QPQ-AG/libsodium
12
0
Fork 0
mirror of https://github.com/jedisct1/libsodium.git synced 2026-08-25 08:37:13 +09:00
Code Issues Packages Projects Releases Wiki Activity

Indent

Browse Source
This commit is contained in:
Frank Denis
2017-02-23 10:09:08 +01:00
parent 2a24a27afa
commit 6980d47ec2
8 changed files with 335 additions and 305 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsodium/crypto_pwhash/scryptsalsa208sha256/crypto_scrypt-common.c
+36 -36
View File
@@ -26,11 +26,11 @@
#include "runtime.h"
#include "utils.h"
static const char * const itoa64 =
static const char *const itoa64 =
"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
static uint8_t *
encode64_uint32(uint8_t * dst, size_t dstlen, uint32_t src, uint32_t srcbits)
encode64_uint32(uint8_t *dst, size_t dstlen, uint32_t src, uint32_t srcbits)
{
uint32_t bit;
@@ -42,22 +42,23 @@ encode64_uint32(uint8_t * dst, size_t dstlen, uint32_t src, uint32_t srcbits)
dstlen--;
src >>= 6;
}
return dst;
}
static uint8_t *
encode64(uint8_t * dst, size_t dstlen, const uint8_t * src, size_t srclen)
encode64(uint8_t *dst, size_t dstlen, const uint8_t *src, size_t srclen)
{
size_t i;
for (i = 0; i < srclen; ) {
uint8_t * dnext;
for (i = 0; i < srclen;) {
uint8_t *dnext;
uint32_t value = 0, bits = 0;
do {
value |= (uint32_t)src[i++] << bits;
value |= (uint32_t) src[i++] << bits;
bits += 8;
} while (bits < 24 && i < srclen);
dnext = encode64_uint32(dst, dstlen, value, bits);
if (!dnext) {
return NULL; /* LCOV_EXCL_LINE */
@@ -65,25 +66,25 @@ encode64(uint8_t * dst, size_t dstlen, const uint8_t * src, size_t srclen)
dstlen -= dnext - dst;
dst = dnext;
}
return dst;
}
static int
decode64_one(uint32_t * dst, uint8_t src)
decode64_one(uint32_t *dst, uint8_t src)
{
const char *ptr = strchr(itoa64, src);
if (ptr) {
*dst = (uint32_t) (ptr - itoa64);
*dst = (uint32_t)(ptr - itoa64);
return 0;
}
*dst = 0;
return -1;
}
static const uint8_t *
decode64_uint32(uint32_t * dst, uint32_t dstbits, const uint8_t * src)
decode64_uint32(uint32_t *dst, uint32_t dstbits, const uint8_t *src)
{
uint32_t bit;
uint32_t value;
@@ -98,20 +99,20 @@ decode64_uint32(uint32_t * dst, uint32_t dstbits, const uint8_t * src)
src++;
value |= one << bit;
}
*dst = value;
return src;
}
uint8_t *
escrypt_r(escrypt_local_t * local, const uint8_t * passwd, size_t passwdlen,
const uint8_t * setting, uint8_t * buf, size_t buflen)
escrypt_r(escrypt_local_t *local, const uint8_t *passwd, size_t passwdlen,
const uint8_t *setting, uint8_t *buf, size_t buflen)
{
uint8_t hash[crypto_pwhash_scryptsalsa208sha256_STRHASHBYTES];
escrypt_kdf_t escrypt_kdf;
const uint8_t *src;
const uint8_t *salt;
uint8_t *dst;
uint8_t * dst;
size_t prefixlen;
size_t saltlen;
size_t need;
@@ -142,29 +143,29 @@ escrypt_r(escrypt_local_t * local, const uint8_t * passwd, size_t passwdlen,
prefixlen = src - setting;
salt = src;
src = (uint8_t *) strrchr((char *)salt, '$');
src = (uint8_t *) strrchr((char *) salt, '$');
if (src) {
saltlen = src - salt;
} else {
saltlen = strlen((char *)salt);
saltlen = strlen((char *) salt);
}
need = prefixlen + saltlen + 1 +
crypto_pwhash_scryptsalsa208sha256_STRHASHBYTES_ENCODED + 1;
crypto_pwhash_scryptsalsa208sha256_STRHASHBYTES_ENCODED + 1;
if (need > buflen || need < saltlen) {
return NULL;
}
#if defined(HAVE_EMMINTRIN_H) || \
(defined(_MSC_VER) && (defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86)))
(defined(_MSC_VER) && \
(defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86)))
escrypt_kdf =
sodium_runtime_has_sse2() ? escrypt_kdf_sse : escrypt_kdf_nosse;
#else
escrypt_kdf = escrypt_kdf_nosse;
#endif
if (escrypt_kdf(local, passwd, passwdlen, salt, saltlen,
N, r, p, hash, sizeof(hash))) {
if (escrypt_kdf(local, passwd, passwdlen, salt, saltlen, N, r, p, hash,
sizeof(hash))) {
return NULL;
}
dst = buf;
memcpy(dst, setting, prefixlen + saltlen);
dst += prefixlen + saltlen;
@@ -181,24 +182,23 @@ escrypt_r(escrypt_local_t * local, const uint8_t * passwd, size_t passwdlen,
}
uint8_t *
escrypt_gensalt_r(uint32_t N_log2, uint32_t r, uint32_t p,
const uint8_t * src, size_t srclen,
uint8_t * buf, size_t buflen)
escrypt_gensalt_r(uint32_t N_log2, uint32_t r, uint32_t p, const uint8_t *src,
size_t srclen, uint8_t *buf, size_t buflen)
{
uint8_t *dst;
size_t prefixlen =
(sizeof "$7$" - 1U) + (1U /* N_log2 */) + (5U /* r */) + (5U /* p */);
size_t saltlen = BYTES2CHARS(srclen);
size_t need;
size_t saltlen = BYTES2CHARS(srclen);
size_t need;
need = prefixlen + saltlen + 1;
if (need > buflen || need < saltlen || saltlen < srclen) {
return NULL; /* LCOV_EXCL_LINE */
}
if (N_log2 > 63 || ((uint64_t)r * (uint64_t)p >= (1U << 30))) {
if (N_log2 > 63 || ((uint64_t) r * (uint64_t) p >= (1U << 30))) {
return NULL;
}
dst = buf;
dst = buf;
*dst++ = '$';
*dst++ = '7';
*dst++ = '$';
@@ -223,10 +223,10 @@ escrypt_gensalt_r(uint32_t N_log2, uint32_t r, uint32_t p,
}
int
