1 // SPDX-License-Identifier: GPL-2.0 OR MIT
3  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
5  * This is a specialized constant-time base64/hex implementation that resists side-channel attacks.
11 static inline void encode_base64(char dest[static 4], const uint8_t src[static 3])  in encode_base64()
13 …onst uint8_t input[] = { (src[0] >> 2) & 63, ((src[0] << 4) | (src[1] >> 4)) & 63, ((src[1] << 2) …  in encode_base64()
17 			  + (((25 - input[i]) >> 8) & 6)  in encode_base64()
18 			  - (((51 - input[i]) >> 8) & 75)  in encode_base64()
19 			  - (((61 - input[i]) >> 8) & 15)  in encode_base64()
20 			  + (((62 - input[i]) >> 8) & 3);  in encode_base64()
31 	base64[WG_KEY_LEN_BASE64 - 2] = '=';  in key_to_base64()
32 	base64[WG_KEY_LEN_BASE64 - 1] = '\0';  in key_to_base64()
35 static inline int decode_base64(const char src[static 4])  in decode_base64()
40 		val |= (-1  in decode_base64()
41 			    + ((((('A' - 1) - src[i]) & (src[i] - ('Z' + 1))) >> 8) & (src[i] - 64))  in decode_base64()
42 			    + ((((('a' - 1) - src[i]) & (src[i] - ('z' + 1))) >> 8) & (src[i] - 70))  in decode_base64()
43 			    + ((((('0' - 1) - src[i]) & (src[i] - ('9' + 1))) >> 8) & (src[i] + 5))  in decode_base64()
44 			    + ((((('+' - 1) - src[i]) & (src[i] - ('+' + 1))) >> 8) & 63)  in decode_base64()
45 			    + ((((('/' - 1) - src[i]) & (src[i] - ('/' + 1))) >> 8) & 64)  in decode_base64()
46 			) << (18 - 6 * i);  in decode_base64()
56 	if (strlen(base64) != WG_KEY_LEN_BASE64 - 1 || base64[WG_KEY_LEN_BASE64 - 2] != '=')  in key_from_base64()
64 		key[i * 3 + 2] = val & 0xff;  in key_from_base64()
66 …val = decode_base64((const char[]){ base64[i * 4 + 0], base64[i * 4 + 1], base64[i * 4 + 2], 'A' }…  in key_from_base64()
71 	return 1 & ((ret - 1) >> 8);  in key_from_base64()
79 		hex[i * 2] = 87U + (key[i] >> 4) + ((((key[i] >> 4) - 10U) >> 8) & ~38U);  in key_to_hex()
80 		hex[i * 2 + 1] = 87U + (key[i] & 0xf) + ((((key[i] & 0xf) - 10U) >> 8) & ~38U);  in key_to_hex()
82 	hex[i * 2] = '\0';  in key_to_hex()
90 	if (strlen(hex) != WG_KEY_LEN_HEX - 1)  in key_from_hex()
93 	for (unsigned int i = 0; i < WG_KEY_LEN_HEX - 1; i += 2) {  in key_from_hex()
96 		c_num0 = (c_num - 10U) >> 8;  in key_from_hex()
97 		c_alpha = (c & ~32U) - 55U;  in key_from_hex()
98 		c_alpha0 = ((c_alpha - 10U) ^ (c_alpha - 16U)) >> 8;  in key_from_hex()
99 		ret |= ((c_num0 | c_alpha0) - 1) >> 8;  in key_from_hex()
105 		c_num0 = (c_num - 10U) >> 8;  in key_from_hex()
106 		c_alpha = (c & ~32U) - 55U;  in key_from_hex()
107 		c_alpha0 = ((c_alpha - 10U) ^ (c_alpha - 16U)) >> 8;  in key_from_hex()
108 		ret |= ((c_num0 | c_alpha0) - 1) >> 8;  in key_from_hex()
110 		key[i / 2] = c_acc | c_val;  in key_from_hex()
113 	return 1 & ((ret - 1) >> 8);  in key_from_hex()
124 	return 1 & ((acc - 1) >> 8);  in key_is_zero()