chiark - git - mdw - catacomb/blob - symm/whirlpool.c

   1 /* -*-c-*-
   2  *
   3  * Whirlpool hash function
   4  *
   5  * (c) 2005 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of Catacomb.
  11  *
  12  * Catacomb is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU Library General Public License as
  14  * published by the Free Software Foundation; either version 2 of the
  15  * License, or (at your option) any later version.
  16  *
  17  * Catacomb is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU Library General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU Library General Public
  23  * License along with Catacomb; if not, write to the Free
  24  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  25  * MA 02111-1307, USA.
  26  */
  27
  28 /*----- Header files ------------------------------------------------------*/
  29
  30 #include <mLib/bits.h>
  31
  32 #include "ghash.h"
  33 #include "ghash-def.h"
  34 #include "hash.h"
  35 #include "whirlpool.h"
  36
  37 #if defined(HAVE_UINT64)
  38 #  define USE64
  39 #endif
  40
  41 /*----- Static variables --------------------------------------------------*/
  42
  43 extern const kludge64 whirlpool_c[10];
  44
  45 #ifdef USE64
  46 extern const kludge64 whirlpool_t[8][256];
  47 #else
  48 extern const uint32 whirlpool_u[4][256], whirlpool_v[4][256];
  49 #endif
  50
  51 /*----- Main code ---------------------------------------------------------*/
  52
  53 #define DUMP(k, v) do {                                                 \
  54   int i;                                                                \
  55   printf("\n");                                                         \
  56   for (i = 0; i < 8; i++)                                               \
  57     printf("  %08x %08x  :  %08x %08x\n",                               \
  58            HI64(k[i]), LO64(k[i]),                                      \
  59            HI64(v[i]), LO64(v[i]));                                     \
  60 } while (0)
  61
  62 #define OFFSET(i, n) (((i) + 16 - (n)) % 8)
  63
  64 #ifdef USE64
  65
  66 #define BYTE(x, j)                                                      \
  67   U8((j) < 4 ?                                                          \
  68     (LO64(x) >> ((j) * 8)) :                                            \
  69     (HI64(x) >> ((j) * 8 - 32)))
  70
  71 #define TT(v, i, j) whirlpool_t[j][BYTE(v[OFFSET(i, j)], j)]
  72
  73 #define XROW(vv, v, i) do {                                             \
  74   XOR64(vv[i], vv[i], TT(v, i, 1));                                     \
  75   XOR64(vv[i], vv[i], TT(v, i, 2));                                     \
  76   XOR64(vv[i], vv[i], TT(v, i, 3));                                     \
  77   XOR64(vv[i], vv[i], TT(v, i, 4));                                     \
  78   XOR64(vv[i], vv[i], TT(v, i, 5));                                     \
  79   XOR64(vv[i], vv[i], TT(v, i, 6));                                     \
  80   XOR64(vv[i], vv[i], TT(v, i, 7));                                     \
  81 } while (0)
  82
  83 #define ROWZ(vv, v, i) do {                                             \
  84   vv[i] = TT(v, i, 0);                                                  \
  85   XROW(vv, v, i);                                                       \
  86 } while (0)
  87
  88 #define ROWK(vv, v, i, k) do {                                          \
  89   vv[i] = k;                                                            \
  90   XOR64(vv[i], vv[i], TT(v, i, 0));                                     \
  91   XROW(vv, v, i);                                                       \
  92 } while (0)
  93
  94 #else
  95
  96 #define BYTE(x, j) U8((x) >> (((j) & 3) * 8))
  97
  98 #define UUL(v, i, j) whirlpool_u[j & 3][BYTE(v[OFFSET(i, j)].lo, j)]
  99 #define VVL(v, i, j) whirlpool_v[j & 3][BYTE(v[OFFSET(i, j)].lo, j)]