crypto_pwhash_scryptsalsa208sha256_ll(const uint8_t * passwd, size_t passwdlen,
const uint8_t * salt, size_t saltlen,
crypto_pwhash_scryptsalsa208sha256_ll(const uint8_t *passwd, size_t passwdlen,
const uint8_t *salt, size_t saltlen,
uint64_t N, uint32_t r, uint32_t p,
uint8_t * buf, size_t buflen)
uint8_t *buf, size_t buflen)
{
escrypt_kdf_t escrypt_kdf;
escrypt_local_t local;
@@ -236,15 +236,15 @@ crypto_pwhash_scryptsalsa208sha256_ll(const uint8_t * passwd, size_t passwdlen,
return -1; /* LCOV_EXCL_LINE */
}
#if defined(HAVE_EMMINTRIN_H) || \
(defined(_MSC_VER) && (defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86)))
(defined(_MSC_VER) && \
(defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86)))
escrypt_kdf =
sodium_runtime_has_sse2() ? escrypt_kdf_sse : escrypt_kdf_nosse;
#else
escrypt_kdf = escrypt_kdf_nosse;
#endif
retval = escrypt_kdf(&local,
passwd, passwdlen, salt, saltlen,
N, r, p, buf, buflen);
retval = escrypt_kdf(&local, passwd, passwdlen, salt, saltlen, N, r, p, buf,
buflen);
if (escrypt_free_local(&local)) {
return -1; /* LCOV_EXCL_LINE */
}
src/libsodium/crypto_pwhash/scryptsalsa208sha256/crypto_scrypt.h
+27 -32
View File
@@ -31,13 +31,13 @@
#define crypto_scrypt_H
#include <limits.h>
#include <stdint.h>
#include <stddef.h>
#include <stdint.h>
#if SIZE_MAX > 0xffffffffULL
# define ARCH_BITS 64
#define ARCH_BITS 64
#else
# define ARCH_BITS 32
#define ARCH_BITS 32
#endif
#define crypto_pwhash_scryptsalsa208sha256_STRPREFIXBYTES 14
@@ -47,10 +47,10 @@
#define crypto_pwhash_scryptsalsa208sha256_STRHASHBYTES 32
#define crypto_pwhash_scryptsalsa208sha256_STRHASHBYTES_ENCODED 43
#define BYTES2CHARS(bytes) ((((bytes) * 8) + 5) / 6)
#define BYTES2CHARS(bytes) ((((bytes) *8) + 5) / 6)
typedef struct {
void * base, * aligned;
void * base, *aligned;
size_t size;
} escrypt_region_t;
@@ -61,39 +61,34 @@ typedef union {
typedef escrypt_region_t escrypt_local_t;
extern int escrypt_init_local(escrypt_local_t * __local);
extern int escrypt_init_local(escrypt_local_t *__local);
extern int escrypt_free_local(escrypt_local_t * __local);
extern int escrypt_free_local(escrypt_local_t *__local);
extern void *alloc_region(escrypt_region_t * region, size_t size);
extern int free_region(escrypt_region_t * region);
extern void *alloc_region(escrypt_region_t *region, size_t size);
extern int free_region(escrypt_region_t *region);
typedef int (*escrypt_kdf_t)(escrypt_local_t * __local,
const uint8_t * __passwd, size_t __passwdlen,
const uint8_t * __salt, size_t __saltlen,
uint64_t __N, uint32_t __r, uint32_t __p,
uint8_t * __buf, size_t __buflen);
typedef int (*escrypt_kdf_t)(escrypt_local_t *__local, const uint8_t *__passwd,
size_t __passwdlen, const uint8_t *__salt,
size_t __saltlen, uint64_t __N, uint32_t __r,
uint32_t __p, uint8_t *__buf, size_t __buflen);
extern int escrypt_kdf_nosse(escrypt_local_t * __local,
const uint8_t * __passwd, size_t __passwdlen,
const uint8_t * __salt, size_t __saltlen,
uint64_t __N, uint32_t __r, uint32_t __p,
uint8_t * __buf, size_t __buflen);
extern int escrypt_kdf_nosse(escrypt_local_t *__local, const uint8_t *__passwd,
size_t __passwdlen, const uint8_t *__salt,
size_t __saltlen, uint64_t __N, uint32_t __r,
uint32_t __p, uint8_t *__buf, size_t __buflen);
extern int escrypt_kdf_sse(escrypt_local_t * __local,
const uint8_t * __passwd, size_t __passwdlen,
const uint8_t * __salt, size_t __saltlen,
uint64_t __N, uint32_t __r, uint32_t __p,
uint8_t * __buf, size_t __buflen);
extern int escrypt_kdf_sse(escrypt_local_t *__local, const uint8_t *__passwd,
size_t __passwdlen, const uint8_t *__salt,
size_t __saltlen, uint64_t __N, uint32_t __r,
uint32_t __p, uint8_t *__buf, size_t __buflen);
extern uint8_t * escrypt_r(escrypt_local_t * __local,
const uint8_t * __passwd, size_t __passwdlen,
const uint8_t * __setting,
uint8_t * __buf, size_t __buflen);
extern uint8_t *escrypt_r(escrypt_local_t *__local, const uint8_t *__passwd,
size_t __passwdlen, const uint8_t *__setting,
uint8_t *__buf, size_t __buflen);
extern uint8_t * escrypt_gensalt_r(
uint32_t __N_log2, uint32_t __r, uint32_t __p,
const uint8_t * __src, size_t __srclen,
uint8_t * __buf, size_t __buflen);
extern uint8_t *escrypt_gensalt_r(uint32_t __N_log2, uint32_t __r, uint32_t __p,
const uint8_t *__src, size_t __srclen,
uint8_t *__buf, size_t __buflen);
#endif /* !_CRYPTO_SCRYPT_H_ */
src/libsodium/crypto_pwhash/scryptsalsa208sha256/nosse/pwhash_scryptsalsa208sha256_nosse.c
+113 -79
View File
@@ -34,8 +34,8 @@
#include <stdlib.h>
#include <string.h>
#include "../pbkdf2-sha256.h"
#include "../crypto_scrypt.h"
#include "../pbkdf2-sha256.h"
#include "private/common.h"
static inline void
@@ -43,12 +43,14 @@ blkcpy_64(escrypt_block_t *dest, const escrypt_block_t *src)
{
int i;
#if (ARCH_BITS==32)
for (i = 0; i < 16; ++i)
#if (ARCH_BITS == 32)
for (i = 0; i < 16; ++i) {
dest->w[i] = src->w[i];
}
#else
for (i = 0; i < 8; ++i)
