1 // SPDX-License-Identifier: CDDL-1.0
2 /*
3 * This file and its contents are supplied under the terms of the
4 * Common Development and Distribution License ("CDDL"), version 1.0.
5 * You may only use this file in accordance with the terms of version
6 * 1.0 of the CDDL.
7 *
8 * A full copy of the text of the CDDL should have accompanied this
9 * source. A copy of the CDDL is also available via the Internet at
10 * https://opensource.org/license/CDDL-1.0.
11 */
12
13 /*
14 * Based on Edon-R implementation for SUPERCOP, based on NIST API.
15 * Copyright (c) 2009, 2010, Jørn Amundsen <jorn.amundsen@ntnu.no>
16 * Copyright (c) 2013 Saso Kiselkov, All rights reserved
17 * Copyright (c) 2023 Tino Reichardt <milky-zfs@mcmilk.de>
18 */
19
20 #include <sys/zfs_context.h>
21 #include <sys/string.h>
22 #include <sys/edonr.h>
23
24 /*
25 * We need 1196 byte stack for Q512() on i386
26 * - we define this pragma to make gcc happy
27 */
28 #if defined(__GNUC__) && defined(_ILP32)
29 #pragma GCC diagnostic ignored "-Wframe-larger-than="
30 #endif
31
32 /*
33 * Insert compiler memory barriers to reduce stack frame size.
34 */
35 #define MEMORY_BARRIER asm volatile("" ::: "memory");
36
37 #if defined(_ZFS_BIG_ENDIAN)
38 #define ld_swap64(s, d) (d = __builtin_bswap64(*(s)))
39 #define st_swap64(s, d) (*(d) = __builtin_bswap64(s))
40 #else
41 #define ld_swap64(s, d) (d = *(s))
42 #define st_swap64(s, d) (*(d) = s)
43 #endif
44
45 #define hashState512(x) ((x)->pipe->p512)
46
47 /* rotate shortcuts */
48 #define rotl64(x, n) (((x) << (n)) | ((x) >> (64 - (n))))
49
50 /* EdonR512 initial double chaining pipe */
51 static const uint64_t i512p2[16] = {
52 0x8081828384858687ull, 0x88898a8b8c8d8e8full,
53 0x9091929394959697ull, 0x98999a9b9c9d9e9full,
54 0xa0a1a2a3a4a5a6a7ull, 0xa8a9aaabacadaeafull,
55 0xb0b1b2b3b4b5b6b7ull, 0xb8b9babbbcbdbebfull,
56 0xc0c1c2c3c4c5c6c7ull, 0xc8c9cacbcccdcecfull,
57 0xd0d1d2d3d4d5d6d7ull, 0xd8d9dadbdcdddedfull,
58 0xe0e1e2e3e4e5e6e7ull, 0xe8e9eaebecedeeefull,
59 0xf0f1f2f3f4f5f6f7ull, 0xf8f9fafbfcfdfeffull
60 };
61
62 #define LS1_512(x0, x1, x2, x3, x4, x5, x6, x7) \
63 { \
64 MEMORY_BARRIER \
65 z1 = x0 + x4, z2 = x1 + x7; z5 = z1 + z2; \
66 s0 = 0xaaaaaaaaaaaaaaaaull + z5 + x2; \
67 s1 = rotl64(z5 + x3, 5); \
68 s2 = rotl64(z5 + x6, 15); z3 = x2 + x3; \
69 s5 = rotl64(z1 + z3 + x5, 40); z4 = x5 + x6; \
70 s6 = rotl64(z2 + z4 + x0, 50); z6 = z3 + z4; \
71 s3 = rotl64(z6 + x7, 22); \
72 s4 = rotl64(z6 + x1, 31); \
73 s7 = rotl64(z6 + x4, 59); \
74 }
75
76 #define LS2_512(y0, y1, y2, y3, y4, y5, y6, y7) \
77 { \
78 z1 = y0 + y1, z2 = y2 + y5; z6 = z1 + z2; \
79 t0 = ~0xaaaaaaaaaaaaaaaaull + z6 + y7; \
80 t2 = rotl64(z6 + y3, 19); \
81 z3 = y3 + y4, z5 = z1 + z3; \
82 t1 = rotl64(z5 + y6, 10); \
83 t4 = rotl64(z5 + y5, 36); \
84 z4 = y6 + y7, z8 = z3 + z4; \
85 t3 = rotl64(z8 + y2, 29); \
86 t7 = rotl64(z8 + y0, 55); z7 = z2 + z4; \
87 t5 = rotl64(z7 + y4, 44); \
88 t6 = rotl64(z7 + y1, 48); \
89 }
90
91 #define QEF_512(r0, r1, r2, r3, r4, r5, r6, r7) \
92 { \
93 z1 = s0 ^ s4, z5 = t0 ^ t1; \
94 r0 = (z1 ^ s1) + (z5 ^ t5); z8 = t6 ^ t7; \
95 r1 = (z1 ^ s7) + (t2 ^ z8); z3 = s2 ^ s3; \
96 r7 = (z3 ^ s5) + (t4 ^ z8); z7 = t3 ^ t4; \
97 r3 = (z3 ^ s4) + (t0 ^ z7); z4 = s5 ^ s6; \
98 r5 = (s3 ^ z4) + (z7 ^ t6); z6 = t2 ^ t5; \
99 r6 = (s2 ^ z4) + (z6 ^ t7); z2 = s1 ^ s7; \
100 r4 = (s0 ^ z2) + (t1 ^ z6); \
101 r2 = (z2 ^ s6) + (z5 ^ t3); \
