diff options
Diffstat (limited to 'com/BLAKE2')
| -rw-r--r-- | com/BLAKE2/README.md | 7 | ||||
| -rw-r--r-- | com/BLAKE2/blake2s.c | 126 | ||||
| -rw-r--r-- | com/BLAKE2/blake2s.h | 59 | ||||
| -rw-r--r-- | com/BLAKE2/meson.build | 17 | ||||
| -rw-r--r-- | com/BLAKE2/rfc7693.txt | 1683 | ||||
| -rw-r--r-- | com/BLAKE2/test/blake2s_kat.c | 31 | ||||
| -rwxr-xr-x | com/BLAKE2/test/blake2s_kat.py | 40 | ||||
| -rw-r--r-- | com/BLAKE2/test/blake2s_selftest.c | 102 |
8 files changed, 0 insertions, 2065 deletions
diff --git a/com/BLAKE2/README.md b/com/BLAKE2/README.md deleted file mode 100644 index 223324e..0000000 --- a/com/BLAKE2/README.md +++ /dev/null @@ -1,7 +0,0 @@ -## BLAKE2 -BLAKE2 is a cryptographic hash function faster than MD5, SHA-1, SHA-2, and SHA-3, yet is at least as secure as the -latest standard SHA-3. - -## BLAKE2s -BLAKE2s is optimized for 8 to 32-bit platforms and produces digests of any size between 1 and 32 bytes. - diff --git a/com/BLAKE2/blake2s.c b/com/BLAKE2/blake2s.c deleted file mode 100644 index 5b03b88..0000000 --- a/com/BLAKE2/blake2s.c +++ /dev/null @@ -1,126 +0,0 @@ -#include "blake2s.h" -#include <endian.h> -#include <stdio.h> // TODO remove -#include <string.h> - -static const uint32_t IV[8] = {0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, - 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19}; - -const uint8_t SIGMA[10][16] = { - {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}, {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3}, - {11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4}, {7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8}, - {9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13}, {2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9}, - {12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11}, {13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10}, - {6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5}, {10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0}}; - -uint32_t -rotr_u32(uint32_t word, uint8_t c) -{ - return (word >> c) | (word << (32 - c)); -} - -void -G(uint32_t v[16], unsigned a, unsigned b, unsigned c, unsigned d, uint32_t x, uint32_t y) -{ - v[a] = v[a] + v[b] + x; - v[d] = rotr_u32(v[d] ^ v[a], 16); - v[c] = v[c] + v[d]; - v[b] = rotr_u32(v[b] ^ v[c], 12); - v[a] = v[a] + v[b] + y; - v[d] = rotr_u32(v[d] ^ v[a], 8); - v[c] = v[c] + v[d]; - v[b] = rotr_u32(v[b] ^ v[c], 7); -} - -void -F(struct BLAKE2s_ctx *ctx, uint32_t m[16], uint32_t f) -{ - // Initialize local work vector v - uint32_t v[16] = {ctx->h[0], ctx->h[1], ctx->h[2], ctx->h[3], ctx->h[4], ctx->h[5], - ctx->h[6], ctx->h[7], IV[0], IV[1], IV[2], IV[3], - IV[4] ^ ctx->t[0], IV[5] ^ ctx->t[1], IV[6], IV[7]}; - if (f) v[14] = ~v[14]; // if last block flag, invert all bits - - // cryptographic mixing - for (unsigned i = 0; i < 10; ++i) { - G(v, 0, 4, 8, 12, m[SIGMA[i][0]], m[SIGMA[i][1]]); - G(v, 1, 5, 9, 13, m[SIGMA[i][2]], m[SIGMA[i][3]]); - G(v, 2, 6, 10, 14, m[SIGMA[i][4]], m[SIGMA[i][5]]); - G(v, 3, 7, 11, 15, m[SIGMA[i][6]], m[SIGMA[i][7]]); - - G(v, 0, 5, 10, 15, m[SIGMA[i][8]], m[SIGMA[i][9]]); - G(v, 1, 6, 11, 12, m[SIGMA[i][10]], m[SIGMA[i][11]]); - G(v, 2, 7, 8, 13, m[SIGMA[i][12]], m[SIGMA[i][13]]); - G(v, 3, 4, 9, 14, m[SIGMA[i][14]], m[SIGMA[i][15]]); - } - - // xor the two halves - for (unsigned i = 0; i < 8; ++i) ctx->h[i] ^= (v[i] ^ v[i + 8]); -} - -int -BLAKE2s_init(struct BLAKE2s_ctx *ctx, size_t outlen, const void *key, size_t keylen) -{ - if (outlen == 0 || outlen > 32 || keylen > 32) { - printf("invalid outlen=%lu or keylen=%lu\n", outlen, keylen); // TODO remove - return -1; - } - - memset(ctx, 0, sizeof(struct BLAKE2s_ctx)); - ctx->param.outlen = outlen; - ctx->param.keylen = keylen; - ctx->param.fanout = 1; - ctx->param.depth = 1; - ctx->outlen = outlen; - - // copy IV into state vector h - for (unsigned i = 0; i < 8; ++i) ctx->h[i] = IV[i]; - // copy param block 0 onto h[0] - ctx->h[0] ^= (ctx->param.depth << 24) ^ (ctx->param.fanout << 16) ^ (keylen << 8) ^ outlen; - - if (keylen > 0) { - BLAKE2s_update(ctx, key, keylen); - ctx->c = 64; // at the end - } - - return 0; -} - -#define MIN(a, b) ((a < b) ? a : b) - -void -BLAKE2s_update(struct BLAKE2s_ctx *ctx, const void *d, size_t dd) -{ - for (unsigned i = 0; i < dd;) { - - if (ctx->c == 64) { // if block is full, consume block - ctx->t[0] += ctx->c; - if (ctx->t[0] < ctx->c) ctx->t[1] += 1; - ctx->c = 0; // reset counter - - uint32_t *m = (uint32_t *)ctx->b; - for (unsigned i = 0; i < 16; ++i) m[i] = htole32(m[i]); - F(ctx, m, 0); - } - - // TODO memcpy - ctx->b[ctx->c] = ((uint8_t *)d)[i]; - ++(ctx->c); - ++i; - } -} - -void -BLAKE2s_final(struct BLAKE2s_ctx *ctx, void *out) -{ - ctx->t[0] += ctx->c; - if (ctx->t[0] < ctx->c) ctx->t[1] += 1; - for (; ctx->c < 64; ++(ctx->c)) ctx->b[ctx->c] = 0; // fill up block with zeroes - - uint32_t *m = (uint32_t *)ctx->b; - for (unsigned i = 0; i < 16; ++i) m[i] = htole32(m[i]); - F(ctx, m, 1); - - for (unsigned i = 0; i < ctx->outlen; ++i) ((uint8_t *)out)[i] = (ctx->h[i >> 2] >> (8 * (i & 3))) & 0xff; -} - diff --git a/com/BLAKE2/blake2s.h b/com/BLAKE2/blake2s.h deleted file mode 100644 index fd68168..0000000 --- a/com/BLAKE2/blake2s.h +++ /dev/null @@ -1,59 +0,0 @@ -#pragma once - -#include <stddef.h> -#include <stdint.h> - -struct BLAKE2s_param { - uint8_t outlen; // digest length - uint8_t keylen; // key length - uint8_t fanout; - uint8_t depth; - uint32_t leaf_length; - uint32_t node_offset; - uint16_t node_offset_ex; - uint8_t node_depth; - uint8_t inner_length; - uint64_t salt; - uint64_t personalization; -}; - -struct BLAKE2s_ctx { - uint8_t b[64]; // input buffer - size_t c; // pointer for b[] - size_t outlen; // digest size TODO remove - uint32_t h[8]; // chained state vector h - uint32_t t[2]; // total number of bytes - struct BLAKE2s_param param; // parameter block -}; - -uint32_t rotr_u32(uint32_t word, uint8_t c); - -/** - * 3.1 Mixing Function G - */ -void G(uint32_t V[16], unsigned a, unsigned b, unsigned c, unsigned d, uint32_t x, uint32_t y); - -/** - * 3.2 Compression Function F - * @param t: 2w-bit offset counter t - * @param f: final block indicator flag f - */ -void F(struct BLAKE2s_ctx *context, uint32_t m[16], uint32_t f); - -[[nodiscard]] int BLAKE2s_init(struct BLAKE2s_ctx *ctx, size_t outlen, const void *key, size_t keylen); -void BLAKE2s_update(struct BLAKE2s_ctx *ctx, const void *d, size_t dd); -void BLAKE2s_final(struct BLAKE2s_ctx *ctx, void *out); - -// All-in-one convenience function. -[[maybe_unused]] static int -BLAKE2s(void *out, size_t outlen, // return buffer for digest - const void *key, size_t keylen, // optional secret key - const void *in, size_t inlen) // data to be hashed -{ - struct BLAKE2s_ctx ctx; - if (BLAKE2s_init(&ctx, outlen, key, keylen)) return -1; - BLAKE2s_update(&ctx, in, inlen); - BLAKE2s_final(&ctx, out); - - return 0; -} diff --git a/com/BLAKE2/meson.build b/com/BLAKE2/meson.build deleted file mode 100644 index 7d180e3..0000000 --- a/com/BLAKE2/meson.build +++ /dev/null @@ -1,17 +0,0 @@ -#BLAKE2s = static_library('BLAKE2s', 'blake2s.c') -BLAKE2s_native = shared_library('BLAKE2s_native', 'blake2s.c', native: true) - -kat = generator(python3, - arguments: '@INPUT@', - capture: true, output: '@BASENAME@.h' -) - -test('BLAKE2s selftest', - executable('b2s_selftest', 'test/blake2s_selftest.c', link_with: BLAKE2s_native, native: true), - suite: 