OpenCoverage

blake2b.c

Absolute File Name:/home/opencoverage/opencoverage/guest-scripts/openssl/src/crypto/blake2/blake2b.c
Source codeSwitch to Preprocessed file
LineSourceCount
1/*-
2 * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.-
3 *-
4 * Licensed under the OpenSSL license (the "License"). You may not use-
5 * this file except in compliance with the License. You can obtain a copy-
6 * in the file LICENSE in the source distribution or at-
7 * https://www.openssl.org/source/license.html-
8 */-
9-
10/*-
11 * Derived from the BLAKE2 reference implementation written by Samuel Neves.-
12 * Copyright 2012, Samuel Neves <sneves@dei.uc.pt>-
13 * More information about the BLAKE2 hash function and its implementations-
14 * can be found at https://blake2.net.-
15 */-
16-
17#include <assert.h>-
18#include <string.h>-
19#include <openssl/crypto.h>-
20-
21#include "blake2_locl.h"-
22#include "blake2_impl.h"-
23-
24static const uint64_t blake2b_IV[8] =-
25{-
26 0x6a09e667f3bcc908U, 0xbb67ae8584caa73bU,-
27 0x3c6ef372fe94f82bU, 0xa54ff53a5f1d36f1U,-
28 0x510e527fade682d1U, 0x9b05688c2b3e6c1fU,-
29 0x1f83d9abfb41bd6bU, 0x5be0cd19137e2179U-
30};-
31-
32static const uint8_t blake2b_sigma[12][16] =-
33{-
34 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,-
35 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,-
36 { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,-
37 { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,-
38 { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,-
39 { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,-
40 { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,-
41 { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,-
42 { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,-
43 { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,-
44 { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,-
45 { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }-
46};-
47-
48/* Set that it's the last block we'll compress */-
49static ossl_inline void blake2b_set_lastblock(BLAKE2B_CTX *S)-
50{-
51 S->f[0] = -1;-
52}
executed 9 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
9
53-
54/* Initialize the hashing state. */-
55static ossl_inline void blake2b_init0(BLAKE2B_CTX *S)-
56{-
57 int i;-
58-
59 memset(S, 0, sizeof(BLAKE2B_CTX));-
60 for (i = 0; i < 8; ++i) {
i < 8Description
TRUEevaluated 72 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 9 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
9-72
61 S->h[i] = blake2b_IV[i];-
62 }
executed 72 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
72
63}
executed 9 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
9
64-
65/* init xors IV with input parameter block */-
66static void blake2b_init_param(BLAKE2B_CTX *S, const BLAKE2B_PARAM *P)-
67{-
68 size_t i;-
69 const uint8_t *p = (const uint8_t *)(P);-
70 blake2b_init0(S);-
71-
72 /* The param struct is carefully hand packed, and should be 64 bytes on-
73 * every platform. */-
74 assert(sizeof(BLAKE2B_PARAM) == 64);-
75 /* IV XOR ParamBlock */-
76 for (i = 0; i < 8; ++i) {
i < 8Description
TRUEevaluated 72 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 9 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
9-72
77 S->h[i] ^= load64(p + sizeof(S->h[i]) * i);-
78 }
executed 72 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
72
79}
executed 9 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
9
80-
81/* Initialize the hashing context. Always returns 1. */-
82int BLAKE2b_Init(BLAKE2B_CTX *c)-
83{-
84 BLAKE2B_PARAM P[1];-
85 P->digest_length = BLAKE2B_DIGEST_LENGTH;-
86 P->key_length = 0;-
87 P->fanout = 1;-
88 P->depth = 1;-
89 store32(P->leaf_length, 0);-
90 store64(P->node_offset, 0);-
