1 /******************************************************************************
2 * Filename: sw_poly1305-donna.c
3 * Revised: 2016-10-05 12:42:03 +0200 (Wed, 05 Oct 2016)
4 * Revision: 47308
5 ******************************************************************************/
6
7 #include "sw_poly1305-donna.h"
8
9 #include "sw_poly1305-donna-32.h"
10
11 void
poly1305_update(poly1305_context * ctx,const unsigned char * m,size_t bytes)12 poly1305_update(poly1305_context *ctx, const unsigned char *m, size_t bytes) {
13 poly1305_state_internal_t *st = (poly1305_state_internal_t *)ctx;
14 size_t i;
15
16 /* handle leftover */
17 if (st->leftover) {
18 size_t want = (poly1305_block_size - st->leftover);
19 if (want > bytes)
20 want = bytes;
21 for (i = 0; i < want; i++)
22 st->buffer[st->leftover + i] = m[i];
23 bytes -= want;
24 m += want;
25 st->leftover += want;
26 if (st->leftover < poly1305_block_size)
27 return;
28 poly1305_blocks(st, st->buffer, poly1305_block_size);
29 st->leftover = 0;
30 }
31
32 /* process full blocks */
33 if (bytes >= poly1305_block_size) {
34 size_t want = (bytes & ~(poly1305_block_size - 1));
35 poly1305_blocks(st, m, want);
36 m += want;
37 bytes -= want;
38 }
39
40 /* store leftover */
41 if (bytes) {
42 for (i = 0; i < bytes; i++)
43 st->buffer[st->leftover + i] = m[i];
44 st->leftover += bytes;
45 }
46 }
47
48 void
poly1305_auth(unsigned char mac[16],const unsigned char * m,size_t bytes,const unsigned char key[32])49 poly1305_auth(unsigned char mac[16], const unsigned char *m, size_t bytes, const unsigned char key[32]) {
50 poly1305_context ctx;
51 poly1305_init(&ctx, key);
52 poly1305_update(&ctx, m, bytes);
53 poly1305_finish(&ctx, mac);
54 }
55
56 int
poly1305_verify(const unsigned char mac1[16],const unsigned char mac2[16])57 poly1305_verify(const unsigned char mac1[16], const unsigned char mac2[16]) {
58 size_t i;
59 unsigned int dif = 0;
60 for (i = 0; i < 16; i++)
61 dif |= (mac1[i] ^ mac2[i]);
62 dif = (dif - 1) >> ((sizeof(unsigned int) * 8) - 1);
63 return (dif & 1);
64 }
65
66
67 /* test a few basic operations */
68 int
poly1305_power_on_self_test(void)69 poly1305_power_on_self_test(void) {
70 /* example from nacl */
71 static const unsigned char nacl_key[32] = {
72 0xee,0xa6,0xa7,0x25,0x1c,0x1e,0x72,0x91,
73 0x6d,0x11,0xc2,0xcb,0x21,0x4d,0x3c,0x25,
74 0x25,0x39,0x12,0x1d,0x8e,0x23,0x4e,0x65,
75 0x2d,0x65,0x1f,0xa4,0xc8,0xcf,0xf8,0x80
76 };
77
78 static const unsigned char nacl_msg[131] = {
79 0x8e,0x99,0x3b,0x9f,0x48,0x68,0x12,0x73,
80 0xc2,0x96,0x50,0xba,0x32,0xfc,0x76,0xce,
81 0x48,0x33,0x2e,0xa7,0x16,0x4d,0x96,0xa4,
82 0x47,0x6f,0xb8,0xc5,0x31,0xa1,0x18,0x6a,
83 0xc0,0xdf,0xc1,0x7c,0x98,0xdc,0xe8,0x7b,
84 0x4d,0xa7,0xf0,0x11,0xec,0x48,0xc9,0x72,
85 0x71,0xd2,0xc2,0x0f,0x9b,0x92,0x8f,0xe2,
86 0x27,0x0d,0x6f,0xb8,0x63,0xd5,0x17,0x38,
87 0xb4,0x8e,0xee,0xe3,0x14,0xa7,0xcc,0x8a,
88 0xb9,0x32,0x16,0x45,0x48,0xe5,0x26,0xae,
89 0x90,0x22,0x43,0x68,0x51,0x7a,0xcf,0xea,
90 0xbd,0x6b,0xb3,0x73,0x2b,0xc0,0xe9,0xda,
91 0x99,0x83,0x2b,0x61,0xca,0x01,0xb6,0xde,
92 0x56,0x24,0x4a,0x9e,0x88,0xd5,0xf9,0xb3,