'BLAKE2' -) -test('BLAKE2s KAT', - executable('b2s_kat', ['test/blake2s_kat.c', kat.process('test/blake2s_kat.py')], - link_with: BLAKE2s_native, native: true), - suite: 'BLAKE2' -) diff --git a/com/BLAKE2/rfc7693.txt b/com/BLAKE2/rfc7693.txt deleted file mode 100644 index d9d3b97..0000000 --- a/com/BLAKE2/rfc7693.txt +++ /dev/null @@ -1,1683 +0,0 @@ - - - - - - -Independent Submission M-J. Saarinen, Ed. -Request for Comments: 7693 Queen's University Belfast -Category: Informational J-P. Aumasson -ISSN: 2070-1721 Kudelski Security - November 2015 - - - The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC) - -Abstract - - This document describes the cryptographic hash function BLAKE2 and - makes the algorithm specification and C source code conveniently - available to the Internet community. BLAKE2 comes in two main - flavors: BLAKE2b is optimized for 64-bit platforms and BLAKE2s for - smaller architectures. BLAKE2 can be directly keyed, making it - functionally equivalent to a Message Authentication Code (MAC). - -Status of This Memo - - This document is not an Internet Standards Track specification; it is - published for informational purposes. - - This is a contribution to the RFC Series, independently of any other - RFC stream. The RFC Editor has chosen to publish this document at - its discretion and makes no statement about its value for - implementation or deployment. Documents approved for publication by - the RFC Editor are not a candidate for any level of Internet - Standard; see Section 2 of RFC 5741. - - Information about the current status of this document, any errata, - and how to provide feedback on it may be obtained at - http://www.rfc-editor.org/info/rfc7693. - -Copyright Notice - - Copyright (c) 2015 IETF Trust and the persons identified as the - document authors. All rights reserved. - - This document is subject to BCP 78 and the IETF Trust's Legal - Provisions Relating to IETF Documents - (http://trustee.ietf.org/license-info) in effect on the date of - publication of this document. Please review these documents - carefully, as they describe your rights and restrictions with respect - to this document. - - - - - - -Saarinen & Aumasson Informational [Page 1] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -Table of Contents - - 1. Introduction and Terminology . . . . . . . . . . . . . . . . 3 - 2. Conventions, Variables, and Constants . . . . . . . . . . . . 4 - 2.1. Parameters . . . . . . . . . . . . . . . . . . . . . . . 4 - 2.2. Other Constants and Variables . . . . . . . . . . . . . . 4 - 2.3. Arithmetic Notation . . . . . . . . . . . . . . . . . . . 4 - 2.4. Little-Endian Interpretation of Words as Bytes . . . . . 5 - 2.5. Parameter Block . . . . . . . . . . . . . . . . . . . . . 5 - 2.6. Initialization Vector . . . . . . . . . . . . . . . . . . 6 - 2.7. Message Schedule SIGMA . . . . . . . . . . . . . . . . . 6 - 3. BLAKE2 Processing . . . . . . . . . . . . . . . . . . . . . . 7 - 3.1. Mixing Function G . . . . . . . . . . . . . . . . . . . . 7 - 3.2. Compression Function F . . . . . . . . . . . . . . . . . 8 - 3.3. Padding Data and Computing a BLAKE2 Digest . . . . . . . 9 - 4. Standard Parameter Sets and Algorithm Identifiers . . . . . . 10 - 5. Security Considerations . . . . . . . . . . . . . . . . . . . 11 - 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 - 6.1. Normative References . . . . . . . . . . . . . . . . . . 11 - 6.2. Informative References . . . . . . . . . . . . . . . . . 11 - Appendix A. Example of BLAKE2b Computation . . . . . . . . . . . 13 - Appendix B. Example of BLAKE2s Computation . . . . . . . . . . . 15 - Appendix C. BLAKE2b Implementation C Source . . . . . . . . . . 16 - C.1. blake2b.h . . . . . . . . . . . . . . . . . . . . . . . . 16 - C.2. blake2b.c . . . . . . . . . . . . . . . . . . . . . . . . 17 - Appendix D. BLAKE2s Implementation C Source . . . . . . . . . . 21 - D.1. blake2s.h . . . . . . . . . . . . . . . . . . . . . . . . 21 - D.2. blake2s.c . . . . . . . . . . . . . . . . . . . . . . . . 22 - Appendix E. BLAKE2b and BLAKE2s Self-Test Module C Source . . . 26 - Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 29 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 30 - - - - - - - - - - - - - - - - - - - - -Saarinen & Aumasson Informational [Page 2] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -1. Introduction and Terminology - - The BLAKE2 cryptographic hash function [BLAKE2] was designed by Jean- - Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian - Winnerlein. - - BLAKE2 comes in two basic flavors: - - o BLAKE2b (or just BLAKE2) is optimized for 64-bit platforms and - produces digests of any size between 1 and 64 bytes. - - o BLAKE2s is optimized for 8- to 32-bit platforms and produces - digests of any size between 1 and 32 bytes. - - Both BLAKE2b and BLAKE2s are believed to be highly secure and perform - well on any platform, software, or hardware. BLAKE2 does not require - a special "HMAC" (Hashed Message Authentication Code) construction - for keyed message authentication as it has a built-in keying - mechanism. - - The BLAKE2 hash function may be used by digital signature algorithms - and message authentication and integrity protection mechanisms in - applications such as Public Key Infrastructure (PKI), secure - communication protocols, cloud storage, intrusion detection, forensic - suites, and version control systems. - - The BLAKE2 suite provides a more efficient alternative to US Secure - Hash Algorithms SHA and HMAC-SHA [RFC6234]. BLAKE2s-128 is - especially suited as a fast and more secure drop-in replacement to - MD5 and HMAC-MD5 in legacy applications [RFC6151]. - - To aid implementation, we provide a trace of BLAKE2b-512 hash - computation in Appendix A and a trace of BLAKE2s-256 hash computation - in Appendix B. Due to space constraints, this document does not - contain a full set of test vectors for BLAKE2. - - A reference implementation in C programming language for BLAKE2b can - be found in Appendix C and for BLAKE2s in Appendix D of this - document. These implementations MAY be validated with the more - exhaustive Test Module contained in Appendix E. - - The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", - "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this - document are to be interpreted as described in [RFC2119]. - - - - - - - -Saarinen & Aumasson Informational [Page 3] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -2. Conventions, Variables, and Constants - -2.1. Parameters - - The following table summarizes various parameters and their ranges: - - | BLAKE2b | BLAKE2s | - --------------+------------------+------------------+ - Bits in word | w = 64 | w = 32 | - Rounds in F | r = 12 | r = 10 | - Block bytes | bb = 128 | bb = 64 | - Hash bytes | 1 <= nn <= 64 | 1 <= nn <= 32 | - Key bytes | 0 <= kk <= 64 | 0 <= kk <= 32 | - Input bytes | 0 <= ll < 2**128 | 0 <= ll < 2**64 | - --------------+------------------+------------------+ - G Rotation | (R1, R2, R3, R4) | (R1, R2, R3, R4) | - constants = | (32, 24, 16, 63) | (16, 12, 8, 7) | - --------------+------------------+------------------+ - -2.2. Other Constants and Variables - - These variables are used in the algorithm description: - - IV[0..7] Initialization Vector (constant). - - SIGMA[0..9] Message word permutations (constant). - - p[0..7] Parameter block (defines hash and key sizes). - - m[0..15] Sixteen words of a single message block. - - h[0..7] Internal state of the hash. - - d[0..dd-1] Padded input blocks. Each has "bb" bytes. - - t Message byte offset at the end of the current block. - - f Flag indicating the last block. - -2.3. Arithmetic Notation - - For real-valued x, we define the following functions: - - floor(x) Floor, the largest integer <= x. - - ceil(x) Ceiling, the smallest integer >= x. - - frac(x) Positive fractional part of x, frac(x) = x - floor(x). - - - -Saarinen & Aumasson Informational [Page 4] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - Operator notation in pseudocode: - - 2**n = 2 to the power "n". 