91 P->node_depth = 0;-
92 P->inner_length = 0;-
93 memset(P->reserved, 0, sizeof(P->reserved));-
94 memset(P->salt, 0, sizeof(P->salt));-
95 memset(P->personal, 0, sizeof(P->personal));-
96 blake2b_init_param(c, P);-
97 return 1;
executed 9 times by 1 test: return 1;
Executed by:
  • libcrypto.so.1.1
9
98}-
99-
100/* Permute the state while xoring in the block of data. */-
101static void blake2b_compress(BLAKE2B_CTX *S,-
102 const uint8_t *blocks,-
103 size_t len)-
104{-
105 uint64_t m[16];-
106 uint64_t v[16];-
107 int i;-
108 size_t increment;-
109-
110 /*-
111 * There are two distinct usage vectors for this function:-
112 *-
113 * a) BLAKE2b_Update uses it to process complete blocks,-
114 * possibly more than one at a time;-
115 *-
116 * b) BLAK2b_Final uses it to process last block, always-
117 * single but possibly incomplete, in which case caller-
118 * pads input with zeros.-
119 */-
120 assert(len < BLAKE2B_BLOCKBYTES || len % BLAKE2B_BLOCKBYTES == 0);-
121-
122 /*-
123 * Since last block is always processed with separate call,-
124 * |len| not being multiple of complete blocks can be observed-
125 * only with |len| being less than BLAKE2B_BLOCKBYTES ("less"-
126 * including even zero), which is why following assignment doesn't-
127 * have to reside inside the main loop below.-
128 */-
129 increment = len < BLAKE2B_BLOCKBYTES ? len : BLAKE2B_BLOCKBYTES;
len < 128Description
TRUEevaluated 8 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 2 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
2-8
130-
131 for (i = 0; i < 8; ++i) {
i < 8Description
TRUEevaluated 80 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 10 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
10-80
132 v[i] = S->h[i];-
133 }
executed 80 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
80
134-
135 do {-
136 for (i = 0; i < 16; ++i) {
i < 16Description
TRUEevaluated 160 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 10 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
10-160
137 m[i] = load64(blocks + i * sizeof(m[i]));-
138 }
executed 160 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
160
139-
140 /* blake2b_increment_counter */-
141 S->t[0] += increment;-
142 S->t[1] += (S->t[0] < increment);-
143-
144 v[8] = blake2b_IV[0];-
145 v[9] = blake2b_IV[1];-
146 v[10] = blake2b_IV[2];-
147 v[11] = blake2b_IV[3];-
148 v[12] = S->t[0] ^ blake2b_IV[4];-
149 v[13] = S->t[1] ^ blake2b_IV[5];-
150 v[14] = S->f[0] ^ blake2b_IV[6];-
151 v[15] = S->f[1] ^ blake2b_IV[7];-
152#define G(r,i,a,b,c,d) \-
153 do { \-
154 a = a + b + m[blake2b_sigma[r][2*i+0]]; \-
155 d = rotr64(d ^ a, 32); \-
156 c = c + d; \-
157 b = rotr64(b ^ c, 24); \-
158 a = a + b + m[blake2b_sigma[r][2*i+1]]; \-
159 d = rotr64(d ^ a, 16); \-
160 c = c + d; \-
161 b = rotr64(b ^ c, 63); \-
162 } while (0)-
163#define ROUND(r) \-
164 do { \-
165 G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \-
166 G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \-
167 G(r,2,v[ 2],v[ 6],v[10],v[14]); \-
168 G(r,3,v[ 3],v[ 7],v[11],v[15]); \-
169 G(r,4,v[ 0],v[ 5],v[10],v[15]); \-
170 G(r,5,v[ 1],v[ 6],v[11],v[12]); \-
171 G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \-
172 G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \-
173 } while (0)-
174#if defined(OPENSSL_SMALL_FOOTPRINT)-
175 /* 3x size reduction on x86_64, almost 7x on ARMv8, 9x on ARMv4 */-
176 for (i = 0; i < 12; i++) {-
177 ROUND(i);-
178 }-
179#else-
180 ROUND(0);-
181 ROUND(1);-
182 ROUND(2);-
183 ROUND(3);-
184 ROUND(4);-
185 ROUND(5);-
186 ROUND(6);-
187 ROUND(7);-
188 ROUND(8);-
189 ROUND(9);-
190 ROUND(10);-
191 ROUND(11);-
192#endif-
193-
194 for (i = 0; i < 8; ++i) {
i < 8Description