93 0x79,0x73,0xf6,0x22,0xa4,0x3d,0x14,0xa6,
94 0x59,0x9b,0x1f,0x65,0x4c,0xb4,0x5a,0x74,
95 0xe3,0x55,0xa5
96 };
97
98 static const unsigned char nacl_mac[16] = {
99 0xf3,0xff,0xc7,0x70,0x3f,0x94,0x00,0xe5,
100 0x2a,0x7d,0xfb,0x4b,0x3d,0x33,0x05,0xd9
101 };
102
103 /* generates a final value of (2^130 - 2) == 3 */
104 static const unsigned char wrap_key[32] = {
105 0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
106 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
107 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
108 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
109 };
110
111 static const unsigned char wrap_msg[16] = {
112 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
113 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
114 };
115
116 static const unsigned char wrap_mac[16] = {
117 0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
118 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
119 };
120
121 /*
122 mac of the macs of messages of length 0 to 256, where the key and messages
123 have all their values set to the length
124 */
125 static const unsigned char total_key[32] = {
126 0x01,0x02,0x03,0x04,0x05,0x06,0x07,
127 0xff,0xfe,0xfd,0xfc,0xfb,0xfa,0xf9,
128 0xff,0xff,0xff,0xff,0xff,0xff,0xff,
129 0xff,0xff,0xff,0xff,0xff,0xff,0xff
130 };
131
132 static const unsigned char total_mac[16] = {
133 0x64,0xaf,0xe2,0xe8,0xd6,0xad,0x7b,0xbd,
134 0xd2,0x87,0xf9,0x7c,0x44,0x62,0x3d,0x39
135 };
136
137 poly1305_context ctx;
138 poly1305_context total_ctx;
139 unsigned char all_key[32];
140 unsigned char all_msg[256];
141 unsigned char mac[16];
142 size_t i, j;
143 int result = 1;
144
145 for (i = 0; i < sizeof(mac); i++)
146 mac[i] = 0;
147 poly1305_auth(mac, nacl_msg, sizeof(nacl_msg), nacl_key);
148 result &= poly1305_verify(nacl_mac, mac);
149
150 for (i = 0; i < sizeof(mac); i++)
151 mac[i] = 0;
152 poly1305_init(&ctx, nacl_key);
153 poly1305_update(&ctx, nacl_msg + 0, 32);
154 poly1305_update(&ctx, nacl_msg + 32, 64);
155 poly1305_update(&ctx, nacl_msg + 96, 16);
156 poly1305_update(&ctx, nacl_msg + 112, 8);
157 poly1305_update(&ctx, nacl_msg + 120, 4);
158 poly1305_update(&ctx, nacl_msg + 124, 2);
159 poly1305_update(&ctx, nacl_msg + 126, 1);
160 poly1305_update(&ctx, nacl_msg + 127, 1);
161 poly1305_update(&ctx, nacl_msg + 128, 1);
162 poly1305_update(&ctx, nacl_msg + 129, 1);
163 poly1305_update(&ctx, nacl_msg + 130, 1);
164 poly1305_finish(&ctx, mac);
165 result &= poly1305_verify(nacl_mac, mac);
166
167 for (i = 0; i < sizeof(mac); i++)
168 mac[i] = 0;
169 poly1305_auth(mac, wrap_msg, sizeof(wrap_msg), wrap_key);
170 result &= poly1305_verify(wrap_mac, mac);
171
172 poly1305_init(&total_ctx, total_key);
173 for (i = 0; i < 256; i++) {
174 /* set key and message to 'i,i,i..' */
175 for (j = 0; j < sizeof(all_key); j++)
176 all_key[j] = i;
177 for (j = 0; j < i; j++)
178 all_msg[j] = i;
179 poly1305_auth(mac, all_msg, i, all_key);
180 poly1305_update(&total_ctx, mac, 16);
181 }
182 poly1305_finish(&total_ctx, mac);
183 result &= poly1305_verify(total_mac, mac);
184
185 return result;
186 }
187
