authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-10-16 19:10:20+02:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-10-17 18:53:08-04:00
logfa17447090500b67c515c023376ab66201f8f088
tree5521ad832ded1b9c38a24fec0cc02871739bd630
parent0011def2b24f63233f2ee24909701f92264c2ef5

std/crypto: make the whole APIs more consistent

- use `PascalCase` for all types. So, AES256GCM is now Aes256Gcm. - consistently use `_length` instead of mixing `_size` and `_length` for the constants we expose - Use `minimum_key_length` when it represents an actual minimum length. Otherwise, use `key_length`. - Require output buffers (for ciphertexts, macs, hashes) to be of the right size, not at least of that size in some functions, and the exact size elsewhere. - Use a `_bits` suffix instead of `_length` when a size is represented as a number of bits to avoid confusion. - Functions returning a constant-sized slice are now defined as a slice instead of a pointer + a runtime assertion. This is the case for most hash functions. - Use `camelCase` for all functions instead of `snake_case`. No functional changes, but these are breaking API changes.

24 files changed, 743 insertions(+), 758 deletions(-)

lib/std/crypto.zig+9-6
......@@ -11,10 +11,10 @@ pub const aead = struct {
1111 pub const Gimli = @import("crypto/gimli.zig").Aead;
1212 pub const ChaCha20Poly1305 = chacha20.Chacha20Poly1305;
1313 pub const XChaCha20Poly1305 = chacha20.XChacha20Poly1305;
14 pub const AEGIS128L = @import("crypto/aegis.zig").AEGIS128L;
15 pub const AEGIS256 = @import("crypto/aegis.zig").AEGIS256;
16 pub const AES128GCM = @import("crypto/aes_gcm.zig").AES128GCM;
17 pub const AES256GCM = @import("crypto/aes_gcm.zig").AES256GCM;
14 pub const Aegis128L = @import("crypto/aegis.zig").Aegis128L;
15 pub const Aegis256 = @import("crypto/aegis.zig").Aegis256;
16 pub const Aes128Gcm = @import("crypto/aes_gcm.zig").Aes128Gcm;
17 pub const Aes256Gcm = @import("crypto/aes_gcm.zig").Aes256Gcm;
1818};
1919
2020/// Authentication (MAC) functions.
......@@ -156,8 +156,11 @@ test "issue #4532: no index out of bounds" {
156156 hash.sha3.Sha3_256,
157157 hash.sha3.Sha3_384,
158158 hash.sha3.Sha3_512,
159 hash.blake2.Blake2s128,
159160 hash.blake2.Blake2s224,
160161 hash.blake2.Blake2s256,
162 hash.blake2.Blake2b128,
163 hash.blake2.Blake2b256,
161164 hash.blake2.Blake2b384,
162165 hash.blake2.Blake2b512,
163166 hash.Gimli,
......@@ -170,11 +173,11 @@ test "issue #4532: no index out of bounds" {
170173 const h0 = Hasher.init(.{});
171174 var h = h0;
172175 h.update(block[0..]);
173 h.final(out1[0..]);
176 h.final(&out1);
174177 h = h0;
175178 h.update(block[0..1]);
176179 h.update(block[1..]);
177 h.final(out2[0..]);
180 h.final(&out2);
178181
179182 std.testing.expectEqual(out1, out2);
180183 }
lib/std/crypto/25519/x25519.zig+5-5
......@@ -14,12 +14,12 @@ pub const X25519 = struct {
1414 /// Length (in bytes) of a secret key.
1515 pub const secret_length = 32;
1616 /// Length (in bytes) of the output of the DH function.
17 pub const minimum_key_length = 32;
17 pub const key_length = 32;
1818
1919 /// Compute the public key for a given private key.
2020 pub fn createPublicKey(public_key: []u8, private_key: []const u8) bool {
21 std.debug.assert(private_key.len >= minimum_key_length);
22 std.debug.assert(public_key.len >= minimum_key_length);
21 std.debug.assert(private_key.len >= key_length);
22 std.debug.assert(public_key.len >= key_length);
2323 var s: [32]u8 = undefined;
2424 mem.copy(u8, &s, private_key[0..32]);
2525 if (Curve.basePoint.clampedMul(s)) |q| {
......@@ -35,8 +35,8 @@ pub const X25519 = struct {
3535 /// hashing it first.
3636 pub fn create(out: []u8, private_key: []const u8, public_key: []const u8) bool {
3737 std.debug.assert(out.len >= secret_length);
38 std.debug.assert(private_key.len >= minimum_key_length);
39 std.debug.assert(public_key.len >= minimum_key_length);
38 std.debug.assert(private_key.len >= key_length);
39 std.debug.assert(public_key.len >= key_length);
4040 var s: [32]u8 = undefined;
4141 var b: [32]u8 = undefined;
4242 mem.copy(u8, &s, private_key[0..32]);
lib/std/crypto/aegis.zig+70-70
......@@ -1,17 +1,17 @@
11const std = @import("std");
22const mem = std.mem;
33const assert = std.debug.assert;
4const AESBlock = std.crypto.core.aes.Block;
4const AesBlock = std.crypto.core.aes.Block;
55
66const State128L = struct {
7 blocks: [8]AESBlock,
7 blocks: [8]AesBlock,
88
99 fn init(key: [16]u8, nonce: [16]u8) State128L {
10 const c1 = AESBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
11 const c2 = AESBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
12 const key_block = AESBlock.fromBytes(&key);
13 const nonce_block = AESBlock.fromBytes(&nonce);
14 const blocks = [8]AESBlock{
10 const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
11 const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
12 const key_block = AesBlock.fromBytes(&key);
13 const nonce_block = AesBlock.fromBytes(&nonce);
14 const blocks = [8]AesBlock{
1515 key_block.xorBlocks(nonce_block),
1616 c1,
1717 c2,
......@@ -29,7 +29,7 @@ const State128L = struct {
2929 return state;
3030 }
3131
32 inline fn update(state: *State128L, d1: AESBlock, d2: AESBlock) void {
32 inline fn update(state: *State128L, d1: AesBlock, d2: AesBlock) void {
3333 const blocks = &state.blocks;
3434 const tmp = blocks[7];
3535 comptime var i: usize = 7;
......@@ -43,8 +43,8 @@ const State128L = struct {
4343
4444 fn enc(state: *State128L, dst: *[32]u8, src: *const [32]u8) void {
4545 const blocks = &state.blocks;
46 const msg0 = AESBlock.fromBytes(src[0..16]);
47 const msg1 = AESBlock.fromBytes(src[16..32]);
46 const msg0 = AesBlock.fromBytes(src[0..16]);
47 const msg1 = AesBlock.fromBytes(src[16..32]);
4848 var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]);
4949 var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]);
5050 tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3]));
......@@ -56,8 +56,8 @@ const State128L = struct {
5656
5757 fn dec(state: *State128L, dst: *[32]u8, src: *const [32]u8) void {
5858 const blocks = &state.blocks;
59 var msg0 = AESBlock.fromBytes(src[0..16]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);
60 var msg1 = AESBlock.fromBytes(src[16..32]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);
59 var msg0 = AesBlock.fromBytes(src[0..16]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);
60 var msg1 = AesBlock.fromBytes(src[16..32]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);
6161 msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3]));
6262 msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7]));
6363 dst[0..16].* = msg0.toBytes();
......@@ -70,7 +70,7 @@ const State128L = struct {
7070 var sizes: [16]u8 = undefined;
7171 mem.writeIntLittle(u64, sizes[0..8], adlen * 8);
7272 mem.writeIntLittle(u64, sizes[8..16], mlen * 8);
73 const tmp = AESBlock.fromBytes(&sizes).xorBlocks(blocks[2]);
73 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[2]);
7474 var i: usize = 0;
7575 while (i < 7) : (i += 1) {
7676 state.update(tmp, tmp);
......@@ -86,7 +86,7 @@ const State128L = struct {
8686/// It was designed to fully exploit the parallelism and built-in AES support of recent Intel and ARM CPUs.
8787///
8888/// https://competitions.cr.yp.to/round3/aegisv11.pdf
89pub const AEGIS128L = struct {
89pub const Aegis128L = struct {
9090 pub const tag_length = 16;
9191 pub const nonce_length = 16;
9292 pub const key_length = 16;
......@@ -155,8 +155,8 @@ pub const AEGIS128L = struct {
155155 mem.copy(u8, m[i .. i + m.len % 32], dst[0 .. m.len % 32]);
156156 mem.set(u8, dst[0 .. m.len % 32], 0);
157157 const blocks = &state.blocks;
158 blocks[0] = blocks[0].xorBlocks(AESBlock.fromBytes(dst[0..16]));
159 blocks[4] = blocks[4].xorBlocks(AESBlock.fromBytes(dst[16..32]));
158 blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(dst[0..16]));
159 blocks[4] = blocks[4].xorBlocks(AesBlock.fromBytes(dst[16..32]));
160160 }
161161 const computed_tag = state.mac(ad.len, m.len);
162162 var acc: u8 = 0;
......@@ -171,18 +171,18 @@ pub const AEGIS128L = struct {
171171};
172172
173173const State256 = struct {
174 blocks: [6]AESBlock,
174 blocks: [6]AesBlock,
175175
176176 fn init(key: [32]u8, nonce: [32]u8) State256 {
177 const c1 = AESBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
178 const c2 = AESBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
179 const key_block1 = AESBlock.fromBytes(key[0..16]);
180 const key_block2 = AESBlock.fromBytes(key[16..32]);
181 const nonce_block1 = AESBlock.fromBytes(nonce[0..16]);
182 const nonce_block2 = AESBlock.fromBytes(nonce[16..32]);
177 const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
178 const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
179 const key_block1 = AesBlock.fromBytes(key[0..16]);
180 const key_block2 = AesBlock.fromBytes(key[16..32]);
181 const nonce_block1 = AesBlock.fromBytes(nonce[0..16]);
182 const nonce_block2 = AesBlock.fromBytes(nonce[16..32]);
183183 const kxn1 = key_block1.xorBlocks(nonce_block1);
184184 const kxn2 = key_block2.xorBlocks(nonce_block2);
185 const blocks = [6]AESBlock{
185 const blocks = [6]AesBlock{
186186 kxn1,
187187 kxn2,
188188 c1,
......@@ -201,7 +201,7 @@ const State256 = struct {
201201 return state;
202202 }
203203
204 inline fn update(state: *State256, d: AESBlock) void {
204 inline fn update(state: *State256, d: AesBlock) void {
205205 const blocks = &state.blocks;
206206 const tmp = blocks[5].encrypt(blocks[0]);
207207 comptime var i: usize = 5;
......@@ -213,7 +213,7 @@ const State256 = struct {
213213
214214 fn enc(state: *State256, dst: *[16]u8, src: *const [16]u8) void {
215215 const blocks = &state.blocks;
216 const msg = AESBlock.fromBytes(src);
216 const msg = AesBlock.fromBytes(src);
217217 var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
218218 tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3]));
219219 dst.* = tmp.toBytes();
......@@ -222,7 +222,7 @@ const State256 = struct {
222222
223223 fn dec(state: *State256, dst: *[16]u8, src: *const [16]u8) void {
224224 const blocks = &state.blocks;
225 var msg = AESBlock.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
225 var msg = AesBlock.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
226226 msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3]));
227227 dst.* = msg.toBytes();
228228 state.update(msg);
......@@ -233,7 +233,7 @@ const State256 = struct {
233233 var sizes: [16]u8 = undefined;
234234 mem.writeIntLittle(u64, sizes[0..8], adlen * 8);
235235 mem.writeIntLittle(u64, sizes[8..16], mlen * 8);
236 const tmp = AESBlock.fromBytes(&sizes).xorBlocks(blocks[3]);
236 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[3]);
237237 var i: usize = 0;
238238 while (i < 7) : (i += 1) {
239239 state.update(tmp);
......@@ -248,7 +248,7 @@ const State256 = struct {
248248/// The 256 bit variant of AEGIS has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks.
249249///
250250/// https://competitions.cr.yp.to/round3/aegisv11.pdf
251pub const AEGIS256 = struct {
251pub const Aegis256 = struct {
252252 pub const tag_length = 16;
253253 pub const nonce_length = 32;
254254 pub const key_length = 32;
......@@ -317,7 +317,7 @@ pub const AEGIS256 = struct {
317317 mem.copy(u8, m[i .. i + m.len % 16], dst[0 .. m.len % 16]);
318318 mem.set(u8, dst[0 .. m.len % 16], 0);
319319 const blocks = &state.blocks;
320 blocks[0] = blocks[0].xorBlocks(AESBlock.fromBytes(&dst));
320 blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(&dst));
321321 }
322322 const computed_tag = state.mac(ad.len, m.len);
323323 var acc: u8 = 0;
......@@ -334,113 +334,113 @@ pub const AEGIS256 = struct {
334334const htest = @import("test.zig");
335335const testing = std.testing;
336336
337test "AEGIS128L test vector 1" {
338 const key: [AEGIS128L.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 14;
339 const nonce: [AEGIS128L.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 13;
337test "Aegis128L test vector 1" {
338 const key: [Aegis128L.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 14;
339 const nonce: [Aegis128L.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 13;
340340 const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 };
341341 const m = [32]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
342342 var c: [m.len]u8 = undefined;
343343 var m2: [m.len]u8 = undefined;
344 var tag: [AEGIS128L.tag_length]u8 = undefined;
344 var tag: [Aegis128L.tag_length]u8 = undefined;
345345
346 AEGIS128L.encrypt(&c, &tag, &m, &ad, nonce, key);
347 try AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key);
346 Aegis128L.encrypt(&c, &tag, &m, &ad, nonce, key);
347 try Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key);
348348 testing.expectEqualSlices(u8, &m, &m2);
349349
350350 htest.assertEqual("79d94593d8c2119d7e8fd9b8fc77845c5c077a05b2528b6ac54b563aed8efe84", &c);
351351 htest.assertEqual("cc6f3372f6aa1bb82388d695c3962d9a", &tag);
352352
353353 c[0] +%= 1;
354 testing.expectError(error.AuthenticationFailed, AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key));
354 testing.expectError(error.AuthenticationFailed, Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key));
355355 c[0] -%= 1;
356356 tag[0] +%= 1;
357 testing.expectError(error.AuthenticationFailed, AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key));
357 testing.expectError(error.AuthenticationFailed, Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key));
358358}
359359
360test "AEGIS128L test vector 2" {
361 const key: [AEGIS128L.key_length]u8 = [_]u8{0x00} ** 16;
362 const nonce: [AEGIS128L.nonce_length]u8 = [_]u8{0x00} ** 16;
360test "Aegis128L test vector 2" {
361 const key: [Aegis128L.key_length]u8 = [_]u8{0x00} ** 16;
362 const nonce: [Aegis128L.nonce_length]u8 = [_]u8{0x00} ** 16;
363363 const ad = [_]u8{};
364364 const m = [_]u8{0x00} ** 16;
365365 var c: [m.len]u8 = undefined;
366366 var m2: [m.len]u8 = undefined;
367 var tag: [AEGIS128L.tag_length]u8 = undefined;
367 var tag: [Aegis128L.tag_length]u8 = undefined;
368368
369 AEGIS128L.encrypt(&c, &tag, &m, &ad, nonce, key);
370 try AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key);
369 Aegis128L.encrypt(&c, &tag, &m, &ad, nonce, key);
370 try Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key);
371371 testing.expectEqualSlices(u8, &m, &m2);
372372
373373 htest.assertEqual("41de9000a7b5e40e2d68bb64d99ebb19", &c);
374374 htest.assertEqual("f4d997cc9b94227ada4fe4165422b1c8", &tag);
375375}
376376
377test "AEGIS128L test vector 3" {
378 const key: [AEGIS128L.key_length]u8 = [_]u8{0x00} ** 16;
379 const nonce: [AEGIS128L.nonce_length]u8 = [_]u8{0x00} ** 16;
377test "Aegis128L test vector 3" {
378 const key: [Aegis128L.key_length]u8 = [_]u8{0x00} ** 16;
379 const nonce: [Aegis128L.nonce_length]u8 = [_]u8{0x00} ** 16;
380380 const ad = [_]u8{};
381381 const m = [_]u8{};
382382 var c: [m.len]u8 = undefined;
383383 var m2: [m.len]u8 = undefined;
384 var tag: [AEGIS128L.tag_length]u8 = undefined;
384 var tag: [Aegis128L.tag_length]u8 = undefined;
385385
386 AEGIS128L.encrypt(&c, &tag, &m, &ad, nonce, key);
387 try AEGIS128L.decrypt(&m2, &c, tag, &ad, nonce, key);
386 Aegis128L.encrypt(&c, &tag, &m, &ad, nonce, key);
387 try Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key);
388388 testing.expectEqualSlices(u8, &m, &m2);
389389
390390 htest.assertEqual("83cc600dc4e3e7e62d4055826174f149", &tag);
391391}
392392
393test "AEGIS256 test vector 1" {
394 const key: [AEGIS256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30;
395 const nonce: [AEGIS256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29;
393test "Aegis256 test vector 1" {
394 const key: [Aegis256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30;
395 const nonce: [Aegis256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29;
396396 const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 };
397397 const m = [32]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
398398 var c: [m.len]u8 = undefined;
399399 var m2: [m.len]u8 = undefined;
400 var tag: [AEGIS256.tag_length]u8 = undefined;
400 var tag: [Aegis256.tag_length]u8 = undefined;
401401
402 AEGIS256.encrypt(&c, &tag, &m, &ad, nonce, key);
403 try AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key);
402 Aegis256.encrypt(&c, &tag, &m, &ad, nonce, key);
403 try Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key);
404404 testing.expectEqualSlices(u8, &m, &m2);
405405
406406 htest.assertEqual("f373079ed84b2709faee373584585d60accd191db310ef5d8b11833df9dec711", &c);
407407 htest.assertEqual("8d86f91ee606e9ff26a01b64ccbdd91d", &tag);
408408
409409 c[0] +%= 1;
410 testing.expectError(error.AuthenticationFailed, AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key));
410 testing.expectError(error.AuthenticationFailed, Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key));
411411 c[0] -%= 1;
412412 tag[0] +%= 1;
413 testing.expectError(error.AuthenticationFailed, AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key));
413 testing.expectError(error.AuthenticationFailed, Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key));
414414}
415415
416test "AEGIS256 test vector 2" {
417 const key: [AEGIS256.key_length]u8 = [_]u8{0x00} ** 32;
418 const nonce: [AEGIS256.nonce_length]u8 = [_]u8{0x00} ** 32;
416test "Aegis256 test vector 2" {
417 const key: [Aegis256.key_length]u8 = [_]u8{0x00} ** 32;
418 const nonce: [Aegis256.nonce_length]u8 = [_]u8{0x00} ** 32;
419419 const ad = [_]u8{};
420420 const m = [_]u8{0x00} ** 16;
421421 var c: [m.len]u8 = undefined;
422422 var m2: [m.len]u8 = undefined;
423 var tag: [AEGIS256.tag_length]u8 = undefined;
423 var tag: [Aegis256.tag_length]u8 = undefined;
424424
425 AEGIS256.encrypt(&c, &tag, &m, &ad, nonce, key);
