X-Git-Url: https://git.distorted.org.uk/~mdw/catacomb/blobdiff_plain/91f56a78e497b97c996cc46c7e7aff487a0b68bd..a9a5bfa088ebf3b16dec488c384ad24762184ed0:/symm/poly1305.c diff --git a/symm/poly1305.c b/symm/poly1305.c index 55fe3711..df389395 100644 --- a/symm/poly1305.c +++ b/symm/poly1305.c @@ -33,6 +33,7 @@ #include #include "poly1305.h" +#include "rsvr.h" /*----- Global variables --------------------------------------------------*/ @@ -183,7 +184,7 @@ static void mul_r(const poly1305_ctx *ctx, felt z, const felt x) #endif -/*----- Low-level implementation for 32/64-bit targets --------------------*/ +/*----- Low-level implementation for 16/32-bit targets --------------------*/ #ifndef POLY1305_IMPL # define POLY1305_IMPL 11 @@ -536,28 +537,15 @@ static void update_full(poly1305_ctx *ctx, const octet *p) ctx->count++; } +static const rsvr_policy pol = { 0, 16, 16 }; + void poly1305_hash(poly1305_ctx *ctx, const void *p, size_t sz) { - const octet *pp = p; - size_t n; - - if (ctx->nbuf) { - if (sz < 16 - ctx->nbuf) { - memcpy(ctx->buf + ctx->nbuf, p, sz); - ctx->nbuf += sz; - return; - } - n = 16 - ctx->nbuf; - memcpy(ctx->buf + ctx->nbuf, pp, n); - update_full(ctx, ctx->buf); - pp += n; sz -= n; - } - while (sz >= 16) { - update_full(ctx, pp); - pp += 16; sz -= 16; - } - if (sz) memcpy(ctx->buf, pp, sz); - ctx->nbuf = sz; + rsvr_state st; + const octet *q = p; + + rsvr_setup(&st, &pol, &ctx->buf, &ctx->nbuf, p, sz); + RSVR_DO(&st) while ((q = RSVR_NEXT(&st, 16)) != 0) update_full(ctx, q); } /* --- @poly1305_flush@ --- * @@ -571,6 +559,7 @@ void poly1305_hash(poly1305_ctx *ctx, const void *p, size_t sz) * far is a whole number of blocks. Flushing is performed * automatically by @poly1305_done@, but it may be necessary to * force it by hand when using @poly1305_concat@. + * (Alternatively, you might use @poly1305_flushzero@ instead.) * * Flushing a partial block has an observable effect on the * computation: the resulting state is (with high probability) @@ -604,7 +593,29 @@ void poly1305_flush(poly1305_ctx *ctx) #endif mul_r(ctx, ctx->u.P.h, t); - ctx->count++; + ctx->nbuf = 0; ctx->count++; +} + +/* --- @poly1305_flushzero@ --- * + * + * Arguments: @poly1305_ctx *ctx@ = MAC context to flush + * + * Returns: --- + * + * Use: Forces any buffered message data in the context to be + * processed, by hashing between zero and fifteen additional + * zero bytes. Like @poly1305_flush@, this has no effect if the + * the message processed so far is a whole number of blocks. + * Unlike @poly1305_flush@, the behaviour if the message is not + * a whole number of blocks is equivalent to actually hashing + * some extra data. + */ + +void poly1305_flushzero(poly1305_ctx *ctx) +{ + if (!ctx->nbuf) return; + memset(ctx->buf + ctx->nbuf, 0, 16 - ctx->nbuf); + update_full(ctx, ctx->buf); ctx->nbuf = 0; } @@ -850,8 +861,12 @@ void poly1305_done(poly1305_ctx *ctx, void *h) #ifdef TEST_RIG +#include #include +#include "ct.h" +#include "rijndael-ecb.h" + static int vrf_hash(dstr v[]) { poly1305_key k; @@ -864,6 +879,7 @@ static int vrf_hash(dstr v[]) if (v[3].len != 16) { fprintf(stderr, "bad tag length\n"); exit(2); } dstr_ensure(&t, 16); t.len = 16; + ct_poison(v[0].buf, v[0].len); poly1305_keyinit(&k, v[0].buf, v[0].len); for (i = 0; i < v[2].len; i++) { for (j = i; j < v[2].len; j++) { @@ -872,7 +888,8 @@ static int vrf_hash(dstr v[]) poly1305_hash(&ctx, v[2].buf + i, j - i); poly1305_hash(&ctx, v[2].buf + j, v[2].len - j); poly1305_done(&ctx, t.buf); - if (memcmp(t.buf, v[3].buf, 16) != 0) { + ct_remedy(t.buf, t.len); + if (MEMCMP(t.buf, !