1 /* $OpenBSD: siphash.c,v 1.2 2015/01/16 16:48:51 deraadt Exp $ */ 2 3 /*- 4 * Copyright (c) 2013 Andre Oppermann <andre@FreeBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * SipHash is a family of PRFs SipHash-c-d where the integer parameters c and d 34 * are the number of compression rounds and the number of finalization rounds. 35 * A compression round is identical to a finalization round and this round 36 * function is called SipRound. Given a 128-bit key k and a (possibly empty) 37 * byte string m, SipHash-c-d returns a 64-bit value SipHash-c-d(k; m). 38 * 39 * Implemented from the paper "SipHash: a fast short-input PRF", 2012.09.18, 40 * by Jean-Philippe Aumasson and Daniel J. Bernstein, 41 * Permanent Document ID b9a943a805fbfc6fde808af9fc0ecdfa 42 * https://131002.net/siphash/siphash.pdf 43 * https://131002.net/siphash/ 44 */ 45 46 #include <sys/types.h> 47 #include <sys/endian.h> 48 49 #include <string.h> 50 #include <siphash.h> 51 52 void SipHash_CRounds(SIPHASH_CTX *, int); 53 void SipHash_Rounds(SIPHASH_CTX *, int); 54 55 void 56 SipHash_Init(SIPHASH_CTX *ctx, const SIPHASH_KEY *key) 57 { 58 uint64_t k0, k1; 59 60 k0 = le64toh(key->k0); 61 k1 = le64toh(key->k1); 62 63 ctx->v[0] = 0x736f6d6570736575ULL ^ k0; 64 ctx->v[1] = 0x646f72616e646f6dULL ^ k1; 65 ctx->v[2] = 0x6c7967656e657261ULL ^ k0; 66 ctx->v[3] = 0x7465646279746573ULL ^ k1; 67 68 memset(ctx->buf, 0, sizeof(ctx->buf)); 69 ctx->bytes = 0; 70 } 71 72 void 73 SipHash_Update(SIPHASH_CTX *ctx, int rc, int rf, const void *src, size_t len) 74 { 75 const u_int8_t *ptr = src; 76 size_t free, used; 77 78 if (len == 0) 79 return; 80 81 used = ctx->bytes % sizeof(ctx->buf); 82 ctx->bytes += len; 83 84 if (used > 0) { 85 free = sizeof(ctx->buf) - used; 86 87 if (len >= free) { 88 memcpy(&ctx->buf[used], ptr, free); 89 SipHash_CRounds(ctx, rc); 90 len -= free; 91 ptr += free; 92 } else { 93 memcpy(&ctx->buf[used], ptr, len); 94 return; 95 } 96 } 97 98 while (len >= sizeof(ctx->buf)) { 99 memcpy(ctx->buf, ptr, sizeof(ctx->buf)); 100 SipHash_CRounds(ctx, rc); 101 len -= sizeof(ctx->buf); 102 ptr += sizeof(ctx->buf); 103 } 104 105 if (len > 0) 106 memcpy(&ctx->buf[used], ptr, len); 107 } 108 109 void 110 SipHash_Final(void *dst, SIPHASH_CTX *ctx, int rc, int rf) 111 { 112 u_int64_t r; 113 114 r = SipHash_End(ctx, rc, rf); 115 116 *(u_int64_t *)dst = htole64(r); 117 } 118 119 u_int64_t 120 SipHash_End(SIPHASH_CTX *ctx, int rc, int rf) 121 { 122 u_int64_t r; 123 size_t free, used; 124 125 used = ctx->bytes % sizeof(ctx->buf); 126 free = sizeof(ctx->buf) - used; 127 memset(&ctx->buf[used], 0, free - 1); 128 ctx->buf[7] = ctx->bytes; 129 130 SipHash_CRounds(ctx, rc); 131 ctx->v[2] ^= 0xff; 132 SipHash_Rounds(ctx, rf); 133 134 r = (ctx->v[0] ^ ctx->v[1]) ^ (ctx->v[2] ^ ctx->v[3]); 135 explicit_bzero(ctx, sizeof(*ctx)); 136 return (r); 137 } 138 139 u_int64_t 140 SipHash(const SIPHASH_KEY *key, int rc, int rf, const void *src, size_t len) 141 { 142 SIPHASH_CTX ctx; 143 144 SipHash_Init(&ctx, key); 145 SipHash_Update(&ctx, rc, rf, src, len); 146 return (SipHash_End(&ctx, rc, rf)); 147 } 148 149 #define SIP_ROTL(x, b) ((x) << (b)) | ( (x) >> (64 - (b))) 150 151 void 152 SipHash_Rounds(SIPHASH_CTX *ctx, int rounds) 153 { 154 while (rounds--) { 155 ctx->v[0] += ctx->v[1]; 156 ctx->v[2] += ctx->v[3]; 157 ctx->v[1] = SIP_ROTL(ctx->v[1], 13); 158 ctx->v[3] = SIP_ROTL(ctx->v[3], 16); 159 160 ctx->v[1] ^= ctx->v[0]; 161 ctx->v[3] ^= ctx->v[2]; 162 ctx->v[0] = SIP_ROTL(ctx->v[0], 32); 163 164 ctx->v[2] += ctx->v[1]; 165 ctx->v[0] += ctx->v[3]; 166 ctx->v[1] = SIP_ROTL(ctx->v[1], 17); 167 ctx->v[3] = SIP_ROTL(ctx->v[3], 21); 168 169 ctx->v[1] ^= ctx->v[2]; 170 ctx->v[3] ^= ctx->v[0]; 171 ctx->v[2] = SIP_ROTL(ctx->v[2], 32); 172 } 173 } 174 175 void 176 SipHash_CRounds(SIPHASH_CTX *ctx, int rounds) 177 { 178 u_int64_t m = letoh64(*(u_int64_t *)ctx->buf); 179 180 ctx->v[3] ^= m; 181 SipHash_Rounds(ctx, rounds); 182 ctx->v[0] ^= m; 183 } 184