426 try AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key);
425 Aegis256.encrypt(&c, &tag, &m, &ad, nonce, key);
426 try Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key);
427427 testing.expectEqualSlices(u8, &m, &m2);
428428
429429 htest.assertEqual("b98f03a947807713d75a4fff9fc277a6", &c);
430430 htest.assertEqual("478f3b50dc478ef7d5cf2d0f7cc13180", &tag);
431431}
432432
433test "AEGIS256 test vector 3" {
434 const key: [AEGIS256.key_length]u8 = [_]u8{0x00} ** 32;
435 const nonce: [AEGIS256.nonce_length]u8 = [_]u8{0x00} ** 32;
433test "Aegis256 test vector 3" {
434 const key: [Aegis256.key_length]u8 = [_]u8{0x00} ** 32;
435 const nonce: [Aegis256.nonce_length]u8 = [_]u8{0x00} ** 32;
436436 const ad = [_]u8{};
437437 const m = [_]u8{};
438438 var c: [m.len]u8 = undefined;
439439 var m2: [m.len]u8 = undefined;
440 var tag: [AEGIS256.tag_length]u8 = undefined;
440 var tag: [Aegis256.tag_length]u8 = undefined;
441441
442 AEGIS256.encrypt(&c, &tag, &m, &ad, nonce, key);
443 try AEGIS256.decrypt(&m2, &c, tag, &ad, nonce, key);
442 Aegis256.encrypt(&c, &tag, &m, &ad, nonce, key);
443 try Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key);
444444 testing.expectEqualSlices(u8, &m, &m2);
445445
446446 htest.assertEqual("f7a0878f68bd083e8065354071fc27c3", &tag);
lib/std/crypto/aes.zig+14-14
......@@ -21,10 +21,10 @@ impl: {
2121};
2222
2323pub const Block = impl.Block;
24pub const AESEncryptCtx = impl.AESEncryptCtx;
25pub const AESDecryptCtx = impl.AESDecryptCtx;
26pub const AES128 = impl.AES128;
27pub const AES256 = impl.AES256;
24pub const AesEncryptCtx = impl.AesEncryptCtx;
25pub const AesDecryptCtx = impl.AesDecryptCtx;
26pub const Aes128 = impl.Aes128;
27pub const Aes256 = impl.Aes256;
2828
2929test "ctr" {
3030 // NIST SP 800-38A pp 55-58
......@@ -46,8 +46,8 @@ test "ctr" {
4646 };
4747
4848 var out: [exp_out.len]u8 = undefined;
49 var ctx = AES128.initEnc(key);
50 ctr(AESEncryptCtx(AES128), ctx, out[0..], in[0..], iv, builtin.Endian.Big);
49 var ctx = Aes128.initEnc(key);
50 ctr(AesEncryptCtx(Aes128), ctx, out[0..], in[0..], iv, builtin.Endian.Big);
5151 testing.expectEqualSlices(u8, exp_out[0..], out[0..]);
5252}
5353
......@@ -59,7 +59,7 @@ test "encrypt" {
5959 const exp_out = [_]u8{ 0x39, 0x25, 0x84, 0x1d, 0x02, 0xdc, 0x09, 0xfb, 0xdc, 0x11, 0x85, 0x97, 0x19, 0x6a, 0x0b, 0x32 };
6060
6161 var out: [exp_out.len]u8 = undefined;
62 var ctx = AES128.initEnc(key);
62 var ctx = Aes128.initEnc(key);
6363 ctx.encrypt(out[0..], in[0..]);
6464 testing.expectEqualSlices(u8, exp_out[0..], out[0..]);
6565 }
......@@ -74,7 +74,7 @@ test "encrypt" {
7474 const exp_out = [_]u8{ 0x8e, 0xa2, 0xb7, 0xca, 0x51, 0x67, 0x45, 0xbf, 0xea, 0xfc, 0x49, 0x90, 0x4b, 0x49, 0x60, 0x89 };
7575
7676 var out: [exp_out.len]u8 = undefined;
77 var ctx = AES256.initEnc(key);
77 var ctx = Aes256.initEnc(key);
7878 ctx.encrypt(out[0..], in[0..]);
7979 testing.expectEqualSlices(u8, exp_out[0..], out[0..]);
8080 }
......@@ -88,7 +88,7 @@ test "decrypt" {
8888 const exp_out = [_]u8{ 0x32, 0x43, 0xf6, 0xa8, 0x88, 0x5a, 0x30, 0x8d, 0x31, 0x31, 0x98, 0xa2, 0xe0, 0x37, 0x07, 0x34 };
8989
9090 var out: [exp_out.len]u8 = undefined;
91 var ctx = AES128.initDec(key);
91 var ctx = Aes128.initDec(key);
9292 ctx.decrypt(out[0..], in[0..]);
9393 testing.expectEqualSlices(u8, exp_out[0..], out[0..]);
9494 }
......@@ -103,7 +103,7 @@ test "decrypt" {
103103 const exp_out = [_]u8{ 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff };
104104
105105 var out: [exp_out.len]u8 = undefined;
106 var ctx = AES256.initDec(key);
106 var ctx = Aes256.initDec(key);
107107 ctx.decrypt(out[0..], in[0..]);
108108 testing.expectEqualSlices(u8, exp_out[0..], out[0..]);
109109 }
......@@ -117,8 +117,8 @@ test "expand 128-bit key" {
117117 const exp_dec = [_]*const [32:0]u8{
118118 "2b7e151628aed2a6abf7158809cf4f3c", "a0fafe1788542cb123a339392a6c7605", "f2c295f27a96b9435935807a7359f67f", "3d80477d4716fe3e1e237e446d7a883b", "ef44a541a8525b7fb671253bdb0bad00", "d4d1c6f87c839d87caf2b8bc11f915bc", "6d88a37a110b3efddbf98641ca0093fd", "4e54f70e5f5fc9f384a64fb24ea6dc4f", "ead27321b58dbad2312bf5607f8d292f", "ac7766f319fadc2128d12941575c006e", "d014f9a8c9ee2589e13f0cc8b6630ca6",
119119 };
120 const enc = AES128.initEnc(key);
121 const dec = AES128.initDec(key);
120 const enc = Aes128.initEnc(key);
121 const dec = Aes128.initDec(key);
122122 var exp: [16]u8 = undefined;
123123
124124 for (enc.key_schedule.round_keys) |round_key, i| {
......@@ -139,8 +139,8 @@ test "expand 256-bit key" {
139139 const exp_dec = [_]*const [32:0]u8{
140140 "fe4890d1e6188d0b046df344706c631e", "ada23f4963e23b2455427c8a5c709104", "57c96cf6074f07c0706abb07137f9241", "b668b621ce40046d36a047ae0932ed8e", "34ad1e4450866b367725bcc763152946", "32526c367828b24cf8e043c33f92aa20", "c440b289642b757227a3d7f114309581", "d669a7334a7ade7a80c8f18fc772e9e3", "25ba3c22a06bc7fb4388a28333934270", "54fb808b9c137949cab22ff547ba186c", "6c3d632985d1fbd9e3e36578701be0f3", "4a7459f9c8e8f9c256a156bc8d083799", "42107758e9ec98f066329ea193f8858b", "8ec6bff6829ca03b9e49af7edba96125", "603deb1015ca71be2b73aef0857d7781",
141141 };
142 const enc = AES256.initEnc(key);
143 const dec = AES256.initDec(key);
142 const enc = Aes256.initEnc(key);
143 const dec = Aes256.initDec(key);
144144 var exp: [16]u8 = undefined;
145145
146146 for (enc.key_schedule.round_keys) |round_key, i| {
lib/std/crypto/aes/aesni.zig+33-33
......@@ -13,7 +13,7 @@ const BlockVec = Vector(2, u64);
1313
1414/// A single AES block.
1515pub const Block = struct {
16 pub const block_size: usize = 16;
16 pub const block_length: usize = 16;
1717
1818 /// Internal representation of a block.
1919 repr: BlockVec,
......@@ -165,9 +165,9 @@ pub const Block = struct {
165165 };
166166};
167167
168fn KeySchedule(comptime AES: type) type {
169 std.debug.assert(AES.rounds == 10 or AES.rounds == 14);
170 const rounds = AES.rounds;
168fn KeySchedule(comptime Aes: type) type {
169 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
170 const rounds = Aes.rounds;
171171
172172 return struct {
173173 const Self = @This();
......@@ -243,24 +243,24 @@ fn KeySchedule(comptime AES: type) type {
243243}
244244
245245/// A context to perform encryption using the standard AES key schedule.
246pub fn AESEncryptCtx(comptime AES: type) type {
247 std.debug.assert(AES.key_bits == 128 or AES.key_bits == 256);
248 const rounds = AES.rounds;
246pub fn AesEncryptCtx(comptime Aes: type) type {
247 std.debug.assert(Aes.key_bits == 128 or Aes.key_bits == 256);
248 const rounds = Aes.rounds;
249249
250250 return struct {
251251 const Self = @This();
252 pub const block = AES.block;
253 pub const block_size = block.block_size;
254 key_schedule: KeySchedule(AES),
252 pub const block = Aes.block;
253 pub const block_length = block.block_length;
254 key_schedule: KeySchedule(Aes),
255255
256256 /// Create a new encryption context with the given key.
257 pub fn init(key: [AES.key_bits / 8]u8) Self {
257 pub fn init(key: [Aes.key_bits / 8]u8) Self {
258258 var t1 = Block.fromBytes(key[0..16]);
259 const key_schedule = if (AES.key_bits == 128) ks: {
260 break :ks KeySchedule(AES).expand128(&t1);
259 const key_schedule = if (Aes.key_bits == 128) ks: {
260 break :ks KeySchedule(Aes).expand128(&t1);
261261 } else ks: {
262262 var t2 = Block.fromBytes(key[16..32]);
263 break :ks KeySchedule(AES).expand256(&t1, &t2);
263 break :ks KeySchedule(Aes).expand256(&t1, &t2);
264264 };
265265 return Self{
266266 .key_schedule = key_schedule,
......@@ -335,26 +335,26 @@ pub fn AESEncryptCtx(comptime AES: type) type {
335335}
336336
337337/// A context to perform decryption using the standard AES key schedule.
338pub fn AESDecryptCtx(comptime AES: type) type {
339 std.debug.assert(AES.key_bits == 128 or AES.key_bits == 256);
340 const rounds = AES.rounds;
338pub fn AesDecryptCtx(comptime Aes: type) type {
339 std.debug.assert(Aes.key_bits == 128 or Aes.key_bits == 256);
340 const rounds = Aes.rounds;
341341
342342 return struct {
343343 const Self = @This();
344 pub const block = AES.block;
345 pub const block_size = block.block_size;
346 key_schedule: KeySchedule(AES),
344 pub const block = Aes.block;
345 pub const block_length = block.block_length;
346 key_schedule: KeySchedule(Aes),
347347
348348 /// Create a decryption context from an existing encryption context.
349 pub fn initFromEnc(ctx: AESEncryptCtx(AES)) Self {
349 pub fn initFromEnc(ctx: AesEncryptCtx(Aes)) Self {
350350 return Self{
351351 .key_schedule = ctx.key_schedule.invert(),
352352 };
353353 }
354354
355355 /// Create a new decryption context with the given key.
356 pub fn init(key: [AES.key_bits / 8]u8) Self {
357 const enc_ctx = AESEncryptCtx(AES).init(key);
356 pub fn init(key: [Aes.key_bits / 8]u8) Self {
357 const enc_ctx = AesEncryptCtx(Aes).init(key);
358358 return initFromEnc(enc_ctx);
359359 }
360360
......@@ -395,35 +395,35 @@ pub fn AESDecryptCtx(comptime AES: type) type {
395395}
396396
397397/// AES-128 with the standard key schedule.
398pub const AES128 = struct {
398pub const Aes128 = struct {
399399 pub const key_bits: usize = 128;
400400 pub const rounds = ((key_bits - 64) / 32 + 8);
401401 pub const block = Block;
402402
403403 /// Create a new context for encryption.
404 pub fn initEnc(key: [key_bits / 8]u8) AESEncryptCtx(AES128) {
405 return AESEncryptCtx(AES128).init(key);
404 pub fn initEnc(key: [key_bits / 8]u8) AesEncryptCtx(Aes128) {
405 return AesEncryptCtx(Aes128).init(key);
406406 }
407407
408408 /// Create a new context for decryption.
409 pub fn initDec(key: [key_bits / 8]u8) AESDecryptCtx(AES128) {
410 return AESDecryptCtx(AES128).init(key);
409 pub fn initDec(key: [key_bits / 8]u8) AesDecryptCtx(Aes128) {
410 return AesDecryptCtx(Aes128).init(key);
411411 }
412412};
413413
414414/// AES-256 with the standard key schedule.
415pub const AES256 = struct {
415pub const Aes256 = struct {
416416 pub const key_bits: usize = 256;
417417 pub const rounds = ((key_bits - 64) / 32 + 8);
418418 pub const block = Block;
419419
420420 /// Create a new context for encryption.
421 pub fn initEnc(key: [key_bits / 8]u8) AESEncryptCtx(AES256) {
422 return AESEncryptCtx(AES256).init(key);
421 pub fn initEnc(key: [key_bits / 8]u8) AesEncryptCtx(Aes256) {
422 return AesEncryptCtx(Aes256).init(key);
423423 }
424424
425425 /// Create a new context for decryption.
426 pub fn initDec(key: [key_bits / 8]u8) AESDecryptCtx(AES256) {
427 return AESDecryptCtx(AES256).init(key);
426 pub fn initDec(key: [key_bits / 8]u8) AesDecryptCtx(Aes256) {
427 return AesDecryptCtx(Aes256).init(key);
428428 }
429429};
lib/std/crypto/aes/armcrypto.zig+33-33
......@@ -13,7 +13,7 @@ const BlockVec = Vector(2, u64);
1313
1414/// A single AES block.
1515pub const Block = struct {
16 pub const block_size: usize = 16;
16 pub const block_length: usize = 16;
1717
1818 /// Internal representation of a block.
1919 repr: BlockVec,
......@@ -181,9 +181,9 @@ pub const Block = struct {
181181 };
182182};
183183
184fn KeySchedule(comptime AES: type) type {
185 std.debug.assert(AES.rounds == 10 or AES.rounds == 14);
186 const rounds = AES.rounds;
184fn KeySchedule(comptime Aes: type) type {
185 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
186 const rounds = Aes.rounds;
187187
188188 return struct {
189189 const Self = @This();
......@@ -304,24 +304,24 @@ fn KeySchedule(comptime AES: type) type {
304304}
305305
306306/// A context to perform encryption using the standard AES key schedule.
307pub fn AESEncryptCtx(comptime AES: type) type {
308 std.debug.assert(AES.key_bits == 128 or AES.key_bits == 256);
309 const rounds = AES.rounds;
307pub fn AesEncryptCtx(comptime Aes: type) type {
308 std.debug.assert(Aes.key_bits == 128 or Aes.key_bits == 256);
309 const rounds = Aes.rounds;
310310
311311 return struct {
312312 const Self = @This();
313 pub const block = AES.block;
314 pub const block_size = block.block_size;
315 key_schedule: KeySchedule(AES),
313 pub const block = Aes.block;
314 pub const block_length = block.block_length;
315 key_schedule: KeySchedule(Aes),
316316
317317 /// Create a new encryption context with the given key.
318 pub fn init(key: [AES.key_bits / 8]u8) Self {
318 pub fn init(key: [Aes.key_bits / 8]u8) Self {
319319 var t1 = Block.fromBytes(key[0..16]);
320 const key_schedule = if (AES.key_bits == 128) ks: {
321 break :ks KeySchedule(AES).expand128(&t1);
320 const key_schedule = if (Aes.key_bits == 128) ks: {
321 break :ks KeySchedule(Aes).expand128(&t1);
322322 } else ks: {
323323 var t2 = Block.fromBytes(key[16..32]);
324 break :ks KeySchedule(AES).expand256(&t1, &t2);
324 break :ks KeySchedule(Aes).expand256(&t1, &t2);
325325 };
326326 return Self{
327327 .key_schedule = key_schedule,
......@@ -396,26 +396,26 @@ pub fn AESEncryptCtx(comptime AES: type) type {
396396}
397397
398398/// A context to perform decryption using the standard AES key schedule.
399pub fn AESDecryptCtx(comptime AES: type) type {
400 std.debug.assert(AES.key_bits == 128 or AES.key_bits == 256);
401 const rounds = AES.rounds;
399pub fn AesDecryptCtx(comptime Aes: type) type {
400 std.debug.assert(Aes.key_bits == 128 or Aes.key_bits == 256);
401 const rounds = Aes.rounds;
402402
403403 return struct {
404404 const Self = @This();
405 pub const block = AES.block;
406 pub const block_size = block.block_size;
407 key_schedule: KeySchedule(AES),
405 pub const block = Aes.block;
406 pub const block_length = block.block_length;
407 key_schedule: KeySchedule(Aes),
408408
409409 /// Create a decryption context from an existing encryption context.
410 pub fn initFromEnc(ctx: AESEncryptCtx(AES)) Self {
410 pub fn initFromEnc(ctx: AesEncryptCtx(Aes)) Self {
411411 return Self{
412412 .key_schedule = ctx.key_schedule.invert(),
413413 };
414414 }
415415
416416 /// Create a new decryption context with the given key.
417 pub fn init(key: [AES.key_bits / 8]u8) Self {
418 const enc_ctx = AESEncryptCtx(AES).init(key);
417 pub fn init(key: [Aes.key_bits / 8]u8) Self {
418 const enc_ctx = AesEncryptCtx(Aes).init(key);
419419 return initFromEnc(enc_ctx);
420420 }
421421
......@@ -456,35 +456,35 @@ pub fn AESDecryptCtx(comptime AES: type) type {
456456}
457457
458458/// AES-128 with the standard key schedule.
459pub const AES128 = struct {
459pub const Aes128 = struct {
460460 pub const key_bits: usize = 128;
461461 pub const rounds = ((key_bits - 64) / 32 + 8);
462462 pub const block = Block;
463463
464464 /// Create a new context for encryption.
465 pub fn initEnc(key: [key_bits / 8]u8) AESEncryptCtx(AES128) {
466 return AESEncryptCtx(AES128).init(key);
465 pub fn initEnc(key: [key_bits / 8]u8) AesEncryptCtx(Aes128) {
466 return AesEncryptCtx(Aes128).init(key);
467467 }
468468
469469 /// Create a new context for decryption.
470 pub fn initDec(key: [key_bits / 8]u8) AESDecryptCtx(AES128) {
471 return AESDecryptCtx(AES128).init(key);
470 pub fn initDec(key: [key_bits / 8]u8) AesDecryptCtx(Aes128) {
471 return AesDecryptCtx(Aes128).init(key);
472472 }
473473};
474474
475475/// AES-256 with the standard key schedule.
476pub const AES256 = struct {
476pub const Aes256 = struct {
477477 pub const key_bits: usize = 256;
478478 pub const rounds = ((key_bits - 64) / 32 + 8);
479479 pub const block = Block;
480480
481481 /// Create a new context for encryption.
482 pub fn initEnc(key: [key_bits / 8]u8) AESEncryptCtx(AES256) {
483 return AESEncryptCtx(AES256).init(key);
482 pub fn initEnc(key: [key_bits / 8]u8) AesEncryptCtx(Aes256) {
483 return AesEncryptCtx(Aes256).init(key);
484484 }
485485
486486 /// Create a new context for decryption.
487 pub fn initDec(key: [key_bits / 8]u8) AESDecryptCtx(AES256) {
488 return AESDecryptCtx(AES256).init(key);
487 pub fn initDec(key: [key_bits / 8]u8) AesDecryptCtx(Aes256) {
488 return AesDecryptCtx(Aes256).init(key);
489489 }
490490};
lib/std/crypto/aes/soft.zig+34-34
......@@ -12,7 +12,7 @@ const BlockVec = [4]u32;
1212
1313/// A single AES block.
1414pub const Block = struct {
15 pub const block_size: usize = 16;
15 pub const block_length: usize = 16;
1616
1717 /// Internal representation of a block.
1818 repr: BlockVec align(16),
......@@ -222,19 +222,19 @@ pub const Block = struct {
222222 };
223223};
224224
225fn KeySchedule(comptime AES: type) type {
226 std.debug.assert(AES.rounds == 10 or AES.rounds == 14);
227 const key_size = AES.key_bits / 8;
228 const rounds = AES.rounds;
225fn KeySchedule(comptime Aes: type) type {
226 std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
227 const key_length = Aes.key_bits / 8;
228 const rounds = Aes.rounds;
229229
230230 return struct {
231231 const Self = @This();
232 const words_in_key = key_size / 4;
232 const words_in_key = key_length / 4;
233233
234234 round_keys: [rounds + 1]Block,
235235
236236 // Key expansion algorithm. See FIPS-197, Figure 11.
237 fn expandKey(key: [key_size]u8) Self {
237 fn expandKey(key: [key_length]u8) Self {
238238 const subw = struct {
239239 // Apply sbox0 to each byte in w.
240240 fn func(w: u32) u32 {
......@@ -282,19 +282,19 @@ fn KeySchedule(comptime AES: type) type {
282282}
283283
284284/// A context to perform encryption using the standard AES key schedule.
285pub fn AESEncryptCtx(comptime AES: type) type {
286 std.debug.assert(AES.key_bits == 128 or AES.key_bits == 256);
287 const rounds = AES.rounds;
285pub fn AesEncryptCtx(comptime Aes: type) type {
286 std.debug.assert(Aes.key_bits == 128 or Aes.key_bits == 256);
287 const rounds = Aes.rounds;
288288
289289 return struct {
290290 const Self = @This();
291 pub const block = AES.block;
292 pub const block_size = block.block_size;
293 key_schedule: KeySchedule(AES),
291 pub const block = Aes.block;
292 pub const block_length = block.block_length;
293 key_schedule: KeySchedule(Aes),
294294
295295 /// Create a new encryption context with the given key.
