sum_ref.go 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141
  1. // Copyright 2012 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. // +build !amd64,!arm gccgo appengine nacl
  5. package poly1305
  6. import "encoding/binary"
  7. // Sum generates an authenticator for msg using a one-time key and puts the
  8. // 16-byte result into out. Authenticating two different messages with the same
  9. // key allows an attacker to forge messages at will.
  10. func Sum(out *[TagSize]byte, msg []byte, key *[32]byte) {
  11. var (
  12. h0, h1, h2, h3, h4 uint32 // the hash accumulators
  13. r0, r1, r2, r3, r4 uint64 // the r part of the key
  14. )
  15. r0 = uint64(binary.LittleEndian.Uint32(key[0:]) & 0x3ffffff)
  16. r1 = uint64((binary.LittleEndian.Uint32(key[3:]) >> 2) & 0x3ffff03)
  17. r2 = uint64((binary.LittleEndian.Uint32(key[6:]) >> 4) & 0x3ffc0ff)
  18. r3 = uint64((binary.LittleEndian.Uint32(key[9:]) >> 6) & 0x3f03fff)
  19. r4 = uint64((binary.LittleEndian.Uint32(key[12:]) >> 8) & 0x00fffff)
  20. R1, R2, R3, R4 := r1*5, r2*5, r3*5, r4*5
  21. for len(msg) >= TagSize {
  22. // h += msg
  23. h0 += binary.LittleEndian.Uint32(msg[0:]) & 0x3ffffff
  24. h1 += (binary.LittleEndian.Uint32(msg[3:]) >> 2) & 0x3ffffff
  25. h2 += (binary.LittleEndian.Uint32(msg[6:]) >> 4) & 0x3ffffff
  26. h3 += (binary.LittleEndian.Uint32(msg[9:]) >> 6) & 0x3ffffff
  27. h4 += (binary.LittleEndian.Uint32(msg[12:]) >> 8) | (1 << 24)
  28. // h *= r
  29. d0 := (uint64(h0) * r0) + (uint64(h1) * R4) + (uint64(h2) * R3) + (uint64(h3) * R2) + (uint64(h4) * R1)
  30. d1 := (d0 >> 26) + (uint64(h0) * r1) + (uint64(h1) * r0) + (uint64(h2) * R4) + (uint64(h3) * R3) + (uint64(h4) * R2)
  31. d2 := (d1 >> 26) + (uint64(h0) * r2) + (uint64(h1) * r1) + (uint64(h2) * r0) + (uint64(h3) * R4) + (uint64(h4) * R3)
  32. d3 := (d2 >> 26) + (uint64(h0) * r3) + (uint64(h1) * r2) + (uint64(h2) * r1) + (uint64(h3) * r0) + (uint64(h4) * R4)
  33. d4 := (d3 >> 26) + (uint64(h0) * r4) + (uint64(h1) * r3) + (uint64(h2) * r2) + (uint64(h3) * r1) + (uint64(h4) * r0)
  34. // h %= p
  35. h0 = uint32(d0) & 0x3ffffff
  36. h1 = uint32(d1) & 0x3ffffff
  37. h2 = uint32(d2) & 0x3ffffff
  38. h3 = uint32(d3) & 0x3ffffff
  39. h4 = uint32(d4) & 0x3ffffff
  40. h0 += uint32(d4>>26) * 5
  41. h1 += h0 >> 26
  42. h0 = h0 & 0x3ffffff
  43. msg = msg[TagSize:]
  44. }
  45. if len(msg) > 0 {
  46. var block [TagSize]byte
  47. off := copy(block[:], msg)
  48. block[off] = 0x01
  49. // h += msg
  50. h0 += binary.LittleEndian.Uint32(block[0:]) & 0x3ffffff
  51. h1 += (binary.LittleEndian.Uint32(block[3:]) >> 2) & 0x3ffffff
  52. h2 += (binary.LittleEndian.Uint32(block[6:]) >> 4) & 0x3ffffff