 100 #define UUH(v, i, j) whirlpool_u[j & 3][BYTE(v[OFFSET(i, j)].hi, j)]
 101 #define VVH(v, i, j) whirlpool_v[j & 3][BYTE(v[OFFSET(i, j)].hi, j)]
 102
 103 #define XROW(vv, v, i) do {                                             \
 104   vv[i].lo ^= UUL(v, i, 1); vv[i].hi ^= VVL(v, i, 1);                   \
 105   vv[i].lo ^= UUL(v, i, 2); vv[i].hi ^= VVL(v, i, 2);                   \
 106   vv[i].lo ^= UUL(v, i, 3); vv[i].hi ^= VVL(v, i, 3);                   \
 107   vv[i].lo ^= VVH(v, i, 4); vv[i].hi ^= UUH(v, i, 4);                   \
 108   vv[i].lo ^= VVH(v, i, 5); vv[i].hi ^= UUH(v, i, 5);                   \
 109   vv[i].lo ^= VVH(v, i, 6); vv[i].hi ^= UUH(v, i, 6);                   \
 110   vv[i].lo ^= VVH(v, i, 7); vv[i].hi ^= UUH(v, i, 7);                   \
 111 } while (0)
 112
 113 #define ROWZ(vv, v, i) do {                                             \
 114   vv[i].lo = UUL(v, i, 0);  vv[i].hi = VVL(v, i, 0);                    \
 115   XROW(vv, v, i);                                                       \
 116 } while (0)
 117
 118 #define ROWK(vv, v, i, k) do {                                          \
 119   vv[i] = k;                                                            \
 120   vv[i].lo ^= UUL(v, i, 0); vv[i].hi ^= VVL(v, i, 0);                   \
 121   XROW(vv, v, i);                                                       \
 122 } while (0)
 123
 124 #endif
 125
 126 #define RHO(vv, v, kk, k) do {                                          \
 127   ROWK(kk, k, 0, *c++);   ROWK(vv, v, 0, kk[0]);                        \
 128   ROWZ(kk, k, 1);         ROWK(vv, v, 1, kk[1]);                        \
 129   ROWZ(kk, k, 2);         ROWK(vv, v, 2, kk[2]);                        \
 130   ROWZ(kk, k, 3);         ROWK(vv, v, 3, kk[3]);                        \
 131   ROWZ(kk, k, 4);         ROWK(vv, v, 4, kk[4]);                        \
 132   ROWZ(kk, k, 5);         ROWK(vv, v, 5, kk[5]);                        \
 133   ROWZ(kk, k, 6);         ROWK(vv, v, 6, kk[6]);                        \
 134   ROWZ(kk, k, 7);         ROWK(vv, v, 7, kk[7]);                        \
 135 } while (0)
 136
 137 void whirlpool_compress(whirlpool_ctx *ctx, const void *sbuf)
 138 {
 139   kludge64 m[8], k[8], kk[8], v[8], vv[8];
 140   const kludge64 *c = whirlpool_c;
 141   const octet *s = sbuf;
 142   int i;
 143
 144   for (i = 0; i < 8; i++) {
 145     LOAD64_L_(m[i], &s[i * 8]);
 146     XOR64(v[i], m[i], ctx->s[i]);
 147   }
 148
 149   RHO(vv, v, kk, ctx->s);
 150   RHO(v, vv, k, kk);
 151   RHO(vv, v, kk, k);
 152   RHO(v, vv, k, kk);
 153   RHO(vv, v, kk, k);
 154   RHO(v, vv, k, kk);
 155   RHO(vv, v, kk, k);
 156   RHO(v, vv, k, kk);
 157   RHO(vv, v, kk, k);
 158   RHO(v, vv, k, kk);
 159
 160   for (i = 0; i < 8; i++) {
 161     XOR64(ctx->s[i], ctx->s[i], m[i]);
 162     XOR64(ctx->s[i], ctx->s[i], v[i]);
 163   }
 164 }
 165
 166 /* --- @whirlpool_init@, @whirlpool256_init@ --- *
 167  *
 168  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block to initialize
 169  *
 170  * Returns:     ---
 171  *
 172  * Use:         Initializes a context block ready for hashing.
 173  */
 174
 175 void whirlpool_init(whirlpool_ctx *ctx)
 176 {
 177   int i;
 178
 179   for (i = 0; i < 8; i++)
 180     SET64(ctx->s[i], 0, 0);
 181   ctx->off = 0;
 182   ctx->nh = ctx->nl = 0;
 183 }
 184
 185 /* --- @whirlpool_set@, @whirlpool256_set@ --- *
 186  *
 187  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block
 188  *              @const void *buf@ = pointer to state buffer
 189  *              @unsigned long count@ = current count of bytes processed
 190  *
 191  * Returns:     ---
 192  *
 193  * Use:         Initializes a context block from a given state.  This is
 194  *              useful in cases where the initial hash state is meant to be
 195  *              secret, e.g., for NMAC and HMAC support.