for (i = 0; i < 8; ++i) {
dest->d[i] = src->d[i];
}
#endif
}
@@ -57,12 +59,14 @@ blkxor_64(escrypt_block_t *dest, const escrypt_block_t *src)
{
int i;
#if (ARCH_BITS==32)
for (i = 0; i < 16; ++i)
#if (ARCH_BITS == 32)
for (i = 0; i < 16; ++i) {
dest->w[i] ^= src->w[i];
}
#else
for (i = 0; i < 8; ++i)
for (i = 0; i < 8; ++i) {
dest->d[i] ^= src->d[i];
}
#endif
}
@@ -70,14 +74,17 @@ static inline void
blkcpy(escrypt_block_t *dest, const escrypt_block_t *src, size_t len)
{
size_t i, L;
#if (ARCH_BITS==32)
L = (len>>2);
for (i = 0; i < L; ++i)
#if (ARCH_BITS == 32)
L = (len >> 2);
for (i = 0; i < L; ++i) {
dest->w[i] = src->w[i];
}
#else
L = (len>>3);
for (i = 0; i < L; ++i)
L = (len >> 3);
for (i = 0; i < L; ++i) {
dest->d[i] = src->d[i];
}
#endif
}
@@ -85,14 +92,17 @@ static inline void
blkxor(escrypt_block_t *dest, const escrypt_block_t *src, size_t len)
{
size_t i, L;
#if (ARCH_BITS==32)
L = (len>>2);
for (i = 0; i < L; ++i)
#if (ARCH_BITS == 32)
L = (len >> 2);
for (i = 0; i < L; ++i) {
dest->w[i] ^= src->w[i];
}
#else
L = (len>>3);
for (i = 0; i < L; ++i)
L = (len >> 3);
for (i = 0; i < L; ++i) {
dest->d[i] ^= src->d[i];
}
#endif
}
@@ -104,37 +114,53 @@ static void
salsa20_8(uint32_t B[16])
{
escrypt_block_t X;
uint32_t *x = X.w;
size_t i;
uint32_t * x = X.w;
size_t i;
blkcpy_64(&X, (escrypt_block_t*)B);
blkcpy_64(&X, (escrypt_block_t *) B);
for (i = 0; i < 8; i += 2) {
#define R(a,b) (((a) << (b)) | ((a) >> (32 - (b))))
#define R(a, b) (((a) << (b)) | ((a) >> (32 - (b))))
/* Operate on columns. */
x[ 4] ^= R(x[ 0]+x[12], 7); x[ 8] ^= R(x[ 4]+x[ 0], 9);
x[12] ^= R(x[ 8]+x[ 4],13); x[ 0] ^= R(x[12]+x[ 8],18);
x[4] ^= R(x[0] + x[12], 7);
x[8] ^= R(x[4] + x[0], 9);
x[12] ^= R(x[8] + x[4], 13);
x[0] ^= R(x[12] + x[8], 18);
x[ 9] ^= R(x[ 5]+x[ 1], 7); x[13] ^= R(x[ 9]+x[ 5], 9);
x[ 1] ^= R(x[13]+x[ 9],13); x[ 5] ^= R(x[ 1]+x[13],18);
x[9] ^= R(x[5] + x[1], 7);
x[13] ^= R(x[9] + x[5], 9);
x[1] ^= R(x[13] + x[9], 13);
x[5] ^= R(x[1] + x[13], 18);
x[14] ^= R(x[10]+x[ 6], 7); x[ 2] ^= R(x[14]+x[10], 9);
x[ 6] ^= R(x[ 2]+x[14],13); x[10] ^= R(x[ 6]+x[ 2],18);
x[14] ^= R(x[10] + x[6], 7);
x[2] ^= R(x[14] + x[10], 9);
x[6] ^= R(x[2] + x[14], 13);
x[10] ^= R(x[6] + x[2], 18);
x[ 3] ^= R(x[15]+x[11], 7); x[ 7] ^= R(x[ 3]+x[15], 9);
x[11] ^= R(x[ 7]+x[ 3],13); x[15] ^= R(x[11]+x[ 7],18);
x[3] ^= R(x[15] + x[11], 7);
x[7] ^= R(x[3] + x[15], 9);
x[11] ^= R(x[7] + x[3], 13);
x[15] ^= R(x[11] + x[7], 18);
/* Operate on rows. */
x[ 1] ^= R(x[ 0]+x[ 3], 7); x[ 2] ^= R(x[ 1]+x[ 0], 9);
x[ 3] ^= R(x[ 2]+x[ 1],13); x[ 0] ^= R(x[ 3]+x[ 2],18);
x[1] ^= R(x[0] + x[3], 7);
x[2] ^= R(x[1] + x[0], 9);
x[3] ^= R(x[2] + x[1], 13);
x[0] ^= R(x[3] + x[2], 18);
x[ 6] ^= R(x[ 5]+x[ 4], 7); x[ 7] ^= R(x[ 6]+x[ 5], 9);
x[ 4] ^= R(x[ 7]+x[ 6],13); x[ 5] ^= R(x[ 4]+x[ 7],18);
x[6] ^= R(x[5] + x[4], 7);
x[7] ^= R(x[6] + x[5], 9);
x[4] ^= R(x[7] + x[6], 13);
x[5] ^= R(x[4] + x[7], 18);
x[11] ^= R(x[10]+x[ 9], 7); x[ 8] ^= R(x[11]+x[10], 9);
x[ 9] ^= R(x[ 8]+x[11],13); x[10] ^= R(x[ 9]+x[ 8],18);
x[11] ^= R(x[10] + x[9], 7);
x[8] ^= R(x[11] + x[10], 9);
x[9] ^= R(x[8] + x[11], 13);
x[10] ^= R(x[9] + x[8], 18);
x[12] ^= R(x[15]+x[14], 7); x[13] ^= R(x[12]+x[15], 9);
x[14] ^= R(x[13]+x[12],13); x[15] ^= R(x[14]+x[13],18);
x[12] ^= R(x[15] + x[14], 7);
x[13] ^= R(x[12] + x[15], 9);
x[14] ^= R(x[13] + x[12], 13);
x[15] ^= R(x[14] + x[13], 18);
#undef R
}
for (i = 0; i < 16; i++)
@@ -148,30 +174,32 @@ salsa20_8(uint32_t B[16])
* temporary space X must be 64 bytes.
*/
static void
blockmix_salsa8(const uint32_t * Bin, uint32_t * Bout, uint32_t * X, size_t r)
blockmix_salsa8(const uint32_t *Bin, uint32_t *Bout, uint32_t *X, size_t r)
{
size_t i;
/* 1: X <-- B_{2r - 1} */
blkcpy_64((escrypt_block_t*)X, (escrypt_block_t*)&Bin[(2 * r - 1) * 16]);
blkcpy_64((escrypt_block_t *) X,
(escrypt_block_t *) &Bin[(2 * r - 1) * 16]);
/* 2: for i = 0 to 2r - 1 do */
for (i = 0; i < 2 * r; i += 2) {
/* 3: X <-- H(X \xor B_i) */
blkxor_64((escrypt_block_t*)X, (escrypt_block_t*)&Bin[i * 16]);
blkxor_64((escrypt_block_t *) X, (escrypt_block_t *) &Bin[i * 16]);
salsa20_8(X);
/* 4: Y_i <-- X */
/* 6: B' <-- (Y_0, Y_2 ... Y_{2r-2}, Y_1, Y_3 ... Y_{2r-1}) */
blkcpy_64((escrypt_block_t*)&Bout[i * 8], (escrypt_block_t*)X);
blkcpy_64((escrypt_block_t *) &Bout[i * 8], (escrypt_block_t *) X);
/* 3: X <-- H(X \xor B_i) */
blkxor_64((escrypt_block_t*)X, (escrypt_block_t*)&Bin[i * 16 + 16]);
blkxor_64((escrypt_block_t *) X, (escrypt_block_t *) &Bin[i * 16 + 16]);
salsa20_8(X);
/* 4: Y_i <-- X */
/* 6: B' <-- (Y_0, Y_2 ... Y_{2r-2}, Y_1, Y_3 ... Y_{2r-1}) */
blkcpy_64((escrypt_block_t*)&Bout[i * 8 + r * 16], (escrypt_block_t*)X);
blkcpy_64((escrypt_block_t *) &Bout[i * 8 + r * 16],
(escrypt_block_t *) X);
}
}
@@ -180,9 +208,9 @@ blockmix_salsa8(const uint32_t * Bin, uint32_t * Bout, uint32_t * X, size_t r)
* Return the result of parsing B_{2r-1} as a little-endian integer.
