1*0957b409SSimon J. Gerraty /*
2*0957b409SSimon J. Gerraty * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3*0957b409SSimon J. Gerraty *
4*0957b409SSimon J. Gerraty * Permission is hereby granted, free of charge, to any person obtaining
5*0957b409SSimon J. Gerraty * a copy of this software and associated documentation files (the
6*0957b409SSimon J. Gerraty * "Software"), to deal in the Software without restriction, including
7*0957b409SSimon J. Gerraty * without limitation the rights to use, copy, modify, merge, publish,
8*0957b409SSimon J. Gerraty * distribute, sublicense, and/or sell copies of the Software, and to
9*0957b409SSimon J. Gerraty * permit persons to whom the Software is furnished to do so, subject to
10*0957b409SSimon J. Gerraty * the following conditions:
11*0957b409SSimon J. Gerraty *
12*0957b409SSimon J. Gerraty * The above copyright notice and this permission notice shall be
13*0957b409SSimon J. Gerraty * included in all copies or substantial portions of the Software.
14*0957b409SSimon J. Gerraty *
15*0957b409SSimon J. Gerraty * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16*0957b409SSimon J. Gerraty * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17*0957b409SSimon J. Gerraty * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18*0957b409SSimon J. Gerraty * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19*0957b409SSimon J. Gerraty * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20*0957b409SSimon J. Gerraty * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21*0957b409SSimon J. Gerraty * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22*0957b409SSimon J. Gerraty * SOFTWARE.
23*0957b409SSimon J. Gerraty */
24*0957b409SSimon J. Gerraty
25*0957b409SSimon J. Gerraty #include "inner.h"
26*0957b409SSimon J. Gerraty
27*0957b409SSimon J. Gerraty /*
28*0957b409SSimon J. Gerraty * This is the 64-bit variant of br_ghash_ctmul32(), with 64-bit operands
29*0957b409SSimon J. Gerraty * and bit reversal of 64-bit words.
30*0957b409SSimon J. Gerraty */
31*0957b409SSimon J. Gerraty
32*0957b409SSimon J. Gerraty static inline uint64_t
bmul64(uint64_t x,uint64_t y)33*0957b409SSimon J. Gerraty bmul64(uint64_t x, uint64_t y)
34*0957b409SSimon J. Gerraty {
35*0957b409SSimon J. Gerraty uint64_t x0, x1, x2, x3;
36*0957b409SSimon J. Gerraty uint64_t y0, y1, y2, y3;
37*0957b409SSimon J. Gerraty uint64_t z0, z1, z2, z3;
38*0957b409SSimon J. Gerraty
39*0957b409SSimon J. Gerraty x0 = x & (uint64_t)0x1111111111111111;
40*0957b409SSimon J. Gerraty x1 = x & (uint64_t)0x2222222222222222;
41*0957b409SSimon J. Gerraty x2 = x & (uint64_t)0x4444444444444444;
42*0957b409SSimon J. Gerraty x3 = x & (uint64_t)0x8888888888888888;
43*0957b409SSimon J. Gerraty y0 = y & (uint64_t)0x1111111111111111;
44*0957b409SSimon J. Gerraty y1 = y & (uint64_t)0x2222222222222222;