 196  */
 197
 198 void whirlpool_set(whirlpool_ctx *ctx, const void *buf, unsigned long count)
 199 {
 200   const octet *p = buf;
 201   int i;
 202
 203   for (i = 0; i < 8; i++) {
 204     LOAD64_L_(ctx->s[i], p);
 205     p += 8;
 206   }
 207   ctx->off = 0;
 208   ctx->nl = U32(count);
 209   ctx->nh = U32(((count & ~(unsigned long)MASK32) >> 16) >> 16);
 210 }
 211
 212 /* --- @whirlpool_hash@, @whirlpool256_hash@ --- *
 213  *
 214  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block
 215  *              @const void *buf@ = buffer of data to hash
 216  *              @size_t sz@ = size of buffer to hash
 217  *
 218  * Returns:     ---
 219  *
 220  * Use:         Hashes a buffer of data.  The buffer may be of any size and
 221  *              alignment.
 222  */
 223
 224 void whirlpool_hash(whirlpool_ctx *ctx, const void *buf, size_t sz)
 225 {
 226   HASH_BUFFER(WHIRLPOOL, whirlpool, ctx, buf, sz);
 227 }
 228
 229 /* --- @whirlpool_done@, @whirlpool256_done@ --- *
 230  *
 231  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block
 232  *              @void *hash@ = pointer to output buffer
 233  *
 234  * Returns:     ---
 235  *
 236  * Use:         Returns the hash of the data read so far.
 237  */
 238
 239 static void final(whirlpool_ctx *ctx)
 240 {
 241   HASH_PAD(WHIRLPOOL, whirlpool, ctx, 0x80, 0, 32);
 242   memset(ctx->buf + WHIRLPOOL_BUFSZ - 32, 0, 24);
 243   STORE32(ctx->buf + WHIRLPOOL_BUFSZ -  8, (ctx->nl >> 29) | (ctx->nh << 3));
 244   STORE32(ctx->buf + WHIRLPOOL_BUFSZ -  4, ctx->nl << 3);
 245   whirlpool_compress(ctx, ctx->buf);
 246 }
 247
 248 void whirlpool_done(whirlpool_ctx *ctx, void *hash)
 249 {
 250   octet *p = hash;
 251   int i;
 252
 253   final(ctx);
 254   for (i = 0; i < 8; i++) {
 255     STORE64_L_(p, ctx->s[i]);
 256     p += 8;
 257   }
 258 }
 259
 260 void whirlpool256_done(whirlpool256_ctx *ctx, void *hash)
 261 {
 262   octet *p = hash;
 263   int i;
 264
 265   final(ctx);
 266   for (i = 0; i < 4; i++) {
 267     STORE64_L_(p, ctx->s[i]);
 268     p += 8;
 269   }
 270 }
 271
 272 /* --- @whirlpool_state@, @whirlpool256_state@ --- *
 273  *
 274  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context
 275  *              @void *state@ = pointer to buffer for current state
 276  *
 277  * Returns:     Number of bytes written to the hash function so far.
 278  *
 279  * Use:         Returns the current state of the hash function such that
 280  *              it can be passed to @whirlpool_set@.
 281  */
 282
 283 unsigned long whirlpool_state(whirlpool_ctx *ctx, void *state)
 284 {
 285   octet *p = state;
 286   int i;
 287
 288   for (i = 0; i < 8; i++) {
 289     STORE64_L_(p, ctx->s[i]);
 290     p += 8;
 291   }
 292   return (ctx->nl | ((ctx->nh << 16) << 16));
 293 }
 294
 295 /* --- Generic interface --- */
 296
 297 #define HASHES(_)                                                       \
 298   _(WHIRLPOOL, whirlpool)                                               \
 299   _(WHIRLPOOL256, whirlpool256)
 300
 301 HASHES(GHASH_DEF)
 302
 303 /*----- Test rig ----------------------------------------------------------*/
 304
 305 #ifdef TEST_RIG
 306
 307 #include <mLib/testrig.h>
 308
 309 HASHES(HASH_VERIFY)
 310
 311 static const test_chunk defs[] = {
 312   HASHES(HASH_TESTDEFS)
 313   { 0, 0, { 0 } }
 314 };
 315
 316 int main(int argc, char *argv[])
 317 {
 318   test_run(argc, argv, defs, SRCDIR "/t/whirlpool");
 319   return (0);
 320 }
 321
 322 #endif
 323
 324 /*----- That's all, folks -------------------------------------------------*/