poly1305.c File Reference

#include "precomp.h"

Include dependency graph for poly1305.c:

Go to the source code of this file.

Functions
VOID SYMCRYPT_CALL	SymCryptPoly1305ProcessBlocks (_Inout_ PSYMCRYPT_POLY1305_STATE pState, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData)
VOID SYMCRYPT_CALL	SymCryptPoly1305 (_In_reads_(SYMCRYPT_POLY1305_KEY_SIZE) PCBYTE pbKey, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData, _Out_writes_(SYMCRYPT_POLY1305_RESULT_SIZE) PBYTE pbResult)
VOID SYMCRYPT_CALL	SymCryptPoly1305Init (_Out_ PSYMCRYPT_POLY1305_STATE pState, _In_reads_(SYMCRYPT_POLY1305_KEY_SIZE) PCBYTE pbKey)
VOID SYMCRYPT_CALL	SymCryptPoly1305Append (_Inout_ PSYMCRYPT_POLY1305_STATE pState, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData)
VOID SYMCRYPT_CALL	SymCryptPoly1305Result (_Inout_ PSYMCRYPT_POLY1305_STATE pState, _Out_writes_(SYMCRYPT_POLY1305_RESULT_SIZE) PBYTE pbResult)
VOID SYMCRYPT_CALL	SymCryptPoly1305Selftest (void)

Variables
static const BYTE	poly1305Kat [16]

Function Documentation

SymCryptPoly1305()

VOID SYMCRYPT_CALL SymCryptPoly1305	(	_In_reads_(SYMCRYPT_POLY1305_KEY_SIZE) PCBYTE	pbKey,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData,
		_Out_writes_(SYMCRYPT_POLY1305_RESULT_SIZE) PBYTE	pbResult
	)

Definition at line 18 of file poly1305.c.

{
    SYMCRYPT_POLY1305_STATE state;
 
    SymCryptPoly1305Init( &state, pbKey );
    SymCryptPoly1305Append( &state, pbData, cbData );
    SymCryptPoly1305Result( &state, pbResult );
}

Referenced by SymCryptPoly1305Selftest().

SymCryptPoly1305Append()

VOID SYMCRYPT_CALL SymCryptPoly1305Append	(	_Inout_ PSYMCRYPT_POLY1305_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData
	)

Definition at line 55 of file poly1305.c.

{
    SIZE_T nBytes;
    SIZE_T bytesInBuffer;
 
    bytesInBuffer = pState->bytesInBuffer;
    if( bytesInBuffer != 0 )
    {
        // We have a partial block in the buffer, keep filling the block
 
        SYMCRYPT_ASSERT( bytesInBuffer < 16 );
        nBytes = 16 - bytesInBuffer;
        if( nBytes > cbData )
        {
            nBytes = cbData;
        }
 
        memcpy( &pState->buf[bytesInBuffer], pbData, nBytes );
        pbData += nBytes;
        cbData -= nBytes;
        bytesInBuffer += nBytes;
 
        if( bytesInBuffer == 16 )
        {
            // Buffer is full, process it and empty the buffer
            SymCryptPoly1305ProcessBlocks( pState, pState->buf, bytesInBuffer );
            bytesInBuffer = 0;
        }
        pState->bytesInBuffer = bytesInBuffer;
    }
 
    if( cbData >= 16 )
    {
        // There are whole blocks to process
        SymCryptPoly1305ProcessBlocks( pState, pbData, cbData & ~0xf );
        pbData += cbData;
        cbData &= 0xf;
        pbData -= cbData;
    }
 
    if( cbData > 0 )
    {
        // Copy remaining data to buffer
        SYMCRYPT_ASSERT( cbData < 16 );
        memcpy( &pState->buf[0], pbData, cbData );
        pState->bytesInBuffer = cbData;
    }
}

Referenced by SymCryptChaCha20Poly1305ComputeTag(), and SymCryptPoly1305().