45*0957b409SSimon J. Gerraty y2 = y & (uint64_t)0x4444444444444444;
46*0957b409SSimon J. Gerraty y3 = y & (uint64_t)0x8888888888888888;
47*0957b409SSimon J. Gerraty z0 = (x0 * y0) ^ (x1 * y3) ^ (x2 * y2) ^ (x3 * y1);
48*0957b409SSimon J. Gerraty z1 = (x0 * y1) ^ (x1 * y0) ^ (x2 * y3) ^ (x3 * y2);
49*0957b409SSimon J. Gerraty z2 = (x0 * y2) ^ (x1 * y1) ^ (x2 * y0) ^ (x3 * y3);
50*0957b409SSimon J. Gerraty z3 = (x0 * y3) ^ (x1 * y2) ^ (x2 * y1) ^ (x3 * y0);
51*0957b409SSimon J. Gerraty z0 &= (uint64_t)0x1111111111111111;
52*0957b409SSimon J. Gerraty z1 &= (uint64_t)0x2222222222222222;
53*0957b409SSimon J. Gerraty z2 &= (uint64_t)0x4444444444444444;
54*0957b409SSimon J. Gerraty z3 &= (uint64_t)0x8888888888888888;
55*0957b409SSimon J. Gerraty return z0 | z1 | z2 | z3;
56*0957b409SSimon J. Gerraty }
57*0957b409SSimon J. Gerraty
58*0957b409SSimon J. Gerraty static uint64_t
rev64(uint64_t x)59*0957b409SSimon J. Gerraty rev64(uint64_t x)
60*0957b409SSimon J. Gerraty {
61*0957b409SSimon J. Gerraty #define RMS(m, s) do { \
62*0957b409SSimon J. Gerraty x = ((x & (uint64_t)(m)) << (s)) \
63*0957b409SSimon J. Gerraty | ((x >> (s)) & (uint64_t)(m)); \
64*0957b409SSimon J. Gerraty } while (0)
65*0957b409SSimon J. Gerraty
66*0957b409SSimon J. Gerraty RMS(0x5555555555555555, 1);
67*0957b409SSimon J. Gerraty RMS(0x3333333333333333, 2);
68*0957b409SSimon J. Gerraty RMS(0x0F0F0F0F0F0F0F0F, 4);
69*0957b409SSimon J. Gerraty RMS(0x00FF00FF00FF00FF, 8);
70*0957b409SSimon J. Gerraty RMS(0x0000FFFF0000FFFF, 16);
71*0957b409SSimon J. Gerraty return (x << 32) | (x >> 32);
72*0957b409SSimon J. Gerraty
73*0957b409SSimon J. Gerraty #undef RMS
74*0957b409SSimon J. Gerraty }
75*0957b409SSimon J. Gerraty
76*0957b409SSimon J. Gerraty /* see bearssl_ghash.h */
77*0957b409SSimon J. Gerraty void
br_ghash_ctmul64(void * y,const void * h,const void * data,size_t len)78*0957b409SSimon J. Gerraty br_ghash_ctmul64(void *y, const void *h, const void *data, size_t len)
79*0957b409SSimon J. Gerraty {
80*0957b409SSimon J. Gerraty const unsigned char *buf, *hb;
81*0957b409SSimon J. Gerraty unsigned char *yb;
82*0957b409SSimon J. Gerraty uint64_t y0, y1;
83*0957b409SSimon J. Gerraty uint64_t h0, h1, h2, h0r, h1r, h2r;
84*0957b409SSimon J. Gerraty
85*0957b409SSimon J. Gerraty buf = data;
86*0957b409SSimon J. Gerraty yb = y;
87*0957b409SSimon J. Gerraty hb = h;
88*0957b409SSimon J. Gerraty y1 = br_dec64be(yb);
89*0957b409SSimon J. Gerraty y0 = br_dec64be(yb + 8);
90*0957b409SSimon J. Gerraty h1 = br_dec64be(hb);
91*0957b409SSimon J. Gerraty h0 = br_dec64be(hb + 8);
92*0957b409SSimon J. Gerraty h0r = rev64(h0);
93*0957b409SSimon J. Gerraty h1r = rev64(h1);
94*0957b409SSimon J. Gerraty h2 = h0 ^ h1;
95*0957b409SSimon J. Gerraty h2r = h0r ^ h1r;
96*0957b409SSimon J. Gerraty while (len > 0) {
