| ... | ... | @@ -44,6 +44,9 @@ pub const Poly1305 = struct { |
| 44 | 44 | const r0 = st.r[0]; |
| 45 | 45 | const r1 = st.r[1]; |
| 46 | 46 | const r2 = st.r[2]; |
| 47 | var h0 = st.h[0]; |
| 48 | var h1 = st.h[1]; |
| 49 | var h2 = st.h[2]; |
| 47 | 50 | const s1 = r1 * (5 << 2); |
| 48 | 51 | const s2 = r2 * (5 << 2); |
| 49 | 52 | var i: usize = 0; |
| ... | ... | @@ -51,29 +54,30 @@ pub const Poly1305 = struct { |
| 51 | 54 | // h += m[i] |
| 52 | 55 | const t0 = mem.readIntLittle(u64, m[i..][0..8]); |
| 53 | 56 | const t1 = mem.readIntLittle(u64, m[i + 8 ..][0..8]); |
| 54 | | st.h[0] += t0 & 0xfffffffffff; |
| 55 | | st.h[1] += ((t0 >> 44) | (t1 << 20)) & 0xfffffffffff; |
| 56 | | st.h[2] += (((t1 >> 24)) & 0x3ffffffffff) | hibit; |
| 57 | h0 += @truncate(u44, t0); |
| 58 | h1 += @truncate(u44, (t0 >> 44) | (t1 << 20)); |
| 59 | h2 += @truncate(u42, t1 >> 24) | hibit; |
| 57 | 60 | |
| 58 | 61 | // h *= r |
| 59 | | const d0 = @as(u128, st.h[0]) * @as(u128, r0) + @as(u128, st.h[1]) * @as(u128, s2) + @as(u128, st.h[2]) * @as(u128, s1); |
| 60 | | var d1 = @as(u128, st.h[0]) * @as(u128, r1) + @as(u128, st.h[1]) * @as(u128, r0) + @as(u128, st.h[2]) * @as(u128, s2); |
| 61 | | var d2 = @as(u128, st.h[0]) * @as(u128, r2) + @as(u128, st.h[1]) * @as(u128, r1) + @as(u128, st.h[2]) * @as(u128, r0); |
| 62 | const d0 = @as(u128, h0) * r0 + @as(u128, h1) * s2 + @as(u128, h2) * s1; |
| 63 | var d1 = @as(u128, h0) * r1 + @as(u128, h1) * r0 + @as(u128, h2) * s2; |
| 64 | var d2 = @as(u128, h0) * r2 + @as(u128, h1) * r1 + @as(u128, h2) * r0; |
| 62 | 65 | |
| 63 | 66 | // partial reduction |
| 64 | 67 | var carry = d0 >> 44; |
| 65 | | st.h[0] = @truncate(u64, d0) & 0xfffffffffff; |
| 68 | h0 = @truncate(u44, d0); |
| 66 | 69 | d1 += carry; |
| 67 | 70 | carry = @intCast(u64, d1 >> 44); |
| 68 | | st.h[1] = @truncate(u64, d1) & 0xfffffffffff; |
| 71 | h1 = @truncate(u44, d1); |
| 69 | 72 | d2 += carry; |
| 70 | 73 | carry = @intCast(u64, d2 >> 42); |
| 71 | | st.h[2] = @truncate(u64, d2) & 0x3ffffffffff; |
| 72 | | st.h[0] += @truncate(u64, carry) * 5; |
| 73 | | carry = st.h[0] >> 44; |
| 74 | | st.h[0] &= 0xfffffffffff; |
| 75 | | st.h[1] += @truncate(u64, carry); |
| 74 | h2 = @truncate(u42, d2); |
| 75 | h0 += @truncate(u64, carry) * 5; |
| 76 | carry = h0 >> 44; |
| 77 | h0 = @truncate(u44, h0); |
| 78 | h1 += @truncate(u64, carry); |
| 76 | 79 | } |
| 80 | st.h = [_]u64{ h0, h1, h2 }; |
| 77 | 81 | } |
| 78 | 82 | |
| 79 | 83 | pub fn update(st: *Poly1305, m: []const u8) void { |
| ... | ... | @@ -124,31 +128,31 @@ pub const Poly1305 = struct { |
| 124 | 128 | } |
| 125 | 129 | // fully carry h |
| 126 | 130 | var carry = st.h[1] >> 44; |
| 127 | | st.h[1] &= 0xfffffffffff; |
| 131 | st.h[1] = @truncate(u44, st.h[1]); |
| 128 | 132 | st.h[2] += carry; |