*/
static inline uint64_t
integerify(const void * B, size_t r)
integerify(const void *B, size_t r)
{
const uint32_t * X = (const uint32_t *)((uintptr_t)(B) + (2 * r - 1) * 64);
const uint32_t *X = (const uint32_t *) ((uintptr_t)(B) + (2 * r - 1) * 64);
return (((uint64_t)(X[1]) << 32) + X[0]);
}
@@ -196,29 +224,31 @@ integerify(const void * B, size_t r)
* multiple of 64 bytes.
*/
static void
smix(uint8_t * B, size_t r, uint64_t N, uint32_t * V, uint32_t * XY)
smix(uint8_t *B, size_t r, uint64_t N, uint32_t *V, uint32_t *XY)
{
uint32_t * X = XY;
uint32_t * Y = &XY[32 * r];
uint32_t * Z = &XY[64 * r];
uint64_t i;
uint64_t j;
size_t k;
uint32_t *X = XY;
uint32_t *Y = &XY[32 * r];
uint32_t *Z = &XY[64 * r];
uint64_t i;
uint64_t j;
size_t k;
/* 1: X <-- B */
for (k = 0; k < 32 * r; k++)
for (k = 0; k < 32 * r; k++) {
X[k] = LOAD32_LE(&B[4 * k]);
}
/* 2: for i = 0 to N - 1 do */
for (i = 0; i < N; i += 2) {
/* 3: V_i <-- X */
blkcpy((escrypt_block_t*)&V[i * (32 * r)], (escrypt_block_t*)X, 128 * r);
blkcpy((escrypt_block_t *) &V[i * (32 * r)], (escrypt_block_t *) X,
128 * r);
/* 4: X <-- H(X) */
blockmix_salsa8(X, Y, Z, r);
/* 3: V_i <-- X */
blkcpy((escrypt_block_t*)&V[(i + 1) * (32 * r)], (escrypt_block_t*)Y, 128 * r);
blkcpy((escrypt_block_t *) &V[(i + 1) * (32 * r)],
(escrypt_block_t *) Y, 128 * r);
/* 4: X <-- H(X) */
blockmix_salsa8(Y, X, Z, r);
@@ -230,19 +260,22 @@ smix(uint8_t * B, size_t r, uint64_t N, uint32_t * V, uint32_t * XY)
j = integerify(X, r) & (N - 1);
/* 8: X <-- H(X \xor V_j) */
blkxor((escrypt_block_t*)X, (escrypt_block_t*)&V[j * (32 * r)], 128 * r);
blkxor((escrypt_block_t *) X, (escrypt_block_t *) &V[j * (32 * r)],
128 * r);
blockmix_salsa8(X, Y, Z, r);
/* 7: j <-- Integerify(X) mod N */
j = integerify(Y, r) & (N - 1);
/* 8: X <-- H(X \xor V_j) */
blkxor((escrypt_block_t*)Y, (escrypt_block_t*)&V[j * (32 * r)], 128 * r);
blkxor((escrypt_block_t *) Y, (escrypt_block_t *) &V[j * (32 * r)],
128 * r);
blockmix_salsa8(Y, X, Z, r);
}
/* 10: B' <-- X */
for (k = 0; k < 32 * r; k++)
for (k = 0; k < 32 * r; k++) {
STORE32_LE(&B[4 * k], X[k]);
}
}
/**
@@ -256,19 +289,18 @@ smix(uint8_t * B, size_t r, uint64_t N, uint32_t * V, uint32_t * XY)
* Return 0 on success; or -1 on error.
*/
int
escrypt_kdf_nosse(escrypt_local_t * local,
const uint8_t * passwd, size_t passwdlen,
const uint8_t * salt, size_t saltlen,
uint64_t N, uint32_t _r, uint32_t _p,
uint8_t * buf, size_t buflen)
escrypt_kdf_nosse(escrypt_local_t *local, const uint8_t *passwd,
size_t passwdlen, const uint8_t *salt, size_t saltlen,
uint64_t N, uint32_t _r, uint32_t _p, uint8_t *buf,
size_t buflen)
{
size_t B_size, V_size, XY_size, need;
size_t B_size, V_size, XY_size, need;
uint8_t * B;
uint32_t * V, * XY;
size_t r = _r, p = _p;
uint32_t i;
uint32_t *V, *XY;
size_t r = _r, p = _p;
uint32_t i;
/* Sanity-check parameters. */
/* Sanity-check parameters. */
#if SIZE_MAX > UINT32_MAX
if (buflen > (((uint64_t)(1) << 32) - 1) * 32) {
errno = EFBIG;
@@ -301,28 +333,30 @@ escrypt_kdf_nosse(escrypt_local_t * local,
}
/* Allocate memory. */
B_size = (size_t)128 * r * p;
V_size = (size_t)128 * r * N;
need = B_size + V_size;
B_size = (size_t) 128 * r * p;
V_size = (size_t) 128 * r * N;
need = B_size + V_size;
if (need < V_size) {
errno = ENOMEM;
return -1;
}
XY_size = (size_t)256 * r + 64;
XY_size = (size_t) 256 * r + 64;
need += XY_size;
if (need < XY_size) {
errno = ENOMEM;
return -1;
}
if (local->size < need) {
if (free_region(local))
if (free_region(local)) {
return -1;
if (!alloc_region(local, need))
}
if (!alloc_region(local, need)) {
return -1;
}
}
B = (uint8_t *)local->aligned;
V = (uint32_t *)((uint8_t *)B + B_size);
XY = (uint32_t *)((uint8_t *)V + V_size);
B = (uint8_t *) local->aligned;
V = (uint32_t *) ((uint8_t *) B + B_size);
XY = (uint32_t *) ((uint8_t *) V + V_size);
/* 1: (B_0 ... B_{p-1}) <-- PBKDF2(P, S, 1, p * MFLen) */
PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, 1, B, B_size);
@@ -330,7 +364,7 @@ escrypt_kdf_nosse(escrypt_local_t * local,
/* 2: for i = 0 to p - 1 do */
for (i = 0; i < p; i++) {
/* 3: B_i <-- MF(B_i, N) */
smix(&B[(size_t)128 * i * r], r, N, V, XY);
smix(&B[(size_t) 128 * i * r], r, N, V, XY);
}
/* 5: DK <-- PBKDF2(P, B, 1, dkLen) */
src/libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf2-sha256.c
+10 -10
View File
@@ -32,8 +32,8 @@
#include "crypto_auth_hmacsha256.h"
#include "pbkdf2-sha256.h"
#include "utils.h"
#include "private/common.h"
#include "utils.h"
/**
* PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, c, buf, dkLen):
@@ -41,17 +41,17 @@
* write the output to buf. The value dkLen must be at most 32 * (2^32 - 1).