296 pub fn init(key: [AES.key_bits / 8]u8) Self {
297 const key_schedule = KeySchedule(AES).expandKey(key);
296 pub fn init(key: [Aes.key_bits / 8]u8) Self {
297 const key_schedule = KeySchedule(Aes).expandKey(key);
298298 return Self{
299299 .key_schedule = key_schedule,
300300 };
......@@ -343,26 +343,26 @@ pub fn AESEncryptCtx(comptime AES: type) type {
343343}
344344
345345/// A context to perform decryption using the standard AES key schedule.
346pub fn AESDecryptCtx(comptime AES: type) type {
347 std.debug.assert(AES.key_bits == 128 or AES.key_bits == 256);
348 const rounds = AES.rounds;
346pub fn AesDecryptCtx(comptime Aes: type) type {
347 std.debug.assert(Aes.key_bits == 128 or Aes.key_bits == 256);
348 const rounds = Aes.rounds;
349349
350350 return struct {
351351 const Self = @This();
352 pub const block = AES.block;
353 pub const block_size = block.block_size;
354 key_schedule: KeySchedule(AES),
352 pub const block = Aes.block;
353 pub const block_length = block.block_length;
354 key_schedule: KeySchedule(Aes),
355355
356356 /// Create a decryption context from an existing encryption context.
357 pub fn initFromEnc(ctx: AESEncryptCtx(AES)) Self {
357 pub fn initFromEnc(ctx: AesEncryptCtx(Aes)) Self {
358358 return Self{
359359 .key_schedule = ctx.key_schedule.invert(),
360360 };
361361 }
362362
363363 /// Create a new decryption context with the given key.
364 pub fn init(key: [AES.key_bits / 8]u8) Self {
365 const enc_ctx = AESEncryptCtx(AES).init(key);
364 pub fn init(key: [Aes.key_bits / 8]u8) Self {
365 const enc_ctx = AesEncryptCtx(Aes).init(key);
366366 return initFromEnc(enc_ctx);
367367 }
368368
......@@ -389,36 +389,36 @@ pub fn AESDecryptCtx(comptime AES: type) type {
389389}
390390
391391/// AES-128 with the standard key schedule.
392pub const AES128 = struct {
392pub const Aes128 = struct {
393393 pub const key_bits: usize = 128;
394394 pub const rounds = ((key_bits - 64) / 32 + 8);
395395 pub const block = Block;
396396
397397 /// Create a new context for encryption.
398 pub fn initEnc(key: [key_bits / 8]u8) AESEncryptCtx(AES128) {
399 return AESEncryptCtx(AES128).init(key);
398 pub fn initEnc(key: [key_bits / 8]u8) AesEncryptCtx(Aes128) {
399 return AesEncryptCtx(Aes128).init(key);
400400 }
401401
402402 /// Create a new context for decryption.
403 pub fn initDec(key: [key_bits / 8]u8) AESDecryptCtx(AES128) {
404 return AESDecryptCtx(AES128).init(key);
403 pub fn initDec(key: [key_bits / 8]u8) AesDecryptCtx(Aes128) {
404 return AesDecryptCtx(Aes128).init(key);
405405 }
406406};
407407
408408/// AES-256 with the standard key schedule.
409pub const AES256 = struct {
409pub const Aes256 = struct {
410410 pub const key_bits: usize = 256;
411411 pub const rounds = ((key_bits - 64) / 32 + 8);
412412 pub const block = Block;
413413
414414 /// Create a new context for encryption.
415 pub fn initEnc(key: [key_bits / 8]u8) AESEncryptCtx(AES256) {
416 return AESEncryptCtx(AES256).init(key);
415 pub fn initEnc(key: [key_bits / 8]u8) AesEncryptCtx(Aes256) {
416 return AesEncryptCtx(Aes256).init(key);
417417 }
418418
419419 /// Create a new context for decryption.
420 pub fn initDec(key: [key_bits / 8]u8) AESDecryptCtx(AES256) {
421 return AESDecryptCtx(AES256).init(key);
420 pub fn initDec(key: [key_bits / 8]u8) AesDecryptCtx(Aes256) {
421 return AesDecryptCtx(Aes256).init(key);
422422 }
423423};
424424
lib/std/crypto/aes_gcm.zig+29-29
......@@ -7,16 +7,16 @@ const Ghash = std.crypto.onetimeauth.Ghash;
77const mem = std.mem;
88const modes = crypto.core.modes;
99
10pub const AES128GCM = AESGCM(crypto.core.aes.AES128);
11pub const AES256GCM = AESGCM(crypto.core.aes.AES256);
10pub const Aes128Gcm = AesGcm(crypto.core.aes.Aes128);
11pub const Aes256Gcm = AesGcm(crypto.core.aes.Aes256);
1212
13fn AESGCM(comptime AES: anytype) type {
14 debug.assert(AES.block.block_size == 16);
13fn AesGcm(comptime Aes: anytype) type {
14 debug.assert(Aes.block.block_length == 16);
1515
1616 return struct {
1717 pub const tag_length = 16;
1818 pub const nonce_length = 12;
19 pub const key_length = AES.key_bits / 8;
19 pub const key_length = Aes.key_bits / 8;
2020
2121 const zeros = [_]u8{0} ** 16;
2222
......@@ -24,7 +24,7 @@ fn AESGCM(comptime AES: anytype) type {
2424 debug.assert(c.len == m.len);
2525 debug.assert(m.len <= 16 * ((1 << 32) - 2));
2626
27 const aes = AES.initEnc(key);
27 const aes = Aes.initEnc(key);
2828 var h: [16]u8 = undefined;
2929 aes.encrypt(&h, &zeros);
3030
......@@ -56,7 +56,7 @@ fn AESGCM(comptime AES: anytype) type {
5656 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) !void {
5757 assert(c.len == m.len);
5858
59 const aes = AES.initEnc(key);
59 const aes = Aes.initEnc(key);
6060 var h: [16]u8 = undefined;
6161 aes.encrypt(&h, &zeros);
6262
......@@ -101,59 +101,59 @@ fn AESGCM(comptime AES: anytype) type {
101101const htest = @import("test.zig");
102102const testing = std.testing;
103103
104test "AES256GCM - Empty message and no associated data" {
105 const key: [AES256GCM.key_length]u8 = [_]u8{0x69} ** AES256GCM.key_length;
106 const nonce: [AES256GCM.nonce_length]u8 = [_]u8{0x42} ** AES256GCM.nonce_length;
104test "Aes256Gcm - Empty message and no associated data" {
105 const key: [Aes256Gcm.key_length]u8 = [_]u8{0x69} ** Aes256Gcm.key_length;
106 const nonce: [Aes256Gcm.nonce_length]u8 = [_]u8{0x42} ** Aes256Gcm.nonce_length;
107107 const ad = "";
108108 const m = "";
109109 var c: [m.len]u8 = undefined;
110110 var m2: [m.len]u8 = undefined;
111 var tag: [AES256GCM.tag_length]u8 = undefined;
111 var tag: [Aes256Gcm.tag_length]u8 = undefined;
112112
113 AES256GCM.encrypt(&c, &tag, m, ad, nonce, key);
113 Aes256Gcm.encrypt(&c, &tag, m, ad, nonce, key);
114114 htest.assertEqual("6b6ff610a16fa4cd59f1fb7903154e92", &tag);
115115}
116116
117test "AES256GCM - Associated data only" {
118 const key: [AES256GCM.key_length]u8 = [_]u8{0x69} ** AES256GCM.key_length;
119 const nonce: [AES256GCM.nonce_length]u8 = [_]u8{0x42} ** AES256GCM.nonce_length;
117test "Aes256Gcm - Associated data only" {
118 const key: [Aes256Gcm.key_length]u8 = [_]u8{0x69} ** Aes256Gcm.key_length;
119 const nonce: [Aes256Gcm.nonce_length]u8 = [_]u8{0x42} ** Aes256Gcm.nonce_length;
120120 const m = "";
121121 const ad = "Test with associated data";
122122 var c: [m.len]u8 = undefined;
123 var tag: [AES256GCM.tag_length]u8 = undefined;
123 var tag: [Aes256Gcm.tag_length]u8 = undefined;
124124
125 AES256GCM.encrypt(&c, &tag, m, ad, nonce, key);
125 Aes256Gcm.encrypt(&c, &tag, m, ad, nonce, key);
126126 htest.assertEqual("262ed164c2dfb26e080a9d108dd9dd4c", &tag);
127127}
128128
129test "AES256GCM - Message only" {
130 const key: [AES256GCM.key_length]u8 = [_]u8{0x69} ** AES256GCM.key_length;
131 const nonce: [AES256GCM.nonce_length]u8 = [_]u8{0x42} ** AES256GCM.nonce_length;
129test "Aes256Gcm - Message only" {
130 const key: [Aes256Gcm.key_length]u8 = [_]u8{0x69} ** Aes256Gcm.key_length;
131 const nonce: [Aes256Gcm.nonce_length]u8 = [_]u8{0x42} ** Aes256Gcm.nonce_length;
132132 const m = "Test with message only";
133133 const ad = "";
134134 var c: [m.len]u8 = undefined;
135135 var m2: [m.len]u8 = undefined;
136 var tag: [AES256GCM.tag_length]u8 = undefined;
136 var tag: [Aes256Gcm.tag_length]u8 = undefined;
137137
138 AES256GCM.encrypt(&c, &tag, m, ad, nonce, key);
139 try AES256GCM.decrypt(&m2, &c, tag, ad, nonce, key);
138 Aes256Gcm.encrypt(&c, &tag, m, ad, nonce, key);
139 try Aes256Gcm.decrypt(&m2, &c, tag, ad, nonce, key);
140140 testing.expectEqualSlices(u8, m[0..], m2[0..]);
141141
142142 htest.assertEqual("5ca1642d90009fea33d01f78cf6eefaf01d539472f7c", &c);
143143 htest.assertEqual("07cd7fc9103e2f9e9bf2dfaa319caff4", &tag);
144144}
145145
146test "AES256GCM - Message and associated data" {
147 const key: [AES256GCM.key_length]u8 = [_]u8{0x69} ** AES256GCM.key_length;
148 const nonce: [AES256GCM.nonce_length]u8 = [_]u8{0x42} ** AES256GCM.nonce_length;
146test "Aes256Gcm - Message and associated data" {
147 const key: [Aes256Gcm.key_length]u8 = [_]u8{0x69} ** Aes256Gcm.key_length;
148 const nonce: [Aes256Gcm.nonce_length]u8 = [_]u8{0x42} ** Aes256Gcm.nonce_length;
149149 const m = "Test with message";
150150 const ad = "Test with associated data";
151151 var c: [m.len]u8 = undefined;
152152 var m2: [m.len]u8 = undefined;
153 var tag: [AES256GCM.tag_length]u8 = undefined;
153 var tag: [Aes256Gcm.tag_length]u8 = undefined;
154154
155 AES256GCM.encrypt(&c, &tag, m, ad, nonce, key);
156 try AES256GCM.decrypt(&m2, &c, tag, ad, nonce, key);
155 Aes256Gcm.encrypt(&c, &tag, m, ad, nonce, key);
156 try Aes256Gcm.decrypt(&m2, &c, tag, ad, nonce, key);
157157 testing.expectEqualSlices(u8, m[0..], m2[0..]);
158158
159159 htest.assertEqual("5ca1642d90009fea33d01f78cf6eefaf01", &c);
lib/std/crypto/benchmark.zig+20-20
......@@ -73,7 +73,7 @@ pub fn benchmarkMac(comptime Mac: anytype, comptime bytes: comptime_int) !u64 {
7373 var in: [512 * KiB]u8 = undefined;
7474 prng.random.bytes(in[0..]);
7575
76 const key_length = if (Mac.minimum_key_length == 0) 32 else Mac.minimum_key_length;
76 const key_length = if (Mac.key_length == 0) 32 else Mac.key_length;
7777 var key: [key_length]u8 = undefined;
7878 prng.random.bytes(key[0..]);
7979
......@@ -96,12 +96,12 @@ pub fn benchmarkMac(comptime Mac: anytype, comptime bytes: comptime_int) !u64 {
9696const exchanges = [_]Crypto{Crypto{ .ty = crypto.dh.X25519, .name = "x25519" }};
9797
9898pub fn benchmarkKeyExchange(comptime DhKeyExchange: anytype, comptime exchange_count: comptime_int) !u64 {
99 std.debug.assert(DhKeyExchange.minimum_key_length >= DhKeyExchange.secret_length);
99 std.debug.assert(DhKeyExchange.key_length >= DhKeyExchange.secret_length);
100100
101 var in: [DhKeyExchange.minimum_key_length]u8 = undefined;
101 var in: [DhKeyExchange.key_length]u8 = undefined;
102102 prng.random.bytes(in[0..]);
103103
104 var out: [DhKeyExchange.minimum_key_length]u8 = undefined;
104 var out: [DhKeyExchange.key_length]u8 = undefined;
105105 prng.random.bytes(out[0..]);
106106
107107 var timer = try Timer.start();
......@@ -150,10 +150,10 @@ const aeads = [_]Crypto{
150150 Crypto{ .ty = crypto.aead.ChaCha20Poly1305, .name = "chacha20Poly1305" },
151151 Crypto{ .ty = crypto.aead.XChaCha20Poly1305, .name = "xchacha20Poly1305" },
152152 Crypto{ .ty = crypto.aead.Gimli, .name = "gimli-aead" },
153 Crypto{ .ty = crypto.aead.AEGIS128L, .name = "aegis-128l" },
154 Crypto{ .ty = crypto.aead.AEGIS256, .name = "aegis-256" },
155 Crypto{ .ty = crypto.aead.AES128GCM, .name = "aes128-gcm" },
156 Crypto{ .ty = crypto.aead.AES256GCM, .name = "aes256-gcm" },
153 Crypto{ .ty = crypto.aead.Aegis128L, .name = "aegis-128l" },
154 Crypto{ .ty = crypto.aead.Aegis256, .name = "aegis-256" },
155 Crypto{ .ty = crypto.aead.Aes128Gcm, .name = "aes128-gcm" },
156 Crypto{ .ty = crypto.aead.Aes256Gcm, .name = "aes256-gcm" },
157157};
158158
159159pub fn benchmarkAead(comptime Aead: anytype, comptime bytes: comptime_int) !u64 {
......@@ -185,14 +185,14 @@ pub fn benchmarkAead(comptime Aead: anytype, comptime bytes: comptime_int) !u64
185185}
186186
187187const aes = [_]Crypto{
188 Crypto{ .ty = crypto.core.aes.AES128, .name = "aes128-single" },
189 Crypto{ .ty = crypto.core.aes.AES256, .name = "aes256-single" },
188 Crypto{ .ty = crypto.core.aes.Aes128, .name = "aes128-single" },
189 Crypto{ .ty = crypto.core.aes.Aes256, .name = "aes256-single" },
190190};
191191
192pub fn benchmarkAES(comptime AES: anytype, comptime count: comptime_int) !u64 {
193 var key: [AES.key_bits / 8]u8 = undefined;
192pub fn benchmarkAes(comptime Aes: anytype, comptime count: comptime_int) !u64 {
193 var key: [Aes.key_bits / 8]u8 = undefined;
194194 prng.random.bytes(key[0..]);
195 const ctx = AES.initEnc(key);
195 const ctx = Aes.initEnc(key);
196196
197197 var in = [_]u8{0} ** 16;
198198
......@@ -214,14 +214,14 @@ pub fn benchmarkAES(comptime AES: anytype, comptime count: comptime_int) !u64 {
214214}
215215
216216const aes8 = [_]Crypto{
217 Crypto{ .ty = crypto.core.aes.AES128, .name = "aes128-8" },
218 Crypto{ .ty = crypto.core.aes.AES256, .name = "aes256-8" },
217 Crypto{ .ty = crypto.core.aes.Aes128, .name = "aes128-8" },
218 Crypto{ .ty = crypto.core.aes.Aes256, .name = "aes256-8" },
219219};
220220
221pub fn benchmarkAES8(comptime AES: anytype, comptime count: comptime_int) !u64 {
222 var key: [AES.key_bits / 8]u8 = undefined;
221pub fn benchmarkAes8(comptime Aes: anytype, comptime count: comptime_int) !u64 {
222 var key: [Aes.key_bits / 8]u8 = undefined;
223223 prng.random.bytes(key[0..]);
224 const ctx = AES.initEnc(key);
224 const ctx = Aes.initEnc(key);
225225
226226 var in = [_]u8{0} ** (8 * 16);
227227
......@@ -335,14 +335,14 @@ pub fn main() !void {
335335
336336 inline for (aes) |E| {
337337 if (filter == null or std.mem.indexOf(u8, E.name, filter.?) != null) {
338 const throughput = try benchmarkAES(E.ty, mode(100000000));
338 const throughput = try benchmarkAes(E.ty, mode(100000000));
339339 try stdout.print("{:>17}: {:10} ops/s\n", .{ E.name, throughput });
340340 }
341341 }
342342
343343 inline for (aes8) |E| {
344344 if (filter == null or std.mem.indexOf(u8, E.name, filter.?) != null) {
345 const throughput = try benchmarkAES8(E.ty, mode(10000000));
345 const throughput = try benchmarkAes8(E.ty, mode(10000000));
346346 try stdout.print("{:>17}: {:10} ops/s\n", .{ E.name, throughput });
347347 }
348348 }
lib/std/crypto/blake2.zig+39-33
......@@ -18,7 +18,7 @@ const RoundParam = struct {
1818 y: usize,
1919};
2020
21fn Rp(a: usize, b: usize, c: usize, d: usize, x: usize, y: usize) RoundParam {
21fn roundParam(a: usize, b: usize, c: usize, d: usize, x: usize, y: usize) RoundParam {
2222 return RoundParam{
2323 .a = a,
2424 .b = b,
......@@ -32,14 +32,18 @@ fn Rp(a: usize, b: usize, c: usize, d: usize, x: usize, y: usize) RoundParam {
3232/////////////////////
3333// Blake2s
3434
35pub const Blake2s128 = Blake2s(128);
3536pub const Blake2s224 = Blake2s(224);
3637pub const Blake2s256 = Blake2s(256);
3738
38pub fn Blake2s(comptime out_len: usize) type {
39pub fn Blake2s(comptime out_bits: usize) type {
3940 return struct {
4041 const Self = @This();
4142 pub const block_length = 64;
42 pub const digest_length = out_len / 8;
43 pub const digest_length = out_bits / 8;
44 pub const key_length_min = 0;
45 pub const key_length_max = 32;
46 pub const key_length = 32; // recommended key length
4347 pub const Options = struct { key: ?[]const u8 = null, salt: ?[8]u8 = null, context: ?[8]u8 = null };
4448
4549 const iv = [8]u32{
......@@ -73,14 +77,14 @@ pub fn Blake2s(comptime out_len: usize) type {
7377 buf_len: u8,
7478
7579 pub fn init(options: Options) Self {
76 debug.assert(8 <= out_len and out_len <= 512);
80 debug.assert(8 <= out_bits and out_bits <= 256);
7781
7882 var d: Self = undefined;
7983 mem.copy(u32, d.h[0..], iv[0..]);
8084
8185 const key_len = if (options.key) |key| key.len else 0;
8286 // default parameters
83 d.h[0] ^= 0x01010000 ^ @truncate(u32, key_len << 8) ^ @intCast(u32, out_len >> 3);
87 d.h[0] ^= 0x01010000 ^ @truncate(u32, key_len << 8) ^ @intCast(u32, out_bits >> 3);
8488 d.t = 0;
8589 d.buf_len = 0;
8690
......@@ -100,7 +104,7 @@ pub fn Blake2s(comptime out_len: usize) type {
100104 return d;
101105 }
102106
103 pub fn hash(b: []const u8, out: []u8, options: Options) void {
107 pub fn hash(b: []const u8, out: *[digest_length]u8, options: Options) void {
104108 var d = Self.init(options);
105109 d.update(b);
106110 d.final(out);
......@@ -129,14 +133,12 @@ pub fn Blake2s(comptime out_len: usize) type {
129133 d.buf_len += @intCast(u8, b[off..].len);
130134 }
131135
132 pub fn final(d: *Self, out: []u8) void {
133 debug.assert(out.len >= out_len / 8);
134
136 pub fn final(d: *Self, out: *[digest_length]u8) void {
135137 mem.set(u8, d.buf[d.buf_len..], 0);
136138 d.t += d.buf_len;
137139 d.round(d.buf[0..], true);
138140
139 const rr = d.h[0 .. out_len / 32];
141 const rr = d.h[0 .. digest_length / 4];
140142
141143 for (rr) |s, j| {
142144 mem.writeIntSliceLittle(u32, out[4 * j ..], s);
......@@ -164,14 +166,14 @@ pub fn Blake2s(comptime out_len: usize) type {
164166 if (last) v[14] = ~v[14];
165167
166168 const rounds = comptime [_]RoundParam{
167 Rp(0, 4, 8, 12, 0, 1),
168 Rp(1, 5, 9, 13, 2, 3),
