chiark - git - mdw - catacomb/blob - symm/whirlpool.c

   1 /* -*-c-*-
   2  *
   3  * Whirlpool hash function
   4  *
   5  * (c) 2005 Straylight/Edgeware
   6  */
   7
   8 /*----- Licensing notice --------------------------------------------------*
   9  *
  10  * This file is part of Catacomb.
  11  *
  12  * Catacomb is free software; you can redistribute it and/or modify
  13  * it under the terms of the GNU Library General Public License as
  14  * published by the Free Software Foundation; either version 2 of the
  15  * License, or (at your option) any later version.
  16  *
  17  * Catacomb is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU Library General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU Library General Public
  23  * License along with Catacomb; if not, write to the Free
  24  * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  25  * MA 02111-1307, USA.
  26  */
  27
  28 /*----- Header files ------------------------------------------------------*/
  29
  30 #include <mLib/bits.h>
  31
  32 #include "ghash.h"
  33 #include "ghash-def.h"
  34 #include "hash.h"
  35 #include "whirlpool.h"
  36 #include "whirlpool-tab.h"
  37
  38 #if defined(HAVE_UINT64)
  39 #  define USE64
  40 #endif
  41
  42 /*----- Static variables --------------------------------------------------*/
  43
  44 static const kludge64 C[10] = WHIRLPOOL_C;
  45
  46 #ifdef USE64
  47 static const kludge64 T[8][256] = WHIRLPOOL_T;
  48 #else
  49 static const uint32 U[4][256] = WHIRLPOOL_U, V[4][256] = WHIRLPOOL_V;
  50 #endif
  51
  52 /*----- Main code ---------------------------------------------------------*/
  53
  54 #define DUMP(k, v) do {                                                 \
  55   int i;                                                                \
  56   printf("\n");                                                         \
  57   for (i = 0; i < 8; i++)                                               \
  58     printf("  %08x %08x  :  %08x %08x\n",                               \
  59            HI64(k[i]), LO64(k[i]),                                      \
  60            HI64(v[i]), LO64(v[i]));                                     \
  61 } while (0)
  62
  63 #define OFFSET(i, n) (((i) + 16 - (n)) % 8)
  64
  65 #ifdef USE64
  66
  67 #define BYTE(x, j)                                                      \
  68   U8((j) < 4 ?                                                          \
  69     (LO64(x) >> ((j) * 8)) :                                            \
  70     (HI64(x) >> ((j) * 8 - 32)))
  71
  72 #define TT(v, i, j) T[j][BYTE(v[OFFSET(i, j)], j)]
  73
  74 #define XROW(vv, v, i) do {                                             \
  75   XOR64(vv[i], vv[i], TT(v, i, 1));                                     \
  76   XOR64(vv[i], vv[i], TT(v, i, 2));                                     \
  77   XOR64(vv[i], vv[i], TT(v, i, 3));                                     \
  78   XOR64(vv[i], vv[i], TT(v, i, 4));                                     \
  79   XOR64(vv[i], vv[i], TT(v, i, 5));                                     \
  80   XOR64(vv[i], vv[i], TT(v, i, 6));                                     \
  81   XOR64(vv[i], vv[i], TT(v, i, 7));                                     \
  82 } while (0)
  83
  84 #define ROWZ(vv, v, i) do {                                             \
  85   vv[i] = TT(v, i, 0);                                                  \
  86   XROW(vv, v, i);                                                       \
  87 } while (0)
  88
  89 #define ROWK(vv, v, i, k) do {                                          \
  90   vv[i] = k;                                                            \
  91   XOR64(vv[i], vv[i], TT(v, i, 0));                                     \
  92   XROW(vv, v, i);                                                       \
  93 } while (0)
  94
  95 #else
  96
  97 #define BYTE(x, j) U8((x) >> (((j) & 3) * 8))
  98