*/
void
PBKDF2_SHA256(const uint8_t * passwd, size_t passwdlen, const uint8_t * salt,
size_t saltlen, uint64_t c, uint8_t * buf, size_t dkLen)
PBKDF2_SHA256(const uint8_t *passwd, size_t passwdlen, const uint8_t *salt,
size_t saltlen, uint64_t c, uint8_t *buf, size_t dkLen)
{
crypto_auth_hmacsha256_state PShctx, hctx;
size_t i;
uint8_t ivec[4];
uint8_t U[32];
uint8_t T[32];
uint64_t j;
int k;
size_t clen;
size_t i;
uint8_t ivec[4];
uint8_t U[32];
uint8_t T[32];
uint64_t j;
int k;
size_t clen;
if (dkLen > 0x1fffffffe0ULL) {
abort();
src/libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf2-sha256.h
+2 -2
View File
@@ -39,7 +39,7 @@
* Compute PBKDF2(passwd, salt, c, dkLen) using HMAC-SHA256 as the PRF, and
* write the output to buf. The value dkLen must be at most 32 * (2^32 - 1).
*/
void PBKDF2_SHA256(const uint8_t *, size_t, const uint8_t *, size_t,
uint64_t, uint8_t *, size_t);
void PBKDF2_SHA256(const uint8_t *, size_t, const uint8_t *, size_t, uint64_t,
uint8_t *, size_t);
#endif /* !_SHA256_H_ */
src/libsodium/crypto_pwhash/scryptsalsa208sha256/pwhash_scryptsalsa208sha256.c
+42 -45
View File
@@ -7,16 +7,17 @@
#include "crypto_pwhash_scryptsalsa208sha256.h"
#include "crypto_scrypt.h"
#include "private/common.h"
#include "randombytes.h"
#include "utils.h"
#define SETTING_SIZE(saltbytes) \
((sizeof "$7$" - 1U) + \
(1U /* N_log2 */) + (5U /* r */) + (5U /* p */) + BYTES2CHARS(saltbytes))
#define SETTING_SIZE(saltbytes) \
((sizeof "$7$" - 1U) + (1U /* N_log2 */) + (5U /* r */) + (5U /* p */) + \
BYTES2CHARS(saltbytes))
static int
pickparams(unsigned long long opslimit, const size_t memlimit,
uint32_t * const N_log2, uint32_t * const p, uint32_t * const r)
uint32_t *const N_log2, uint32_t *const p, uint32_t *const r)
{
unsigned long long maxN;
unsigned long long maxrp;
@@ -26,7 +27,7 @@ pickparams(unsigned long long opslimit, const size_t memlimit,
}
*r = 8;
if (opslimit < memlimit / 32) {
*p = 1;
*p = 1;
maxN = opslimit / (*r * 4);
for (*N_log2 = 1; *N_log2 < 63; *N_log2 += 1) {
if ((uint64_t)(1) << *N_log2 > maxN / 2) {
@@ -36,17 +37,17 @@ pickparams(unsigned long long opslimit, const size_t memlimit,
} else {
maxN = memlimit / ((size_t) *r * 128);
for (*N_log2 = 1; *N_log2 < 63; *N_log2 += 1) {
if ((uint64_t) (1) << *N_log2 > maxN / 2) {
if ((uint64_t)(1) << *N_log2 > maxN / 2) {
break;
}
}
maxrp = (opslimit / 4) / ((uint64_t) (1) << *N_log2);
maxrp = (opslimit / 4) / ((uint64_t)(1) << *N_log2);
/* LCOV_EXCL_START */
if (maxrp > 0x3fffffff) {
maxrp = 0x3fffffff;
}
/* LCOV_EXCL_STOP */
*p = (uint32_t) (maxrp) / *r;
*p = (uint32_t)(maxrp) / *r;
}
return 0;
}
@@ -142,13 +143,12 @@ crypto_pwhash_scryptsalsa208sha256_memlimit_sensitive(void)
}
int
crypto_pwhash_scryptsalsa208sha256(unsigned char * const out,
unsigned long long outlen,
const char * const passwd,
unsigned long long passwdlen,
const unsigned char * const salt,
unsigned long long opslimit,
size_t memlimit)
crypto_pwhash_scryptsalsa208sha256(unsigned char *const out,
unsigned long long outlen,
const char *const passwd,
unsigned long long passwdlen,
const unsigned char *const salt,
unsigned long long opslimit, size_t memlimit)
{
uint32_t N_log2;
uint32_t p;
@@ -158,30 +158,27 @@ crypto_pwhash_scryptsalsa208sha256(unsigned char * const out,
if (passwdlen > crypto_pwhash_scryptsalsa208sha256_PASSWD_MAX ||
outlen > crypto_pwhash_scryptsalsa208sha256_BYTES_MAX) {
errno = EFBIG; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
}
if (outlen < crypto_pwhash_scryptsalsa208sha256_BYTES_MIN ||
pickparams(opslimit, memlimit, &N_log2, &p, &r) != 0) {
errno = EINVAL; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
}
return crypto_pwhash_scryptsalsa208sha256_ll((const uint8_t *) passwd,
(size_t) passwdlen,
(const uint8_t *) salt,
crypto_pwhash_scryptsalsa208sha256_SALTBYTES,
(uint64_t) (1) << N_log2, r, p,
out, (size_t) outlen);
return crypto_pwhash_scryptsalsa208sha256_ll(
(const uint8_t *) passwd, (size_t) passwdlen, (const uint8_t *) salt,
crypto_pwhash_scryptsalsa208sha256_SALTBYTES, (uint64_t)(1) << N_log2,
r, p, out, (size_t) outlen);
}
int
crypto_pwhash_scryptsalsa208sha256_str(char out[crypto_pwhash_scryptsalsa208sha256_STRBYTES],
const char * const passwd,
unsigned long long passwdlen,
unsigned long long opslimit,
size_t memlimit)
crypto_pwhash_scryptsalsa208sha256_str(
char out[crypto_pwhash_scryptsalsa208sha256_STRBYTES],
const char *const passwd, unsigned long long passwdlen,
unsigned long long opslimit, size_t memlimit)
{
uint8_t salt[crypto_pwhash_scryptsalsa208sha256_STRSALTBYTES];