169 Rp(2, 6, 10, 14, 4, 5),
170 Rp(3, 7, 11, 15, 6, 7),
171 Rp(0, 5, 10, 15, 8, 9),
172 Rp(1, 6, 11, 12, 10, 11),
173 Rp(2, 7, 8, 13, 12, 13),
174 Rp(3, 4, 9, 14, 14, 15),
169 roundParam(0, 4, 8, 12, 0, 1),
170 roundParam(1, 5, 9, 13, 2, 3),
171 roundParam(2, 6, 10, 14, 4, 5),
172 roundParam(3, 7, 11, 15, 6, 7),
173 roundParam(0, 5, 10, 15, 8, 9),
174 roundParam(1, 6, 11, 12, 10, 11),
175 roundParam(2, 7, 8, 13, 12, 13),
176 roundParam(3, 4, 9, 14, 14, 15),
175177 };
176178
177179 comptime var j: usize = 0;
......@@ -372,15 +374,19 @@ test "comptime blake2s256" {
372374/////////////////////
373375// Blake2b
374376
377pub const Blake2b128 = Blake2b(128);
375378pub const Blake2b256 = Blake2b(256);
376379pub const Blake2b384 = Blake2b(384);
377380pub const Blake2b512 = Blake2b(512);
378381
379pub fn Blake2b(comptime out_len: usize) type {
382pub fn Blake2b(comptime out_bits: usize) type {
380383 return struct {
381384 const Self = @This();
382385 pub const block_length = 128;
383 pub const digest_length = out_len / 8;
386 pub const digest_length = out_bits / 8;
387 pub const key_length_min = 0;
388 pub const key_length_max = 64;
389 pub const key_length = 32; // recommended key length
384390 pub const Options = struct { key: ?[]const u8 = null, salt: ?[16]u8 = null, context: ?[16]u8 = null };
385391
386392 const iv = [8]u64{
......@@ -416,14 +422,14 @@ pub fn Blake2b(comptime out_len: usize) type {
416422 buf_len: u8,
417423
418424 pub fn init(options: Options) Self {
419 debug.assert(8 <= out_len and out_len <= 512);
425 debug.assert(8 <= out_bits and out_bits <= 512);
420426
421427 var d: Self = undefined;
422428 mem.copy(u64, d.h[0..], iv[0..]);
423429
424430 const key_len = if (options.key) |key| key.len else 0;
425431 // default parameters
426 d.h[0] ^= 0x01010000 ^ (key_len << 8) ^ (out_len >> 3);
432 d.h[0] ^= 0x01010000 ^ (key_len << 8) ^ (out_bits >> 3);
427433 d.t = 0;
428434 d.buf_len = 0;
429435
......@@ -443,7 +449,7 @@ pub fn Blake2b(comptime out_len: usize) type {
443449 return d;
444450 }
445451
446 pub fn hash(b: []const u8, out: []u8, options: Options) void {
452 pub fn hash(b: []const u8, out: *[digest_length]u8, options: Options) void {
447453 var d = Self.init(options);
448454 d.update(b);
449455 d.final(out);
......@@ -472,12 +478,12 @@ pub fn Blake2b(comptime out_len: usize) type {
472478 d.buf_len += @intCast(u8, b[off..].len);
473479 }
474480
475 pub fn final(d: *Self, out: []u8) void {
481 pub fn final(d: *Self, out: *[digest_length]u8) void {
476482 mem.set(u8, d.buf[d.buf_len..], 0);
477483 d.t += d.buf_len;
478484 d.round(d.buf[0..], true);
479485
480 const rr = d.h[0 .. out_len / 64];
486 const rr = d.h[0 .. digest_length / 8];
481487
482488 for (rr) |s, j| {
483489 mem.writeIntSliceLittle(u64, out[8 * j ..], s);
......@@ -505,14 +511,14 @@ pub fn Blake2b(comptime out_len: usize) type {
505511 if (last) v[14] = ~v[14];
506512
507513 const rounds = comptime [_]RoundParam{
508 Rp(0, 4, 8, 12, 0, 1),
509 Rp(1, 5, 9, 13, 2, 3),
510 Rp(2, 6, 10, 14, 4, 5),
511 Rp(3, 7, 11, 15, 6, 7),
512 Rp(0, 5, 10, 15, 8, 9),
513 Rp(1, 6, 11, 12, 10, 11),
514 Rp(2, 7, 8, 13, 12, 13),
515 Rp(3, 4, 9, 14, 14, 15),
514 roundParam(0, 4, 8, 12, 0, 1),
515 roundParam(1, 5, 9, 13, 2, 3),
516 roundParam(2, 6, 10, 14, 4, 5),
517 roundParam(3, 7, 11, 15, 6, 7),
518 roundParam(0, 5, 10, 15, 8, 9),
519 roundParam(1, 6, 11, 12, 10, 11),
520 roundParam(2, 7, 8, 13, 12, 13),
521 roundParam(3, 4, 9, 14, 14, 15),
516522 };
517523
518524 comptime var j: usize = 0;
lib/std/crypto/blake3.zig+35-34
......@@ -124,11 +124,11 @@ fn compress(
124124 return state;
125125}
126126
127fn first_8_words(words: [16]u32) [8]u32 {
127fn first8Words(words: [16]u32) [8]u32 {
128128 return @ptrCast(*const [8]u32, &words).*;
129129}
130130
131fn words_from_little_endian_bytes(words: []u32, bytes: []const u8) void {
131fn wordsFromLittleEndianBytes(words: []u32, bytes: []const u8) void {
132132 var byte_slice = bytes;
133133 for (words) |*word| {
134134 word.* = mem.readIntSliceLittle(u32, byte_slice);
......@@ -146,8 +146,8 @@ const Output = struct {
146146 counter: u64,
147147 flags: u8,
148148
149 fn chaining_value(self: *const Output) [8]u32 {
150 return first_8_words(compress(
149 fn chainingValue(self: *const Output) [8]u32 {
150 return first8Words(compress(
151151 self.input_chaining_value,
152152 self.block_words,
153153 self.block_len,
......@@ -156,7 +156,7 @@ const Output = struct {
156156 ));
157157 }
158158
159 fn root_output_bytes(self: *const Output, output: []u8) void {
159 fn rootOutputBytes(self: *const Output, output: []u8) void {
160160 var out_block_it = ChunkIterator.init(output, 2 * OUT_LEN);
161161 var output_block_counter: usize = 0;
162162 while (out_block_it.next()) |out_block| {
......@@ -200,7 +200,7 @@ const ChunkState = struct {
200200 return BLOCK_LEN * @as(usize, self.blocks_compressed) + @as(usize, self.block_len);
201201 }
202202
203 fn fill_block_buf(self: *ChunkState, input: []const u8) []const u8 {
203 fn fillBlockBuf(self: *ChunkState, input: []const u8) []const u8 {
204204 const want = BLOCK_LEN - self.block_len;
205205 const take = math.min(want, input.len);
206206 mem.copy(u8, self.block[self.block_len..][0..take], input[0..take]);
......@@ -208,7 +208,7 @@ const ChunkState = struct {
208208 return input[take..];
209209 }
210210
211 fn start_flag(self: *const ChunkState) u8 {
211 fn startFlag(self: *const ChunkState) u8 {
212212 return if (self.blocks_compressed == 0) CHUNK_START else 0;
213213 }
214214
......@@ -219,13 +219,13 @@ const ChunkState = struct {
219219 // input is coming, so this compression is not CHUNK_END.
220220 if (self.block_len == BLOCK_LEN) {
221221 var block_words: [16]u32 = undefined;
222 words_from_little_endian_bytes(block_words[0..], self.block[0..]);
223 self.chaining_value = first_8_words(compress(
222 wordsFromLittleEndianBytes(block_words[0..], self.block[0..]);
223 self.chaining_value = first8Words(compress(
224224 self.chaining_value,
225225 block_words,
226226 BLOCK_LEN,
227227 self.chunk_counter,
228 self.flags | self.start_flag(),
228 self.flags | self.startFlag(),
229229 ));
230230 self.blocks_compressed += 1;
231231 self.block = [_]u8{0} ** BLOCK_LEN;
......@@ -233,24 +233,24 @@ const ChunkState = struct {
233233 }
234234
235235 // Copy input bytes into the block buffer.
236 input = self.fill_block_buf(input);
236 input = self.fillBlockBuf(input);
237237 }
238238 }
239239
240240 fn output(self: *const ChunkState) Output {
241241 var block_words: [16]u32 = undefined;
242 words_from_little_endian_bytes(block_words[0..], self.block[0..]);
242 wordsFromLittleEndianBytes(block_words[0..], self.block[0..]);
243243 return Output{
244244 .input_chaining_value = self.chaining_value,
245245 .block_words = block_words,
246246 .block_len = self.block_len,
247247 .counter = self.chunk_counter,
248 .flags = self.flags | self.start_flag() | CHUNK_END,
248 .flags = self.flags | self.startFlag() | CHUNK_END,
249249 };
250250 }
251251};
252252
253fn parent_output(
253fn parentOutput(
254254 left_child_cv: [8]u32,
255255 right_child_cv: [8]u32,
256256 key: [8]u32,
......@@ -268,18 +268,18 @@ fn parent_output(
268268 };
269269}
270270
271fn parent_cv(
271fn parentCv(
272272 left_child_cv: [8]u32,
273273 right_child_cv: [8]u32,
274274 key: [8]u32,
275275 flags: u8,
276276) [8]u32 {
277 return parent_output(left_child_cv, right_child_cv, key, flags).chaining_value();
277 return parentOutput(left_child_cv, right_child_cv, key, flags).chainingValue();
278278}
279279
280280/// An incremental hasher that can accept any number of writes.
281281pub const Blake3 = struct {
282 pub const Options = struct { key: ?[KEY_LEN]u8 = null };
282 pub const Options = struct { key: ?[digest_length]u8 = null };
283283 pub const KdfOptions = struct {};
284284
285285 chunk_state: ChunkState,
......@@ -288,8 +288,9 @@ pub const Blake3 = struct {
288288 cv_stack_len: u8 = 0, // 2^54 * CHUNK_LEN = 2^64
289289 flags: u8,
290290
291 pub const digest_length = OUT_LEN;
292291 pub const block_length = BLOCK_LEN;
292 pub const digest_length = OUT_LEN;
293 pub const key_length = KEY_LEN;
293294
294295 fn init_internal(key: [8]u32, flags: u8) Blake3 {
295296 return Blake3{
......@@ -303,7 +304,7 @@ pub const Blake3 = struct {
303304 pub fn init(options: Options) Blake3 {
304305 if (options.key) |key| {
305306 var key_words: [8]u32 = undefined;
306 words_from_little_endian_bytes(key_words[0..], key[0..]);
307 wordsFromLittleEndianBytes(key_words[0..], key[0..]);
307308 return Blake3.init_internal(key_words, KEYED_HASH);
308309 } else {
309310 return Blake3.init_internal(IV, 0);
......@@ -318,7 +319,7 @@ pub const Blake3 = struct {
318319 var context_key: [KEY_LEN]u8 = undefined;
319320 context_hasher.final(context_key[0..]);
320321 var context_key_words: [8]u32 = undefined;
321 words_from_little_endian_bytes(context_key_words[0..], context_key[0..]);
322 wordsFromLittleEndianBytes(context_key_words[0..], context_key[0..]);
322323 return Blake3.init_internal(context_key_words, DERIVE_KEY_MATERIAL);
323324 }
324325
......@@ -328,18 +329,18 @@ pub const Blake3 = struct {
328329 hasher.final(out);
329330 }
330331
331 fn push_cv(self: *Blake3, cv: [8]u32) void {
332 fn pushCv(self: *Blake3, cv: [8]u32) void {
332333 self.cv_stack[self.cv_stack_len] = cv;
333334 self.cv_stack_len += 1;
334335 }
335336
336 fn pop_cv(self: *Blake3) [8]u32 {
337 fn popCv(self: *Blake3) [8]u32 {
337338 self.cv_stack_len -= 1;
338339 return self.cv_stack[self.cv_stack_len];
339340 }
340341
341342 // Section 5.1.2 of the BLAKE3 spec explains this algorithm in more detail.
342 fn add_chunk_chaining_value(self: *Blake3, first_cv: [8]u32, total_chunks: u64) void {
343 fn addChunkChainingValue(self: *Blake3, first_cv: [8]u32, total_chunks: u64) void {
343344 // This chunk might complete some subtrees. For each completed subtree,
344345 // its left child will be the current top entry in the CV stack, and
345346 // its right child will be the current value of `new_cv`. Pop each left
......@@ -350,10 +351,10 @@ pub const Blake3 = struct {
350351 var new_cv = first_cv;
351352 var chunk_counter = total_chunks;
352353 while (chunk_counter & 1 == 0) {
353 new_cv = parent_cv(self.pop_cv(), new_cv, self.key, self.flags);
354 new_cv = parentCv(self.popCv(), new_cv, self.key, self.flags);
354355 chunk_counter >>= 1;
355356 }
356 self.push_cv(new_cv);
357 self.pushCv(new_cv);
357358 }
358359
359360 /// Add input to the hash state. This can be called any number of times.
......@@ -363,9 +364,9 @@ pub const Blake3 = struct {
363364 // If the current chunk is complete, finalize it and reset the
364365 // chunk state. More input is coming, so this chunk is not ROOT.
365366 if (self.chunk_state.len() == CHUNK_LEN) {
366 const chunk_cv = self.chunk_state.output().chaining_value();
367 const chunk_cv = self.chunk_state.output().chainingValue();
367368 const total_chunks = self.chunk_state.chunk_counter + 1;
368 self.add_chunk_chaining_value(chunk_cv, total_chunks);
369 self.addChunkChainingValue(chunk_cv, total_chunks);
369370 self.chunk_state = ChunkState.init(self.key, total_chunks, self.flags);
370371 }
371372
......@@ -386,14 +387,14 @@ pub const Blake3 = struct {
386387 var parent_nodes_remaining: usize = self.cv_stack_len;
387388 while (parent_nodes_remaining > 0) {
388389 parent_nodes_remaining -= 1;
389 output = parent_output(
390 output = parentOutput(
390391 self.cv_stack[parent_nodes_remaining],
391 output.chaining_value(),
392 output.chainingValue(),
392393 self.key,
393394 self.flags,
394395 );
395396 }
396 output.root_output_bytes(out_slice);
397 output.rootOutputBytes(out_slice);
397398 }
398399};
399400
......@@ -561,7 +562,7 @@ const reference_test = ReferenceTest{
561562 },
562563};
563564
564fn test_blake3(hasher: *Blake3, input_len: usize, expected_hex: [262]u8) void {
565fn testBlake3(hasher: *Blake3, input_len: usize, expected_hex: [262]u8) void {
565566 // Save initial state
566567 const initial_state = hasher.*;
567568
......@@ -596,8 +597,8 @@ test "BLAKE3 reference test cases" {
596597 var derive_key = &Blake3.initKdf(reference_test.context_string, .{});
597598
598599 for (reference_test.cases) |t| {
599 test_blake3(hash, t.input_len, t.hash.*);
600 test_blake3(keyed_hash, t.input_len, t.keyed_hash.*);
601 test_blake3(derive_key, t.input_len, t.derive_key.*);
600 testBlake3(hash, t.input_len, t.hash.*);
601 testBlake3(keyed_hash, t.input_len, t.keyed_hash.*);
602 testBlake3(derive_key, t.input_len, t.derive_key.*);
602603 }
603604}
lib/std/crypto/chacha20.zig+17-17
......@@ -317,7 +317,7 @@ fn keyToWords(key: [32]u8) [8]u32 {
317317/// counter, nonce, and key.
318318pub const ChaCha20IETF = struct {
319319 pub fn xor(out: []u8, in: []const u8, counter: u32, key: [32]u8, nonce: [12]u8) void {
320 assert(in.len >= out.len);
320 assert(in.len == out.len);
321321 assert((in.len >> 6) + counter <= maxInt(u32));
322322
323323 var c: [4]u32 = undefined;
......@@ -334,7 +334,7 @@ pub const ChaCha20IETF = struct {
334334/// exceed the 256 GiB limit of the 96-bit nonce version.
335335pub const ChaCha20With64BitNonce = struct {
336336 pub fn xor(out: []u8, in: []const u8, counter: u64, key: [32]u8, nonce: [8]u8) void {
337 assert(in.len >= out.len);
337 assert(in.len == out.len);
338338 assert(counter +% (in.len >> 6) >= counter);
339339
340340 var cursor: usize = 0;
......@@ -345,9 +345,9 @@ pub const ChaCha20With64BitNonce = struct {
345345 c[2] = mem.readIntLittle(u32, nonce[0..4]);
346346 c[3] = mem.readIntLittle(u32, nonce[4..8]);
347347
348 const block_size = (1 << 6);
348 const block_length = (1 << 6);
349349 // The full block size is greater than the address space on a 32bit machine
350 const big_block = if (@sizeOf(usize) > 4) (block_size << 32) else maxInt(usize);
350 const big_block = if (@sizeOf(usize) > 4) (block_length << 32) else maxInt(usize);
351351
352352 // first partial big block
353353 if (((@intCast(u64, maxInt(u32) - @truncate(u32, counter)) + 1) << 6) < in.len) {
......@@ -621,10 +621,10 @@ test "crypto.chacha20 test vector 5" {
621621 testing.expectEqualSlices(u8, &expected_result, &result);
622622}
623623
624pub const chacha20poly1305_tag_size = 16;
624pub const chacha20poly1305_tag_length = 16;
625625
626fn chacha20poly1305SealDetached(ciphertext: []u8, tag: *[chacha20poly1305_tag_size]u8, plaintext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) void {
627 assert(ciphertext.len >= plaintext.len);
626fn chacha20poly1305SealDetached(ciphertext: []u8, tag: *[chacha20poly1305_tag_length]u8, plaintext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) void {
627 assert(ciphertext.len == plaintext.len);
628628
629629 // derive poly1305 key
630630 var polyKey = [_]u8{0} ** 32;
......@@ -655,13 +655,13 @@ fn chacha20poly1305SealDetached(ciphertext: []u8, tag: *[chacha20poly1305_tag_si
655655}
656656
657657fn chacha20poly1305Seal(ciphertextAndTag: []u8, plaintext: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) void {
658 return chacha20poly1305SealDetached(ciphertextAndTag[0..plaintext.len], ciphertextAndTag[plaintext.len..][0..chacha20poly1305_tag_size], plaintext, data, key, nonce);
658 return chacha20poly1305SealDetached(ciphertextAndTag[0..plaintext.len], ciphertextAndTag[plaintext.len..][0..chacha20poly1305_tag_length], plaintext, data, key, nonce);
659659}
660660
661661/// Verifies and decrypts an authenticated message produced by chacha20poly1305SealDetached.
662fn chacha20poly1305OpenDetached(dst: []u8, ciphertext: []const u8, tag: *const [chacha20poly1305_tag_size]u8, data: []const u8, key: [32]u8, nonce: [12]u8) !void {
662fn chacha20poly1305OpenDetached(dst: []u8, ciphertext: []const u8, tag: *const [chacha20poly1305_tag_length]u8, data: []const u8, key: [32]u8, nonce: [12]u8) !void {
663663 // split ciphertext and tag
664 assert(dst.len >= ciphertext.len);
664 assert(dst.len == ciphertext.len);
665665
666666 // derive poly1305 key
667667 var polyKey = [_]u8{0} ** 32;
......@@ -706,11 +706,11 @@ fn chacha20poly1305OpenDetached(dst: []u8, ciphertext: []const u8, tag: *const [
706706
707707/// Verifies and decrypts an authenticated message produced by chacha20poly1305Seal.
