1 // SPDX-License-Identifier: CDDL-1.0 2 /* 3 * CDDL HEADER START 4 * 5 * The contents of this file are subject to the terms of the 6 * Common Development and Distribution License (the "License"). 7 * You may not use this file except in compliance with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://opensource.org/licenses/CDDL-1.0. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 23 /* 24 * Based on Edon-R implementation for SUPERCOP, based on NIST API. 25 * Copyright (c) 2009, 2010, Jørn Amundsen <jorn.amundsen@ntnu.no> 26 * Copyright (c) 2013 Saso Kiselkov, All rights reserved 27 * Copyright (c) 2023 Tino Reichardt <milky-zfs@mcmilk.de> 28 */ 29 30 #include <sys/zfs_context.h> 31 #include <sys/string.h> 32 #include <sys/edonr.h> 33 34 /* 35 * We need 1196 byte stack for Q512() on i386 36 * - we define this pragma to make gcc happy 37 */ 38 #if defined(__GNUC__) && defined(_ILP32) 39 #pragma GCC diagnostic ignored "-Wframe-larger-than=" 40 #endif 41 42 /* 43 * Insert compiler memory barriers to reduce stack frame size. 44 */ 45 #define MEMORY_BARRIER asm volatile("" ::: "memory"); 46 47 #if defined(_ZFS_BIG_ENDIAN) 48 #define ld_swap64(s, d) (d = __builtin_bswap64(*(s))) 49 #define st_swap64(s, d) (*(d) = __builtin_bswap64(s)) 50 #else 51 #define ld_swap64(s, d) (d = *(s)) 52 #define st_swap64(s, d) (*(d) = s) 53 #endif 54 55 #define hashState512(x) ((x)->pipe->p512) 56 57 /* rotate shortcuts */ 58 #define rotl64(x, n) (((x) << (n)) | ((x) >> (64 - (n)))) 59 60 /* EdonR512 initial double chaining pipe */ 61 static const uint64_t i512p2[16] = { 62 0x8081828384858687ull, 0x88898a8b8c8d8e8full, 63 0x9091929394959697ull, 0x98999a9b9c9d9e9full, 64 0xa0a1a2a3a4a5a6a7ull, 0xa8a9aaabacadaeafull, 65 0xb0b1b2b3b4b5b6b7ull, 0xb8b9babbbcbdbebfull, 66 0xc0c1c2c3c4c5c6c7ull, 0xc8c9cacbcccdcecfull, 67 0xd0d1d2d3d4d5d6d7ull, 0xd8d9dadbdcdddedfull, 68 0xe0e1e2e3e4e5e6e7ull, 0xe8e9eaebecedeeefull, 69 0xf0f1f2f3f4f5f6f7ull, 0xf8f9fafbfcfdfeffull 70 }; 71 72 #define LS1_512(x0, x1, x2, x3, x4, x5, x6, x7) \ 73 { \ 74 MEMORY_BARRIER \ 75 z1 = x0 + x4, z2 = x1 + x7; z5 = z1 + z2; \ 76 s0 = 0xaaaaaaaaaaaaaaaaull + z5 + x2; \ 77 s1 = rotl64(z5 + x3, 5); \ 78 s2 = rotl64(z5 + x6, 15); z3 = x2 + x3; \ 79 s5 = rotl64(z1 + z3 + x5, 40); z4 = x5 + x6; \ 80 s6 = rotl64(z2 + z4 + x0, 50); z6 = z3 + z4; \ 81 s3 = rotl64(z6 + x7, 22); \ 82 s4 = rotl64(z6 + x1, 31); \ 83 s7 = rotl64(z6 + x4, 59); \ 84 } 85 86 #define LS2_512(y0, y1, y2, y3, y4, y5, y6, y7) \ 87 { \ 88 z1 = y0 + y1, z2 = y2 + y5; z6 = z1 + z2; \ 89 t0 = ~0xaaaaaaaaaaaaaaaaull + z6 + y7; \ 90 t2 = rotl64(z6 + y3, 19); \ 91 z3 = y3 + y4, z5 = z1 + z3; \ 92 t1 = rotl64(z5 + y6, 10); \ 93 t4 = rotl64(z5 + y5, 36); \ 94 z4 = y6 + y7, z8 = z3 + z4; \ 95 t3 = rotl64(z8 + y2, 29); \ 96 t7 = rotl64(z8 + y0, 55); z7 = z2 + z4; \ 97 t5 = rotl64(z7 + y4, 44); \ 98 t6 = rotl64(z7 + y1, 48); \ 99 } 100 101 #define QEF_512(r0, r1, r2, r3, r4, r5, r6, r7) \ 102 { \ 103 z1 = s0 ^ s4, z5 = t0 ^ t1; \ 104 r0 = (z1 ^ s1) + (z5 ^ t5); z8 = t6 ^ t7; \ 105 r1 = (z1 ^ s7) + (t2 ^ z8); z3 = s2 ^ s3; \ 106 r7 = (z3 ^ s5) + (t4 ^ z8); z7 = t3 ^ t4; \ 107 r3 = (z3 ^ s4) + (t0 ^ z7); z4 = s5 ^ s6; \ 108 r5 = (s3 ^ z4) + (z7 ^ t6); z6 = t2 ^ t5; \ 109 r6 = (s2 ^ z4) + (z6 ^ t7); z2 = s1 ^ s7; \ 110 r4 = (s0 ^ z2) + (t1 ^ z6); \ 111 r2 = (z2 ^ s6) + (z5 ^ t3); \ 112 } 113 114 static inline size_t 115 Q512(size_t bitlen, const uint64_t *data, uint64_t *p) 116 { 117 size_t bl; 118 119 for (bl = bitlen; bl >= EdonR512_BLOCK_BITSIZE; 120 bl -= EdonR512_BLOCK_BITSIZE, data += 16) { 121 uint64_t q0, q1, q2, q3, q4, q5, q6, q7; 122 uint64_t p0, p1, p2, p3, p4, p5, p6, p7; 123 uint64_t s0, s1, s2, s3, s4, s5, s6, s7; 124 uint64_t t0, t1, t2, t3, t4, t5, t6, t7; 125 uint64_t z1, z2, z3, z4, z5, z6, z7, z8; 126 127 #if defined(_ZFS_BIG_ENDIAN) 128 uint64_t swp0, swp1, swp2, swp3, swp4, swp5, swp6, swp7, 129 swp8, swp9, swp10, swp11, swp12, swp13, swp14, swp15; 130 #define d(j) swp##j 131 #define s64(j) ld_swap64((uint64_t *)data+j, swp##j) 132 s64(0); 133 s64(1); 134 s64(2); 135 s64(3); 136 s64(4); 137 s64(5); 138 s64(6); 139 s64(7); 140 s64(8); 141 s64(9); 142 s64(10); 143 s64(11); 144 s64(12); 145 s64(13); 146 s64(14); 147 s64(15); 148 #else 149 #define d(j) data[j] 150 #endif 151 152 /* First row of quasigroup e-transformations */ 153 LS1_512(d(15), d(14), d(13), d(12), d(11), d(10), d(9), d(8)); 154 LS2_512(d(0), d(1), d(2), d(3), d(4), d(5), d(6), d(7)); 155 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7); 156 157 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7); 158 LS2_512(d(8), d(9), d(10), d(11), d(12), d(13), d(14), d(15)); 159 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7); 160 161 /* Second row of quasigroup e-transformations */ 162 LS1_512(p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]); 163 LS2_512(p0, p1, p2, p3, p4, p5, p6, p7); 164 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7); 165 166 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7); 167 LS2_512(q0, q1, q2, q3, q4, q5, q6, q7); 168 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7); 169 170 /* Third row of quasigroup e-transformations */ 171 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7); 172 LS2_512(p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]); 173 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7); 174 175 LS1_512(q0, q1, q2, q3, q4, q5, q6, q7); 176 LS2_512(p0, p1, p2, p3, p4, p5, p6, p7); 177 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7); 178 179 /* Fourth row of quasigroup e-transformations */ 180 LS1_512(d(7), d(6), d(5), d(4), d(3), d(2), d(1), d(0)); 181 LS2_512(p0, p1, p2, p3, p4, p5, p6, p7); 182 QEF_512(p0, p1, p2, p3, p4, p5, p6, p7); 183 184 LS1_512(p0, p1, p2, p3, p4, p5, p6, p7); 185 LS2_512(q0, q1, q2, q3, q4, q5, q6, q7); 186 QEF_512(q0, q1, q2, q3, q4, q5, q6, q7); 187 188 /* Edon-R tweak on the original SHA-3 Edon-R submission. */ 189 p[0] ^= d(8) ^ p0; 190 p[1] ^= d(9) ^ p1; 191 p[2] ^= d(10) ^ p2; 192 p[3] ^= d(11) ^ p3; 193 p[4] ^= d(12) ^ p4; 194 p[5] ^= d(13) ^ p5; 195 p[6] ^= d(14) ^ p6; 196 p[7] ^= d(15) ^ p7; 197 p[8] ^= d(0) ^ q0; 198 p[9] ^= d(1) ^ q1; 199 p[10] ^= d(2) ^ q2; 200 p[11] ^= d(3) ^ q3; 201 p[12] ^= d(4) ^ q4; 202 p[13] ^= d(5) ^ q5; 203 p[14] ^= d(6) ^ q6; 204 p[15] ^= d(7) ^ q7; 205 } 206 207 #undef s64 208 #undef d 209 return (bitlen - bl); 210 } 211 212 void 213 EdonRInit(EdonRState *state) 214 { 215 state->bits_processed = 0; 216 state->unprocessed_bits = 0; 217 memcpy(hashState512(state)->DoublePipe, i512p2, sizeof (i512p2)); 218 } 219 220 void 221 EdonRUpdate(EdonRState *state, const uint8_t *data, size_t databitlen) 222 { 223 uint64_t *data64; 224 size_t bits_processed; 225 226 if (state->unprocessed_bits > 0) { 227 /* LastBytes = databitlen / 8 */ 228 int LastBytes = (int)databitlen >> 3; 229 230 ASSERT(state->unprocessed_bits + databitlen <= 231 EdonR512_BLOCK_SIZE * 8); 232 233 memcpy(hashState512(state)->LastPart 234 + (state->unprocessed_bits >> 3), data, LastBytes); 235 state->unprocessed_bits += (int)databitlen; 236 databitlen = state->unprocessed_bits; 237 /* LINTED E_BAD_PTR_CAST_ALIGN */ 238 data64 = (uint64_t *)hashState512(state)->LastPart; 239 } else 240 /* LINTED E_BAD_PTR_CAST_ALIGN */ 241 data64 = (uint64_t *)data; 242 243 bits_processed = Q512(databitlen, data64, 244 hashState512(state)->DoublePipe); 245 state->bits_processed += bits_processed; 246 databitlen -= bits_processed; 247 state->unprocessed_bits = (int)databitlen; 248 if (databitlen > 0) { 249 /* LastBytes = Ceil(databitlen / 8) */ 250 int LastBytes = ((~(((-(int)databitlen) >> 3) & 0x03ff)) + 1) \ 251 & 0x03ff; 252 253 data64 += bits_processed >> 6; /* byte size update */ 254 memmove(hashState512(state)->LastPart, data64, LastBytes); 255 } 256 } 257 258 void 259 EdonRFinal(EdonRState *state, uint8_t *hashval) 260 { 261 uint64_t *data64, num_bits; 262 size_t databitlen; 263 int LastByte, PadOnePosition; 264 265 num_bits = state->bits_processed + state->unprocessed_bits; 266 LastByte = (int)state->unprocessed_bits >> 3; 267 PadOnePosition = 7 - (state->unprocessed_bits & 0x07); 268 hashState512(state)->LastPart[LastByte] = 269 (hashState512(state)->LastPart[LastByte] \ 270 & (0xff << (PadOnePosition + 1))) ^ (0x01 << PadOnePosition); 271 /* LINTED E_BAD_PTR_CAST_ALIGN */ 272 data64 = (uint64_t *)hashState512(state)->LastPart; 273 274 if (state->unprocessed_bits < 960) { 275 memset((hashState512(state)->LastPart) + 276 LastByte + 1, 0x00, EdonR512_BLOCK_SIZE - LastByte - 9); 277 databitlen = EdonR512_BLOCK_SIZE * 8; 278 #if defined(_ZFS_BIG_ENDIAN) 279 st_swap64(num_bits, data64 + 15); 280 #else 281 data64[15] = num_bits; 282 #endif 283 } else { 284 memset((hashState512(state)->LastPart) + LastByte + 1, 285 0x00, EdonR512_BLOCK_SIZE * 2 - LastByte - 9); 286 databitlen = EdonR512_BLOCK_SIZE * 16; 287 #if defined(_ZFS_BIG_ENDIAN) 288 st_swap64(num_bits, data64 + 31); 289 #else 290 data64[31] = num_bits; 291 #endif 292 } 293 294 state->bits_processed += Q512(databitlen, data64, 295 hashState512(state)->DoublePipe); 296 297 #if defined(_ZFS_BIG_ENDIAN) 298 data64 = (uint64_t *)hashval; 299 uint64_t *s64 = hashState512(state)->DoublePipe + 8; 300 int j; 301 302 for (j = 0; j < EdonR512_DIGEST_SIZE >> 3; j++) 303 st_swap64(s64[j], data64 + j); 304 #else 305 memcpy(hashval, hashState512(state)->DoublePipe + 8, 306 EdonR512_DIGEST_SIZE); 307 #endif 308 } 309 310 void 311 EdonRHash(const uint8_t *data, size_t databitlen, uint8_t *hashval) 312 { 313 EdonRState state; 314 315 EdonRInit(&state); 316 EdonRUpdate(&state, data, databitlen); 317 EdonRFinal(&state, hashval); 318 } 319 320 #ifdef _KERNEL 321 EXPORT_SYMBOL(EdonRInit); 322 EXPORT_SYMBOL(EdonRUpdate); 323 EXPORT_SYMBOL(EdonRHash); 324 EXPORT_SYMBOL(EdonRFinal); 325 #endif 326