TRUEevaluated 80 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 10 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
10-80
195 S->h[i] = v[i] ^= v[i + 8] ^ S->h[i];-
196 }
executed 80 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
80
197#undef G-
198#undef ROUND-
199 blocks += increment;-
200 len -= increment;-
201 } while (len);
executed 10 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
lenDescription
TRUEnever evaluated
FALSEevaluated 10 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
0-10
202}
executed 10 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
10
203-
204/* Absorb the input data into the hash state. Always returns 1. */-
205int BLAKE2b_Update(BLAKE2B_CTX *c, const void *data, size_t datalen)-
206{-
207 const uint8_t *in = data;-
208 size_t fill;-
209-
210 /*-
211 * Intuitively one would expect intermediate buffer, c->buf, to-
212 * store incomplete blocks. But in this case we are interested to-
213 * temporarily stash even complete blocks, because last one in the-
214 * stream has to be treated in special way, and at this point we-
215 * don't know if last block in *this* call is last one "ever". This-
216 * is the reason for why |datalen| is compared as >, and not >=.-
217 */-
218 fill = sizeof(c->buf) - c->buflen;-
219 if (datalen > fill) {
datalen > fillDescription
TRUEevaluated 1 time by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 8 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
1-8
220 if (c->buflen) {
c->buflenDescription
TRUEnever evaluated
FALSEevaluated 1 time by 1 test
Evaluated by:
  • libcrypto.so.1.1
0-1
221 memcpy(c->buf + c->buflen, in, fill); /* Fill buffer */-
222 blake2b_compress(c, c->buf, BLAKE2B_BLOCKBYTES);-
223 c->buflen = 0;-
224 in += fill;-
225 datalen -= fill;-
226 }
never executed: end of block
0
227 if (datalen > BLAKE2B_BLOCKBYTES) {
datalen > 128Description
TRUEevaluated 1 time by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEnever evaluated
0-1
228 size_t stashlen = datalen % BLAKE2B_BLOCKBYTES;-
229 /*-
230 * If |datalen| is a multiple of the blocksize, stash-
231 * last complete block, it can be final one...-
232 */-
233 stashlen = stashlen ? stashlen : BLAKE2B_BLOCKBYTES;
stashlenDescription
TRUEevaluated 1 time by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEnever evaluated
0-1
234 datalen -= stashlen;-
235 blake2b_compress(c, in, datalen);-
236 in += datalen;-
237 datalen = stashlen;-
238 }
executed 1 time by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
1
239 }
executed 1 time by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
1
240-
241 assert(datalen <= BLAKE2B_BLOCKBYTES);-
242-
243 memcpy(c->buf + c->buflen, in, datalen);-
244 c->buflen += datalen; /* Be lazy, do not compress */-
245-
246 return 1;
executed 9 times by 1 test: return 1;
Executed by:
  • libcrypto.so.1.1
9
247}-
248-
249/*-
250 * Calculate the final hash and save it in md.-
251 * Always returns 1.-
252 */-
253int BLAKE2b_Final(unsigned char *md, BLAKE2B_CTX *c)-
254{-
255 int i;-
256-
257 blake2b_set_lastblock(c);-
258 /* Padding */-
259 memset(c->buf + c->buflen, 0, sizeof(c->buf) - c->buflen);-
260 blake2b_compress(c, c->buf, c->buflen);-
261-
262 /* Output full hash to message digest */-
263 for (i = 0; i < 8; ++i) {
i < 8Description
TRUEevaluated 72 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
FALSEevaluated 9 times by 1 test
Evaluated by:
  • libcrypto.so.1.1
9-72
264 store64(md + sizeof(c->h[i]) * i, c->h[i]);-
265 }
executed 72 times by 1 test: end of block
Executed by:
  • libcrypto.so.1.1
72
266-
267 OPENSSL_cleanse(c, sizeof(BLAKE2B_CTX));-
268 return 1;
executed 9 times by 1 test: return 1;
Executed by:
  • libcrypto.so.1.1
9
269}-
Source codeSwitch to Preprocessed file
Generated by Squish Coco 4.2.2