SymCryptPoly1305Init()

VOID SYMCRYPT_CALL SymCryptPoly1305Init	(	_Out_ PSYMCRYPT_POLY1305_STATE	pState,
		_In_reads_(SYMCRYPT_POLY1305_KEY_SIZE) PCBYTE	pbKey
	)

Definition at line 33 of file poly1305.c.

{
    pState->r[0] = SYMCRYPT_LOAD_LSBFIRST32( pbKey +  0 ) & 0x0fffffff;
    pState->r[1] = SYMCRYPT_LOAD_LSBFIRST32( pbKey +  4 ) & 0x0ffffffc;
    pState->r[2] = SYMCRYPT_LOAD_LSBFIRST32( pbKey +  8 ) & 0x0ffffffc;
    pState->r[3] = SYMCRYPT_LOAD_LSBFIRST32( pbKey + 12 ) & 0x0ffffffc;
 
    pState->s[0] = SYMCRYPT_LOAD_LSBFIRST32( pbKey + 16 );
    pState->s[1] = SYMCRYPT_LOAD_LSBFIRST32( pbKey + 20 );
    pState->s[2] = SYMCRYPT_LOAD_LSBFIRST32( pbKey + 24 );
    pState->s[3] = SYMCRYPT_LOAD_LSBFIRST32( pbKey + 28 );
 
    // Set accumulator to zero
    SymCryptWipeKnownSize( &pState->a[0], sizeof( pState->a ) );
 
    pState->bytesInBuffer = 0;
}

Referenced by SymCryptChaCha20Poly1305Decrypt(), SymCryptChaCha20Poly1305Encrypt(), and SymCryptPoly1305().

SymCryptPoly1305ProcessBlocks()

VOID SYMCRYPT_CALL SymCryptPoly1305ProcessBlocks	(	_Inout_ PSYMCRYPT_POLY1305_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData
	)

Definition at line 323 of file poly1305.c.

{
    UINT32 a0, a1, a2, a3, a4;
    UINT32 r0, r1, r2, r3;
    UINT64 t64;
    UINT32 T3;
    UINT32 V0, V1, V2;
    UINT32 cy;
    UINT32 U;
    UINT32 t32;
 
    r0 = pState->r[0];
    r1 = pState->r[1];
    r2 = pState->r[2];
    r3 = pState->r[3];
 
    a0 = pState->a[0];
    a1 = pState->a[1];
    a2 = pState->a[2];
    a3 = pState->a[3];
    a4 = pState->a[4];
 
    // Here we have a4 < 6, but we sometimes decrement a4 to compensate for the
    // 2^128 this function always adds. So we test a4 + 1 < 7
    SYMCRYPT_ASSERT( a4 + 1 < 7 );
 
    while( cbData >= 16 )
    {
        // Acc += data[0..15] + 2^128
        t64 = (UINT64) a0 + SYMCRYPT_LOAD_LSBFIRST32( pbData +  0 );
        a0 = (UINT32) t64;
        t64 >>= 32;
 
        t64 += (UINT64) a1 + SYMCRYPT_LOAD_LSBFIRST32( pbData +  4 );
        a1 = (UINT32) t64;
        t64 >>= 32;
 
        t64 += (UINT64) a2 + SYMCRYPT_LOAD_LSBFIRST32( pbData +  8 );
        a2 = (UINT32) t64;
        t64 >>= 32;
 
        t64 += (UINT64) a3 + SYMCRYPT_LOAD_LSBFIRST32( pbData + 12 );
        a3 = (UINT32) t64;
        t64 >>= 32;
 
        a4 = (UINT32) t64 + a4 + 1;   // +1 is the padding '1' which we always apply
        SYMCRYPT_ASSERT( a4 < 8 );
 
        pbData += 16;
        cbData -=16;
 