97*0957b409SSimon J. Gerraty const unsigned char *src;
98*0957b409SSimon J. Gerraty unsigned char tmp[16];
99*0957b409SSimon J. Gerraty uint64_t y0r, y1r, y2, y2r;
100*0957b409SSimon J. Gerraty uint64_t z0, z1, z2, z0h, z1h, z2h;
101*0957b409SSimon J. Gerraty uint64_t v0, v1, v2, v3;
102*0957b409SSimon J. Gerraty
103*0957b409SSimon J. Gerraty if (len >= 16) {
104*0957b409SSimon J. Gerraty src = buf;
105*0957b409SSimon J. Gerraty buf += 16;
106*0957b409SSimon J. Gerraty len -= 16;
107*0957b409SSimon J. Gerraty } else {
108*0957b409SSimon J. Gerraty memcpy(tmp, buf, len);
109*0957b409SSimon J. Gerraty memset(tmp + len, 0, (sizeof tmp) - len);
110*0957b409SSimon J. Gerraty src = tmp;
111*0957b409SSimon J. Gerraty len = 0;
112*0957b409SSimon J. Gerraty }
113*0957b409SSimon J. Gerraty y1 ^= br_dec64be(src);
114*0957b409SSimon J. Gerraty y0 ^= br_dec64be(src + 8);
115*0957b409SSimon J. Gerraty
116*0957b409SSimon J. Gerraty y0r = rev64(y0);
117*0957b409SSimon J. Gerraty y1r = rev64(y1);
118*0957b409SSimon J. Gerraty y2 = y0 ^ y1;
119*0957b409SSimon J. Gerraty y2r = y0r ^ y1r;
120*0957b409SSimon J. Gerraty
121*0957b409SSimon J. Gerraty z0 = bmul64(y0, h0);
122*0957b409SSimon J. Gerraty z1 = bmul64(y1, h1);
123*0957b409SSimon J. Gerraty z2 = bmul64(y2, h2);
124*0957b409SSimon J. Gerraty z0h = bmul64(y0r, h0r);
125*0957b409SSimon J. Gerraty z1h = bmul64(y1r, h1r);
126*0957b409SSimon J. Gerraty z2h = bmul64(y2r, h2r);
127*0957b409SSimon J. Gerraty z2 ^= z0 ^ z1;
128*0957b409SSimon J. Gerraty z2h ^= z0h ^ z1h;
129*0957b409SSimon J. Gerraty z0h = rev64(z0h) >> 1;
130*0957b409SSimon J. Gerraty z1h = rev64(z1h) >> 1;
131*0957b409SSimon J. Gerraty z2h = rev64(z2h) >> 1;
132*0957b409SSimon J. Gerraty
133*0957b409SSimon J. Gerraty v0 = z0;
134*0957b409SSimon J. Gerraty v1 = z0h ^ z2;
135*0957b409SSimon J. Gerraty v2 = z1 ^ z2h;
136*0957b409SSimon J. Gerraty v3 = z1h;
137*0957b409SSimon J. Gerraty
138*0957b409SSimon J. Gerraty v3 = (v3 << 1) | (v2 >> 63);
139*0957b409SSimon J. Gerraty v2 = (v2 << 1) | (v1 >> 63);
140*0957b409SSimon J. Gerraty v1 = (v1 << 1) | (v0 >> 63);
141*0957b409SSimon J. Gerraty v0 = (v0 << 1);
142*0957b409SSimon J. Gerraty
143*0957b409SSimon J. Gerraty v2 ^= v0 ^ (v0 >> 1) ^ (v0 >> 2) ^ (v0 >> 7);
144*0957b409SSimon J. Gerraty v1 ^= (v0 << 63) ^ (v0 << 62) ^ (v0 << 57);
145*0957b409SSimon J. Gerraty v3 ^= v1 ^ (v1 >> 1) ^ (v1 >> 2) ^ (v1 >> 7);
146*0957b409SSimon J. Gerraty v2 ^= (v1 << 63) ^ (v1 << 62) ^ (v1 << 57);
147*0957b409SSimon J. Gerraty
148*0957b409SSimon J. Gerraty y0 = v2;
149*0957b409SSimon J. Gerraty y1 = v3;
150*0957b409SSimon J. Gerraty }
151*0957b409SSimon J. Gerraty
152*0957b409SSimon J. Gerraty br_enc64be(yb, y1);
153*0957b409SSimon J. Gerraty br_enc64be(yb + 8, y0);
154*0957b409SSimon J. Gerraty }
155