1 /*	$OpenBSD: siphash.c,v 1.8 2019/01/20 03:53:47 bcook Exp $ */
2 
3 /*-
4  * Copyright (c) 2013 Andre Oppermann <andre@FreeBSD.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. The name of the author may not be used to endorse or promote
16  *    products derived from this software without specific prior written
17  *    permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*
33  * SipHash is a family of PRFs SipHash-c-d where the integer parameters c and d
34  * are the number of compression rounds and the number of finalization rounds.
35  * A compression round is identical to a finalization round and this round
36  * function is called SipRound.  Given a 128-bit key k and a (possibly empty)
37  * byte string m, SipHash-c-d returns a 64-bit value SipHash-c-d(k; m).
38  *
39  * Implemented from the paper "SipHash: a fast short-input PRF", 2012.09.18,
40  * by Jean-Philippe Aumasson and Daniel J. Bernstein,
41  * Permanent Document ID b9a943a805fbfc6fde808af9fc0ecdfa
42  * https://131002.net/siphash/siphash.pdf
43  * https://131002.net/siphash/
44  */
45 
46 #include <stdint.h>
47 #include <string.h>
48 #include "siphash.h"
49 
50 #include "got_compat.h"
51 
52 static void	SipHash_CRounds(SIPHASH_CTX *, int);
53 static void	SipHash_Rounds(SIPHASH_CTX *, int);
54 
55 void
56 SipHash_Init(SIPHASH_CTX *ctx, const SIPHASH_KEY *key)
57 {
58 	uint64_t k0, k1;
59 
60 	k0 = le64toh(key->k0);
61 	k1 = le64toh(key->k1);
62 
63 	ctx->v[0] = 0x736f6d6570736575ULL ^ k0;
64 	ctx->v[1] = 0x646f72616e646f6dULL ^ k1;
65 	ctx->v[2] = 0x6c7967656e657261ULL ^ k0;
66 	ctx->v[3] = 0x7465646279746573ULL ^ k1;
67 
68 	memset(ctx->buf, 0, sizeof(ctx->buf));
69 	ctx->bytes = 0;
70 }
71 
72 void
73 SipHash_Update(SIPHASH_CTX *ctx, int rc, int rf, const void *src, size_t len)
74 {
75 	const uint8_t *ptr = src;
76 	size_t left, used;
77 
78 	if (len == 0)
79 		return;
80 
81 	used = ctx->bytes % sizeof(ctx->buf);
82 	ctx->bytes += len;
83 
84 	if (used > 0) {
85 		left = sizeof(ctx->buf) - used;
86 
87 		if (len >= left) {
88 			memcpy(&ctx->buf[used], ptr, left);
89 			SipHash_CRounds(ctx, rc);
90 			len -= left;
91 			ptr += left;
92 		} else {
93 			memcpy(&ctx->buf[used], ptr, len);
94 			return;
95 		}
96 	}
97 
98 	while (len >= sizeof(ctx->buf)) {
99 		memcpy(ctx->buf, ptr, sizeof(ctx->buf));
100 		SipHash_CRounds(ctx, rc);
101 		len -= sizeof(ctx->buf);
102 		ptr += sizeof(ctx->buf);
103 	}
104 
105 	if (len > 0)
106 		memcpy(ctx->buf, ptr, len);
107 }
108 
109 void
110 SipHash_Final(void *dst, SIPHASH_CTX *ctx, int rc, int rf)
111 {
112 	uint64_t r;
113 
114 	r = htole64(SipHash_End(ctx, rc, rf));
115 	memcpy(dst, &r, sizeof r);
116 }
117 
118 uint64_t
119 SipHash_End(SIPHASH_CTX *ctx, int rc, int rf)
120 {
121 	uint64_t r;
122 	size_t left, used;
123 
124 	used = ctx->bytes % sizeof(ctx->buf);
125 	left = sizeof(ctx->buf) - used;
126 	memset(&ctx->buf[used], 0, left - 1);
127 	ctx->buf[7] = ctx->bytes;
128 
129 	SipHash_CRounds(ctx, rc);
130 	ctx->v[2] ^= 0xff;
131 	SipHash_Rounds(ctx, rf);
132 
133 	r = (ctx->v[0] ^ ctx->v[1]) ^ (ctx->v[2] ^ ctx->v[3]);
134 
135 #ifdef __APPLE__
136 	memset_s(ctx, sizeof(*ctx), 0, sizeof(*ctx));
137 #elif defined(__NetBSD__)
138 	explicit_memset(ctx, sizeof(*ctx), 0);
139 #else
140 	explicit_bzero(ctx, sizeof(*ctx));
141 #endif
142 	return (r);
143 }
144 
145 uint64_t
146 SipHash(const SIPHASH_KEY *key, int rc, int rf, const void *src, size_t len)
147 {
148 	SIPHASH_CTX ctx;
149 
150 	SipHash_Init(&ctx, key);
151 	SipHash_Update(&ctx, rc, rf, src, len);
152 	return (SipHash_End(&ctx, rc, rf));
153 }
154 
155 #define SIP_ROTL(x, b) ((x) << (b)) | ( (x) >> (64 - (b)))
156 
157 static void
158 SipHash_Rounds(SIPHASH_CTX *ctx, int rounds)
159 {
160 	while (rounds--) {
161 		ctx->v[0] += ctx->v[1];
162 		ctx->v[2] += ctx->v[3];
163 		ctx->v[1] = SIP_ROTL(ctx->v[1], 13);
164 		ctx->v[3] = SIP_ROTL(ctx->v[3], 16);
165 
166 		ctx->v[1] ^= ctx->v[0];
167 		ctx->v[3] ^= ctx->v[2];
168 		ctx->v[0] = SIP_ROTL(ctx->v[0], 32);
169 
170 		ctx->v[2] += ctx->v[1];
171 		ctx->v[0] += ctx->v[3];
172 		ctx->v[1] = SIP_ROTL(ctx->v[1], 17);
173 		ctx->v[3] = SIP_ROTL(ctx->v[3], 21);
174 
175 		ctx->v[1] ^= ctx->v[2];
176 		ctx->v[3] ^= ctx->v[0];
177 		ctx->v[2] = SIP_ROTL(ctx->v[2], 32);
178 	}
179 }
180 
181 static void
182 SipHash_CRounds(SIPHASH_CTX *ctx, int rounds)
183 {
184 	uint64_t m = le64toh(*(uint64_t *)ctx->buf);
185 
186 	ctx->v[3] ^= m;
187 	SipHash_Rounds(ctx, rounds);
188 	ctx->v[0] ^= m;
189 }