708708fn chacha20poly1305Open(dst: []u8, ciphertextAndTag: []const u8, data: []const u8, key: [32]u8, nonce: [12]u8) !void {
709 if (ciphertextAndTag.len < chacha20poly1305_tag_size) {
709 if (ciphertextAndTag.len < chacha20poly1305_tag_length) {
710710 return error.InvalidMessage;
711711 }
712 const ciphertextLen = ciphertextAndTag.len - chacha20poly1305_tag_size;
713 return try chacha20poly1305OpenDetached(dst, ciphertextAndTag[0..ciphertextLen], ciphertextAndTag[ciphertextLen..][0..chacha20poly1305_tag_size], data, key, nonce);
712 const ciphertextLen = ciphertextAndTag.len - chacha20poly1305_tag_length;
713 return try chacha20poly1305OpenDetached(dst, ciphertextAndTag[0..ciphertextLen], ciphertextAndTag[ciphertextLen..][0..chacha20poly1305_tag_length], data, key, nonce);
714714}
715715
716716fn extend(key: [32]u8, nonce: [24]u8) struct { key: [32]u8, nonce: [12]u8 } {
......@@ -730,9 +730,9 @@ pub const XChaCha20IETF = struct {
730730 }
731731};
732732
733pub const xchacha20poly1305_tag_size = 16;
733pub const xchacha20poly1305_tag_length = 16;
734734
735fn xchacha20poly1305SealDetached(ciphertext: []u8, tag: *[chacha20poly1305_tag_size]u8, plaintext: []const u8, data: []const u8, key: [32]u8, nonce: [24]u8) void {
735fn xchacha20poly1305SealDetached(ciphertext: []u8, tag: *[chacha20poly1305_tag_length]u8, plaintext: []const u8, data: []const u8, key: [32]u8, nonce: [24]u8) void {
736736 const extended = extend(key, nonce);
737737 return chacha20poly1305SealDetached(ciphertext, tag, plaintext, data, extended.key, extended.nonce);
738738}
......@@ -743,7 +743,7 @@ fn xchacha20poly1305Seal(ciphertextAndTag: []u8, plaintext: []const u8, data: []
743743}
744744
745745/// Verifies and decrypts an authenticated message produced by xchacha20poly1305SealDetached.
746fn xchacha20poly1305OpenDetached(plaintext: []u8, ciphertext: []const u8, tag: *const [chacha20poly1305_tag_size]u8, data: []const u8, key: [32]u8, nonce: [24]u8) !void {
746fn xchacha20poly1305OpenDetached(plaintext: []u8, ciphertext: []const u8, tag: *const [chacha20poly1305_tag_length]u8, data: []const u8, key: [32]u8, nonce: [24]u8) !void {
747747 const extended = extend(key, nonce);
748748 return try chacha20poly1305OpenDetached(plaintext, ciphertext, tag, data, extended.key, extended.nonce);
749749}
......@@ -883,7 +883,7 @@ test "crypto.xchacha20" {
883883 }
884884 {
885885 const data = "Additional data";
886 var ciphertext: [input.len + xchacha20poly1305_tag_size]u8 = undefined;
886 var ciphertext: [input.len + xchacha20poly1305_tag_length]u8 = undefined;
887887 xchacha20poly1305Seal(ciphertext[0..], input, data, key, nonce);
888888 var out: [input.len]u8 = undefined;
889889 try xchacha20poly1305Open(out[0..], ciphertext[0..], data, key, nonce);
lib/std/crypto/ghash.zig+10-10
......@@ -18,9 +18,9 @@ const mem = std.mem;
1818///
1919/// GHASH is typically used to compute the authentication tag in the AES-GCM construction.
2020pub const Ghash = struct {
21 pub const block_size: usize = 16;
21 pub const block_length: usize = 16;
2222 pub const mac_length = 16;
23 pub const minimum_key_length = 16;
23 pub const key_length = 16;
2424
2525 y0: u64 = 0,
2626 y1: u64 = 0,
......@@ -39,9 +39,9 @@ pub const Ghash = struct {
3939 hh2r: u64 = undefined,
4040
4141 leftover: usize = 0,
42 buf: [block_size]u8 align(16) = undefined,
42 buf: [block_length]u8 align(16) = undefined,
4343
44 pub fn init(key: *const [minimum_key_length]u8) Ghash {
44 pub fn init(key: *const [key_length]u8) Ghash {
4545 const h1 = mem.readIntBig(u64, key[0..8]);
4646 const h0 = mem.readIntBig(u64, key[8..16]);
4747 const h1r = @bitReverse(u64, h1);
......@@ -261,21 +261,21 @@ pub const Ghash = struct {
261261 var mb = m;
262262
263263 if (st.leftover > 0) {
264 const want = math.min(block_size - st.leftover, mb.len);
264 const want = math.min(block_length - st.leftover, mb.len);
265265 const mc = mb[0..want];
266266 for (mc) |x, i| {
267267 st.buf[st.leftover + i] = x;
268268 }
269269 mb = mb[want..];
270270 st.leftover += want;
271 if (st.leftover < block_size) {
271 if (st.leftover < block_length) {
272272 return;
273273 }
274274 st.blocks(&st.buf);
275275 st.leftover = 0;
276276 }
277 if (mb.len >= block_size) {
278 const want = mb.len & ~(block_size - 1);
277 if (mb.len >= block_length) {
278 const want = mb.len & ~(block_length - 1);
279279 st.blocks(mb[0..want]);
280280 mb = mb[want..];
281281 }
......@@ -293,7 +293,7 @@ pub const Ghash = struct {
293293 return;
294294 }
295295 var i = st.leftover;
296 while (i < block_size) : (i += 1) {
296 while (i < block_length) : (i += 1) {
297297 st.buf[i] = 0;
298298 }
299299 st.blocks(&st.buf);
......@@ -308,7 +308,7 @@ pub const Ghash = struct {
308308 mem.secureZero(u8, @ptrCast([*]u8, st)[0..@sizeOf(Ghash)]);
309309 }
310310
311 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [minimum_key_length]u8) void {
311 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void {
312312 var st = Ghash.init(key);
313313 st.update(msg);
314314 st.final(out);
lib/std/crypto/gimli.zig+3-4
......@@ -200,6 +200,7 @@ pub const Hash = struct {
200200 buf_off: usize,
201201
202202 pub const block_length = State.RATE;
203 pub const digest_length = 32;
203204 pub const Options = struct {};
204205
205206 const Self = @This();
......@@ -231,15 +232,13 @@ pub const Hash = struct {
231232 }
232233 }
233234
234 pub const digest_length = 32;
235
236235 /// Finish the current hashing operation, writing the hash to `out`
237236 ///
238237 /// From 4.9 "Application to hashing"
239238 /// By default, Gimli-Hash provides a fixed-length output of 32 bytes
240239 /// (the concatenation of two 16-byte blocks). However, Gimli-Hash can
241240 /// be used as an “extendable one-way function” (XOF).
242 pub fn final(self: *Self, out: []u8) void {
241 pub fn final(self: *Self, out: *[digest_length]u8) void {
243242 const buf = self.state.toSlice();
244243
245244 // XOR 1 into the next byte of the state
......@@ -251,7 +250,7 @@ pub const Hash = struct {
251250 }
252251};
253252
254pub fn hash(out: []u8, in: []const u8, options: Hash.Options) void {
253pub fn hash(out: *[Hash.digest_length]u8, in: []const u8, options: Hash.Options) void {
255254 var st = Hash.init(options);
256255 st.update(in);
257256 st.final(out);
lib/std/crypto/hmac.zig+3-2
......@@ -22,14 +22,15 @@ pub fn Hmac(comptime Hash: type) type {
2222 return struct {
2323 const Self = @This();
2424 pub const mac_length = Hash.digest_length;
25 pub const minimum_key_length = 0;
25 pub const key_length_min = 0;
26 pub const key_length = 32; // recommended key length
2627
2728 o_key_pad: [Hash.block_length]u8,
2829 i_key_pad: [Hash.block_length]u8,
2930 scratch: [Hash.block_length]u8,
3031 hash: Hash,
3132
32 // HMAC(k, m) = H(o_key_pad | H(i_key_pad | msg)) where | is concatenation
33 // HMAC(k, m) = H(o_key_pad || H(i_key_pad || msg)) where || is concatenation
3334 pub fn create(out: []u8, msg: []const u8, key: []const u8) void {
3435 var ctx = Self.init(key);
3536 ctx.update(msg);
lib/std/crypto/md5.zig+70-75
......@@ -6,7 +6,6 @@
66const std = @import("../std.zig");
77const mem = std.mem;
88const math = std.math;
9const debug = std.debug;
109
1110const RoundParam = struct {
1211 a: usize,
......@@ -18,7 +17,7 @@ const RoundParam = struct {
1817 t: u32,
1918};
2019
21fn Rp(a: usize, b: usize, c: usize, d: usize, k: usize, s: u32, t: u32) RoundParam {
20fn roundParam(a: usize, b: usize, c: usize, d: usize, k: usize, s: u32, t: u32) RoundParam {
2221 return RoundParam{
2322 .a = a,
2423 .b = b,
......@@ -59,7 +58,7 @@ pub const Md5 = struct {
5958 };
6059 }
6160
62 pub fn hash(b: []const u8, out: []u8, options: Options) void {
61 pub fn hash(b: []const u8, out: *[digest_length]u8, options: Options) void {
6362 var d = Md5.init(options);
6463 d.update(b);
6564 d.final(out);
......@@ -73,13 +72,13 @@ pub const Md5 = struct {
7372 off += 64 - d.buf_len;
7473 mem.copy(u8, d.buf[d.buf_len..], b[0..off]);
7574
76 d.round(d.buf[0..]);
75 d.round(&d.buf);
7776 d.buf_len = 0;
7877 }
7978
8079 // Full middle blocks.
8180 while (off + 64 <= b.len) : (off += 64) {
82 d.round(b[off .. off + 64]);
81 d.round(b[off..][0..64]);
8382 }
8483
8584 // Copy any remainder for next pass.
......@@ -90,9 +89,7 @@ pub const Md5 = struct {
9089 d.total_len +%= b.len;
9190 }
9291
93 pub fn final(d: *Self, out: []u8) void {
94 debug.assert(out.len >= 16);
95
92 pub fn final(d: *Self, out: *[digest_length]u8) void {
9693 // The buffer here will never be completely full.
9794 mem.set(u8, d.buf[d.buf_len..], 0);
9895
......@@ -122,9 +119,7 @@ pub const Md5 = struct {
122119 }
123120 }
124121
125 fn round(d: *Self, b: []const u8) void {
126 debug.assert(b.len == 64);
127
122 fn round(d: *Self, b: *const [64]u8) void {
128123 var s: [16]u32 = undefined;
129124
130125 var i: usize = 0;
......@@ -145,22 +140,22 @@ pub const Md5 = struct {
145140 };
146141
147142 const round0 = comptime [_]RoundParam{
148 Rp(0, 1, 2, 3, 0, 7, 0xD76AA478),
149 Rp(3, 0, 1, 2, 1, 12, 0xE8C7B756),
150 Rp(2, 3, 0, 1, 2, 17, 0x242070DB),
151 Rp(1, 2, 3, 0, 3, 22, 0xC1BDCEEE),
152 Rp(0, 1, 2, 3, 4, 7, 0xF57C0FAF),
153 Rp(3, 0, 1, 2, 5, 12, 0x4787C62A),
154 Rp(2, 3, 0, 1, 6, 17, 0xA8304613),
155 Rp(1, 2, 3, 0, 7, 22, 0xFD469501),
156 Rp(0, 1, 2, 3, 8, 7, 0x698098D8),
157 Rp(3, 0, 1, 2, 9, 12, 0x8B44F7AF),
158 Rp(2, 3, 0, 1, 10, 17, 0xFFFF5BB1),
159 Rp(1, 2, 3, 0, 11, 22, 0x895CD7BE),
160 Rp(0, 1, 2, 3, 12, 7, 0x6B901122),
161 Rp(3, 0, 1, 2, 13, 12, 0xFD987193),
162 Rp(2, 3, 0, 1, 14, 17, 0xA679438E),
163 Rp(1, 2, 3, 0, 15, 22, 0x49B40821),
143 roundParam(0, 1, 2, 3, 0, 7, 0xD76AA478),
144 roundParam(3, 0, 1, 2, 1, 12, 0xE8C7B756),
145 roundParam(2, 3, 0, 1, 2, 17, 0x242070DB),
146 roundParam(1, 2, 3, 0, 3, 22, 0xC1BDCEEE),
147 roundParam(0, 1, 2, 3, 4, 7, 0xF57C0FAF),
148 roundParam(3, 0, 1, 2, 5, 12, 0x4787C62A),
149 roundParam(2, 3, 0, 1, 6, 17, 0xA8304613),
150 roundParam(1, 2, 3, 0, 7, 22, 0xFD469501),
151 roundParam(0, 1, 2, 3, 8, 7, 0x698098D8),
152 roundParam(3, 0, 1, 2, 9, 12, 0x8B44F7AF),
153 roundParam(2, 3, 0, 1, 10, 17, 0xFFFF5BB1),
154 roundParam(1, 2, 3, 0, 11, 22, 0x895CD7BE),
155 roundParam(0, 1, 2, 3, 12, 7, 0x6B901122),
156 roundParam(3, 0, 1, 2, 13, 12, 0xFD987193),
157 roundParam(2, 3, 0, 1, 14, 17, 0xA679438E),
158 roundParam(1, 2, 3, 0, 15, 22, 0x49B40821),
164159 };
165160 inline for (round0) |r| {
166161 v[r.a] = v[r.a] +% (v[r.d] ^ (v[r.b] & (v[r.c] ^ v[r.d]))) +% r.t +% s[r.k];
......@@ -168,22 +163,22 @@ pub const Md5 = struct {
168163 }
169164
170165 const round1 = comptime [_]RoundParam{
171 Rp(0, 1, 2, 3, 1, 5, 0xF61E2562),
172 Rp(3, 0, 1, 2, 6, 9, 0xC040B340),
173 Rp(2, 3, 0, 1, 11, 14, 0x265E5A51),
174 Rp(1, 2, 3, 0, 0, 20, 0xE9B6C7AA),
175 Rp(0, 1, 2, 3, 5, 5, 0xD62F105D),
176 Rp(3, 0, 1, 2, 10, 9, 0x02441453),
177 Rp(2, 3, 0, 1, 15, 14, 0xD8A1E681),
178 Rp(1, 2, 3, 0, 4, 20, 0xE7D3FBC8),
179 Rp(0, 1, 2, 3, 9, 5, 0x21E1CDE6),
180 Rp(3, 0, 1, 2, 14, 9, 0xC33707D6),
181 Rp(2, 3, 0, 1, 3, 14, 0xF4D50D87),
182 Rp(1, 2, 3, 0, 8, 20, 0x455A14ED),
183 Rp(0, 1, 2, 3, 13, 5, 0xA9E3E905),
184 Rp(3, 0, 1, 2, 2, 9, 0xFCEFA3F8),
185 Rp(2, 3, 0, 1, 7, 14, 0x676F02D9),
186 Rp(1, 2, 3, 0, 12, 20, 0x8D2A4C8A),
166 roundParam(0, 1, 2, 3, 1, 5, 0xF61E2562),
167 roundParam(3, 0, 1, 2, 6, 9, 0xC040B340),
168 roundParam(2, 3, 0, 1, 11, 14, 0x265E5A51),
169 roundParam(1, 2, 3, 0, 0, 20, 0xE9B6C7AA),
170 roundParam(0, 1, 2, 3, 5, 5, 0xD62F105D),
171 roundParam(3, 0, 1, 2, 10, 9, 0x02441453),
172 roundParam(2, 3, 0, 1, 15, 14, 0xD8A1E681),
173 roundParam(1, 2, 3, 0, 4, 20, 0xE7D3FBC8),
174 roundParam(0, 1, 2, 3, 9, 5, 0x21E1CDE6),
175 roundParam(3, 0, 1, 2, 14, 9, 0xC33707D6),
176 roundParam(2, 3, 0, 1, 3, 14, 0xF4D50D87),
177 roundParam(1, 2, 3, 0, 8, 20, 0x455A14ED),
178 roundParam(0, 1, 2, 3, 13, 5, 0xA9E3E905),
179 roundParam(3, 0, 1, 2, 2, 9, 0xFCEFA3F8),
180 roundParam(2, 3, 0, 1, 7, 14, 0x676F02D9),
181 roundParam(1, 2, 3, 0, 12, 20, 0x8D2A4C8A),
187182 };
188183 inline for (round1) |r| {
189184 v[r.a] = v[r.a] +% (v[r.c] ^ (v[r.d] & (v[r.b] ^ v[r.c]))) +% r.t +% s[r.k];
......@@ -191,22 +186,22 @@ pub const Md5 = struct {
191186 }
192187
193188 const round2 = comptime [_]RoundParam{
194 Rp(0, 1, 2, 3, 5, 4, 0xFFFA3942),
195 Rp(3, 0, 1, 2, 8, 11, 0x8771F681),
196 Rp(2, 3, 0, 1, 11, 16, 0x6D9D6122),
197 Rp(1, 2, 3, 0, 14, 23, 0xFDE5380C),
198 Rp(0, 1, 2, 3, 1, 4, 0xA4BEEA44),
199 Rp(3, 0, 1, 2, 4, 11, 0x4BDECFA9),
200 Rp(2, 3, 0, 1, 7, 16, 0xF6BB4B60),
201 Rp(1, 2, 3, 0, 10, 23, 0xBEBFBC70),
202 Rp(0, 1, 2, 3, 13, 4, 0x289B7EC6),
203 Rp(3, 0, 1, 2, 0, 11, 0xEAA127FA),
204 Rp(2, 3, 0, 1, 3, 16, 0xD4EF3085),
205 Rp(1, 2, 3, 0, 6, 23, 0x04881D05),
206 Rp(0, 1, 2, 3, 9, 4, 0xD9D4D039),
207 Rp(3, 0, 1, 2, 12, 11, 0xE6DB99E5),
208 Rp(2, 3, 0, 1, 15, 16, 0x1FA27CF8),
209 Rp(1, 2, 3, 0, 2, 23, 0xC4AC5665),
189 roundParam(0, 1, 2, 3, 5, 4, 0xFFFA3942),
190 roundParam(3, 0, 1, 2, 8, 11, 0x8771F681),
191 roundParam(2, 3, 0, 1, 11, 16, 0x6D9D6122),
192 roundParam(1, 2, 3, 0, 14, 23, 0xFDE5380C),
193 roundParam(0, 1, 2, 3, 1, 4, 0xA4BEEA44),
194 roundParam(3, 0, 1, 2, 4, 11, 0x4BDECFA9),
195 roundParam(2, 3, 0, 1, 7, 16, 0xF6BB4B60),
196 roundParam(1, 2, 3, 0, 10, 23, 0xBEBFBC70),
197 roundParam(0, 1, 2, 3, 13, 4, 0x289B7EC6),
198 roundParam(3, 0, 1, 2, 0, 11, 0xEAA127FA),
199 roundParam(2, 3, 0, 1, 3, 16, 0xD4EF3085),
200 roundParam(1, 2, 3, 0, 6, 23, 0x04881D05),
201 roundParam(0, 1, 2, 3, 9, 4, 0xD9D4D039),
202 roundParam(3, 0, 1, 2, 12, 11, 0xE6DB99E5),
203 roundParam(2, 3, 0, 1, 15, 16, 0x1FA27CF8),
204 roundParam(1, 2, 3, 0, 2, 23, 0xC4AC5665),
210205 };
211206 inline for (round2) |r| {
212207 v[r.a] = v[r.a] +% (v[r.b] ^ v[r.c] ^ v[r.d]) +% r.t +% s[r.k];
......@@ -214,22 +209,22 @@ pub const Md5 = struct {
214209 }
215210
216211 const round3 = comptime [_]RoundParam{
217 Rp(0, 1, 2, 3, 0, 6, 0xF4292244),
218 Rp(3, 0, 1, 2, 7, 10, 0x432AFF97),
219 Rp(2, 3, 0, 1, 14, 15, 0xAB9423A7),
220 Rp(1, 2, 3, 0, 5, 21, 0xFC93A039),
221 Rp(0, 1, 2, 3, 12, 6, 0x655B59C3),
222 Rp(3, 0, 1, 2, 3, 10, 0x8F0CCC92),
223 Rp(2, 3, 0, 1, 10, 15, 0xFFEFF47D),
224 Rp(1, 2, 3, 0, 1, 21, 0x85845DD1),
225 Rp(0, 1, 2, 3, 8, 6, 0x6FA87E4F),
226 Rp(3, 0, 1, 2, 15, 10, 0xFE2CE6E0),
227 Rp(2, 3, 0, 1, 6, 15, 0xA3014314),
228 Rp(1, 2, 3, 0, 13, 21, 0x4E0811A1),
229 Rp(0, 1, 2, 3, 4, 6, 0xF7537E82),
230 Rp(3, 0, 1, 2, 11, 10, 0xBD3AF235),
231 Rp(2, 3, 0, 1, 2, 15, 0x2AD7D2BB),
232 Rp(1, 2, 3, 0, 9, 21, 0xEB86D391),
212 roundParam(0, 1, 2, 3, 0, 6, 0xF4292244),
213 roundParam(3, 0, 1, 2, 7, 10, 0x432AFF97),
214 roundParam(2, 3, 0, 1, 14, 15, 0xAB9423A7),
215 roundParam(1, 2, 3, 0, 5, 21, 0xFC93A039),
216 roundParam(0, 1, 2, 3, 12, 6, 0x655B59C3),
217 roundParam(3, 0, 1, 2, 3, 10, 0x8F0CCC92),
218 roundParam(2, 3, 0, 1, 10, 15, 0xFFEFF47D),
219 roundParam(1, 2, 3, 0, 1, 21, 0x85845DD1),
220 roundParam(0, 1, 2, 3, 8, 6, 0x6FA87E4F),
221 roundParam(3, 0, 1, 2, 15, 10, 0xFE2CE6E0),
222 roundParam(2, 3, 0, 1, 6, 15, 0xA3014314),
223 roundParam(1, 2, 3, 0, 13, 21, 0x4E0811A1),
224 roundParam(0, 1, 2, 3, 4, 6, 0xF7537E82),
225 roundParam(3, 0, 1, 2, 11, 10, 0xBD3AF235),
226 roundParam(2, 3, 0, 1, 2, 15, 0x2AD7D2BB),
227 roundParam(1, 2, 3, 0, 9, 21, 0xEB86D391),
233228 };
234229 inline for (round3) |r| {
235230 v[r.a] = v[r.a] +% (v[r.c] ^ (v[r.b] | ~v[r.d])) +% r.t +% s[r.k];
lib/std/crypto/modes.zig+10-10
......@@ -16,34 +16,34 @@ const debug = std.debug;
1616///
1717/// Important: the counter mode doesn't provide authenticated encryption: the ciphertext can be trivially modified without this being detected.