  53. h3 += (binary.LittleEndian.Uint32(block[9:]) >> 6) & 0x3ffffff
  54. h4 += (binary.LittleEndian.Uint32(block[12:]) >> 8)
  55. // h *= r
  56. d0 := (uint64(h0) * r0) + (uint64(h1) * R4) + (uint64(h2) * R3) + (uint64(h3) * R2) + (uint64(h4) * R1)
  57. d1 := (d0 >> 26) + (uint64(h0) * r1) + (uint64(h1) * r0) + (uint64(h2) * R4) + (uint64(h3) * R3) + (uint64(h4) * R2)
  58. d2 := (d1 >> 26) + (uint64(h0) * r2) + (uint64(h1) * r1) + (uint64(h2) * r0) + (uint64(h3) * R4) + (uint64(h4) * R3)
  59. d3 := (d2 >> 26) + (uint64(h0) * r3) + (uint64(h1) * r2) + (uint64(h2) * r1) + (uint64(h3) * r0) + (uint64(h4) * R4)
  60. d4 := (d3 >> 26) + (uint64(h0) * r4) + (uint64(h1) * r3) + (uint64(h2) * r2) + (uint64(h3) * r1) + (uint64(h4) * r0)
  61. // h %= p
  62. h0 = uint32(d0) & 0x3ffffff
  63. h1 = uint32(d1) & 0x3ffffff
  64. h2 = uint32(d2) & 0x3ffffff
  65. h3 = uint32(d3) & 0x3ffffff
  66. h4 = uint32(d4) & 0x3ffffff
  67. h0 += uint32(d4>>26) * 5
  68. h1 += h0 >> 26
  69. h0 = h0 & 0x3ffffff
  70. }
  71. // h %= p reduction
  72. h2 += h1 >> 26
  73. h1 &= 0x3ffffff
  74. h3 += h2 >> 26
  75. h2 &= 0x3ffffff
  76. h4 += h3 >> 26
  77. h3 &= 0x3ffffff
  78. h0 += 5 * (h4 >> 26)
  79. h4 &= 0x3ffffff
  80. h1 += h0 >> 26
  81. h0 &= 0x3ffffff
  82. // h - p
  83. t0 := h0 + 5
  84. t1 := h1 + (t0 >> 26)
  85. t2 := h2 + (t1 >> 26)
  86. t3 := h3 + (t2 >> 26)
  87. t4 := h4 + (t3 >> 26) - (1 << 26)
  88. t0 &= 0x3ffffff
  89. t1 &= 0x3ffffff
  90. t2 &= 0x3ffffff
  91. t3 &= 0x3ffffff
  92. // select h if h < p else h - p
  93. t_mask := (t4 >> 31) - 1
  94. h_mask := ^t_mask
  95. h0 = (h0 & h_mask) | (t0 & t_mask)
  96. h1 = (h1 & h_mask) | (t1 & t_mask)
  97. h2 = (h2 & h_mask) | (t2 & t_mask)
  98. h3 = (h3 & h_mask) | (t3 & t_mask)
  99. h4 = (h4 & h_mask) | (t4 & t_mask)
  100. // h %= 2^128
  101. h0 |= h1 << 26
  102. h1 = ((h1 >> 6) | (h2 << 20))
  103. h2 = ((h2 >> 12) | (h3 << 14))
  104. h3 = ((h3 >> 18) | (h4 << 8))
  105. // s: the s part of the key
  106. // tag = (h + s) % (2^128)
  107. t := uint64(h0) + uint64(binary.LittleEndian.Uint32(key[16:]))
  108. h0 = uint32(t)
  109. t = uint64(h1) + uint64(binary.LittleEndian.Uint32(key[20:])) + (t >> 32)
  110. h1 = uint32(t)
  111. t = uint64(h2) + uint64(binary.LittleEndian.Uint32(key[24:])) + (t >> 32)
  112. h2 = uint32(t)
  113. t = uint64(h3) + uint64(binary.LittleEndian.Uint32(key[28:])) + (t >> 32)
  114. h3 = uint32(t)
  115. binary.LittleEndian.PutUint32(out[0:], h0)
  116. binary.LittleEndian.PutUint32(out[4:], h1)
  117. binary.LittleEndian.PutUint32(out[8:], h2)
  118. binary.LittleEndian.PutUint32(out[12:], h3)
  119. }