        // Compute S3
        t64 =  SYMCRYPT_MUL32x32TO64( a3, r0 )
             + SYMCRYPT_MUL32x32TO64( a2, r1 )
             + SYMCRYPT_MUL32x32TO64( a1, r2 )
             + SYMCRYPT_MUL32x32TO64( a0, r3 );
 
        SYMCRYPT_ASSERT( t64 < (1ULL << 62) );
 
        T3 = (UINT32) t64;
        t64 >>= 32;
 
        // Compute T = S4 + floor(S3/2^32). We have the floor part in t64 already
        // now add S4 to it
        t64 +=   a4*r0                              // this fits in 32 bits as r0 < 2^28 and a4 < 8
                + SYMCRYPT_MUL32x32TO64( a3, r1 )
                + SYMCRYPT_MUL32x32TO64( a2, r2 )
                + SYMCRYPT_MUL32x32TO64( a1, r3 );
 
        U = (UINT32) t64 & 3;
        t64 &= ~3;                  // t64 = T4 here
 
        // Compute S0 + T4 + T4/4, and V0
        t64 += (t64 >> 2) + SYMCRYPT_MUL32x32TO64( a0, r0 );
        V0 = (UINT32)t64;
        cy = (UINT32)(t64 >> 32);     // the carry from S0 to S1
 
        // Compute S5
        t64 = a4 * r1 + SYMCRYPT_MUL32x32TO64( a3, r2 ) + SYMCRYPT_MUL32x32TO64( a2, r3 );
        t64 += t64 >> 2;    // = S5 + S5/4
 
        t64 += SYMCRYPT_MUL32x32TO64( a1, r0 ) + SYMCRYPT_MUL32x32TO64( a0, r1 );
        // t64 = S1 + S5 + S5/4
 
        t64 += cy;
        V1 = (UINT32) t64;
        cy = (UINT32)(t64 >> 32);     // the carry from S1 to S2
 
        // Compute S6
        t64 = a4 * r2 + SYMCRYPT_MUL32x32TO64( a3, r3 );
        t64 += t64 >> 2;    // S6 + S6/4
 
        // now add S2
        t64 += SYMCRYPT_MUL32x32TO64( a2, r0 ) + SYMCRYPT_MUL32x32TO64( a1, r1 ) + SYMCRYPT_MUL32x32TO64( a0, r2 );
        t64 += cy;
        V2 = (UINT32) t64;
        cy = (UINT32)(t64 >> 32);
 
        // Finally T3 + S7 + S7/4
        t32 = a4 * r3;      // =S7, a 32-bit value
        t32 += t32/4;
        t64 = (UINT64) T3 + t32;
        t64 += cy;
 
        a0 = V0;
        a1 = V1;
        a2 = V2;
        a3 = (UINT32) t64;
        a4 = U + (UINT32)(t64 >> 32);
 
        SYMCRYPT_ASSERT( a4 < 6 );
    }
 
    pState->a[0] = a0;
    pState->a[1] = a1;
    pState->a[2] = a2;
    pState->a[3] = a3;
    pState->a[4] = a4;
}

Referenced by SymCryptPoly1305Append(), and SymCryptPoly1305Result().

SymCryptPoly1305Result()

VOID SYMCRYPT_CALL SymCryptPoly1305Result	(	_Inout_ PSYMCRYPT_POLY1305_STATE	pState,
		_Out_writes_(SYMCRYPT_POLY1305_RESULT_SIZE) PBYTE	pbResult
	)

Definition at line 109 of file poly1305.c.