1818/// As a result, applications should generally never use it directly, but only in a construction that includes a MAC.
19pub fn ctr(comptime BlockCipher: anytype, block_cipher: BlockCipher, dst: []u8, src: []const u8, iv: [BlockCipher.block_size]u8, endian: comptime builtin.Endian) void {
19pub fn ctr(comptime BlockCipher: anytype, block_cipher: BlockCipher, dst: []u8, src: []const u8, iv: [BlockCipher.block_length]u8, endian: comptime builtin.Endian) void {
2020 debug.assert(dst.len >= src.len);
21 const block_size = BlockCipher.block_size;
22 var counter: [BlockCipher.block_size]u8 = undefined;
21 const block_length = BlockCipher.block_length;
22 var counter: [BlockCipher.block_length]u8 = undefined;
2323 var counterInt = mem.readInt(u128, &iv, endian);
2424 var i: usize = 0;
2525
2626 const parallel_count = BlockCipher.block.parallel.optimal_parallel_blocks;
27 const wide_block_size = parallel_count * 16;
28 if (src.len >= wide_block_size) {
27 const wide_block_length = parallel_count * 16;
28 if (src.len >= wide_block_length) {
2929 var counters: [parallel_count * 16]u8 = undefined;
30 while (i + wide_block_size <= src.len) : (i += wide_block_size) {
30 while (i + wide_block_length <= src.len) : (i += wide_block_length) {
3131 comptime var j = 0;
3232 inline while (j < parallel_count) : (j += 1) {
3333 mem.writeInt(u128, counters[j * 16 .. j * 16 + 16], counterInt, endian);
3434 counterInt +%= 1;
3535 }
36 block_cipher.xorWide(parallel_count, dst[i .. i + wide_block_size][0..wide_block_size], src[i .. i + wide_block_size][0..wide_block_size], counters);
36 block_cipher.xorWide(parallel_count, dst[i .. i + wide_block_length][0..wide_block_length], src[i .. i + wide_block_length][0..wide_block_length], counters);
3737 }
3838 }
39 while (i + block_size <= src.len) : (i += block_size) {
39 while (i + block_length <= src.len) : (i += block_length) {
4040 mem.writeInt(u128, &counter, counterInt, endian);
4141 counterInt +%= 1;
42 block_cipher.xor(dst[i .. i + block_size][0..block_size], src[i .. i + block_size][0..block_size], counter);
42 block_cipher.xor(dst[i .. i + block_length][0..block_length], src[i .. i + block_length][0..block_length], counter);
4343 }
4444 if (i < src.len) {
4545 mem.writeInt(u128, &counter, counterInt, endian);
46 var pad = [_]u8{0} ** block_size;
46 var pad = [_]u8{0} ** block_length;
4747 mem.copy(u8, &pad, src[i..]);
4848 block_cipher.xor(&pad, &pad, counter);
4949 mem.copy(u8, dst[i..], pad[0 .. src.len - i]);
lib/std/crypto/poly1305.zig+12-12
......@@ -7,9 +7,9 @@ const std = @import("../std.zig");
77const mem = std.mem;
88
99pub const Poly1305 = struct {
10 pub const block_size: usize = 16;
10 pub const block_length: usize = 16;
1111 pub const mac_length = 16;
12 pub const minimum_key_length = 32;
12 pub const key_length = 32;
1313
1414 // constant multiplier (from the secret key)
1515 r: [3]u64,
......@@ -20,9 +20,9 @@ pub const Poly1305 = struct {
2020 // how many bytes are waiting to be processed in a partial block
2121 leftover: usize = 0,
2222 // partial block buffer
23 buf: [block_size]u8 align(16) = undefined,
23 buf: [block_length]u8 align(16) = undefined,
2424
25 pub fn init(key: *const [minimum_key_length]u8) Poly1305 {
25 pub fn init(key: *const [key_length]u8) Poly1305 {
2626 const t0 = mem.readIntLittle(u64, key[0..8]);
2727 const t1 = mem.readIntLittle(u64, key[8..16]);
2828 return Poly1305{
......@@ -49,7 +49,7 @@ pub const Poly1305 = struct {
4949 const s1 = r1 * (5 << 2);
5050 const s2 = r2 * (5 << 2);
5151 var i: usize = 0;
52 while (i + block_size <= m.len) : (i += block_size) {
52 while (i + block_length <= m.len) : (i += block_length) {
5353 // h += m[i]
5454 const t0 = mem.readIntLittle(u64, m[i..][0..8]);
5555 const t1 = mem.readIntLittle(u64, m[i + 8 ..][0..8]);
......@@ -84,14 +84,14 @@ pub const Poly1305 = struct {
8484
8585 // handle leftover
8686 if (st.leftover > 0) {
87 const want = std.math.min(block_size - st.leftover, mb.len);
87 const want = std.math.min(block_length - st.leftover, mb.len);
8888 const mc = mb[0..want];
8989 for (mc) |x, i| {
9090 st.buf[st.leftover + i] = x;
9191 }
9292 mb = mb[want..];
9393 st.leftover += want;
94 if (st.leftover < block_size) {
94 if (st.leftover < block_length) {
9595 return;
9696 }
9797 st.blocks(&st.buf, false);
......@@ -99,8 +99,8 @@ pub const Poly1305 = struct {
9999 }
100100
101101 // process full blocks
102 if (mb.len >= block_size) {
103 const want = mb.len & ~(block_size - 1);
102 if (mb.len >= block_length) {
103 const want = mb.len & ~(block_length - 1);
104104 st.blocks(mb[0..want], false);
105105 mb = mb[want..];
106106 }
......@@ -120,7 +120,7 @@ pub const Poly1305 = struct {
120120 return;
121121 }
122122 var i = st.leftover;
123 while (i < block_size) : (i += 1) {
123 while (i < block_length) : (i += 1) {
124124 st.buf[i] = 0;
125125 }
126126 st.blocks(&st.buf);
......@@ -132,7 +132,7 @@ pub const Poly1305 = struct {
132132 var i = st.leftover;
133133 st.buf[i] = 1;
134134 i += 1;
135 while (i < block_size) : (i += 1) {
135 while (i < block_length) : (i += 1) {
136136 st.buf[i] = 0;
137137 }
138138 st.blocks(&st.buf, true);
......@@ -198,7 +198,7 @@ pub const Poly1305 = struct {
198198 std.mem.secureZero(u8, @ptrCast([*]u8, st)[0..@sizeOf(Poly1305)]);
199199 }
200200
201 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [minimum_key_length]u8) void {
201 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void {
202202 var st = Poly1305.init(key);
203203 st.update(msg);
204204 st.final(out);
lib/std/crypto/sha1.zig+88-93
......@@ -6,7 +6,6 @@
66const std = @import("../std.zig");
77const mem = std.mem;
88const math = std.math;
9const debug = std.debug;
109
1110const RoundParam = struct {
1211 a: usize,
......@@ -17,7 +16,7 @@ const RoundParam = struct {
1716 i: u32,
1817};
1918
20fn Rp(a: usize, b: usize, c: usize, d: usize, e: usize, i: u32) RoundParam {
19fn roundParam(a: usize, b: usize, c: usize, d: usize, e: usize, i: u32) RoundParam {
2120 return RoundParam{
2221 .a = a,
2322 .b = b,
......@@ -55,7 +54,7 @@ pub const Sha1 = struct {
5554 };
5655 }
5756
58 pub fn hash(b: []const u8, out: []u8, options: Options) void {
57 pub fn hash(b: []const u8, out: *[digest_length]u8, options: Options) void {
5958 var d = Sha1.init(options);
6059 d.update(b);
6160 d.final(out);
......@@ -75,7 +74,7 @@ pub const Sha1 = struct {
7574
7675 // Full middle blocks.
7776 while (off + 64 <= b.len) : (off += 64) {
78 d.round(b[off .. off + 64]);
77 d.round(b[off..][0..64]);
7978 }
8079
8180 // Copy any remainder for next pass.
......@@ -85,9 +84,7 @@ pub const Sha1 = struct {
8584 d.total_len += b.len;
8685 }
8786
88 pub fn final(d: *Self, out: []u8) void {
89 debug.assert(out.len >= 20);
90
87 pub fn final(d: *Self, out: *[digest_length]u8) void {
9188 // The buffer here will never be completely full.
9289 mem.set(u8, d.buf[d.buf_len..], 0);
9390
......@@ -117,9 +114,7 @@ pub const Sha1 = struct {
117114 }
118115 }
119116
120 fn round(d: *Self, b: []const u8) void {
121 debug.assert(b.len == 64);
122
117 fn round(d: *Self, b: *const [64]u8) void {
123118 var s: [16]u32 = undefined;
124119
125120 var v: [5]u32 = [_]u32{
......@@ -131,22 +126,22 @@ pub const Sha1 = struct {
131126 };
132127
133128 const round0a = comptime [_]RoundParam{
134 Rp(0, 1, 2, 3, 4, 0),
135 Rp(4, 0, 1, 2, 3, 1),
136 Rp(3, 4, 0, 1, 2, 2),
137 Rp(2, 3, 4, 0, 1, 3),
138 Rp(1, 2, 3, 4, 0, 4),
139 Rp(0, 1, 2, 3, 4, 5),
140 Rp(4, 0, 1, 2, 3, 6),
141 Rp(3, 4, 0, 1, 2, 7),
142 Rp(2, 3, 4, 0, 1, 8),
143 Rp(1, 2, 3, 4, 0, 9),
144 Rp(0, 1, 2, 3, 4, 10),
145 Rp(4, 0, 1, 2, 3, 11),
146 Rp(3, 4, 0, 1, 2, 12),
147 Rp(2, 3, 4, 0, 1, 13),
148 Rp(1, 2, 3, 4, 0, 14),
149 Rp(0, 1, 2, 3, 4, 15),
129 roundParam(0, 1, 2, 3, 4, 0),
130 roundParam(4, 0, 1, 2, 3, 1),
131 roundParam(3, 4, 0, 1, 2, 2),
132 roundParam(2, 3, 4, 0, 1, 3),
133 roundParam(1, 2, 3, 4, 0, 4),
134 roundParam(0, 1, 2, 3, 4, 5),
135 roundParam(4, 0, 1, 2, 3, 6),
136 roundParam(3, 4, 0, 1, 2, 7),
137 roundParam(2, 3, 4, 0, 1, 8),
138 roundParam(1, 2, 3, 4, 0, 9),
139 roundParam(0, 1, 2, 3, 4, 10),
140 roundParam(4, 0, 1, 2, 3, 11),
141 roundParam(3, 4, 0, 1, 2, 12),
142 roundParam(2, 3, 4, 0, 1, 13),
143 roundParam(1, 2, 3, 4, 0, 14),
144 roundParam(0, 1, 2, 3, 4, 15),
150145 };
151146 inline for (round0a) |r| {
152147 s[r.i] = (@as(u32, b[r.i * 4 + 0]) << 24) | (@as(u32, b[r.i * 4 + 1]) << 16) | (@as(u32, b[r.i * 4 + 2]) << 8) | (@as(u32, b[r.i * 4 + 3]) << 0);
......@@ -156,10 +151,10 @@ pub const Sha1 = struct {
156151 }
157152
158153 const round0b = comptime [_]RoundParam{
159 Rp(4, 0, 1, 2, 3, 16),
160 Rp(3, 4, 0, 1, 2, 17),
161 Rp(2, 3, 4, 0, 1, 18),
162 Rp(1, 2, 3, 4, 0, 19),
154 roundParam(4, 0, 1, 2, 3, 16),
155 roundParam(3, 4, 0, 1, 2, 17),
156 roundParam(2, 3, 4, 0, 1, 18),
157 roundParam(1, 2, 3, 4, 0, 19),
163158 };
164159 inline for (round0b) |r| {
165160 const t = s[(r.i - 3) & 0xf] ^ s[(r.i - 8) & 0xf] ^ s[(r.i - 14) & 0xf] ^ s[(r.i - 16) & 0xf];
......@@ -170,26 +165,26 @@ pub const Sha1 = struct {
170165 }
171166
172167 const round1 = comptime [_]RoundParam{
173 Rp(0, 1, 2, 3, 4, 20),
174 Rp(4, 0, 1, 2, 3, 21),
175 Rp(3, 4, 0, 1, 2, 22),
176 Rp(2, 3, 4, 0, 1, 23),
177 Rp(1, 2, 3, 4, 0, 24),
178 Rp(0, 1, 2, 3, 4, 25),
179 Rp(4, 0, 1, 2, 3, 26),
180 Rp(3, 4, 0, 1, 2, 27),
181 Rp(2, 3, 4, 0, 1, 28),
182 Rp(1, 2, 3, 4, 0, 29),
183 Rp(0, 1, 2, 3, 4, 30),
184 Rp(4, 0, 1, 2, 3, 31),
185 Rp(3, 4, 0, 1, 2, 32),
186 Rp(2, 3, 4, 0, 1, 33),
187 Rp(1, 2, 3, 4, 0, 34),
188 Rp(0, 1, 2, 3, 4, 35),
189 Rp(4, 0, 1, 2, 3, 36),
190 Rp(3, 4, 0, 1, 2, 37),
191 Rp(2, 3, 4, 0, 1, 38),
192 Rp(1, 2, 3, 4, 0, 39),
168 roundParam(0, 1, 2, 3, 4, 20),
169 roundParam(4, 0, 1, 2, 3, 21),
170 roundParam(3, 4, 0, 1, 2, 22),
171 roundParam(2, 3, 4, 0, 1, 23),
172 roundParam(1, 2, 3, 4, 0, 24),
173 roundParam(0, 1, 2, 3, 4, 25),
174 roundParam(4, 0, 1, 2, 3, 26),
175 roundParam(3, 4, 0, 1, 2, 27),
176 roundParam(2, 3, 4, 0, 1, 28),
177 roundParam(1, 2, 3, 4, 0, 29),
178 roundParam(0, 1, 2, 3, 4, 30),
179 roundParam(4, 0, 1, 2, 3, 31),
180 roundParam(3, 4, 0, 1, 2, 32),
181 roundParam(2, 3, 4, 0, 1, 33),
182 roundParam(1, 2, 3, 4, 0, 34),
183 roundParam(0, 1, 2, 3, 4, 35),
184 roundParam(4, 0, 1, 2, 3, 36),
185 roundParam(3, 4, 0, 1, 2, 37),
186 roundParam(2, 3, 4, 0, 1, 38),
187 roundParam(1, 2, 3, 4, 0, 39),
193188 };
194189 inline for (round1) |r| {
195190 const t = s[(r.i - 3) & 0xf] ^ s[(r.i - 8) & 0xf] ^ s[(r.i - 14) & 0xf] ^ s[(r.i - 16) & 0xf];
......@@ -200,26 +195,26 @@ pub const Sha1 = struct {
200195 }
201196
202197 const round2 = comptime [_]RoundParam{
203 Rp(0, 1, 2, 3, 4, 40),
204 Rp(4, 0, 1, 2, 3, 41),
205 Rp(3, 4, 0, 1, 2, 42),
206 Rp(2, 3, 4, 0, 1, 43),
207 Rp(1, 2, 3, 4, 0, 44),
208 Rp(0, 1, 2, 3, 4, 45),
209 Rp(4, 0, 1, 2, 3, 46),
210 Rp(3, 4, 0, 1, 2, 47),
211 Rp(2, 3, 4, 0, 1, 48),
212 Rp(1, 2, 3, 4, 0, 49),
213 Rp(0, 1, 2, 3, 4, 50),
214 Rp(4, 0, 1, 2, 3, 51),
215 Rp(3, 4, 0, 1, 2, 52),
216 Rp(2, 3, 4, 0, 1, 53),
217 Rp(1, 2, 3, 4, 0, 54),
218 Rp(0, 1, 2, 3, 4, 55),
219 Rp(4, 0, 1, 2, 3, 56),
220 Rp(3, 4, 0, 1, 2, 57),
221 Rp(2, 3, 4, 0, 1, 58),
222 Rp(1, 2, 3, 4, 0, 59),
198 roundParam(0, 1, 2, 3, 4, 40),
199 roundParam(4, 0, 1, 2, 3, 41),
200 roundParam(3, 4, 0, 1, 2, 42),
201 roundParam(2, 3, 4, 0, 1, 43),
202 roundParam(1, 2, 3, 4, 0, 44),
203 roundParam(0, 1, 2, 3, 4, 45),
204 roundParam(4, 0, 1, 2, 3, 46),
205 roundParam(3, 4, 0, 1, 2, 47),
206 roundParam(2, 3, 4, 0, 1, 48),
207 roundParam(1, 2, 3, 4, 0, 49),
208 roundParam(0, 1, 2, 3, 4, 50),
209 roundParam(4, 0, 1, 2, 3, 51),
210 roundParam(3, 4, 0, 1, 2, 52),
211 roundParam(2, 3, 4, 0, 1, 53),
212 roundParam(1, 2, 3, 4, 0, 54),
213 roundParam(0, 1, 2, 3, 4, 55),
214 roundParam(4, 0, 1, 2, 3, 56),
215 roundParam(3, 4, 0, 1, 2, 57),
216 roundParam(2, 3, 4, 0, 1, 58),
217 roundParam(1, 2, 3, 4, 0, 59),
223218 };
224219 inline for (round2) |r| {
225220 const t = s[(r.i - 3) & 0xf] ^ s[(r.i - 8) & 0xf] ^ s[(r.i - 14) & 0xf] ^ s[(r.i - 16) & 0xf];
......@@ -230,26 +225,26 @@ pub const Sha1 = struct {
230225 }
231226
232227 const round3 = comptime [_]RoundParam{
233 Rp(0, 1, 2, 3, 4, 60),
234 Rp(4, 0, 1, 2, 3, 61),
235 Rp(3, 4, 0, 1, 2, 62),
236 Rp(2, 3, 4, 0, 1, 63),
237 Rp(1, 2, 3, 4, 0, 64),
238 Rp(0, 1, 2, 3, 4, 65),
239 Rp(4, 0, 1, 2, 3, 66),
240 Rp(3, 4, 0, 1, 2, 67),
241 Rp(2, 3, 4, 0, 1, 68),
242 Rp(1, 2, 3, 4, 0, 69),
243 Rp(0, 1, 2, 3, 4, 70),
244 Rp(4, 0, 1, 2, 3, 71),
245 Rp(3, 4, 0, 1, 2, 72),
246 Rp(2, 3, 4, 0, 1, 73),
247 Rp(1, 2, 3, 4, 0, 74),
248 Rp(0, 1, 2, 3, 4, 75),
249 Rp(4, 0, 1, 2, 3, 76),
250 Rp(3, 4, 0, 1, 2, 77),
251 Rp(2, 3, 4, 0, 1, 78),
252 Rp(1, 2, 3, 4, 0, 79),
228 roundParam(0, 1, 2, 3, 4, 60),
229 roundParam(4, 0, 1, 2, 3, 61),
230 roundParam(3, 4, 0, 1, 2, 62),
231 roundParam(2, 3, 4, 0, 1, 63),
232 roundParam(1, 2, 3, 4, 0, 64),
233 roundParam(0, 1, 2, 3, 4, 65),
234 roundParam(4, 0, 1, 2, 3, 66),
235 roundParam(3, 4, 0, 1, 2, 67),
236 roundParam(2, 3, 4, 0, 1, 68),
237 roundParam(1, 2, 3, 4, 0, 69),
238 roundParam(0, 1, 2, 3, 4, 70),
239 roundParam(4, 0, 1, 2, 3, 71),
240 roundParam(3, 4, 0, 1, 2, 72),
241 roundParam(2, 3, 4, 0, 1, 73),
242 roundParam(1, 2, 3, 4, 0, 74),
243 roundParam(0, 1, 2, 3, 4, 75),
244 roundParam(4, 0, 1, 2, 3, 76),
245 roundParam(3, 4, 0, 1, 2, 77),
246 roundParam(2, 3, 4, 0, 1, 78),
247 roundParam(1, 2, 3, 4, 0, 79),
253248 };
254249 inline for (round3) |r| {
255250 const t = s[(r.i - 3) & 0xf] ^ s[(r.i - 8) & 0xf] ^ s[(r.i - 14) & 0xf] ^ s[(r.i - 16) & 0xf];
......@@ -279,19 +274,19 @@ test "sha1 streaming" {
279274 var h = Sha1.init(.{});
280275 var out: [20]u8 = undefined;
281276
282 h.final(out[0..]);
277 h.final(&out);
283278 htest.assertEqual("da39a3ee5e6b4b0d3255bfef95601890afd80709", out[0..]);
284279
285280 h = Sha1.init(.{});
286281 h.update("abc");
287 h.final(out[0..]);
282 h.final(&out);
288283 htest.assertEqual("a9993e364706816aba3e25717850c26c9cd0d89d", out[0..]);
289284
290285 h = Sha1.init(.{});
291286 h.update("a");
292287 h.update("b");
293288 h.update("c");
294 h.final(out[0..]);
289 h.final(&out);
295290 htest.assertEqual("a9993e364706816aba3e25717850c26c9cd0d89d", out[0..]);
296291}
297292
lib/std/crypto/sha2.zig+178-187
......@@ -6,7 +6,6 @@
66const std = @import("../std.zig");
77const mem = std.mem;
88const math = std.math;
9const debug = std.debug;
109const htest = @import("test.zig");
1110
1211/////////////////////
......@@ -25,7 +24,7 @@ const RoundParam256 = struct {
2524 k: u32,
2625};
2726
28fn Rp256(a: usize, b: usize, c: usize, d: usize, e: usize, f: usize, g: usize, h: usize, i: usize, k: u32) RoundParam256 {
27fn roundParam256(a: usize, b: usize, c: usize, d: usize, e: usize, f: usize, g: usize, h: usize, i: usize, k: u32) RoundParam256 {
2928 return RoundParam256{
3029 .a = a,
3130 .b = b,
......@@ -49,7 +48,7 @@ const Sha2Params32 = struct {
4948 iv5: u32,
5049 iv6: u32,
5150 iv7: u32,
52 out_len: usize,
51 digest_bits: usize,
5352};
5453
5554const Sha224Params = Sha2Params32{
......@@ -61,7 +60,7 @@ const Sha224Params = Sha2Params32{
6160 .iv5 = 0x68581511,
6261 .iv6 = 0x64F98FA7,
6362 .iv7 = 0xBEFA4FA4,
64 .out_len = 224,
63 .digest_bits = 224,
6564};
6665
6766const Sha256Params = Sha2Params32{
......@@ -73,20 +72,20 @@ const Sha256Params = Sha2Params32{
7372 .iv5 = 0x9B05688C,
7473 .iv6 = 0x1F83D9AB,
7574 .iv7 = 0x5BE0CD19,
76 .out_len = 256,
75 .digest_bits = 256,
7776};
7877
7978/// SHA-224
80pub const Sha224 = Sha2_32(Sha224Params);
79pub const Sha224 = Sha2x32(Sha224Params);
8180
8281/// SHA-256
83pub const Sha256 = Sha2_32(Sha256Params);
82pub const Sha256 = Sha2x32(Sha256Params);
8483
85fn Sha2_32(comptime params: Sha2Params32) type {