2**0=1, 2**1=2, 2**2=4, 2**3=8, etc. - - a ^ b = Bitwise exclusive-or operation between "a" and "b". - - a mod b = Remainder "a" modulo "b", always in range [0, b-1]. - - x >> n = floor(x / 2**n). Logical shift "x" right by "n" bits. - - x << n = (x * 2**n) mod (2**w). Logical shift "x" left by "n". - - x >>> n = (x >> n) ^ (x << (w - n)). Rotate "x" right by "n". - -2.4. Little-Endian Interpretation of Words as Bytes - - All mathematical operations are on 64-bit words in BLAKE2b and on - 32-bit words in BLAKE2s. - - We may also perform operations on vectors of words. Vector indexing - is zero based; the first element of an n-element vector "v" is v[0] - and the last one is v[n - 1]. All elements are denoted by v[0..n-1]. - - Byte (octet) streams are interpreted as words in little-endian order, - with the least-significant byte first. Consider this sequence of - eight hexadecimal bytes: - - x[0..7] = 0x01 0x23 0x45 0x67 0x89 0xAB 0xCD 0xEF - - When interpreted as a 32-bit word from the beginning memory address, - x[0..3] has a numerical value of 0x67452301 or 1732584193. - - When interpreted as a 64-bit word, bytes x[0..7] have a numerical - value of 0xEFCDAB8967452301 or 17279655951921914625. - -2.5. Parameter Block - - We specify the parameter block words p[0..7] as follows: - - byte offset: 3 2 1 0 (otherwise zero) - p[0] = 0x0101kknn p[1..7] = 0 - - Here the "nn" byte specifies the hash size in bytes. The second - (little-endian) byte of the parameter block, "kk", specifies the key - size in bytes. Set kk = 00 for unkeyed hashing. Bytes 2 and 3 are - set as 01. All other bytes in the parameter block are set as zero. - - - - - -Saarinen & Aumasson Informational [Page 5] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - Note: [BLAKE2] defines additional variants of BLAKE2 with features - such as salting, personalized hashes, and tree hashing. These - OPTIONAL features use fields in the parameter block that are not - defined in this document. - -2.6. Initialization Vector - - We define the Initialization Vector constant IV mathematically as: - - IV[i] = floor(2**w * frac(sqrt(prime(i+1)))), where prime(i) - is the i:th prime number ( 2, 3, 5, 7, 11, 13, 17, 19 ) - and sqrt(x) is the square root of x. - - The numerical values of IV can also be found in implementations in - Appendices C and D for BLAKE2b and BLAKE2s, respectively. - - Note: BLAKE2b IV is the same as SHA-512 IV, and BLAKE2s IV is the - same as SHA-256 IV; see [RFC6234]. - -2.7. Message Schedule SIGMA - - Message word schedule permutations for each round of both BLAKE2b and - BLAKE2s are defined by SIGMA. For BLAKE2b, the two extra - permutations for rounds 10 and 11 are SIGMA[10..11] = SIGMA[0..1]. - - Round | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | - ----------+-------------------------------------------------+ - SIGMA[0] | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | - SIGMA[1] | 14 10 4 8 9 15 13 6 1 12 0 2 11 7 5 3 | - SIGMA[2] | 11 8 12 0 5 2 15 13 10 14 3 6 7 1 9 4 | - SIGMA[3] | 7 9 3 1 13 12 11 14 2 6 5 10 4 0 15 8 | - SIGMA[4] | 9 0 5 7 2 4 10 15 14 1 11 12 6 8 3 13 | - SIGMA[5] | 2 12 6 10 0 11 8 3 4 13 7 5 15 14 1 9 | - SIGMA[6] | 12 5 1 15 14 13 4 10 0 7 6 3 9 2 8 11 | - SIGMA[7] | 13 11 7 14 12 1 3 9 5 0 15 4 8 6 2 10 | - SIGMA[8] | 6 15 14 9 11 3 0 8 12 2 13 7 1 4 10 5 | - SIGMA[9] | 10 2 8 4 7 6 1 5 15 11 9 14 3 12 13 0 | - ----------+-------------------------------------------------+ - - - - - - - - - - - - - -Saarinen & Aumasson Informational [Page 6] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -3. BLAKE2 Processing - -3.1. Mixing Function G - - The G primitive function mixes two input words, "x" and "y", into - four words indexed by "a", "b", "c", and "d" in the working vector - v[0..15]. The full modified vector is returned. The rotation - constants (R1, R2, R3, R4) are given in Section 2.1. - - FUNCTION G( v[0..15], a, b, c, d, x, y ) - | - | v[a] := (v[a] + v[b] + x) mod 2**w - | v[d] := (v[d] ^ v[a]) >>> R1 - | v[c] := (v[c] + v[d]) mod 2**w - | v[b] := (v[b] ^ v[c]) >>> R2 - | v[a] := (v[a] + v[b] + y) mod 2**w - | v[d] := (v[d] ^ v[a]) >>> R3 - | v[c] := (v[c] + v[d]) mod 2**w - | v[b] := (v[b] ^ v[c]) >>> R4 - | - | RETURN v[0..15] - | - END FUNCTION. - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Saarinen & Aumasson Informational [Page 7] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -3.2. Compression Function F - - Compression function F takes as an argument the state vector "h", - message block vector "m" (last block is padded with zeros to full - block size, if required), 2w-bit offset counter "t", and final block - indicator flag "f". Local vector v[0..15] is used in processing. F - returns a new state vector. The number of rounds, "r", is 12 for - BLAKE2b and 10 for BLAKE2s. Rounds are numbered from 0 to r - 1. - - FUNCTION F( h[0..7], m[0..15], t, f ) - | - | // Initialize local work vector v[0..15] - | v[0..7] := h[0..7] // First half from state. - | v[8..15] := IV[0..7] // Second half from IV. - | - | v[12] := v[12] ^ (t mod 2**w) // Low word of the offset. - | v[13] := v[13] ^ (t >> w) // High word. - | - | IF f = TRUE THEN // last block flag? - | | v[14] := v[14] ^ 0xFF..FF // Invert all bits. - | END IF. - | - | // Cryptographic mixing - | FOR i = 0 TO r - 1 DO // Ten or twelve rounds. - | | - | | // Message word selection permutation for this round. - | | s[0..15] := SIGMA[i mod 10][0..15] - | | - | | v := G( v, 0, 4, 8, 12, m[s[ 0]], m[s[ 1]] ) - | | v := G( v, 1, 5, 9, 13, m[s[ 2]], m[s[ 3]] ) - | | v := G( v, 2, 6, 10, 14, m[s[ 4]], m[s[ 5]] ) - | | v := G( v, 3, 7, 11, 15, m[s[ 6]], m[s[ 7]] ) - | | - | | v := G( v, 0, 5, 10, 15, m[s[ 8]], m[s[ 9]] ) - | | v := G( v, 1, 6, 11, 12, m[s[10]], m[s[11]] ) - | | v := G( v, 2, 7, 8, 13, m[s[12]], m[s[13]] ) - | | v := G( v, 3, 4, 9, 14, m[s[14]], m[s[15]] ) - | | - | END FOR - | - | FOR i = 0 TO 7 DO // XOR the two halves. - | | h[i] := h[i] ^ v[i] ^ v[i + 8] - | END FOR. - | - | RETURN h[0..7] // New state. - | - END FUNCTION. - - - - -Saarinen & Aumasson Informational [Page 8] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -3.3. Padding Data and Computing a BLAKE2 Digest - - We refer the reader to Appendices C and D for reference C language - implementations of BLAKE2b and BLAKE2s, respectively. - - Key and data input are split and padded into "dd" message blocks - d[0..dd-1], each consisting of 16 words (or "bb" bytes). - - If a secret key is used (kk > 0), it is padded with zero bytes and - set as d[0]. Otherwise, d[0] is the first data block. The final - data block d[dd-1] is also padded with zero to "bb" bytes (16 words). - - The number of blocks is therefore dd = ceil(kk / bb) + ceil(ll / bb). - However, in the special case of an unkeyed empty message (kk = 0 and - ll = 