| 129 | 133 | carry = st.h[2] >> 42; |
| 130 | | st.h[2] &= 0x3ffffffffff; |
| 134 | st.h[2] = @truncate(u42, st.h[2]); |
| 131 | 135 | st.h[0] += carry * 5; |
| 132 | 136 | carry = st.h[0] >> 44; |
| 133 | | st.h[0] &= 0xfffffffffff; |
| 137 | st.h[0] = @truncate(u44, st.h[0]); |
| 134 | 138 | st.h[1] += carry; |
| 135 | 139 | carry = st.h[1] >> 44; |
| 136 | | st.h[1] &= 0xfffffffffff; |
| 140 | st.h[1] = @truncate(u44, st.h[1]); |
| 137 | 141 | st.h[2] += carry; |
| 138 | 142 | carry = st.h[2] >> 42; |
| 139 | | st.h[2] &= 0x3ffffffffff; |
| 143 | st.h[2] = @truncate(u42, st.h[2]); |
| 140 | 144 | st.h[0] += carry * 5; |
| 141 | 145 | carry = st.h[0] >> 44; |
| 142 | | st.h[0] &= 0xfffffffffff; |
| 146 | st.h[0] = @truncate(u44, st.h[0]); |
| 143 | 147 | st.h[1] += carry; |
| 144 | 148 | |
| 145 | 149 | // compute h + -p |
| 146 | 150 | var g0 = st.h[0] + 5; |
| 147 | 151 | carry = g0 >> 44; |
| 148 | | g0 &= 0xfffffffffff; |
| 152 | g0 = @truncate(u44, g0); |
| 149 | 153 | var g1 = st.h[1] + carry; |
| 150 | 154 | carry = g1 >> 44; |
| 151 | | g1 &= 0xfffffffffff; |
| 155 | g1 = @truncate(u44, g1); |
| 152 | 156 | var g2 = st.h[2] + carry -% (1 << 42); |
| 153 | 157 | |
| 154 | 158 | // (hopefully) constant-time select h if h < p, or h + -p if h >= p |
| ... | ... | @@ -164,14 +168,14 @@ pub const Poly1305 = struct { |
| 164 | 168 | // h = (h + pad) |
| 165 | 169 | const t0 = st.pad[0]; |
| 166 | 170 | const t1 = st.pad[1]; |
| 167 | | st.h[0] += (t0 & 0xfffffffffff); |
| 168 | | carry = (st.h[0] >> 44); |
| 169 | | st.h[0] &= 0xfffffffffff; |
| 170 | | st.h[1] += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff) + carry; |
| 171 | | carry = (st.h[1] >> 44); |
| 172 | | st.h[1] &= 0xfffffffffff; |
| 173 | | st.h[2] += (((t1 >> 24)) & 0x3ffffffffff) + carry; |
| 174 | | st.h[2] &= 0x3ffffffffff; |
| 171 | st.h[0] += @truncate(u44, t0); |
| 172 | carry = st.h[0] >> 44; |
| 173 | st.h[0] = @truncate(u44, st.h[0]); |
| 174 | st.h[1] += @truncate(u44, (t0 >> 44) | (t1 << 20)) + carry; |
| 175 | carry = st.h[1] >> 44; |
| 176 | st.h[1] = @truncate(u44, st.h[1]); |
| 177 | st.h[2] += @truncate(u42, t1 >> 24) + carry; |
| 178 | st.h[2] = @truncate(u42, st.h[2]); |
| 175 | 179 | |
| 176 | 180 | // mac = h % (2^128) |
| 177 | 181 | st.h[0] |= st.h[1] << 44; |
| ... | ... | @@ -180,7 +184,7 @@ pub const Poly1305 = struct { |
| 180 | 184 | mem.writeIntLittle(u64, out[0..8], st.h[0]); |
| 181 | 185 | mem.writeIntLittle(u64, out[8..16], st.h[1]); |
| 182 | 186 | |
| 183 | | mem.secureZero(u64, &st.r); |
| 187 | std.mem.secureZero(u8, @ptrCast([*]u8, st)[0..@sizeOf(Poly1305)]); |
| 184 | 188 | } |
| 185 | 189 | |
| 186 | 190 | pub fn create(out: []u8, msg: []const u8, key: []const u8) void { |
Frank Denis <124872+jedisct1@users.noreply.github.com> 2020-08-21 19:43:06+02:00