84fn Sha2x32(comptime params: Sha2Params32) type {
8685 return struct {
8786 const Self = @This();
8887 pub const block_length = 64;
89 pub const digest_length = params.out_len / 8;
88 pub const digest_length = params.digest_bits / 8;
9089 pub const Options = struct {};
9190
9291 s: [8]u32,
......@@ -110,7 +109,7 @@ fn Sha2_32(comptime params: Sha2Params32) type {
110109 };
111110 }
112111
113 pub fn hash(b: []const u8, out: []u8, options: Options) void {
112 pub fn hash(b: []const u8, out: *[digest_length]u8, options: Options) void {
114113 var d = Self.init(options);
115114 d.update(b);
116115 d.final(out);
......@@ -124,13 +123,13 @@ fn Sha2_32(comptime params: Sha2Params32) type {
124123 off += 64 - d.buf_len;
125124 mem.copy(u8, d.buf[d.buf_len..], b[0..off]);
126125
127 d.round(d.buf[0..]);
126 d.round(&d.buf);
128127 d.buf_len = 0;
129128 }
130129
131130 // Full middle blocks.
132131 while (off + 64 <= b.len) : (off += 64) {
133 d.round(b[off .. off + 64]);
132 d.round(b[off..][0..64]);
134133 }
135134
136135 // Copy any remainder for next pass.
......@@ -140,9 +139,7 @@ fn Sha2_32(comptime params: Sha2Params32) type {
140139 d.total_len += b.len;
141140 }
142141
143 pub fn final(d: *Self, out: []u8) void {
144 debug.assert(out.len >= params.out_len / 8);
145
142 pub fn final(d: *Self, out: *[digest_length]u8) void {
146143 // The buffer here will never be completely full.
147144 mem.set(u8, d.buf[d.buf_len..], 0);
148145
......@@ -152,7 +149,7 @@ fn Sha2_32(comptime params: Sha2Params32) type {
152149
153150 // > 448 mod 512 so need to add an extra round to wrap around.
154151 if (64 - d.buf_len < 8) {
155 d.round(d.buf[0..]);
152 d.round(&d.buf);
156153 mem.set(u8, d.buf[0..], 0);
157154 }
158155
......@@ -165,19 +162,17 @@ fn Sha2_32(comptime params: Sha2Params32) type {
165162 len >>= 8;
166163 }
167164
168 d.round(d.buf[0..]);
165 d.round(&d.buf);
169166
170167 // May truncate for possible 224 output
171 const rr = d.s[0 .. params.out_len / 32];
168 const rr = d.s[0 .. params.digest_bits / 32];
172169
173170 for (rr) |s, j| {
174171 mem.writeIntBig(u32, out[4 * j ..][0..4], s);
175172 }
176173 }
177174
178 fn round(d: *Self, b: []const u8) void {
179 debug.assert(b.len == 64);
180
175 fn round(d: *Self, b: *const [64]u8) void {
181176 var s: [64]u32 = undefined;
182177
183178 var i: usize = 0;
......@@ -204,70 +199,70 @@ fn Sha2_32(comptime params: Sha2Params32) type {
204199 };
205200
206201 const round0 = comptime [_]RoundParam256{
207 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 0, 0x428A2F98),
208 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 1, 0x71374491),
209 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 2, 0xB5C0FBCF),
210 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 3, 0xE9B5DBA5),
211 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 4, 0x3956C25B),
212 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 5, 0x59F111F1),
213 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 6, 0x923F82A4),
214 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 7, 0xAB1C5ED5),
215 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 8, 0xD807AA98),
216 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 9, 0x12835B01),
217 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 10, 0x243185BE),
218 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 11, 0x550C7DC3),
219 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 12, 0x72BE5D74),
220 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 13, 0x80DEB1FE),
221 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 14, 0x9BDC06A7),
222 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 15, 0xC19BF174),
223 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 16, 0xE49B69C1),
224 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 17, 0xEFBE4786),
225 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 18, 0x0FC19DC6),
226 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 19, 0x240CA1CC),
227 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 20, 0x2DE92C6F),
228 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 21, 0x4A7484AA),
229 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 22, 0x5CB0A9DC),
230 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 23, 0x76F988DA),
231 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 24, 0x983E5152),
232 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 25, 0xA831C66D),
233 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 26, 0xB00327C8),
234 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 27, 0xBF597FC7),
235 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 28, 0xC6E00BF3),
236 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 29, 0xD5A79147),
237 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 30, 0x06CA6351),
238 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 31, 0x14292967),
239 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 32, 0x27B70A85),
240 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 33, 0x2E1B2138),
241 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 34, 0x4D2C6DFC),
242 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 35, 0x53380D13),
243 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 36, 0x650A7354),
244 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 37, 0x766A0ABB),
245 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 38, 0x81C2C92E),
246 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 39, 0x92722C85),
247 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 40, 0xA2BFE8A1),
248 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 41, 0xA81A664B),
249 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 42, 0xC24B8B70),
250 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 43, 0xC76C51A3),
251 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 44, 0xD192E819),
252 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 45, 0xD6990624),
253 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 46, 0xF40E3585),
254 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 47, 0x106AA070),
255 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 48, 0x19A4C116),
256 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 49, 0x1E376C08),
257 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 50, 0x2748774C),
258 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 51, 0x34B0BCB5),
259 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 52, 0x391C0CB3),
260 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 53, 0x4ED8AA4A),
261 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 54, 0x5B9CCA4F),
262 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 55, 0x682E6FF3),
263 Rp256(0, 1, 2, 3, 4, 5, 6, 7, 56, 0x748F82EE),
264 Rp256(7, 0, 1, 2, 3, 4, 5, 6, 57, 0x78A5636F),
265 Rp256(6, 7, 0, 1, 2, 3, 4, 5, 58, 0x84C87814),
266 Rp256(5, 6, 7, 0, 1, 2, 3, 4, 59, 0x8CC70208),
267 Rp256(4, 5, 6, 7, 0, 1, 2, 3, 60, 0x90BEFFFA),
268 Rp256(3, 4, 5, 6, 7, 0, 1, 2, 61, 0xA4506CEB),
269 Rp256(2, 3, 4, 5, 6, 7, 0, 1, 62, 0xBEF9A3F7),
270 Rp256(1, 2, 3, 4, 5, 6, 7, 0, 63, 0xC67178F2),
202 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 0, 0x428A2F98),
203 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 1, 0x71374491),
204 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 2, 0xB5C0FBCF),
205 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 3, 0xE9B5DBA5),
206 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 4, 0x3956C25B),
207 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 5, 0x59F111F1),
208 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 6, 0x923F82A4),
209 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 7, 0xAB1C5ED5),
210 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 8, 0xD807AA98),
211 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 9, 0x12835B01),
212 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 10, 0x243185BE),
213 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 11, 0x550C7DC3),
214 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 12, 0x72BE5D74),
215 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 13, 0x80DEB1FE),
216 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 14, 0x9BDC06A7),
217 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 15, 0xC19BF174),
218 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 16, 0xE49B69C1),
219 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 17, 0xEFBE4786),
220 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 18, 0x0FC19DC6),
221 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 19, 0x240CA1CC),
222 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 20, 0x2DE92C6F),
223 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 21, 0x4A7484AA),
224 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 22, 0x5CB0A9DC),
225 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 23, 0x76F988DA),
226 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 24, 0x983E5152),
227 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 25, 0xA831C66D),
228 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 26, 0xB00327C8),
229 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 27, 0xBF597FC7),
230 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 28, 0xC6E00BF3),
231 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 29, 0xD5A79147),
232 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 30, 0x06CA6351),
233 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 31, 0x14292967),
234 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 32, 0x27B70A85),
235 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 33, 0x2E1B2138),
236 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 34, 0x4D2C6DFC),
237 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 35, 0x53380D13),
238 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 36, 0x650A7354),
239 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 37, 0x766A0ABB),
240 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 38, 0x81C2C92E),
241 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 39, 0x92722C85),
242 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 40, 0xA2BFE8A1),
243 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 41, 0xA81A664B),
244 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 42, 0xC24B8B70),
245 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 43, 0xC76C51A3),
246 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 44, 0xD192E819),
247 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 45, 0xD6990624),
248 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 46, 0xF40E3585),
249 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 47, 0x106AA070),
250 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 48, 0x19A4C116),
251 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 49, 0x1E376C08),
252 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 50, 0x2748774C),
253 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 51, 0x34B0BCB5),
254 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 52, 0x391C0CB3),
255 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 53, 0x4ED8AA4A),
256 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 54, 0x5B9CCA4F),
257 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 55, 0x682E6FF3),
258 roundParam256(0, 1, 2, 3, 4, 5, 6, 7, 56, 0x748F82EE),
259 roundParam256(7, 0, 1, 2, 3, 4, 5, 6, 57, 0x78A5636F),
260 roundParam256(6, 7, 0, 1, 2, 3, 4, 5, 58, 0x84C87814),
261 roundParam256(5, 6, 7, 0, 1, 2, 3, 4, 59, 0x8CC70208),
262 roundParam256(4, 5, 6, 7, 0, 1, 2, 3, 60, 0x90BEFFFA),
263 roundParam256(3, 4, 5, 6, 7, 0, 1, 2, 61, 0xA4506CEB),
264 roundParam256(2, 3, 4, 5, 6, 7, 0, 1, 62, 0xBEF9A3F7),
265 roundParam256(1, 2, 3, 4, 5, 6, 7, 0, 63, 0xC67178F2),
271266 };
272267 inline for (round0) |r| {
273268 v[r.h] = v[r.h] +% (math.rotr(u32, v[r.e], @as(u32, 6)) ^ math.rotr(u32, v[r.e], @as(u32, 11)) ^ math.rotr(u32, v[r.e], @as(u32, 25))) +% (v[r.g] ^ (v[r.e] & (v[r.f] ^ v[r.g]))) +% r.k +% s[r.i];
......@@ -366,7 +361,7 @@ const RoundParam512 = struct {
366361 k: u64,
367362};
368363
369fn Rp512(a: usize, b: usize, c: usize, d: usize, e: usize, f: usize, g: usize, h: usize, i: usize, k: u64) RoundParam512 {
364fn roundParam512(a: usize, b: usize, c: usize, d: usize, e: usize, f: usize, g: usize, h: usize, i: usize, k: u64) RoundParam512 {
370365 return RoundParam512{
371366 .a = a,
372367 .b = b,
......@@ -390,7 +385,7 @@ const Sha2Params64 = struct {
390385 iv5: u64,
391386 iv6: u64,
392387 iv7: u64,
393 out_len: usize,
388 digest_bits: usize,
394389};
395390
396391const Sha384Params = Sha2Params64{
......@@ -402,7 +397,7 @@ const Sha384Params = Sha2Params64{
402397 .iv5 = 0x8EB44A8768581511,
403398 .iv6 = 0xDB0C2E0D64F98FA7,
404399 .iv7 = 0x47B5481DBEFA4FA4,
405 .out_len = 384,
400 .digest_bits = 384,
406401};
407402
408403const Sha512Params = Sha2Params64{
......@@ -414,7 +409,7 @@ const Sha512Params = Sha2Params64{
414409 .iv5 = 0x9B05688C2B3E6C1F,
415410 .iv6 = 0x1F83D9ABFB41BD6B,
416411 .iv7 = 0x5BE0CD19137E2179,
417 .out_len = 512,
412 .digest_bits = 512,
418413};
419414
420415const Sha512256Params = Sha2Params64{
......@@ -426,7 +421,7 @@ const Sha512256Params = Sha2Params64{
426421 .iv5 = 0xBE5E1E2553863992,
427422 .iv6 = 0x2B0199FC2C85B8AA,
428423 .iv7 = 0x0EB72DDC81C52CA2,
429 .out_len = 256,
424 .digest_bits = 256,
430425};
431426
432427const Sha512T256Params = Sha2Params64{
......@@ -438,26 +433,26 @@ const Sha512T256Params = Sha2Params64{
438433 .iv5 = 0x9B05688C2B3E6C1F,
439434 .iv6 = 0x1F83D9ABFB41BD6B,
440435 .iv7 = 0x5BE0CD19137E2179,
441 .out_len = 256,
436 .digest_bits = 256,
442437};
443438
444439/// SHA-384
445pub const Sha384 = Sha2_64(Sha384Params);
440pub const Sha384 = Sha2x64(Sha384Params);
446441
447442/// SHA-512
448pub const Sha512 = Sha2_64(Sha512Params);
443pub const Sha512 = Sha2x64(Sha512Params);
449444
450445/// SHA-512/256
451pub const Sha512256 = Sha2_64(Sha512256Params);
446pub const Sha512256 = Sha2x64(Sha512256Params);
452447
453448/// Truncated SHA-512
454pub const Sha512T256 = Sha2_64(Sha512T256Params);
449pub const Sha512T256 = Sha2x64(Sha512T256Params);
455450
456fn Sha2_64(comptime params: Sha2Params64) type {
451fn Sha2x64(comptime params: Sha2Params64) type {
457452 return struct {
458453 const Self = @This();
459454 pub const block_length = 128;
460 pub const digest_length = params.out_len / 8;
455 pub const digest_length = params.digest_bits / 8;
461456 pub const Options = struct {};
462457
463458 s: [8]u64,
......@@ -481,7 +476,7 @@ fn Sha2_64(comptime params: Sha2Params64) type {
481476 };
482477 }
483478
484 pub fn hash(b: []const u8, out: []u8, options: Options) void {
479 pub fn hash(b: []const u8, out: *[digest_length]u8, options: Options) void {
485480 var d = Self.init(options);
486481 d.update(b);
487482 d.final(out);
......@@ -495,13 +490,13 @@ fn Sha2_64(comptime params: Sha2Params64) type {
495490 off += 128 - d.buf_len;
496491 mem.copy(u8, d.buf[d.buf_len..], b[0..off]);
497492
498 d.round(d.buf[0..]);
493 d.round(&d.buf);
499494 d.buf_len = 0;
500495 }
501496
502497 // Full middle blocks.
503498 while (off + 128 <= b.len) : (off += 128) {
504 d.round(b[off .. off + 128]);
499 d.round(b[off..][0..128]);
505500 }
506501
507502 // Copy any remainder for next pass.
......@@ -511,9 +506,7 @@ fn Sha2_64(comptime params: Sha2Params64) type {
511506 d.total_len += b.len;
512507 }
513508
514 pub fn final(d: *Self, out: []u8) void {
515 debug.assert(out.len >= params.out_len / 8);
516
509 pub fn final(d: *Self, out: *[digest_length]u8) void {
517510 // The buffer here will never be completely full.