0), we still set dd = 1 and d[0] consists of all zeros. - - The following procedure processes the padded data blocks into an - "nn"-byte final hash value. See Section 2 for a description of - various variables and constants used. - - FUNCTION BLAKE2( d[0..dd-1], ll, kk, nn ) - | - | h[0..7] := IV[0..7] // Initialization Vector. - | - | // Parameter block p[0] - | h[0] := h[0] ^ 0x01010000 ^ (kk << 8) ^ nn - | - | // Process padded key and data blocks - | IF dd > 1 THEN - | | FOR i = 0 TO dd - 2 DO - | | | h := F( h, d[i], (i + 1) * bb, FALSE ) - | | END FOR. - | END IF. - | - | // Final block. - | IF kk = 0 THEN - | | h := F( h, d[dd - 1], ll, TRUE ) - | ELSE - | | h := F( h, d[dd - 1], ll + bb, TRUE ) - | END IF. - | - | RETURN first "nn" bytes from little-endian word array h[]. - | - END FUNCTION. - - - - - - - -Saarinen & Aumasson Informational [Page 9] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -4. Standard Parameter Sets and Algorithm Identifiers - - An implementation of BLAKE2b and/or BLAKE2s MAY support the following - digest size parameters for interoperability (e.g., digital - signatures), as long as a sufficient level of security is attained by - the parameter selections. These parameters and identifiers are - intended to be suitable as drop-in replacements to MD5 and - corresponding SHA algorithms. - - Developers adapting BLAKE2 to ASN.1-based message formats SHOULD use - the OID tree at x = 1.3.6.1.4.1.1722.12.2. The same OID can be used - for both keyed and unkeyed hashing since in the latter case the key - simply has zero length. - - Algorithm | Target | Collision | Hash | Hash ASN.1 | - Identifier | Arch | Security | nn | OID Suffix | - ---------------+--------+-----------+------+------------+ - id-blake2b160 | 64-bit | 2**80 | 20 | x.1.5 | - id-blake2b256 | 64-bit | 2**128 | 32 | x.1.8 | - id-blake2b384 | 64-bit | 2**192 | 48 | x.1.12 | - id-blake2b512 | 64-bit | 2**256 | 64 | x.1.16 | - ---------------+--------+-----------+------+------------+ - id-blake2s128 | 32-bit | 2**64 | 16 | x.2.4 | - id-blake2s160 | 32-bit | 2**80 | 20 | x.2.5 | - id-blake2s224 | 32-bit | 2**112 | 28 | x.2.7 | - id-blake2s256 | 32-bit | 2**128 | 32 | x.2.8 | - ---------------+--------+-----------+------+------------+ - - hashAlgs OBJECT IDENTIFIER ::= { - iso(1) identified-organization(3) dod(6) internet(1) - private(4) enterprise(1) kudelski(1722) cryptography(12) 2 - } - macAlgs OBJECT IDENTIFIER ::= { - iso(1) identified-organization(3) dod(6) internet(1) - private(4) enterprise(1) kudelski(1722) cryptography(12) 3 - } - - -- the two BLAKE2 variants -- - blake2b OBJECT IDENTIFIER ::= { hashAlgs 1 } - blake2s OBJECT IDENTIFIER ::= { hashAlgs 2 } - - -- BLAKE2b Identifiers -- - id-blake2b160 OBJECT IDENTIFIER ::= { blake2b 5 } - id-blake2b256 OBJECT IDENTIFIER ::= { blake2b 8 } - id-blake2b384 OBJECT IDENTIFIER ::= { blake2b 12 } - id-blake2b512 OBJECT IDENTIFIER ::= { blake2b 16 } - - - - - -Saarinen & Aumasson Informational [Page 10] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - -- BLAKE2s Identifiers -- - id-blake2s128 OBJECT IDENTIFIER ::= { blake2s 4 } - id-blake2s160 OBJECT IDENTIFIER ::= { blake2s 5 } - id-blake2s224 OBJECT IDENTIFIER ::= { blake2s 7 } - id-blake2s256 OBJECT IDENTIFIER ::= { blake2s 8 } - -5. Security Considerations - - This document is intended to provide convenient open-source access by - the Internet community to the BLAKE2 cryptographic hash algorithm. - We wish to make no independent assertion to its security in this - document. We refer the reader to [BLAKE] and [BLAKE2] for detailed - cryptanalytic rationale behind its design. - - In order to avoid bloat, the reference implementations in Appendices - C and D may not erase all sensitive data (such as secret keys) - immediately from process memory after use. Such cleanup can be added - if needed. - -6. References - -6.1. Normative References - - [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate - Requirement Levels", BCP 14, RFC 2119, - DOI 10.17487/RFC2119, March 1997, - <http://www.rfc-editor.org/info/rfc2119>. - -6.2. Informative References - - [BLAKE] Aumasson, J-P., Meier, W., Phan, R., and L. Henzen, "The - Hash Function BLAKE", January 2015, - <https://131002.net/blake/book>. - - [BLAKE2] Aumasson, J-P., Neves, S., Wilcox-O'Hearn, Z., and C. - Winnerlein, "BLAKE2: simpler, smaller, fast as MD5", - January 2013, <https://blake2.net/blake2.pdf>. - - [FIPS140-2IG] - NIST, "Implementation Guidance for FIPS PUB 140-2 and the - Cryptographic Module Validation Program", September 2015, - <http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/ - FIPS1402IG.pdf/>. - - [RFC6151] Turner, S. and L. Chen, "Updated Security Considerations - for the MD5 Message-Digest and the HMAC-MD5 Algorithms", - RFC 6151, DOI 10.17487/RFC6151, March 2011, - <http://www.rfc-editor.org/info/rfc6151>. - - - -Saarinen & Aumasson Informational [Page 11] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - [RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms - (SHA and SHA-based HMAC and HKDF)", RFC 6234, - DOI 10.17487/RFC6234, May 2011, - <http://www.rfc-editor.org/info/rfc6234>. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Saarinen & Aumasson Informational [Page 12] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -Appendix A. Example of BLAKE2b Computation - - We compute the unkeyed hash of three ASCII bytes "abc" with - BLAKE2b-512 and show internal values during computation. - - m[16] = 0000000000636261 0000000000000000 0000000000000000 - 0000000000000000 0000000000000000 0000000000000000 - 0000000000000000 0000000000000000 0000000000000000 - 0000000000000000 0000000000000000 0000000000000000 - 0000000000000000 0000000000000000 0000000000000000 - 0000000000000000 - - (i= 0) v[16] = 6A09E667F2BDC948 BB67AE8584CAA73B 3C6EF372FE94F82B - A54FF53A5F1D36F1 510E527FADE682D1 9B05688C2B3E6C1F - 1F83D9ABFB41BD6B 5BE0CD19137E2179 6A09E667F3BCC908 - BB67AE8584CAA73B 3C6EF372FE94F82B A54FF53A5F1D36F1 - 510E527FADE682D2 9B05688C2B3E6C1F E07C265404BE4294 - 5BE0CD19137E2179 - - (i= 1) v[16] = 86B7C1568029BB79 C12CBCC809FF59F3 C6A5214CC0EACA8E - 0C87CD524C14CC5D 44EE6039BD86A9F7 A447C850AA694A7E - DE080F1BB1C0F84B 595CB8A9A1ACA66C BEC3AE837EAC4887 - 6267FC79DF9D6AD1 FA87B01273FA6DBE 521A715C63E08D8A - E02D0975B8D37A83 1C7B754F08B7D193 8F885A76B6E578FE - 2318A24E2140FC64 - - (i= 2) v[16] = 53281E83806010F2 3594B403F81B4393 8CD63C7462DE0DFF - 85F693F3DA53F974 BAABDBB2F386D9AE CA5425AEC65A10A8 - C6A22E2FF0F7AA48 C6A56A51CB89C595 224E6A3369224F96 - 500E125E58A92923 E9E4AD0D0E1A0D48 85DF9DC143C59A74 - 92A3AAAA6D952B7F C5FDF71090FAE853 2A8A40F15A462DD0 - 572D17EFFDD37358 - - (i= 3) v[16] = 60ED96AA7AD41725 E46A743C71800B9D 1A04B543A01F156B - A2F8716E775C4877 DA0A61BCDE4267EA B1DD230754D7BDEE - 25A1422779E06D14 E6823AE4C3FF58A5 A1677E19F37FD5DA - 22BDCE6976B08C51 F1DE8696BEC11BF1 A0EBD586A4A1D2C8 - C804EBAB11C99FA9 8E0CEC959C715793 7C45557FAE0D4D89 - 716343F52FDD265E - - (i= 4) v[16] = BB2A77D3A8382351 45EB47971F23B103 98BE297F6E45C684 - A36077DEE3370B89 8A03C4CB7E97590A 24192E49EBF54EA0 - 4F82C9401CB32D7A 8CCD013726420DC4 A9C9A8F17B1FC614 - 55908187977514A0 5B44273E66B19D27 B6D5C9FCA2579327 - 086092CFB858437E 5C4BE2156DBEECF9 2EFEDE99ED4EFF16 - 3E7B5F234CD1F804 - - - - - -Saarinen & Aumasson Informational [Page 13] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - (i= 5) v[16] = C79C15B3D423B099 2DA2224E8DA97556 77D2B26DF1C45C55 - 8934EB09A3456052 0F6D9EEED157DA2A 6FE66467AF88C0A9 - 4EB0B76284C7AAFB 299C8E725D954697 B2240B59E6D567D3 - 2643C2370E49EBFD 79E02EEF20CDB1AE 64B3EED7BB602F39 - B97D2D439E4DF63D C718E755294C9111 1F0893F2772BB373 - 1205EA4A7859807D - - (i= 6) v[16] = E58F97D6385BAEE4 7640AA9764DA137A DEB4C7C23EFE287E - 70F6F41C8783C9F6 7127CD48C76A7708 9E472AF0BE3DB3F6 - 0F244C62DDF71788 219828AA83880842 41CCA9073C8C4D0D - 5C7912BC10DF3B4B A2C3ABBD37510EE2 CB5668CC2A9F7859 - 8733794F07AC1500 C67A6BE42335AA6F ACB22B28681E4C82 - DB2161604CBC9828 - - (i= 7) v[16] = 6E2D286EEADEDC81 BCF02C0787E86358 57D56A56DD015EDF - 55D899D40A5D0D0A 819415B56220C459 B63C479A6A769F02 - 258E55E0EC1F362A 3A3B4EC60E19DFDC 04D769B3FCB048DB - B78A9A33E9BFF4DD 5777272AE1E930C0 5A387849E578DBF6 - 92AAC307CF2C0AFC 30AACCC4F06DAFAA 483893CC094F8863 - E03C6CC89C26BF92 - - (i= 8) v[16] = FFC83ECE76024D01 1BE7BFFB8C5CC5F9 A35A18CBAC4C65B7 - B7C2C7E6D88C285F 81937DA314A50838 E1179523A2541963 - 3A1FAD7106232B8F 1C7EDE92AB8B9C46 A3C2D35E4F685C10 - A53D3F73AA619624 30BBCC0285A22F65 BCEFBB6A81539E5D - 3841DEF6F4C9848A 98662C85FBA726D4 7762439BD5A851BD - B0B9F0D443D1A889 - - (i= 9) v[16] = 753A70A1E8FAEADD 6B0D43CA2C25D629 F8343BA8B94F8C0B - BC7D062B0DB5CF35 58540EE1B1AEBC47 63C5B9B80D294CB9 - 490870ECAD27DEBD B2A90DDF667287FE 316CC9EBEEFAD8FC - 4A466BCD021526A4 5DA7F7638CEC5669 D9C8826727D306FC - 88ED6C4F3BD7A537 19AE688DDF67F026 4D8707AAB40F7E6D - FD3F572687FEA4F1 - - (i=10) v[16] = E630C747CCD59C4F BC713D41127571CA 46DB183025025078 - 6727E81260610140 2D04185EAC2A8CBA 5F311B88904056EC - 40BD313009201AAB 0099D4F82A2A1EAB 6DD4FBC1DE60165D - B3B0B51DE3C86270 900AEE2F233B08E5 A07199D87AD058D8 - 2C6B25593D717852 37E8CA471BEAA5F8 2CFC1BAC10EF4457 - 01369EC18746E775 - - (i=11) v[16] = E801F73B9768C760 35C6D22320BE511D 306F27584F65495E - B51776ADF569A77B F4F1BE86690B3C34 3CC88735D1475E4B - 5DAC67921FF76949 1CDB9D31AD70CC4E 35BA354A9C7DF448 - 4929CBE45679D73E 733D1A17248F39DB 92D57B736F5F170A - 61B5C0A41D491399 B5C333457E12844A BD696BE010D0D889 - 02231E1A917FE0BD - - - -Saarinen & Aumasson Informational [Page 14] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - (i=12) v[16] = 12EF8A641EC4F6D6 BCED5DE977C9FAF5 733CA476C5148639 - 97DF596B0610F6FC F42C16519AD5AFA7 AA5AC1888E10467E - 217D930AA51787F3 906A6FF19E573942 75AB709BD3DCBF24 - EE7CE1F345947AA4 F8960D6C2FAF5F5E E332538A36B6D246 - 885BEF040EF6AA0B A4939A417BFB78A3 646CBB7AF6DCE980 - E813A23C60AF3B82 - - h[8] = 0D4D1C983FA580BA E9F6129FB697276A B7C45A68142F214C - D1A2FFDB6FBB124B 2D79AB2A39C5877D 95CC3345DED552C2 - 5A92F1DBA88AD318 239900D4ED8623B9 - - BLAKE2b-512("abc") = BA 80 A5 3F 98 1C 4D 0D 6A 27 97 B6 9F 12 F6 E9 - 4C 21 2F 14 68 5A C4 B7 4B 12 BB 6F DB FF A2 D1 - 7D 87 C5 39 2A AB 79 2D C2 52 D5 DE 45 33 CC 95 - 18 D3 8A A8 DB F1 92 5A B9 23 86 ED D4 00 99 23 - -Appendix B. Example of BLAKE2s Computation - - We compute the unkeyed hash of three ASCII bytes "abc" with - BLAKE2s-256 and show internal values during computation. - - m[16] = 00636261 00000000 00000000 00000000 00000000 00000000 - 00000000 00000000 00000000 00000000 00000000 00000000 - 00000000 00000000 00000000 00000000 - - (i=0) v[16] = 6B08E647 BB67AE85 3C6EF372 A54FF53A 510E527F 9B05688C - 1F83D9AB 5BE0CD19 6A09E667 BB67AE85 3C6EF372 A54FF53A - 510E527C 9B05688C E07C2654 5BE0CD19 - - (i=1) v[16] = 16A3242E D7B5E238 CE8CE24B 927AEDE1 A7B430D9 93A4A14E - A44E7C31 41D4759B 95BF33D3 9A99C181 608A3A6B B666383E - 7A8DD50F BE378ED7 353D1EE6 3BB44C6B - - (i=2) v[16] = 3AE30FE3 0982A96B E88185B4 3E339B16 F24338CD 0E66D326 - E005ED0C D591A277 180B1F3A FCF43914 30DB62D6 4847831C - 7F00C58E FB847886 C544E836 524AB0E2 - - (i=3) v[16] = 7A3BE783 997546C1 D45246DF EDB5F821 7F98A742 10E864E2 - D4AB70D0 C63CB1AB 6038DA9E 414594B0 F2C218B5 8DA0DCB7 - D7CD7AF5 AB4909DF 85031A52 C4EDFC98 - - (i=4) v[16] = 2A8B8CB7 1ACA82B2 14045D7F CC7258ED 383CF67C E090E7F9 - 3025D276 57D04DE4 994BACF0 F0982759 F17EE300 D48FC2D5 - DC854C10 523898A9 C03A0F89 47D6CD88 - - (i=5) v[16] = C4AA2DDB 111343A3 D54A700A 574A00A9 857D5A48 B1E11989 - 6F5C52DF DD2C53A3 678E5F8E 9718D4E9 622CB684 92976076 - 0E41A517 359DC2BE 87A87DDD 643F9CEC - - - -Saarinen & Aumasson Informational [Page 15] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - (i=6) v[16] = 3453921C D7595EE1 592E776D 3ED6A974 4D997CB3 DE9212C3 - 35ADF5C9 9916FD65 96562E89 4EAD0792 EBFC2712 2385F5B2 - F34600FB D7BC20FB EB452A7B ECE1AA40 - - (i=7) v[16] = BE851B2D A85F6358 81E6FC3B 0BB28000 FA55A33A 87BE1FAD - 4119370F 1E2261AA A1318FD3 F4329816 071783C2 6E536A8D - 9A81A601 E7EC80F1 ACC09948 F849A584 - - (i=8) v[16] = 07E5B85A 069CC164 F9DE3141 A56F4680 9E440AD2 9AB659EA - 3C84B971 21DBD9CF 46699F8C 765257EC AF1D998C 75E4C3B6 - 523878DC 30715015 397FEE81 4F1FA799 - - (i=9) v[16] = 435148C4 A5AA2D11 4B354173 D543BC9E BDA2591C BF1D2569 - 4FCB3120 707ADA48 565B3FDE 32C9C916 EAF4A1AB B1018F28 - 8078D978 68ADE4B5 9778FDA3 2863B92E - - (i=10) v[16] = D9C994AA CFEC3AA6 700D0AB2 2C38670E AF6A1F66 1D023EF3 - 1D9EC27D 945357A5 3E9FFEBD 969FE811 EF485E21 A632797A - DEEF082E AF3D80E1 4E86829B 4DEAFD3A - - h[8] = 8C5E8C50 E2147C32 A32BA7E1 2F45EB4E 208B4537 293AD69E - 4C9B994D 82596786 - - BLAKE2s-256("abc") = 50 8C 5E 8C 32 7C 14 E2 E1 A7 2B A3 4E EB 45 2F - 37 45 8B 20 9E D6 3A 29 4D 99 9B 4C 86 67 59 82 - -Appendix C. BLAKE2b Implementation C Source - -C.1. blake2b.h - - <CODE BEGINS> - // blake2b.h - // BLAKE2b Hashing Context and API Prototypes - - #ifndef BLAKE2B_H - #define BLAKE2B_H - - #include <stdint.h> - #include <stddef.h> - - // state context - typedef struct { - uint8_t b[128]; // input buffer - uint64_t h[8]; // chained state - uint64_t t[2]; // total number of bytes - size_t c; // pointer for b[] - size_t outlen; // digest size - } blake2b_ctx; - - - -Saarinen & Aumasson Informational [Page 16] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - // Initialize the hashing context "ctx" with optional key "key". - // 1 <= outlen <= 64 gives the digest size in bytes. - // Secret key (also <= 64 bytes) is optional (keylen = 0). - int blake2b_init(blake2b_ctx *ctx, size_t outlen, - const void *key, size_t keylen); // secret key - - // Add "inlen" bytes from "in" into the hash. - void blake2b_update(blake2b_ctx *ctx, // context - const void *in, size_t inlen); // data to be hashed - - // Generate the message digest (size given in init). - // Result placed in "out". - void blake2b_final(blake2b_ctx *ctx, void *out); - - // All-in-one convenience function. - int blake2b(void *out, size_t outlen, // return buffer for digest - const void *key, size_t keylen, // optional secret key - const void *in, size_t inlen); // data to be hashed - - #endif - <CODE ENDS> - -C.2. blake2b.c - - <CODE BEGINS> - // blake2b.c - // A simple BLAKE2b Reference Implementation. - - #include "blake2b.h" - - // Cyclic right rotation. - - #ifndef ROTR64 - #define ROTR64(x, y) (((x) >> (y)) ^ ((x) << (64 - (y)))) - #endif - - // Little-endian byte access. - - #define B2B_GET64(p) \ - (((uint64_t) ((uint8_t *) (p))[0]) ^ \ - (((uint64_t) ((uint8_t *) (p))[1]) << 8) ^ \ - (((uint64_t) ((uint8_t *) (p))[2]) << 16) ^ \ - (((uint64_t) ((uint8_t *) (p))[3]) << 24) ^ \ - (((uint64_t) ((uint8_t *) (p))[4]) << 32) ^ \ - (((uint64_t) ((uint8_t *) (p))[5]) << 40) ^ \ - (((uint64_t) ((uint8_t *) (p))[6]) << 48) ^ \ - (((uint64_t) ((uint8_t *) (p))[7]) << 56)) - - - - -Saarinen & Aumasson Informational [Page 17] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - // G Mixing function. - - #define B2B_G(a, b, c, d, x, y) { \ - v[a] = v[a] + v[b] + x; \ - v[d] = ROTR64(v[d] ^ v[a], 32); \ - v[c] = v[c] + v[d]; \ - v[b] = ROTR64(v[b] ^ v[c], 24); \ - v[a] = v[a] + v[b] + y; \ - v[d] = ROTR64(v[d] ^ v[a], 16); \ - v[c] = v[c] + v[d]; \ - v[b] = ROTR64(v[b] ^ v[c], 63); } - - // Initialization Vector. - - static const uint64_t blake2b_iv[8] = { - 0x6A09E667F3BCC908, 0xBB67AE8584CAA73B, - 0x3C6EF372FE94F82B, 0xA54FF53A5F1D36F1, - 0x510E527FADE682D1, 0x9B05688C2B3E6C1F, - 0x1F83D9ABFB41BD6B, 0x5BE0CD19137E2179 - }; - - // Compression function. "last" flag indicates last block. - - static void blake2b_compress(blake2b_ctx *ctx, int last) - { - const uint8_t sigma[12][16] = { - { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, - { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }, - { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 }, - { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 }, - { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 }, - { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 }, - { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 }, - { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 }, - { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 }, - { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }, - { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, - { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } - }; - int i; - uint64_t v[16], m[16]; - - for (i = 0; i < 8; i++) { // init work variables - v[i] = ctx->h[i]; - v[i + 8] = blake2b_iv[i]; - } - - - - - -Saarinen & Aumasson Informational [Page 18] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - v[12] ^= ctx->t[0]; // low 64 bits of offset - v[13] ^= ctx->t[1]; // high 64 bits - if (last) // last block flag set ? - v[14] = ~v[14]; - - for (i = 0; i < 16; i++) // get little-endian words - m[i] = B2B_GET64(&ctx->b[8 * i]); - - for (i = 0; i < 12; i++) { // twelve rounds - B2B_G( 0, 4, 8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]); - B2B_G( 1, 5, 9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]); - B2B_G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]); - B2B_G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]); - B2B_G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]); - B2B_G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]); - B2B_G( 2, 7, 8, 13, m[sigma[i][12]], m[sigma[i][13]]); - B2B_G( 3, 4, 9, 14, m[sigma[i][14]], m[sigma[i][15]]); - } - - for( i = 0; i < 8; ++i ) - ctx->h[i] ^= v[i] ^ v[i + 8]; - } - - // Initialize the hashing context "ctx" with optional key "key". - // 1 <= outlen <= 64 gives the digest size in bytes. - // Secret key (also <= 64 bytes) is optional (keylen = 0). - - int blake2b_init(blake2b_ctx *ctx, size_t outlen, - const void *key, size_t keylen) // (keylen=0: no key) - { - size_t i; - - if (outlen == 0 || outlen > 64 || keylen > 64) - return -1; // illegal parameters - - for (i = 0; i < 8; i++) // state, "param block" - ctx->h[i] = blake2b_iv[i]; - ctx->h[0] ^= 0x01010000 ^ (keylen << 8) ^ outlen; - - ctx->t[0] = 0; // input count low word - ctx->t[1] = 0; // input count high word - ctx->c = 0; // pointer within buffer - ctx->outlen = outlen; - - - - - - - - -Saarinen & Aumasson Informational [Page 19] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - for (i = keylen; i < 128; i++) // zero input block - ctx->b[i] = 0; - if (keylen > 0) { - blake2b_update(ctx, key, keylen); - ctx->c = 128; // at the end - } - - return 0; - } - - // Add "inlen" bytes from "in" into the hash. - - void blake2b_update(blake2b_ctx *ctx, - const void *in, size_t inlen) // data bytes - { - size_t i; - - for (i = 0; i < inlen; i++) { - if (ctx->c == 128) { // buffer full ? - ctx->t[0] += ctx->c; // add counters - if (ctx->t[0] < ctx->c) // carry overflow ? - ctx->t[1]++; // high word - blake2b_compress(ctx, 0); // compress (not last) - ctx->c = 0; // counter to zero - } - ctx->b[ctx->c++] = ((const uint8_t *) in)[i]; - } - } - - // Generate the message digest (size given in init). - // Result placed in "out". - - void blake2b_final(blake2b_ctx *ctx, void *out) - { - size_t i; - - ctx->t[0] += ctx->c; // mark last block offset - if (ctx->t[0] < ctx->c) // carry overflow - ctx->t[1]++; // high word - - while (ctx->c < 128) // fill up with zeros - ctx->b[ctx->c++] = 0; - blake2b_compress(ctx, 1); // final block flag = 1 - - - - - - - - -Saarinen & Aumasson Informational [Page 20] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - // little endian convert and store - for (i = 0; i < ctx->outlen; i++) { - ((uint8_t *) out)[i] = - (ctx->h[i >> 3] >> (8 * (i & 7))) & 0xFF; - } - } - - // Convenience function for all-in-one computation. - - int blake2b(void *out, size_t outlen, - const void *key, size_t keylen, - const void *in, size_t inlen) - { - blake2b_ctx ctx; - - if (blake2b_init(&ctx, outlen, key, keylen)) - return -1; - blake2b_update(&ctx, in, inlen); - blake2b_final(&ctx, out); - - return 0; - } - <CODE ENDS> - -Appendix D. BLAKE2s Implementation C Source - -D.1. blake2s.h - - <CODE BEGINS> - // blake2s.h - // BLAKE2s Hashing Context and API Prototypes - - #ifndef BLAKE2S_H - #define BLAKE2S_H - - #include <stdint.h> - #include <stddef.h> - - // state context - typedef struct { - uint8_t b[64]; // input buffer - uint32_t h[8]; // chained state - uint32_t t[2]; // total number of bytes - size_t c; // pointer for b[] - size_t outlen; // digest size - } blake2s_ctx; - - - - - -Saarinen & Aumasson Informational [Page 21] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - // Initialize the hashing context "ctx" with optional key "key". - // 1 <= outlen <= 32 gives the digest size in bytes. - // Secret key (also <= 32 bytes) is optional (keylen = 0). - int blake2s_init(blake2s_ctx *ctx, size_t outlen, - const void *key, size_t keylen); // secret key - - // Add "inlen" bytes from "in" into the hash. - void blake2s_update(blake2s_ctx *ctx, // context - const void *in, size_t inlen); // data to be hashed - - // Generate the message digest (size given in init). - // Result placed in "out". - void blake2s_final(blake2s_ctx *ctx, void *out); - - // All-in-one convenience function. - int blake2s(void *out, size_t outlen, // return buffer for digest - const void *key, size_t keylen, // optional secret key - const void *in, size_t inlen); // data to be hashed - - #endif - <CODE ENDS> - -D.2. blake2s.c - - <CODE BEGINS> - // blake2s.c - // A simple blake2s Reference Implementation. - - #include "blake2s.h" - - // Cyclic right rotation. - - #ifndef ROTR32 - #define ROTR32(x, y) (((x) >> (y)) ^ ((x) << (32 - (y)))) - #endif - - // Little-endian byte access. - - #define B2S_GET32(p) \ - (((uint32_t) ((uint8_t *) (p))[0]) ^ \ - (((uint32_t) ((uint8_t *) (p))[1]) << 8) ^ \ - (((uint32_t) ((uint8_t *) (p))[2]) << 16) ^ \ - (((uint32_t) ((uint8_t *) (p))[3]) << 24)) - - - - - - - - -Saarinen & Aumasson Informational [Page 22] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - // Mixing function G. - - #define B2S_G(a, b, c, d, x, y) { \ - v[a] = v[a] + v[b] + x; \ - v[d] = ROTR32(v[d] ^ v[a], 16); \ - v[c] = v[c] + v[d]; \ - v[b] = ROTR32(v[b] ^ v[c], 12); \ - v[a] = v[a] + v[b] + y; \ - v[d] = ROTR32(v[d] ^ v[a], 8); \ - v[c] = v[c] + v[d]; \ - v[b] = ROTR32(v[b] ^ v[c], 7); } - - // Initialization Vector. - - static const uint32_t blake2s_iv[8] = - { - 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, - 