].len != 16) { fprintf(stderr, "bad tag length\n"); exit(2); } dstr_ensure(&t, 16); t.len = 16; + ct_poison(v[0].buf, v[0].len); poly1305_keyinit(&k, v[0].buf, v[0].len); for (i = 0; i < v[2].len; i++) { for (j = i; j < v[2].len; j++) { @@ -874,7 +888,8 @@ static int vrf_hash(dstr v[]) poly1305_hash(&ctx, v[2].buf + i, j - i); poly1305_hash(&ctx, v[2].buf + j, v[2].len - j); poly1305_done(&ctx, t.buf); - if (memcmp(t.buf, v[3].buf, 16) != 0) { + ct_remedy(t.buf, t.len); + if (MEMCMP(t.buf, !=, v[3].buf, 16)) { fprintf(stderr, "failed..."); fprintf(stderr, "\n\tkey = "); type_hex.dump(&v[0], stderr); fprintf(stderr, "\n\tmask = "); type_hex.dump(&v[1], stderr); @@ -918,7 +933,7 @@ static int vrf_cat(dstr v[]) poly1305_concat(&ctx, &ctx, &cc[2]); } poly1305_done(&ctx, t.buf); - if (memcmp(t.buf, v[5].buf, 16) != 0) { + if (MEMCMP(t.buf, !=, v[5].buf, 16)) { fprintf(stderr, "failed..."); fprintf(stderr, "\n\tkey = "); type_hex.dump(&v[0], stderr); fprintf(stderr, "\n\tmask = "); type_hex.dump(&v[1], stderr); @@ -945,22 +960,29 @@ static int vrf_mct(dstr v[]) rijndael_ecbctx rij; poly1305_key key; poly1305_ctx mac; - dstr d = DSTR_INIT; - octet k[16], r[16], n[16], s[16], *t, m[MSZMAX] = { 0 }; + dstr dk = DSTR_INIT, dr = DSTR_INIT, dn = DSTR_INIT, + dt = DSTR_INIT, dm = DSTR_INIT; + octet *k, *r, s[16], *n, *t, *m; int ok = 1; - if (v[0].len != sizeof(k)) { fprintf(stderr, "AES key len\n"); exit(2); } - if (v[1].len != sizeof(r)) { fprintf(stderr, "poly key len\n"); exit(2); } - if (v[2].len != sizeof(n)) { fprintf(stderr, "nonce len\n"); exit(2); } - if (v[4].len != sizeof(n)) { fprintf(stderr, "result len\n"); exit(2); } - memcpy(k, v[0].buf, sizeof(k)); - memcpy(r, v[1].buf, sizeof(k)); - memcpy(n, v[2].buf, sizeof(k)); + DENSURE(&dk, 16); k = (octet *)dk.buf; dk.len = 16; + DENSURE(&dr, 16); r = (octet *)dr.buf; dr.len = 16; + DENSURE(&dn, 16); n = (octet *)dn.buf; dn.len = 16; + DENSURE(&dt, 16); t = (octet *)dt.buf; dt.len = 16; + DENSURE(&dm, MSZMAX); m = (octet *)dm.buf; dm.len = MSZMAX; + memset(m, 0, MSZMAX); + + if (v[0].len != 16) { fprintf(stderr, "AES key len\n"); exit(2); } + if (v[1].len != 16) { fprintf(stderr, "poly key len\n"); exit(2); } + if (v[2].len != 16) { fprintf(stderr, "nonce len\n"); exit(2); } + if (v[4].len != 16) { fprintf(stderr, "result len\n"); exit(2); } + memcpy(k, v[0].buf, 16); + memcpy(r, v[1].buf, 16); + memcpy(n, v[2].buf, 16); niter = *(unsigned long *)v[3].buf; - dstr_ensure(&d, 16); d.len = 16; t = (octet *)d.buf; - rijndael_ecbinit(&rij, k, sizeof(k), 0); - poly1305_keyinit(&key, r, sizeof(r)); + rijndael_ecbinit(&rij, k, 16, 0); + poly1305_keyinit(&key, r, 16); for (i = 0; i < niter; i++) { msz = 0; for (;;) { @@ -973,17 +995,17 @@ static int vrf_mct(dstr v[]) for (j = 0; j < 16; j++) n[j] ^= t[j]; if (msz%2) { for (j = 0; j < 16; j++) k[j] ^= t[j]; - rijndael_ecbinit(&rij, k, sizeof(k), 0); + rijndael_ecbinit(&rij, k, 16, 0); } if (msz%3) { for (j = 0; j < 16; j++) r[j] ^= t[j]; - poly1305_keyinit(&key, r, sizeof(r)); + poly1305_keyinit(&key, r, 16); } m[msz++] ^= t[0]; } } - if (memcmp(t, v[4].buf, 16) != 0) { + if (MEMCMP(t, !=, v[4].buf, 16)) { ok = 0; fprintf(stderr, "failed..."); fprintf(stderr, "\n\tinitial k = "); type_hex.dump(&v[0], stderr); @@ -991,11 +1013,15 @@ static int vrf_mct(dstr v[]) fprintf(stderr, "\n\tinitial n = "); type_hex.dump(&v[2], stderr); fprintf(stderr, "\n\titerations = %lu", niter); fprintf(stderr, "\n\texpected = "); type_hex.dump(&v[4], stderr); - fprintf(stderr, "\n\tcalculated = "); type_hex.dump(&d, stderr); + fprintf(stderr, "\n\tcalculated = "); type_hex.dump(&dt, stderr); fputc('\n', stderr); } - dstr_destroy(&d); + dstr_destroy(&dk); + dstr_destroy(&dr); + dstr_destroy(&dn); + dstr_destroy(&dt); + dstr_destroy(&dm); return (ok); }