  99 #define UUL(v, i, j) U[j & 3][BYTE(v[OFFSET(i, j)].lo, j)]
 100 #define VVL(v, i, j) V[j & 3][BYTE(v[OFFSET(i, j)].lo, j)]
 101 #define UUH(v, i, j) U[j & 3][BYTE(v[OFFSET(i, j)].hi, j)]
 102 #define VVH(v, i, j) V[j & 3][BYTE(v[OFFSET(i, j)].hi, j)]
 103
 104 #define XROW(vv, v, i) do {                                             \
 105   vv[i].lo ^= UUL(v, i, 1); vv[i].hi ^= VVL(v, i, 1);                   \
 106   vv[i].lo ^= UUL(v, i, 2); vv[i].hi ^= VVL(v, i, 2);                   \
 107   vv[i].lo ^= UUL(v, i, 3); vv[i].hi ^= VVL(v, i, 3);                   \
 108   vv[i].lo ^= VVH(v, i, 4); vv[i].hi ^= UUH(v, i, 4);                   \
 109   vv[i].lo ^= VVH(v, i, 5); vv[i].hi ^= UUH(v, i, 5);                   \
 110   vv[i].lo ^= VVH(v, i, 6); vv[i].hi ^= UUH(v, i, 6);                   \
 111   vv[i].lo ^= VVH(v, i, 7); vv[i].hi ^= UUH(v, i, 7);                   \
 112 } while (0)
 113
 114 #define ROWZ(vv, v, i) do {                                             \
 115   vv[i].lo = UUL(v, i, 0);  vv[i].hi = VVL(v, i, 0);                    \
 116   XROW(vv, v, i);                                                       \
 117 } while (0)
 118
 119 #define ROWK(vv, v, i, k) do {                                          \
 120   vv[i] = k;                                                            \
 121   vv[i].lo ^= UUL(v, i, 0); vv[i].hi ^= VVL(v, i, 0);                   \
 122   XROW(vv, v, i);                                                       \
 123 } while (0)
 124
 125 #endif
 126
 127 #define RHO(vv, v, kk, k) do {                                          \
 128   ROWK(kk, k, 0, *c++);   ROWK(vv, v, 0, kk[0]);                        \
 129   ROWZ(kk, k, 1);         ROWK(vv, v, 1, kk[1]);                        \
 130   ROWZ(kk, k, 2);         ROWK(vv, v, 2, kk[2]);                        \
 131   ROWZ(kk, k, 3);         ROWK(vv, v, 3, kk[3]);                        \
 132   ROWZ(kk, k, 4);         ROWK(vv, v, 4, kk[4]);                        \
 133   ROWZ(kk, k, 5);         ROWK(vv, v, 5, kk[5]);                        \
 134   ROWZ(kk, k, 6);         ROWK(vv, v, 6, kk[6]);                        \
 135   ROWZ(kk, k, 7);         ROWK(vv, v, 7, kk[7]);                        \
 136 } while (0)
 137
 138 void whirlpool_compress(whirlpool_ctx *ctx, const void *sbuf)
 139 {
 140   kludge64 m[8], k[8], kk[8], v[8], vv[8];
 141   const kludge64 *c = C;
 142   const octet *s = sbuf;
 143   int i;
 144
 145   for (i = 0; i < 8; i++) {
 146     LOAD64_L_(m[i], &s[i * 8]);
 147     XOR64(v[i], m[i], ctx->s[i]);
 148   }
 149
 150   RHO(vv, v, kk, ctx->s);
 151   RHO(v, vv, k, kk);
 152   RHO(vv, v, kk, k);
 153   RHO(v, vv, k, kk);
 154   RHO(vv, v, kk, k);
 155   RHO(v, vv, k, kk);
 156   RHO(vv, v, kk, k);
 157   RHO(v, vv, k, kk);
 158   RHO(vv, v, kk, k);
 159   RHO(v, vv, k, kk);
 160
 161   for (i = 0; i < 8; i++) {
 162     XOR64(ctx->s[i], ctx->s[i], m[i]);
 163     XOR64(ctx->s[i], ctx->s[i], v[i]);
 164   }
 165 }
 166
 167 /* --- @whirlpool_init@, @whirlpool256_init@ --- *
 168  *
 169  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block to initialize
 170  *
 171  * Returns:     ---
 172  *
 173  * Use:         Initializes a context block ready for hashing.
 174  */
 175
 176 void whirlpool_init(whirlpool_ctx *ctx)
 177 {
 178   int i;
 179
 180   for (i = 0; i < 8; i++)
 181     SET64(ctx->s[i], 0, 0);
 182   ctx->off = 0;
 183   ctx->nh = ctx->nl = 0;
 184 }
 185
 186 /* --- @whirlpool_set@, @whirlpool256_set@ --- *
 187  *
 188  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block
 189  *              @const void *buf@ = pointer to state buffer
 190  *              @unsigned long count@ = current count of bytes processed
 191  *
 192  * Returns:     ---
 193  *
 194  * Use:         Initializes a context block from a given state.  This is
 195  *              useful in cases where the initial hash state is meant to be
 196  *              secret, e.g., for NMAC and HMAC support.