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19 - }; - - // Compression function. "last" flag indicates last block. - - static void blake2s_compress(blake2s_ctx *ctx, int last) - { - const uint8_t sigma[10][16] = { - { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, - { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }, - { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 }, - { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 }, - { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 }, - { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 }, - { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 }, - { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 }, - { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 }, - { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 } - }; - int i; - uint32_t v[16], m[16]; - - for (i = 0; i < 8; i++) { // init work variables - v[i] = ctx->h[i]; - v[i + 8] = blake2s_iv[i]; - } - - v[12] ^= ctx->t[0]; // low 32 bits of offset - v[13] ^= ctx->t[1]; // high 32 bits - if (last) // last block flag set ? - v[14] = ~v[14]; - - - -Saarinen & Aumasson Informational [Page 23] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - for (i = 0; i < 16; i++) // get little-endian words - m[i] = B2S_GET32(&ctx->b[4 * i]); - - for (i = 0; i < 10; i++) { // ten rounds - B2S_G( 0, 4, 8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]); - B2S_G( 1, 5, 9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]); - B2S_G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]); - B2S_G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]); - B2S_G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]); - B2S_G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]); - B2S_G( 2, 7, 8, 13, m[sigma[i][12]], m[sigma[i][13]]); - B2S_G( 3, 4, 9, 14, m[sigma[i][14]], m[sigma[i][15]]); - } - - for( i = 0; i < 8; ++i ) - ctx->h[i] ^= v[i] ^ v[i + 8]; - } - - // Initialize the hashing context "ctx" with optional key "key". - // 1 <= outlen <= 32 gives the digest size in bytes. - // Secret key (also <= 32 bytes) is optional (keylen = 0). - - int blake2s_init(blake2s_ctx *ctx, size_t outlen, - const void *key, size_t keylen) // (keylen=0: no key) - { - size_t i; - - if (outlen == 0 || outlen > 32 || keylen > 32) - return -1; // illegal parameters - - for (i = 0; i < 8; i++) // state, "param block" - ctx->h[i] = blake2s_iv[i]; - ctx->h[0] ^= 0x01010000 ^ (keylen << 8) ^ outlen; - - ctx->t[0] = 0; // input count low word - ctx->t[1] = 0; // input count high word - ctx->c = 0; // pointer within buffer - ctx->outlen = outlen; - - for (i = keylen; i < 64; i++) // zero input block - ctx->b[i] = 0; - if (keylen > 0) { - blake2s_update(ctx, key, keylen); - ctx->c = 64; // at the end - } - - return 0; - } - - - -Saarinen & Aumasson Informational [Page 24] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - // Add "inlen" bytes from "in" into the hash. - - void blake2s_update(blake2s_ctx *ctx, - const void *in, size_t inlen) // data bytes - { - size_t i; - - for (i = 0; i < inlen; i++) { - if (ctx->c == 64) { // buffer full ? - ctx->t[0] += ctx->c; // add counters - if (ctx->t[0] < ctx->c) // carry overflow ? - ctx->t[1]++; // high word - blake2s_compress(ctx, 0); // compress (not last) - ctx->c = 0; // counter to zero - } - ctx->b[ctx->c++] = ((const uint8_t *) in)[i]; - } - } - - // Generate the message digest (size given in init). - // Result placed in "out". - - void blake2s_final(blake2s_ctx *ctx, void *out) - { - size_t i; - - ctx->t[0] += ctx->c; // mark last block offset - if (ctx->t[0] < ctx->c) // carry overflow - ctx->t[1]++; // high word - - while (ctx->c < 64) // fill up with zeros - ctx->b[ctx->c++] = 0; - blake2s_compress(ctx, 1); // final block flag = 1 - - // little endian convert and store - for (i = 0; i < ctx->outlen; i++) { - ((uint8_t *) out)[i] = - (ctx->h[i >> 2] >> (8 * (i & 3))) & 0xFF; - } - } - - // Convenience function for all-in-one computation. - - int blake2s(void *out, size_t outlen, - const void *key, size_t keylen, - const void *in, size_t inlen) - { - blake2s_ctx ctx; - - - -Saarinen & Aumasson Informational [Page 25] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - if (blake2s_init(&ctx, outlen, key, keylen)) - return -1; - blake2s_update(&ctx, in, inlen); - blake2s_final(&ctx, out); - - return 0; - } - <CODE ENDS> - -Appendix E. BLAKE2b and BLAKE2s Self-Test Module C Source - - This module computes a series of keyed and unkeyed hashes from - deterministically generated pseudorandom data and computes a hash - over those results. This is a fairly exhaustive, yet compact and - fast method for verifying that the hashing module is functioning - correctly. - - Such testing is RECOMMENDED, especially when compiling the - implementation for a new a target platform configuration. - Furthermore, some security standards, such as FIPS-140, may require a - Power-On Self Test (POST) to be performed every time the - cryptographic module is loaded [FIPS140-2IG]. - - <CODE BEGINS> - // test_main.c - // Self test Modules for BLAKE2b and BLAKE2s -- and a stub main(). - - #include <stdio.h> - - #include "blake2b.h" - #include "blake2s.h" - - // Deterministic sequences (Fibonacci generator). - - static void selftest_seq(uint8_t *out, size_t len, uint32_t seed) - { - size_t i; - uint32_t t, a , b; - - a = 0xDEAD4BAD * seed; // prime - b = 1; - - for (i = 0; i < len; i++) { // fill the buf - t = a + b; - a = b; - b = t; - out[i] = (t >> 24) & 0xFF; - } - - - -Saarinen & Aumasson Informational [Page 26] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - } - - // BLAKE2b self-test validation. Return 0 when OK. - - int blake2b_selftest() - { - // grand hash of hash results - const uint8_t blake2b_res[32] = { - 0xC2, 0x3A, 0x78, 0x00, 0xD9, 0x81, 0x23, 0xBD, - 0x10, 0xF5, 0x06, 0xC6, 0x1E, 0x29, 0xDA, 0x56, - 0x03, 0xD7, 0x63, 0xB8, 0xBB, 0xAD, 0x2E, 0x73, - 0x7F, 0x5E, 0x76, 0x5A, 0x7B, 0xCC, 0xD4, 0x75 - }; - // parameter sets - const size_t b2b_md_len[4] = { 20, 32, 48, 64 }; - const size_t b2b_in_len[6] = { 0, 3, 128, 129, 255, 1024 }; - - size_t i, j, outlen, inlen; - uint8_t in[1024], md[64], key[64]; - blake2b_ctx ctx; - - // 256-bit hash for testing - if (blake2b_init(&ctx, 32, NULL, 0)) - return -1; - - for (i = 0; i < 4; i++) { - outlen = b2b_md_len[i]; - for (j = 0; j < 6; j++) { - inlen = b2b_in_len[j]; - - selftest_seq(in, inlen, inlen); // unkeyed hash - blake2b(md, outlen, NULL, 0, in, inlen); - blake2b_update(&ctx, md, outlen); // hash the hash - - selftest_seq(key, outlen, outlen); // keyed hash - blake2b(md, outlen, key, outlen, in, inlen); - blake2b_update(&ctx, md, outlen); // hash the hash - } - } - - // compute and compare the hash of hashes - blake2b_final(&ctx, md); - for (i = 0; i < 32; i++) { - if (md[i] != blake2b_res[i]) - return -1; - } - - return 0; - - - -Saarinen & Aumasson Informational [Page 27] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - } - - // BLAKE2s self-test validation. Return 0 when OK. - - int blake2s_selftest() - { - // Grand hash of hash results. - const uint8_t blake2s_res[32] = { - 0x6A, 0x41, 0x1F, 0x08, 0xCE, 0x25, 0xAD, 0xCD, - 0xFB, 0x02, 0xAB, 0xA6, 0x41, 0x45, 0x1C, 0xEC, - 0x53, 0xC5, 0x98, 0xB2, 0x4F, 0x4F, 0xC7, 0x87, - 0xFB, 0xDC, 0x88, 0x79, 0x7F, 0x4C, 0x1D, 0xFE - }; - // Parameter sets. - const size_t b2s_md_len[4] = { 16, 20, 28, 32 }; - const size_t b2s_in_len[6] = { 