102 }
103
104 static inline size_t
Q512(size_t bitlen,const uint64_t * data,uint64_t * p)105 Q512(size_t bitlen, const uint64_t *data, uint64_t *p)
106 {
107 size_t bl;
108
109 for (bl = bitlen; bl >= EdonR512_BLOCK_BITSIZE;
110 bl -= EdonR512_BLOCK_BITSIZE, data += 16) {
111 uint64_t q0, q1, q2, q3, q4, q5, q6, q7;
112 uint64_t p0, p1, p2, p3, p4, p5, p6, p7;
113 uint64_t s0, s1, s2, s3, s4, s5, s6, s7;
114 uint64_t t0, t1, t2, t3, t4, t5, t6, t7;
115 uint64_t z1, z2, z3, z4, z5, z6, z7, z8;
116
117 #if defined(_ZFS_BIG_ENDIAN)
118 uint64_t swp0, swp1, swp2, swp3, swp4, swp5, swp6, swp7,
119 swp8, swp9, swp10, swp11, swp12, swp13, swp14, swp15;
120 #define d(j) swp##j
121 #define s64(j) ld_swap64((uint64_t *)data+j, swp##j)
122 s64(0);
123 s64(1);
124 s64(2);
125 s64(3);
126 s64(4);
127 s64(5);
128 s64(6);
129 s64(7);
130 s64(8);
131 s64(9);
132 s64(10);
133 s64(11);
134 s64(12);
135 s64(13);
136 s64(14);
137 s64(15);
138 #else
139 #define d(j) data[j]
140 #endif
141
142 /* First row of quasigroup e-transformations */
143 LS1_512(d(15), d(14), d(13), d(12), d(11), d(10), d(9), d(8));
144 LS2_512(d(0), d(1), d(2), d(3), d(4), d(5), d(6), d(7));
145 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7);
146
147 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7);
148 LS2_512(d(8), d(9), d(10), d(11), d(12), d(13), d(14), d(15));
149 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7);
150
151 /* Second row of quasigroup e-transformations */
152 LS1_512(p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
153 LS2_512(p0, p1, p2, p3, p4, p5, p6, p7);
154 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7);
155
156 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7);
157 LS2_512(q0, q1, q2, q3, q4, q5, q6, q7);
158 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7);
159
160 /* Third row of quasigroup e-transformations */
161 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7);
162 LS2_512(p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
163 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7);
164
165 LS1_512(q0, q1, q2, q3, q4, q5, q6, q7);
166 LS2_512(p0, p1, p2, p3, p4, p5, p6, p7);
167 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7);
168
169 /* Fourth row of quasigroup e-transformations */
170 LS1_512(d(7), d(6), d(5), d(4), d(3), d(2), d(1), d(0));
171 LS2_512(p0, p1, p2, p3, p4, p5, p6, p7);
172 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7);
173
174 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7);
175 LS2_512(q0, q1, q2, q3, q4, q5, q6, q7);
176 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7);
177
178 /* Edon-R tweak on the original SHA-3 Edon-R submission. */
179 p[0] ^= d(8) ^ p0;
180 p[1] ^= d(9) ^ p1;
181 p[2] ^= d(10) ^ p2;
182 p[3] ^= d(11) ^ p3;
183 p[4] ^= d(12) ^ p4;
184 p[5] ^= d(13) ^ p5;
185 p[6] ^= d(14) ^ p6;
186 p[7] ^= d(15) ^ p7;
187 p[8] ^= d(0) ^ q0;
188 p[9] ^= d(1) ^ q1;
189 p[10] ^= d(2) ^ q2;
190 p[11] ^= d(3) ^ q3;
191 p[12] ^= d(4) ^ q4;
192 p[13] ^= d(5) ^ q5;
193 p[14] ^= d(6) ^ q6;
194 p[15] ^= d(7) ^ q7;
195 }
196
197 #undef s64
198 #undef d
199 return (bitlen - bl);
200 }
201
202 void
EdonRInit(EdonRState * state)203 EdonRInit(EdonRState *state)
204 {
205 state->bits_processed = 0;
206 state->unprocessed_bits = 0;
207 memcpy(hashState512(state)->DoublePipe, i512p2, sizeof (i512p2));
208 }
209
210 void