=, v[3].buf, 16)) { fprintf(stderr, "failed..."); fprintf(stderr, "\n\tkey = "); type_hex.dump(&v[0], stderr); fprintf(stderr, "\n\tmask = "); type_hex.dump(&v[1], stderr); @@ -916,7 +933,7 @@ static int vrf_cat(dstr v[]) poly1305_concat(&ctx, &ctx, &cc[2]); } poly1305_done(&ctx, t.buf); - if (memcmp(t.buf, v[5].buf, 16) != 0) { + if (MEMCMP(t.buf, !=, v[5].buf, 16)) { fprintf(stderr, "failed..."); fprintf(stderr, "\n\tkey = "); type_hex.dump(&v[0], stderr); fprintf(stderr, "\n\tmask = "); type_hex.dump(&v[1], stderr); @@ -934,11 +951,87 @@ static int vrf_cat(dstr v[]) return (ok); } +#define MSZMAX 1000 + +static int vrf_mct(dstr v[]) +{ + unsigned j, msz; + unsigned long i, niter; + rijndael_ecbctx rij; + poly1305_key key; + poly1305_ctx mac; + dstr dk = DSTR_INIT, dr = DSTR_INIT, dn = DSTR_INIT, + dt = DSTR_INIT, dm = DSTR_INIT; + octet *k, *r, s[16], *n, *t, *m; + int ok = 1; + + DENSURE(&dk, 16); k = (octet *)dk.buf; dk.len = 16; + DENSURE(&dr, 16); r = (octet *)dr.buf; dr.len = 16; + DENSURE(&dn, 16); n = (octet *)dn.buf; dn.len = 16; + DENSURE(&dt, 16); t = (octet *)dt.buf; dt.len = 16; + DENSURE(&dm, MSZMAX); m = (octet *)dm.buf; dm.len = MSZMAX; + memset(m, 0, MSZMAX); + + if (v[0].len != 16) { fprintf(stderr, "AES key len\n"); exit(2); } + if (v[1].len != 16) { fprintf(stderr, "poly key len\n"); exit(2); } + if (v[2].len != 16) { fprintf(stderr, "nonce len\n"); exit(2); } + if (v[4].len != 16) { fprintf(stderr, "result len\n"); exit(2); } + memcpy(k, v[0].buf, 16); + memcpy(r, v[1].buf, 16); + memcpy(n, v[2].buf, 16); + niter = *(unsigned long *)v[3].buf; + + rijndael_ecbinit(&rij, k, 16, 0); + poly1305_keyinit(&key, r, 16); + for (i = 0; i < niter; i++) { + msz = 0; + for (;;) { + rijndael_ecbencrypt(&rij, n, s, 16); + poly1305_macinit(&mac, &key, s); + poly1305_hash(&mac, m, msz); + poly1305_done(&mac, t); + if (msz >= MSZMAX) break; + n[0] ^= i&0xff; + for (j = 0; j < 16; j++) n[j] ^= t[j]; + if (msz%2) { + for (j = 0; j < 16; j++) k[j] ^= t[j]; + rijndael_ecbinit(&rij, k, 16, 0); + } + if (msz%3) { + for (j = 0; j < 16; j++) r[j] ^= t[j]; + poly1305_keyinit(&key, r, 16); + } + m[msz++] ^= t[0]; + } + } + + if (MEMCMP(t, !=, v[4].buf, 16)) { + ok = 0; + fprintf(stderr, "failed..."); + fprintf(stderr, "\n\tinitial k = "); type_hex.dump(&v[0], stderr); + fprintf(stderr, "\n\tinitial r = "); type_hex.dump(&v[1], stderr); + fprintf(stderr, "\n\tinitial n = "); type_hex.dump(&v[2], stderr); + fprintf(stderr, "\n\titerations = %lu", niter); + fprintf(stderr, "\n\texpected = "); type_hex.dump(&v[4], stderr); + fprintf(stderr, "\n\tcalculated = "); type_hex.dump(&dt, stderr); + fputc('\n', stderr); + } + + dstr_destroy(&dk); + dstr_destroy(&dr); + dstr_destroy(&dn); + dstr_destroy(&dt); + dstr_destroy(&dm); + return (ok); +} + static const struct test_chunk tests[] = { { "poly1305-hash", vrf_hash, { &type_hex, &type_hex, &type_hex, &type_hex } }, { "poly1305-cat", vrf_cat, { &type_hex, &type_hex, &type_hex, &type_hex, &type_hex, &type_hex } }, + { "poly1305-mct", vrf_mct, + { &type_hex, &type_hex, &type_hex, &type_ulong, &type_hex } }, { 0, 0, { 0 } } };