{
    SIZE_T bytesInBuffer;
    UINT64 t;
    UINT32 a4, a3, a2, a1, a0;
    UINT32 maskOld, maskNew;
 
    bytesInBuffer = pState->bytesInBuffer;
    if( bytesInBuffer > 0 )
    {
        // Add trailing '1' byte and pad with zeroes
        // Wipe function deals with 0-length wipes properly
        pState->buf[bytesInBuffer++] = 1;
        SymCryptWipe( &pState->buf[bytesInBuffer], 16 - bytesInBuffer );
 
        // Now we have to process the block, but the block function adds a trailing
        // 1 byte to each 16-byte block. We compensate for that by decrementing
        // the highest word of the accumulator first; the 1 byte added by the block
        // processing function has the effect of incrementing the highest accumulator
        // word so those two operations cancel each other out.
        pState->a[4] -= 1;
        SymCryptPoly1305ProcessBlocks( pState, pState->buf, 16 );
    }
 
    // We have to fully reduce the accumulator first
    // We have a[4]<6 at this point
    a0 = pState->a[0];
    a1 = pState->a[1];
    a2 = pState->a[2];
    a3 = pState->a[3];
    a4 = pState->a[4];
 
    SYMCRYPT_ASSERT( a4 < 6 );
    // Because a4 < 6, we have to subtract either 0*P or 1*P
    // we subtract P and them mux-choose between the new and old value
    // Subtracting P is the same as subtracting 2^130 and adding 5
    t = 5;
 
    t += a0;
    a0 = (UINT32) t;
    t >>= 32;
 
    t += a1;
    a1 = (UINT32) t;
    t >>= 32;
 
    t += a2;
    a2 = (UINT32) t;
    t >>= 32;
 
    t += a3;
    a3 = (UINT32) t;
    t >>= 32;
 
    t += a4;
    t -= 4;
    a4 = (UINT32) t;
    t >>= 32;
 
    // If this subtraction produced a carry, then t = 0xffffffff, otherwise it is 0
    maskOld = (UINT32) t;       // ffffffff if the old value is correct, 0 otherwise
    maskNew = ~maskOld;         // ffffffff if the new value is correct, 0 otherwise
 
    a0 = (maskNew & a0) | (maskOld & pState->a[0]);
    a1 = (maskNew & a1) | (maskOld & pState->a[1]);
    a2 = (maskNew & a2) | (maskOld & pState->a[2]);
    a3 = (maskNew & a3) | (maskOld & pState->a[3]);
 // a4 = (maskNew & a4) | (maskOld & pState->a[4]); // We don't need a4...
 
    // Now we add S and return the data
    t  = a0;
    t += pState->s[0];
    SYMCRYPT_STORE_LSBFIRST32( pbResult +  0, (UINT32) t );
    t >>= 32;
 
    t += a1;
    t += pState->s[1];
    SYMCRYPT_STORE_LSBFIRST32( pbResult +  4, (UINT32) t );
    t >>= 32;
 
    t += a2;
    t += pState->s[2];
    SYMCRYPT_STORE_LSBFIRST32( pbResult +  8, (UINT32) t );
    t >>= 32;
 
    t += a3;
    t += pState->s[3];
    SYMCRYPT_STORE_LSBFIRST32( pbResult + 12, (UINT32) t );
 
    SymCryptWipeKnownSize( (PBYTE) pState, sizeof( *pState ) );
}

Referenced by SymCryptChaCha20Poly1305ComputeTag(), and SymCryptPoly1305().

SymCryptPoly1305Selftest()

VOID SYMCRYPT_CALL SymCryptPoly1305Selftest

(

void

)

Definition at line 456 of file poly1305.c.

{
    BYTE res[16];
 
    SymCryptPoly1305( SymCryptTestKey32, SymCryptTestMsg16, 16, res );
 
    SymCryptInjectError( res, sizeof( res ) );
 
    if( memcmp( res, poly1305Kat, sizeof( res ) ) != 0 )
    {
        SymCryptFatal( 'p135');
    }
}

Variable Documentation

poly1305Kat

const BYTE poly1305Kat[16]

static

Initial value:

= {
    0xef, 0x9e, 0x73, 0x2a, 0x7f, 0x2d, 0xf1, 0x85, 0xa7, 0x11, 0x80, 0xae, 0x58, 0x3a, 0x0f, 0x93,
}

Definition at line 449 of file poly1305.c.

Referenced by SymCryptPoly1305Selftest().