char setting[crypto_pwhash_scryptsalsa208sha256_STRSETTINGBYTES + 1U];
uint8_t salt[crypto_pwhash_scryptsalsa208sha256_STRSALTBYTES];
char setting[crypto_pwhash_scryptsalsa208sha256_STRSETTINGBYTES + 1U];
escrypt_local_t escrypt_local;
uint32_t N_log2;
uint32_t p;
@@ -190,18 +187,18 @@ crypto_pwhash_scryptsalsa208sha256_str(char out[crypto_pwhash_scryptsalsa208sha2
memset(out, 0, crypto_pwhash_scryptsalsa208sha256_STRBYTES);
if (passwdlen > crypto_pwhash_scryptsalsa208sha256_PASSWD_MAX) {
errno = EFBIG; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
}
if (passwdlen < crypto_pwhash_scryptsalsa208sha256_PASSWD_MIN ||
pickparams(opslimit, memlimit, &N_log2, &p, &r) != 0) {
errno = EINVAL; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
}
randombytes_buf(salt, sizeof salt);
if (escrypt_gensalt_r(N_log2, r, p, salt, sizeof salt,
(uint8_t *) setting, sizeof setting) == NULL) {
if (escrypt_gensalt_r(N_log2, r, p, salt, sizeof salt, (uint8_t *) setting,
sizeof setting) == NULL) {
errno = EINVAL; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
return -1; /* LCOV_EXCL_LINE */
}
if (escrypt_init_local(&escrypt_local) != 0) {
return -1; /* LCOV_EXCL_LINE */
@@ -217,21 +214,21 @@ crypto_pwhash_scryptsalsa208sha256_str(char out[crypto_pwhash_scryptsalsa208sha2
}
escrypt_free_local(&escrypt_local);
(void) sizeof
(int[SETTING_SIZE(crypto_pwhash_scryptsalsa208sha256_STRSALTBYTES)
== crypto_pwhash_scryptsalsa208sha256_STRSETTINGBYTES ? 1 : -1]);
(void) sizeof
(int[crypto_pwhash_scryptsalsa208sha256_STRSETTINGBYTES + 1U +
crypto_pwhash_scryptsalsa208sha256_STRHASHBYTES_ENCODED + 1U
== crypto_pwhash_scryptsalsa208sha256_STRBYTES ? 1 : -1]);
COMPILER_ASSERT(
SETTING_SIZE(crypto_pwhash_scryptsalsa208sha256_STRSALTBYTES) ==
crypto_pwhash_scryptsalsa208sha256_STRSETTINGBYTES);
COMPILER_ASSERT(
crypto_pwhash_scryptsalsa208sha256_STRSETTINGBYTES + 1U +
crypto_pwhash_scryptsalsa208sha256_STRHASHBYTES_ENCODED + 1U ==
crypto_pwhash_scryptsalsa208sha256_STRBYTES);
return 0;
}
int
crypto_pwhash_scryptsalsa208sha256_str_verify(const char str[crypto_pwhash_scryptsalsa208sha256_STRBYTES],
const char * const passwd,
unsigned long long passwdlen)
crypto_pwhash_scryptsalsa208sha256_str_verify(
const char str[crypto_pwhash_scryptsalsa208sha256_STRBYTES],
const char *const passwd, unsigned long long passwdlen)
{
char wanted[crypto_pwhash_scryptsalsa208sha256_STRBYTES];
escrypt_local_t escrypt_local;
src/libsodium/crypto_pwhash/scryptsalsa208sha256/scrypt_platform.c
+23 -18
View File
@@ -19,7 +19,7 @@
*/
#ifdef HAVE_SYS_MMAN_H
# include <sys/mman.h>
#include <sys/mman.h>
#endif
#include <errno.h>
#include <stdlib.h>
@@ -28,26 +28,27 @@
#include "runtime.h"
#if !defined(MAP_ANON) && defined(MAP_ANONYMOUS)
# define MAP_ANON MAP_ANONYMOUS
#define MAP_ANON MAP_ANONYMOUS
#endif
void *
alloc_region(escrypt_region_t * region, size_t size)
alloc_region(escrypt_region_t *region, size_t size)
{
uint8_t * base, * aligned;
uint8_t *base, *aligned;
#if defined(MAP_ANON) && defined(HAVE_MMAP)
if ((base = (uint8_t *) mmap(NULL, size, PROT_READ | PROT_WRITE,
#ifdef MAP_NOCORE
MAP_ANON | MAP_PRIVATE | MAP_NOCORE,
MAP_ANON | MAP_PRIVATE | MAP_NOCORE,
#else
MAP_ANON | MAP_PRIVATE,
MAP_ANON | MAP_PRIVATE,
#endif
-1, 0)) == MAP_FAILED)
-1, 0)) == MAP_FAILED)
base = NULL; /* LCOV_EXCL_LINE */
aligned = base;
aligned = base;
#elif defined(HAVE_POSIX_MEMALIGN)
if ((errno = posix_memalign((void **) &base, 64, size)) != 0)
if ((errno = posix_memalign((void **) &base, 64, size)) != 0) {
base = NULL;
}
aligned = base;
#else
base = aligned = NULL;
@@ -55,46 +56,50 @@ alloc_region(escrypt_region_t * region, size_t size)
errno = ENOMEM;
else if ((base = (uint8_t *) malloc(size + 63)) != NULL) {
aligned = base + 63;
aligned -= (uintptr_t)aligned & 63;
aligned -= (uintptr_t) aligned & 63;
}
#endif
region->base = base;
region->base = base;
region->aligned = aligned;
region->size = base ? size : 0;
region->size = base ? size : 0;
return aligned;
}
static inline void
init_region(escrypt_region_t * region)
init_region(escrypt_region_t *region)
{
region->base = region->aligned = NULL;
region->size = 0;
region->size = 0;
}
int
free_region(escrypt_region_t * region)
free_region(escrypt_region_t *region)
{
if (region->base) {
#if defined(MAP_ANON) && defined(HAVE_MMAP)
if (munmap(region->base, region->size))
if (munmap(region->base, region->size)) {
return -1; /* LCOV_EXCL_LINE */
}
#else
free(region->base);
#endif
}
init_region(region);
return 0;
}
int
escrypt_init_local(escrypt_local_t * local)
escrypt_init_local(escrypt_local_t *local)
{
init_region(local);
return 0;
}
int