 197  */
 198
 199 void whirlpool_set(whirlpool_ctx *ctx, const void *buf, unsigned long count)
 200 {
 201   const octet *p = buf;
 202   int i;
 203
 204   for (i = 0; i < 8; i++) {
 205     LOAD64_L_(ctx->s[i], p);
 206     p += 8;
 207   }
 208   ctx->off = 0;
 209   ctx->nl = U32(count);
 210   ctx->nh = U32(((count & ~MASK32) >> 16) >> 16);
 211 }
 212
 213 /* --- @whirlpool_hash@, @whirlpool256_hash@ --- *
 214  *
 215  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block
 216  *              @const void *buf@ = buffer of data to hash
 217  *              @size_t sz@ = size of buffer to hash
 218  *
 219  * Returns:     ---
 220  *
 221  * Use:         Hashes a buffer of data.  The buffer may be of any size and
 222  *              alignment.
 223  */
 224
 225 void whirlpool_hash(whirlpool_ctx *ctx, const void *buf, size_t sz)
 226 {
 227   HASH_BUFFER(WHIRLPOOL, whirlpool, ctx, buf, sz);
 228 }
 229
 230 /* --- @whirlpool_done@, @whirlpool256_done@ --- *
 231  *
 232  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context block
 233  *              @void *hash@ = pointer to output buffer
 234  *
 235  * Returns:     ---
 236  *
 237  * Use:         Returns the hash of the data read so far.
 238  */
 239
 240 static void final(whirlpool_ctx *ctx)
 241 {
 242   HASH_PAD(WHIRLPOOL, whirlpool, ctx, 0x80, 0, 32);
 243   memset(ctx->buf + WHIRLPOOL_BUFSZ - 32, 0, 24);
 244   STORE32(ctx->buf + WHIRLPOOL_BUFSZ -  8, (ctx->nl >> 29) | (ctx->nh << 3));
 245   STORE32(ctx->buf + WHIRLPOOL_BUFSZ -  4, ctx->nl << 3);
 246   whirlpool_compress(ctx, ctx->buf);
 247 }
 248
 249 void whirlpool_done(whirlpool_ctx *ctx, void *hash)
 250 {
 251   octet *p = hash;
 252   int i;
 253
 254   final(ctx);
 255   for (i = 0; i < 8; i++) {
 256     STORE64_L_(p, ctx->s[i]);
 257     p += 8;
 258   }
 259 }
 260
 261 void whirlpool256_done(whirlpool256_ctx *ctx, void *hash)
 262 {
 263   octet *p = hash;
 264   int i;
 265
 266   final(ctx);
 267   for (i = 0; i < 4; i++) {
 268     STORE64_L_(p, ctx->s[i]);
 269     p += 8;
 270   }
 271 }
 272
 273 /* --- @whirlpool_state@, @whirlpool256_state@ --- *
 274  *
 275  * Arguments:   @whirlpool_ctx *ctx@ = pointer to context
 276  *              @void *state@ = pointer to buffer for current state
 277  *
 278  * Returns:     Number of bytes written to the hash function so far.
 279  *
 280  * Use:         Returns the current state of the hash function such that
 281  *              it can be passed to @whirlpool_set@.
 282  */
 283
 284 unsigned long whirlpool_state(whirlpool_ctx *ctx, void *state)
 285 {
 286   octet *p = state;
 287   int i;
 288
 289   for (i = 0; i < 8; i++) {
 290     STORE64_L_(p, ctx->s[i]);
 291     p += 8;
 292   }
 293   return (ctx->nl | ((ctx->nh << 16) << 16));
 294 }
 295
 296 /* --- Generic interface --- */
 297
 298 GHASH_DEF(WHIRLPOOL, whirlpool)
 299
 300 /* --- Test code --- */
 301
 302 HASH_TEST(WHIRLPOOL, whirlpool)
 303
 304 /*----- That's all, folks -------------------------------------------------*/