518511 mem.set(u8, d.buf[d.buf_len..], 0);
519512
......@@ -539,16 +532,14 @@ fn Sha2_64(comptime params: Sha2Params64) type {
539532 d.round(d.buf[0..]);
540533
541534 // May truncate for possible 384 output
542 const rr = d.s[0 .. params.out_len / 64];
535 const rr = d.s[0 .. params.digest_bits / 64];
543536
544537 for (rr) |s, j| {
545538 mem.writeIntBig(u64, out[8 * j ..][0..8], s);
546539 }
547540 }
548541
549 fn round(d: *Self, b: []const u8) void {
550 debug.assert(b.len == 128);
551
542 fn round(d: *Self, b: *const [128]u8) void {
552543 var s: [80]u64 = undefined;
553544
554545 var i: usize = 0;
......@@ -581,86 +572,86 @@ fn Sha2_64(comptime params: Sha2Params64) type {
581572 };
582573
583574 const round0 = comptime [_]RoundParam512{
584 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 0, 0x428A2F98D728AE22),
585 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 1, 0x7137449123EF65CD),
586 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 2, 0xB5C0FBCFEC4D3B2F),
587 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 3, 0xE9B5DBA58189DBBC),
588 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 4, 0x3956C25BF348B538),
589 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 5, 0x59F111F1B605D019),
590 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 6, 0x923F82A4AF194F9B),
591 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 7, 0xAB1C5ED5DA6D8118),
592 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 8, 0xD807AA98A3030242),
593 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 9, 0x12835B0145706FBE),
594 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 10, 0x243185BE4EE4B28C),
595 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 11, 0x550C7DC3D5FFB4E2),
596 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 12, 0x72BE5D74F27B896F),
597 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 13, 0x80DEB1FE3B1696B1),
598 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 14, 0x9BDC06A725C71235),
599 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 15, 0xC19BF174CF692694),
600 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 16, 0xE49B69C19EF14AD2),
601 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 17, 0xEFBE4786384F25E3),
602 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 18, 0x0FC19DC68B8CD5B5),
603 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 19, 0x240CA1CC77AC9C65),
604 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 20, 0x2DE92C6F592B0275),
605 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 21, 0x4A7484AA6EA6E483),
606 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 22, 0x5CB0A9DCBD41FBD4),
607 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 23, 0x76F988DA831153B5),
608 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 24, 0x983E5152EE66DFAB),
609 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 25, 0xA831C66D2DB43210),
610 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 26, 0xB00327C898FB213F),
611 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 27, 0xBF597FC7BEEF0EE4),
612 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 28, 0xC6E00BF33DA88FC2),
613 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 29, 0xD5A79147930AA725),
614 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 30, 0x06CA6351E003826F),
615 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 31, 0x142929670A0E6E70),
616 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 32, 0x27B70A8546D22FFC),
617 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 33, 0x2E1B21385C26C926),
618 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 34, 0x4D2C6DFC5AC42AED),
619 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 35, 0x53380D139D95B3DF),
620 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 36, 0x650A73548BAF63DE),
621 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 37, 0x766A0ABB3C77B2A8),
622 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 38, 0x81C2C92E47EDAEE6),
623 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 39, 0x92722C851482353B),
624 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 40, 0xA2BFE8A14CF10364),
625 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 41, 0xA81A664BBC423001),
626 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 42, 0xC24B8B70D0F89791),
627 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 43, 0xC76C51A30654BE30),
628 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 44, 0xD192E819D6EF5218),
629 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 45, 0xD69906245565A910),
630 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 46, 0xF40E35855771202A),
631 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 47, 0x106AA07032BBD1B8),
632 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 48, 0x19A4C116B8D2D0C8),
633 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 49, 0x1E376C085141AB53),
634 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 50, 0x2748774CDF8EEB99),
635 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 51, 0x34B0BCB5E19B48A8),
636 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 52, 0x391C0CB3C5C95A63),
637 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 53, 0x4ED8AA4AE3418ACB),
638 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 54, 0x5B9CCA4F7763E373),
639 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 55, 0x682E6FF3D6B2B8A3),
640 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 56, 0x748F82EE5DEFB2FC),
641 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 57, 0x78A5636F43172F60),
642 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 58, 0x84C87814A1F0AB72),
643 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 59, 0x8CC702081A6439EC),
644 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 60, 0x90BEFFFA23631E28),
645 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 61, 0xA4506CEBDE82BDE9),
646 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 62, 0xBEF9A3F7B2C67915),
647 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 63, 0xC67178F2E372532B),
648 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 64, 0xCA273ECEEA26619C),
649 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 65, 0xD186B8C721C0C207),
650 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 66, 0xEADA7DD6CDE0EB1E),
651 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 67, 0xF57D4F7FEE6ED178),
652 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 68, 0x06F067AA72176FBA),
653 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 69, 0x0A637DC5A2C898A6),
654 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 70, 0x113F9804BEF90DAE),
655 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 71, 0x1B710B35131C471B),
656 Rp512(0, 1, 2, 3, 4, 5, 6, 7, 72, 0x28DB77F523047D84),
657 Rp512(7, 0, 1, 2, 3, 4, 5, 6, 73, 0x32CAAB7B40C72493),
658 Rp512(6, 7, 0, 1, 2, 3, 4, 5, 74, 0x3C9EBE0A15C9BEBC),
659 Rp512(5, 6, 7, 0, 1, 2, 3, 4, 75, 0x431D67C49C100D4C),
660 Rp512(4, 5, 6, 7, 0, 1, 2, 3, 76, 0x4CC5D4BECB3E42B6),
661 Rp512(3, 4, 5, 6, 7, 0, 1, 2, 77, 0x597F299CFC657E2A),
662 Rp512(2, 3, 4, 5, 6, 7, 0, 1, 78, 0x5FCB6FAB3AD6FAEC),
663 Rp512(1, 2, 3, 4, 5, 6, 7, 0, 79, 0x6C44198C4A475817),
575 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 0, 0x428A2F98D728AE22),
576 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 1, 0x7137449123EF65CD),
577 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 2, 0xB5C0FBCFEC4D3B2F),
578 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 3, 0xE9B5DBA58189DBBC),
579 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 4, 0x3956C25BF348B538),
580 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 5, 0x59F111F1B605D019),
581 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 6, 0x923F82A4AF194F9B),
582 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 7, 0xAB1C5ED5DA6D8118),
583 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 8, 0xD807AA98A3030242),
584 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 9, 0x12835B0145706FBE),
585 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 10, 0x243185BE4EE4B28C),
586 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 11, 0x550C7DC3D5FFB4E2),
587 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 12, 0x72BE5D74F27B896F),
588 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 13, 0x80DEB1FE3B1696B1),
589 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 14, 0x9BDC06A725C71235),
590 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 15, 0xC19BF174CF692694),
591 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 16, 0xE49B69C19EF14AD2),
592 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 17, 0xEFBE4786384F25E3),
593 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 18, 0x0FC19DC68B8CD5B5),
594 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 19, 0x240CA1CC77AC9C65),
595 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 20, 0x2DE92C6F592B0275),
596 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 21, 0x4A7484AA6EA6E483),
597 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 22, 0x5CB0A9DCBD41FBD4),
598 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 23, 0x76F988DA831153B5),
599 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 24, 0x983E5152EE66DFAB),
600 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 25, 0xA831C66D2DB43210),
601 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 26, 0xB00327C898FB213F),
602 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 27, 0xBF597FC7BEEF0EE4),
603 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 28, 0xC6E00BF33DA88FC2),
604 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 29, 0xD5A79147930AA725),
605 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 30, 0x06CA6351E003826F),
606 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 31, 0x142929670A0E6E70),
607 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 32, 0x27B70A8546D22FFC),
608 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 33, 0x2E1B21385C26C926),
609 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 34, 0x4D2C6DFC5AC42AED),
610 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 35, 0x53380D139D95B3DF),
611 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 36, 0x650A73548BAF63DE),
612 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 37, 0x766A0ABB3C77B2A8),
613 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 38, 0x81C2C92E47EDAEE6),
614 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 39, 0x92722C851482353B),
615 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 40, 0xA2BFE8A14CF10364),
616 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 41, 0xA81A664BBC423001),
617 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 42, 0xC24B8B70D0F89791),
618 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 43, 0xC76C51A30654BE30),
619 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 44, 0xD192E819D6EF5218),
620 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 45, 0xD69906245565A910),
621 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 46, 0xF40E35855771202A),
622 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 47, 0x106AA07032BBD1B8),
623 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 48, 0x19A4C116B8D2D0C8),
624 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 49, 0x1E376C085141AB53),
625 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 50, 0x2748774CDF8EEB99),
626 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 51, 0x34B0BCB5E19B48A8),
627 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 52, 0x391C0CB3C5C95A63),
628 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 53, 0x4ED8AA4AE3418ACB),
629 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 54, 0x5B9CCA4F7763E373),
630 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 55, 0x682E6FF3D6B2B8A3),
631 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 56, 0x748F82EE5DEFB2FC),
632 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 57, 0x78A5636F43172F60),
633 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 58, 0x84C87814A1F0AB72),
634 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 59, 0x8CC702081A6439EC),
635 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 60, 0x90BEFFFA23631E28),
636 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 61, 0xA4506CEBDE82BDE9),
637 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 62, 0xBEF9A3F7B2C67915),
638 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 63, 0xC67178F2E372532B),
639 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 64, 0xCA273ECEEA26619C),
640 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 65, 0xD186B8C721C0C207),
641 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 66, 0xEADA7DD6CDE0EB1E),
642 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 67, 0xF57D4F7FEE6ED178),
643 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 68, 0x06F067AA72176FBA),
644 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 69, 0x0A637DC5A2C898A6),
645 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 70, 0x113F9804BEF90DAE),
646 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 71, 0x1B710B35131C471B),
647 roundParam512(0, 1, 2, 3, 4, 5, 6, 7, 72, 0x28DB77F523047D84),
648 roundParam512(7, 0, 1, 2, 3, 4, 5, 6, 73, 0x32CAAB7B40C72493),
649 roundParam512(6, 7, 0, 1, 2, 3, 4, 5, 74, 0x3C9EBE0A15C9BEBC),
650 roundParam512(5, 6, 7, 0, 1, 2, 3, 4, 75, 0x431D67C49C100D4C),
651 roundParam512(4, 5, 6, 7, 0, 1, 2, 3, 76, 0x4CC5D4BECB3E42B6),
652 roundParam512(3, 4, 5, 6, 7, 0, 1, 2, 77, 0x597F299CFC657E2A),
653 roundParam512(2, 3, 4, 5, 6, 7, 0, 1, 78, 0x5FCB6FAB3AD6FAEC),
654 roundParam512(1, 2, 3, 4, 5, 6, 7, 0, 79, 0x6C44198C4A475817),
664655 };
665656 inline for (round0) |r| {
666657 v[r.h] = v[r.h] +% (math.rotr(u64, v[r.e], @as(u64, 14)) ^ math.rotr(u64, v[r.e], @as(u64, 18)) ^ math.rotr(u64, v[r.e], @as(u64, 41))) +% (v[r.g] ^ (v[r.e] & (v[r.f] ^ v[r.g]))) +% r.k +% s[r.i];
lib/std/crypto/sha3.zig+6-8
......@@ -29,7 +29,7 @@ fn Keccak(comptime bits: usize, comptime delim: u8) type {
2929 return Self{ .s = [_]u8{0} ** 200, .offset = 0, .rate = 200 - (bits / 4) };
3030 }
3131
32 pub fn hash(b: []const u8, out: []u8, options: Options) void {
32 pub fn hash(b: []const u8, out: *[digest_length]u8, options: Options) void {
3333 var d = Self.init(options);
3434 d.update(b);
3535 d.final(out);
......@@ -46,7 +46,7 @@ fn Keccak(comptime bits: usize, comptime delim: u8) type {
4646 for (d.s[offset .. offset + rate]) |*r, i|
4747 r.* ^= b[ip..][i];
4848
49 keccak_f(1600, d.s[0..]);
49 keccakF(1600, &d.s);
5050
5151 ip += rate;
5252 len -= rate;
......@@ -60,12 +60,12 @@ fn Keccak(comptime bits: usize, comptime delim: u8) type {
6060 d.offset = offset + len;
6161 }
6262
63 pub fn final(d: *Self, out: []u8) void {
63 pub fn final(d: *Self, out: *[digest_length]u8) void {
6464 // padding
6565 d.s[d.offset] ^= delim;
6666 d.s[d.rate - 1] ^= 0x80;
6767
68 keccak_f(1600, d.s[0..]);
68 keccakF(1600, &d.s);
6969
7070 // squeeze
7171 var op: usize = 0;
......@@ -73,7 +73,7 @@ fn Keccak(comptime bits: usize, comptime delim: u8) type {
7373
7474 while (len >= d.rate) {
7575 mem.copy(u8, out[op..], d.s[0..d.rate]);
76 keccak_f(1600, d.s[0..]);
76 keccakF(1600, &d.s);
7777 op += d.rate;
7878 len -= d.rate;
7979 }
......@@ -104,9 +104,7 @@ const M5 = [_]usize{
104104 0, 1, 2, 3, 4, 0, 1, 2, 3, 4,
105105};
106106
107fn keccak_f(comptime F: usize, d: []u8) void {
108 debug.assert(d.len == F / 8);
109
107fn keccakF(comptime F: usize, d: *[F / 8]u8) void {
110108 const B = F / 25;
111109 const no_rounds = comptime x: {
112110 break :x 12 + 2 * math.log2(B);
lib/std/crypto/siphash.zig+15-19
......@@ -51,8 +51,9 @@ fn SipHashStateless(comptime T: type, comptime c_rounds: usize, comptime d_round
5151
5252 return struct {
5353 const Self = @This();
54 const digest_size = 64;
55 const block_size = 64;
54 const block_length = 64;
55 const digest_length = 64;
56 const key_length = 16;
5657
5758 v0: u64,
5859 v1: u64,
......@@ -60,9 +61,7 @@ fn SipHashStateless(comptime T: type, comptime c_rounds: usize, comptime d_round
6061 v3: u64,
6162 msg_len: u8,
6263
63 pub fn init(key: []const u8) Self {
64 assert(key.len >= 16);
65
64 pub fn init(key: *const [key_length]u8) Self {
6665 const k0 = mem.readIntLittle(u64, key[0..8]);
6766 const k1 = mem.readIntLittle(u64, key[8..16]);
6867
......@@ -86,7 +85,7 @@ fn SipHashStateless(comptime T: type, comptime c_rounds: usize, comptime d_round
8685
8786 var off: usize = 0;
8887 while (off < b.len) : (off += 8) {
89 @call(.{ .modifier = .always_inline }, self.round, .{b[off .. off + 8]});
88 @call(.{ .modifier = .always_inline }, self.round, .{b[off..][0..8].*});
9089 }
9190
9291 self.msg_len +%= @truncate(u8, b.len);
......@@ -100,7 +99,7 @@ fn SipHashStateless(comptime T: type, comptime c_rounds: usize, comptime d_round
10099 var buf = [_]u8{0} ** 8;
101100 mem.copy(u8, buf[0..], b[0..]);
102101 buf[7] = self.msg_len;
103 self.round(buf[0..]);
102 self.round(buf);
104103
105104 if (T == u128) {
106105 self.v2 ^= 0xee;
......@@ -132,9 +131,7 @@ fn SipHashStateless(comptime T: type, comptime c_rounds: usize, comptime d_round
132131 return (@as(u128, b2) << 64) | b1;
133132 }
134133
135 fn round(self: *Self, b: []const u8) void {
136 assert(b.len == 8);
137
134 fn round(self: *Self, b: [8]u8) void {
138135 const m = mem.readIntLittle(u64, b[0..8]);
139136 self.v3 ^= m;
140137
......@@ -165,7 +162,7 @@ fn SipHashStateless(comptime T: type, comptime c_rounds: usize, comptime d_round
165162 d.v2 = math.rotl(u64, d.v2, @as(u64, 32));
166163 }
167164
168 pub fn hash(msg: []const u8, key: []const u8) T {
165 pub fn hash(msg: []const u8, key: *const [key_length]u8) T {
169166 const aligned_len = msg.len - (msg.len % 8);
170167 var c = Self.init(key);
171168 @call(.{ .modifier = .always_inline }, c.update, .{msg[0..aligned_len]});
......@@ -181,7 +178,7 @@ fn SipHash(comptime T: type, comptime c_rounds: usize, comptime d_rounds: usize)
181178 return struct {
182179 const State = SipHashStateless(T, c_rounds, d_rounds);
183180 const Self = @This();
184 pub const minimum_key_length = 16;
181 pub const key_length = 16;
185182 pub const mac_length = @sizeOf(T);
186183 pub const block_length = 8;
187184
......@@ -190,7 +187,7 @@ fn SipHash(comptime T: type, comptime c_rounds: usize, comptime d_rounds: usize)
190187 buf_len: usize,
191188
192189 /// Initialize a state for a SipHash function
193 pub fn init(key: []const u8) Self {
190 pub fn init(key: *const [key_length]u8) Self {
194191 return Self{
195192 .state = State.init(key),
196193 .buf = undefined,
......@@ -219,16 +216,15 @@ fn SipHash(comptime T: type, comptime c_rounds: usize, comptime d_rounds: usize)
219216
220217 /// Return an authentication tag for the current state
221218 /// Assumes `out` is less than or equal to `mac_length`.
222 pub fn final(self: *Self, out: []u8) void {
223 std.debug.assert(out.len <= mac_length);
224 mem.writeIntLittle(T, out[0..mac_length], self.state.final(self.buf[0..self.buf_len]));
219 pub fn final(self: *Self, out: *[mac_length]u8) void {
220 mem.writeIntLittle(T, out, self.state.final(self.buf[0..self.buf_len]));
225221 }
226222
227223 /// Return an authentication tag for a message and a key
228 pub fn create(out: []u8, msg: []const u8, key: []const u8) void {
224 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void {
229225 var ctx = Self.init(key);
230226 ctx.update(msg);
231 ctx.final(out[0..]);
227 ctx.final(out);
232228 }
233229
234230 /// Return an authentication tag for the current state, as an integer
......@@ -237,7 +233,7 @@ fn SipHash(comptime T: type, comptime c_rounds: usize, comptime d_rounds: usize)
237233 }
238234
239235 /// Return an authentication tag for a message and a key, as an integer
240 pub fn toInt(msg: []const u8, key: []const u8) T {
236 pub fn toInt(msg: []const u8, key: *const [key_length]u8) T {
241237 return State.hash(msg, key);
242238 }
243239 };
lib/std/crypto/test.zig+8-8
......@@ -8,18 +8,18 @@ const testing = std.testing;
88const fmt = std.fmt;
99
1010// Hash using the specified hasher `H` asserting `expected == H(input)`.
11pub fn assertEqualHash(comptime Hasher: anytype, comptime expected: []const u8, input: []const u8) void {
12 var h: [expected.len / 2]u8 = undefined;
13 Hasher.hash(input, h[0..], .{});
11pub fn assertEqualHash(comptime Hasher: anytype, comptime expected_hex: *const [Hasher.digest_length * 2:0]u8, input: []const u8) void {
12 var h: [Hasher.digest_length]u8 = undefined;
13 Hasher.hash(input, &h, .{});
1414
15 assertEqual(expected, &h);
15 assertEqual(expected_hex, &h);
1616}
1717
18// Assert `expected` == `input` where `input` is a bytestring.
19pub fn assertEqual(comptime expected: []const u8, input: []const u8) void {
20 var expected_bytes: [expected.len / 2]u8 = undefined;
18// Assert `expected` == hex(`input`) where `input` is a bytestring
19pub fn assertEqual(comptime expected_hex: [:0]const u8, input: []const u8) void {
20 var expected_bytes: [expected_hex.len / 2]u8 = undefined;
2121 for (expected_bytes) |*r, i| {
22 r.* = fmt.parseInt(u8, expected[2 * i .. 2 * i + 2], 16) catch unreachable;
22 r.* = fmt.parseInt(u8, expected_hex[2 * i .. 2 * i + 2], 16) catch unreachable;
2323 }
2424
2525 testing.expectEqualSlices(u8, &expected_bytes, input);
src/Cache.zig+2-2
......@@ -35,7 +35,7 @@ const manifest_file_size_max = 50 * 1024 * 1024;
3535pub const Hasher = crypto.auth.siphash.SipHash128(1, 3);
3636
3737/// Initial state, that can be copied.
38pub const hasher_init: Hasher = Hasher.init(&[_]u8{0} ** Hasher.minimum_key_length);
38pub const hasher_init: Hasher = Hasher.init(&[_]u8{0} ** Hasher.key_length);
3939
4040pub const File = struct {
4141 path: ?[]const u8,
......@@ -600,7 +600,7 @@ pub fn writeSmallFile(dir: fs.Dir, sub_path: []const u8, data: []const u8) !void
600600 }
601601}
602602
603fn hashFile(file: fs.File, bin_digest: []u8) !void {
603fn hashFile(file: fs.File, bin_digest: *[Hasher.mac_length]u8) !void {
604604 var buf: [1024]u8 = undefined;
605605
606606 var hasher = hasher_init;