escrypt_free_local(escrypt_local_t * local)
escrypt_free_local(escrypt_local_t *local)
{
return free_region(local);
}
src/libsodium/crypto_pwhash/scryptsalsa208sha256/sse/pwhash_scryptsalsa208sha256_sse.c
+82 -83
View File
@@ -29,13 +29,14 @@
*/
#if defined(HAVE_EMMINTRIN_H) || \
(defined(_MSC_VER) && (defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86)))
(defined(_MSC_VER) && \
(defined(_M_X64) || defined(_M_AMD64) || defined(_M_IX86)))
#ifdef __GNUC__
# pragma GCC target("sse2")
#pragma GCC target("sse2")
#endif
#include <emmintrin.h>
#if defined(__XOP__) && defined(DISABLED)
# include <x86intrin.h>
#include <x86intrin.h>
#endif
#include <errno.h>
@@ -44,41 +45,41 @@
#include <stdlib.h>
#include <string.h>
#include "../pbkdf2-sha256.h"
#include "../crypto_scrypt.h"
#include "../pbkdf2-sha256.h"
#include "private/common.h"
#if defined(__XOP__) && defined(DISABLED)
#define ARX(out, in1, in2, s) \
out = _mm_xor_si128(out, _mm_roti_epi32(_mm_add_epi32(in1, in2), s));
#else
#define ARX(out, in1, in2, s) \
{ \
__m128i T = _mm_add_epi32(in1, in2); \
out = _mm_xor_si128(out, _mm_slli_epi32(T, s)); \
out = _mm_xor_si128(out, _mm_srli_epi32(T, 32-s)); \
#define ARX(out, in1, in2, s) \
{ \
__m128i T = _mm_add_epi32(in1, in2); \
out = _mm_xor_si128(out, _mm_slli_epi32(T, s)); \
out = _mm_xor_si128(out, _mm_srli_epi32(T, 32 - s)); \
}
#endif
#define SALSA20_2ROUNDS \
/* Operate on "columns". */ \
ARX(X1, X0, X3, 7) \
ARX(X2, X1, X0, 9) \
ARX(X3, X2, X1, 13) \
ARX(X0, X3, X2, 18) \
\
/* Rearrange data. */ \
#define SALSA20_2ROUNDS \
/* Operate on "columns". */ \
ARX(X1, X0, X3, 7) \
ARX(X2, X1, X0, 9) \
ARX(X3, X2, X1, 13) \
ARX(X0, X3, X2, 18) \
\
/* Rearrange data. */ \
X1 = _mm_shuffle_epi32(X1, 0x93); \
X2 = _mm_shuffle_epi32(X2, 0x4E); \
X3 = _mm_shuffle_epi32(X3, 0x39); \
\
/* Operate on "rows". */ \
ARX(X3, X0, X1, 7) \
ARX(X2, X3, X0, 9) \
ARX(X1, X2, X3, 13) \
ARX(X0, X1, X2, 18) \
\
/* Rearrange data. */ \
\
/* Operate on "rows". */ \
ARX(X3, X0, X1, 7) \
ARX(X2, X3, X0, 9) \
ARX(X1, X2, X3, 13) \
ARX(X0, X1, X2, 18) \
\
/* Rearrange data. */ \
X1 = _mm_shuffle_epi32(X1, 0x39); \
X2 = _mm_shuffle_epi32(X2, 0x4E); \
X3 = _mm_shuffle_epi32(X3, 0x93);
@@ -86,20 +87,19 @@
/**
* Apply the salsa20/8 core to the block provided in (X0 ... X3) ^ (Z0 ... Z3).
*/
#define SALSA20_8_XOR(in, out) \
{ \
__m128i Y0 = X0 = _mm_xor_si128(X0, (in)[0]); \
__m128i Y1 = X1 = _mm_xor_si128(X1, (in)[1]); \
__m128i Y2 = X2 = _mm_xor_si128(X2, (in)[2]); \
__m128i Y3 = X3 = _mm_xor_si128(X3, (in)[3]); \
SALSA20_2ROUNDS \
SALSA20_2ROUNDS \
SALSA20_2ROUNDS \
SALSA20_2ROUNDS \
(out)[0] = X0 = _mm_add_epi32(X0, Y0); \
(out)[1] = X1 = _mm_add_epi32(X1, Y1); \
(out)[2] = X2 = _mm_add_epi32(X2, Y2); \
(out)[3] = X3 = _mm_add_epi32(X3, Y3); \
#define SALSA20_8_XOR(in, out) \
{ \
__m128i Y0 = X0 = _mm_xor_si128(X0, (in)[0]); \
__m128i Y1 = X1 = _mm_xor_si128(X1, (in)[1]); \
__m128i Y2 = X2 = _mm_xor_si128(X2, (in)[2]); \
__m128i Y3 = X3 = _mm_xor_si128(X3, (in)[3]); \
SALSA20_2ROUNDS \
SALSA20_2ROUNDS \
SALSA20_2ROUNDS \
SALSA20_2ROUNDS(out)[0] = X0 = _mm_add_epi32(X0, Y0); \
(out)[1] = X1 = _mm_add_epi32(X1, Y1); \
(out)[2] = X2 = _mm_add_epi32(X2, Y2); \
(out)[3] = X3 = _mm_add_epi32(X3, Y3); \
}
/**
@@ -108,10 +108,10 @@
* bytes in length; the output Bout must also be the same size.
*/
static inline void
blockmix_salsa8(const __m128i * Bin, __m128i * Bout, size_t r)
blockmix_salsa8(const __m128i *Bin, __m128i *Bout, size_t r)
{
__m128i X0, X1, X2, X3;
size_t i;
size_t i;
/* 1: X <-- B_{2r - 1} */
X0 = Bin[8 * r - 4];
@@ -146,24 +146,24 @@ blockmix_salsa8(const __m128i * Bin, __m128i * Bout, size_t r)
SALSA20_8_XOR(&Bin[i * 8 + 4], &Bout[(r + i) * 4 + 4])
}
#define XOR4(in) \
#define XOR4(in) \
X0 = _mm_xor_si128(X0, (in)[0]); \
X1 = _mm_xor_si128(X1, (in)[1]); \
X2 = _mm_xor_si128(X2, (in)[2]); \
X3 = _mm_xor_si128(X3, (in)[3]);
#define XOR4_2(in1, in2) \
#define XOR4_2(in1, in2) \
X0 = _mm_xor_si128((in1)[0], (in2)[0]); \
X1 = _mm_xor_si128((in1)[1], (in2)[1]); \
X2 = _mm_xor_si128((in1)[2], (in2)[2]); \
X3 = _mm_xor_si128((in1)[3], (in2)[3]);
static inline uint32_t
blockmix_salsa8_xor(const __m128i * Bin1, const __m128i * Bin2, __m128i * Bout,
size_t r)
blockmix_salsa8_xor(const __m128i *Bin1, const __m128i *Bin2, __m128i *Bout,
size_t r)
{
__m128i X0, X1, X2, X3;
size_t i;
size_t i;
/* 1: X <-- B_{2r - 1} */
XOR4_2(&Bin1[8 * r - 4], &Bin2[8 * r - 4])
@@ -213,9 +213,9 @@ blockmix_salsa8_xor(const __m128i * Bin1, const __m128i * Bin2, __m128i * Bout,
* Note that B's layout is permuted compared to the generic implementation.