EdonRUpdate(EdonRState * state,const uint8_t * data,size_t databitlen)211 EdonRUpdate(EdonRState *state, const uint8_t *data, size_t databitlen)
212 {
213 uint64_t *data64;
214 size_t bits_processed;
215
216 if (state->unprocessed_bits > 0) {
217 /* LastBytes = databitlen / 8 */
218 int LastBytes = (int)databitlen >> 3;
219
220 ASSERT(state->unprocessed_bits + databitlen <=
221 EdonR512_BLOCK_SIZE * 8);
222
223 memcpy(hashState512(state)->LastPart
224 + (state->unprocessed_bits >> 3), data, LastBytes);
225 state->unprocessed_bits += (int)databitlen;
226 databitlen = state->unprocessed_bits;
227 /* LINTED E_BAD_PTR_CAST_ALIGN */
228 data64 = (uint64_t *)hashState512(state)->LastPart;
229 } else
230 /* LINTED E_BAD_PTR_CAST_ALIGN */
231 data64 = (uint64_t *)data;
232
233 bits_processed = Q512(databitlen, data64,
234 hashState512(state)->DoublePipe);
235 state->bits_processed += bits_processed;
236 databitlen -= bits_processed;
237 state->unprocessed_bits = (int)databitlen;
238 if (databitlen > 0) {
239 /* LastBytes = Ceil(databitlen / 8) */
240 int LastBytes = ((~(((-(int)databitlen) >> 3) & 0x03ff)) + 1) \
241 & 0x03ff;
242
243 data64 += bits_processed >> 6; /* byte size update */
244 memmove(hashState512(state)->LastPart, data64, LastBytes);
245 }
246 }
247
248 void
EdonRFinal(EdonRState * state,uint8_t * hashval)249 EdonRFinal(EdonRState *state, uint8_t *hashval)
250 {
251 uint64_t *data64, num_bits;
252 size_t databitlen;
253 int LastByte, PadOnePosition;
254
255 num_bits = state->bits_processed + state->unprocessed_bits;
256 LastByte = (int)state->unprocessed_bits >> 3;
257 PadOnePosition = 7 - (state->unprocessed_bits & 0x07);
258 hashState512(state)->LastPart[LastByte] =
259 (hashState512(state)->LastPart[LastByte] \
260 & (0xff << (PadOnePosition + 1))) ^ (0x01 << PadOnePosition);
261 /* LINTED E_BAD_PTR_CAST_ALIGN */
262 data64 = (uint64_t *)hashState512(state)->LastPart;
263
264 if (state->unprocessed_bits < 960) {
265 memset((hashState512(state)->LastPart) +
266 LastByte + 1, 0x00, EdonR512_BLOCK_SIZE - LastByte - 9);
267 databitlen = EdonR512_BLOCK_SIZE * 8;
268 #if defined(_ZFS_BIG_ENDIAN)
269 st_swap64(num_bits, data64 + 15);
270 #else
271 data64[15] = num_bits;
272 #endif
273 } else {
274 memset((hashState512(state)->LastPart) + LastByte + 1,
275 0x00, EdonR512_BLOCK_SIZE * 2 - LastByte - 9);
276 databitlen = EdonR512_BLOCK_SIZE * 16;
277 #if defined(_ZFS_BIG_ENDIAN)
278 st_swap64(num_bits, data64 + 31);
279 #else
280 data64[31] = num_bits;
281 #endif
282 }
283
284 state->bits_processed += Q512(databitlen, data64,
285 hashState512(state)->DoublePipe);
286
287 #if defined(_ZFS_BIG_ENDIAN)
288 data64 = (uint64_t *)hashval;
289 uint64_t *s64 = hashState512(state)->DoublePipe + 8;
290 int j;
291
292 for (j = 0; j < EdonR512_DIGEST_SIZE >> 3; j++)
293 st_swap64(s64[j], data64 + j);
294 #else
295 memcpy(hashval, hashState512(state)->DoublePipe + 8,
296 EdonR512_DIGEST_SIZE);
297 #endif
298 }
299
300 void
EdonRHash(const uint8_t * data,size_t databitlen,uint8_t * hashval)301 EdonRHash(const uint8_t *data, size_t databitlen, uint8_t *hashval)
302 {
303 EdonRState state;
304
305 EdonRInit(&state);
306 EdonRUpdate(&state, data, databitlen);
307 EdonRFinal(&state, hashval);
308 }
309
310 #ifdef _KERNEL
311 EXPORT_SYMBOL(EdonRInit);
312 EXPORT_SYMBOL(EdonRUpdate);
313 EXPORT_SYMBOL(EdonRHash);
314 EXPORT_SYMBOL(EdonRFinal);
315 #endif
316