0, 3, 64, 65, 255, 1024 }; - - size_t i, j, outlen, inlen; - uint8_t in[1024], md[32], key[32]; - blake2s_ctx ctx; - - // 256-bit hash for testing. - if (blake2s_init(&ctx, 32, NULL, 0)) - return -1; - - for (i = 0; i < 4; i++) { - outlen = b2s_md_len[i]; - for (j = 0; j < 6; j++) { - inlen = b2s_in_len[j]; - - selftest_seq(in, inlen, inlen); // unkeyed hash - blake2s(md, outlen, NULL, 0, in, inlen); - blake2s_update(&ctx, md, outlen); // hash the hash - - selftest_seq(key, outlen, outlen); // keyed hash - blake2s(md, outlen, key, outlen, in, inlen); - blake2s_update(&ctx, md, outlen); // hash the hash - } - } - - // Compute and compare the hash of hashes. - blake2s_final(&ctx, md); - for (i = 0; i < 32; i++) { - if (md[i] != blake2s_res[i]) - return -1; - } - - return 0; - - - -Saarinen & Aumasson Informational [Page 28] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - - } - - // Test driver. - - int main(int argc, char **argv) - { - printf("blake2b_selftest() = %s\n", - blake2b_selftest() ? "FAIL" : "OK"); - printf("blake2s_selftest() = %s\n", - blake2s_selftest() ? "FAIL" : "OK"); - - return 0; - } - <CODE ENDS> - -Acknowledgements - - The editor wishes to thank the [BLAKE2] team for their encouragement: - Jean-Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and - Christian Winnerlein. We have borrowed passages from [BLAKE] and - [BLAKE2] with permission. - - [BLAKE2] is based on the SHA-3 proposal [BLAKE], designed by Jean- - Philippe Aumasson, Luca Henzen, Willi Meier, and Raphael C.-W. Phan. - BLAKE2, like BLAKE, relies on a core algorithm borrowed from the - ChaCha stream cipher, designed by Daniel J. Bernstein. - - - - - - - - - - - - - - - - - - - - - - - - - -Saarinen & Aumasson Informational [Page 29] - -RFC 7693 BLAKE2 Crypto Hash and MAC November 2015 - - -Authors' Addresses - - Markku-Juhani O. Saarinen (editor) - Queen's University Belfast - Centre for Secure Information Technologies, ECIT - Northern Ireland Science Park - Queen's Road, Queen's Island - Belfast BT3 9DT - United Kingdom - - Email: m.saarinen@qub.ac.uk - URI: http://www.csit.qub.ac.uk - - - Jean-Philippe Aumasson - Kudelski Security - 22-24, Route de Geneve - Case Postale 134 - Cheseaux 1033 - Switzerland - - Email: jean-philippe.aumasson@nagra.com - URI: https://www.kudelskisecurity.com - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Saarinen & Aumasson Informational [Page 30] - diff --git a/com/BLAKE2/test/blake2s_kat.c b/com/BLAKE2/test/blake2s_kat.c deleted file mode 100644 index 0581c18..0000000 --- a/com/BLAKE2/test/blake2s_kat.c +++ /dev/null @@ -1,31 +0,0 @@ -#include <assert.h> -#include <blake2s.h> -#include <stdio.h> -#include <string.h> - -#include "blake2s_kat.h" - -int -main(void) -{ - uint8_t in[256]; - for (int i = 0; i < 256; ++i) in[i] = i; - uint8_t out[32]; - - for (unsigned i = 0; i < KATs_len; ++i) { - assert(BLAKE2s(out, 32, NULL, 0, in, i) == 0); - assert(memcmp(out, KATs[i], 32) == 0); - } - - for (unsigned i = 0; i < 1; ++i) { - _Static_assert(sizeof(KAT_secret) == 32, "sizeof KAT_secret"); - assert(BLAKE2s(out, 32, KAT_secret, 32, in, i) == 0); - - for (unsigned j = 0; j < 32; ++j) printf("%02x ", out[j]); - printf("\n"); - for (unsigned j = 0; j < 32; ++j) printf("%02x ", secret_KATs[i][j]); - printf("\n"); - - assert(memcmp(out, secret_KATs[i], 32) == 0); - } -} diff --git a/com/BLAKE2/test/blake2s_kat.py b/com/BLAKE2/test/blake2s_kat.py deleted file mode 100755 index 2dd5370..0000000 --- a/com/BLAKE2/test/blake2s_kat.py +++ /dev/null @@ -1,40 +0,0 @@ -#!/usr/bin/env python3 -# Known Answer Test generator - -import json -import hashlib -import secrets - -def blake2s(w, key): - ctx = hashlib.blake2s(key=key) - ctx.update(w) - return ctx.digest().hex() - -def out(s): - o = [s[i:i+2] for i in range(0, len(s), 2)] # split into pairs - o = [f'0x{i}' for i in o] # prepend 0x and join - return ', '.join(o) - -if __name__ == '__main__': - w = b'' - for i in range(0, 256): - w += i.to_bytes(1, 'little') - k = secrets.token_bytes(32) - - print('#pragma once\n') - print(f'static const unsigned KATs_len = 256;') - print(f'static const uint8_t KAT_secret[32] = {{ {", ".join([hex(i) for i in k])} }};') - - print(f'static const uint8_t KATs[256][32] = {{') - for i in range(0, 256): - o = blake2s(w[0:i], b'') - print(f' // {i}') - print(f' {{ {out(o)} }},') - print(f'}};') - - print(f'static const uint8_t secret_KATs[256][32] = {{') - for i in range(0, 256): - o = blake2s(w[0:i], k) - print(f' // {i}') - print(f' {{ {out(o)} }},') - print(f'}};') diff --git a/com/BLAKE2/test/blake2s_selftest.c b/com/BLAKE2/test/blake2s_selftest.c deleted file mode 100644 index 3ada150..0000000 --- a/com/BLAKE2/test/blake2s_selftest.c +++ /dev/null @@ -1,102 +0,0 @@ -// test_main.c -// Self test Modules for BLAKE2b and BLAKE2s -- and a stub main(). - -#include "blake2s.h" -#include <assert.h> -#include <stdio.h> - -_Static_assert(sizeof(struct BLAKE2s_param) == (8 * sizeof(uint32_t)), "sizeof struct BLAKE2s_param"); - -// Deterministic sequences (Fibonacci generator). -static void -selftest_seq(uint8_t *out, size_t len, uint32_t seed) -{ - size_t i; - uint32_t t, a, b; - - a = 0xDEAD4BAD * seed; // prime - b = 1; - - for (i = 0; i < len; i++) { // fill the buf - t = a + b; - a = b; - b = t; - out[i] = (t >> 24) & 0xFF; - } -} - -// BLAKE2s self-test validation. Return 0 when OK. -int -blake2s_selftest() -{ - // Grand hash of hash results. - const uint8_t blake2s_res[32] = {0x6A, 0x41, 0x1F, 0x08, 0xCE, 0x25, 0xAD, 0xCD, 0xFB, 0x02, 0xAB, - 0xA6, 0x41, 0x45, 0x1C, 0xEC, 0x53, 0xC5, 0x98, 0xB2, 0x4F, 0x4F, - 0xC7, 0x87, 0xFB, 0xDC, 0x88, 0x79, 0x7F, 0x4C, 0x1D, 0xFE}; - // Parameter sets. - const size_t b2s_md_len[4] = {16, 20, 28, 32}; - const size_t b2s_in_len[6] = {0, 3, 64, 65, 255, 1024}; - - size_t i, j, outlen, inlen; - uint8_t in[1024], md[32], key[32]; - struct BLAKE2s_ctx ctx; - - // 256-bit hash for testing. - if (BLAKE2s_init(&ctx, 32, NULL, 0)) return -1; - - for (i = 0; i < 4; i++) { - outlen = b2s_md_len[i]; - for (j = 0; j < 6; j++) { - inlen = b2s_in_len[j]; - - selftest_seq(in, inlen, inlen); // unkeyed hash - BLAKE2s(md, outlen, NULL, 0, in, inlen); - BLAKE2s_update(&ctx, md, outlen); // hash the hash - - selftest_seq(key, outlen, outlen); // keyed hash - BLAKE2s(md, outlen, key, outlen, in, inlen); - BLAKE2s_update(&ctx, md, outlen); // hash the hash - } - } - - // Compute and compare the hash of hashes. - BLAKE2s_final(&ctx, md); - for (i = 0; i < 32; i++) { - if (md[i] != blake2s_res[i]) return -1; - } - - return 0; -} - -int -main(void) -{ - // functions - assert(rotr_u32(0xdecafade, 16) == 0xfadedeca); - assert(rotr_u32(0xdecafade, 8) == 0xdedecafa); - - const int good = blake2s_selftest(); - printf("blake2s_selftest() = %s\n", good ? "FAIL" : "OK"); - - char *in = "abc"; - size_t inlen = 3; - - uint8_t out[32]; - BLAKE2s(out, 32, NULL, 0, in, inlen); - - const uint8_t blake2s_res[32] = {0x50, 0x8C, 0x5E, 0x8C, 0x32, 0x7C, 0x14, 0xE2, 0xE1, 0xA7, 0x2B, - 0xA3, 0x4E, 0xEB, 0x45, 0x2F, 0x37, 0x45, 0x8B, 0x20, 0x9E, 0xD6, - 0x3A, 0x29, 0x4D, 0x99, 0x9B, 0x4C, 0x86, 0x67, 0x59, 0x82}; - - for (unsigned i = 0; i < 32; i++) { - if (out[i] != blake2s_res[i]) { - printf("digest failed"); - printf("\nout: "); - for (unsigned n = 0; n < 32; ++n) printf(" %02x", out[n]); - printf("\nres: "); - for (unsigned n = 0; n < 32; ++n) printf(" %02x", blake2s_res[n]); - return -1; - } - } - return good; -} |