*/
static inline uint32_t
integerify(const void * B, size_t r)
integerify(const void *B, size_t r)
{
return *(const uint32_t *)((uintptr_t)(B) + (2 * r - 1) * 64);
return *(const uint32_t *) ((uintptr_t)(B) + (2 * r - 1) * 64);
}
/**
@@ -227,20 +227,19 @@ integerify(const void * B, size_t r)
* multiple of 64 bytes.
*/
static void
smix(uint8_t * B, size_t r, uint32_t N, void * V, void * XY)
smix(uint8_t *B, size_t r, uint32_t N, void *V, void *XY)
{
size_t s = 128 * r;
__m128i * X = (__m128i *) V, * Y;
uint32_t * X32 = (uint32_t *) V;
uint32_t i, j;
size_t k;
size_t s = 128 * r;
__m128i * X = (__m128i *) V, *Y;
uint32_t *X32 = (uint32_t *) V;
uint32_t i, j;
size_t k;
/* 1: X <-- B */
/* 3: V_i <-- X */
for (k = 0; k < 2 * r; k++) {
for (i = 0; i < 16; i++) {
X32[k * 16 + i] =
LOAD32_LE(&B[(k * 16 + (i * 5 % 16)) * 4]);
X32[k * 16 + i] = LOAD32_LE(&B[(k * 16 + (i * 5 % 16)) * 4]);
}
}
@@ -248,18 +247,18 @@ smix(uint8_t * B, size_t r, uint32_t N, void * V, void * XY)
for (i = 1; i < N - 1; i += 2) {
/* 4: X <-- H(X) */
/* 3: V_i <-- X */
Y = (__m128i *)((uintptr_t)(V) + i * s);
Y = (__m128i *) ((uintptr_t)(V) + i * s);
blockmix_salsa8(X, Y, r);
/* 4: X <-- H(X) */
/* 3: V_i <-- X */
X = (__m128i *)((uintptr_t)(V) + (i + 1) * s);
X = (__m128i *) ((uintptr_t)(V) + (i + 1) * s);
blockmix_salsa8(Y, X, r);
}
/* 4: X <-- H(X) */
/* 3: V_i <-- X */
Y = (__m128i *)((uintptr_t)(V) + i * s);
Y = (__m128i *) ((uintptr_t)(V) + i * s);
blockmix_salsa8(X, Y, r);
/* 4: X <-- H(X) */
@@ -268,19 +267,19 @@ smix(uint8_t * B, size_t r, uint32_t N, void * V, void * XY)
blockmix_salsa8(Y, X, r);
X32 = (uint32_t *) XY;
Y = (__m128i *)((uintptr_t)(XY) + s);
Y = (__m128i *) ((uintptr_t)(XY) + s);
/* 7: j <-- Integerify(X) mod N */
j = integerify(X, r) & (N - 1);
/* 6: for i = 0 to N - 1 do */
for (i = 0; i < N; i += 2) {
__m128i * V_j = (__m128i *)((uintptr_t)(V) + j * s);
__m128i *V_j = (__m128i *) ((uintptr_t)(V) + j * s);
/* 8: X <-- H(X \xor V_j) */
/* 7: j <-- Integerify(X) mod N */
j = blockmix_salsa8_xor(X, V_j, Y, r) & (N - 1);
V_j = (__m128i *)((uintptr_t)(V) + j * s);
j = blockmix_salsa8_xor(X, V_j, Y, r) & (N - 1);
V_j = (__m128i *) ((uintptr_t)(V) + j * s);
/* 8: X <-- H(X \xor V_j) */
/* 7: j <-- Integerify(X) mod N */
@@ -306,19 +305,17 @@ smix(uint8_t * B, size_t r, uint32_t N, void * V, void * XY)
* Return 0 on success; or -1 on error.
*/
int
escrypt_kdf_sse(escrypt_local_t * local,
const uint8_t * passwd, size_t passwdlen,
const uint8_t * salt, size_t saltlen,
uint64_t N, uint32_t _r, uint32_t _p,
uint8_t * buf, size_t buflen)
escrypt_kdf_sse(escrypt_local_t *local, const uint8_t *passwd, size_t passwdlen,
const uint8_t *salt, size_t saltlen, uint64_t N, uint32_t _r,
uint32_t _p, uint8_t *buf, size_t buflen)
{
size_t B_size, V_size, XY_size, need;
size_t B_size, V_size, XY_size, need;
uint8_t * B;
uint32_t * V, * XY;
size_t r = _r, p = _p;
uint32_t i;
uint32_t *V, *XY;
size_t r = _r, p = _p;
uint32_t i;
/* Sanity-check parameters. */
/* Sanity-check parameters. */
#if SIZE_MAX > UINT32_MAX
if (buflen > (((uint64_t)(1) << 32) - 1) * 32) {
errno = EFBIG;
@@ -351,28 +348,30 @@ escrypt_kdf_sse(escrypt_local_t * local,
}
/* Allocate memory. */
B_size = (size_t)128 * r * p;
V_size = (size_t)128 * r * N;
need = B_size + V_size;
B_size = (size_t) 128 * r * p;
V_size = (size_t) 128 * r * N;
need = B_size + V_size;
if (need < V_size) {
errno = ENOMEM;
return -1;
}
XY_size = (size_t)256 * r + 64;
XY_size = (size_t) 256 * r + 64;
need += XY_size;
if (need < XY_size) {
errno = ENOMEM;
return -1;
}
if (local->size < need) {
if (free_region(local))
if (free_region(local)) {
return -1; /* LCOV_EXCL_LINE */
if (!alloc_region(local, need))
}
if (!alloc_region(local, need)) {
return -1; /* LCOV_EXCL_LINE */
}
}
B = (uint8_t *)local->aligned;
V = (uint32_t *)((uint8_t *)B + B_size);
XY = (uint32_t *)((uint8_t *)V + V_size);
B = (uint8_t *) local->aligned;
V = (uint32_t *) ((uint8_t *) B + B_size);
XY = (uint32_t *) ((uint8_t *) V + V_size);
/* 1: (B_0 ... B_{p-1}) <-- PBKDF2(P, S, 1, p * MFLen) */
PBKDF2_SHA256(passwd, passwdlen, salt, saltlen, 1, B, B_size);
@@ -380,7 +379,7 @@ escrypt_kdf_sse(escrypt_local_t * local,
/* 2: for i = 0 to p - 1 do */
for (i = 0; i < p; i++) {
/* 3: B_i <-- MF(B_i, N) */
smix(&B[(size_t)128 * i * r], r, (uint32_t) N, V, XY);
smix(&B[(size_t) 128 * i * r], r, (uint32_t) N, V, XY);
}
/* 5: DK <-- PBKDF2(P, B, 1, dkLen) */