Organise files

Signed-off-by: Mattias Andrée <maandree@kth.se>

17 files changed, 478 insertions, 0 deletions

diff --git a/hmac/libkeccak_hmac_copy.c b/hmac/libkeccak_hmac_copy.c
new file mode 100644
index 0000000..8a4077b
--- /dev/null
+++ b/hmac/libkeccak_hmac_copy.c
@@ -0,0 +1,38 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+/**
+ * Make a copy of an HMAC hashing-state
+ * 
+ * @param   dest  The slot for the duplicate, must not be initialised (memory leak otherwise)
+ * @param   src   The state to duplicate
+ * @return        Zero on success, -1 on error
+ */
+int
+libkeccak_hmac_copy(struct libkeccak_hmac_state *restrict dest, const struct libkeccak_hmac_state *restrict src)
+{
+	size_t size;
+
+	dest->key_opad = NULL;
+	dest->key_ipad = NULL;
+
+	if (libkeccak_state_copy(&dest->sponge, &src->sponge) < 0)
+		return -1;
+
+	dest->key_length = src->key_length;
+	dest->leftover = src->leftover;
+
+	size = (src->key_length + 7) >> 3;
+	dest->key_opad = malloc(2 * size);
+	if (!dest->key_opad) {
+		libkeccak_state_destroy(&dest->sponge);
+		return -1;
+	}
+	dest->key_ipad = dest->key_opad + size;
+
+	memcpy(dest->key_opad, src->key_opad, size);
+	memcpy(dest->key_ipad, src->key_ipad, size);
+
+	return 0;
+}
diff --git a/hmac/libkeccak_hmac_create.c b/hmac/libkeccak_hmac_create.c
new file mode 100644
index 0000000..ef6f025
--- /dev/null
+++ b/hmac/libkeccak_hmac_create.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline struct libkeccak_hmac_state *libkeccak_hmac_create(const struct libkeccak_spec *restrict, const void *restrict, size_t);
diff --git a/hmac/libkeccak_hmac_destroy.c b/hmac/libkeccak_hmac_destroy.c
new file mode 100644
index 0000000..f2d7419
--- /dev/null
+++ b/hmac/libkeccak_hmac_destroy.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline void libkeccak_hmac_destroy(volatile struct libkeccak_hmac_state *);
diff --git a/hmac/libkeccak_hmac_digest.c b/hmac/libkeccak_hmac_digest.c
new file mode 100644
index 0000000..a9e3609
--- /dev/null
+++ b/hmac/libkeccak_hmac_digest.c
@@ -0,0 +1,81 @@
+/* See LICENSE file for copyright and license details. */
+#define NEED_EXPLICIT_BZERO 1
+#include "../common.h"
+
+
+/**
+ * Absorb the last part of the message and fetch the hash
+ * and wipe sensitive data when possible
+ * 
+ * You may use `&state->sponge` for continued squeezing
+ * 
+ * @param   state    The hashing state
+ * @param   msg_     The rest of the message, may be `NULL`, may be modified
+ * @param   msglen   The length of the partial message
+ * @param   bits     The number of bits at the end of the message not covered by `msglen`
+ * @param   suffix   The suffix concatenate to the message, only '1':s and '0':s, and NUL-termination
+ * @param   hashsum  Output parameter for the hashsum, may be `NULL`
+ * @return           Zero on success, -1 on error
+ */
+int
+libkeccak_hmac_digest(struct libkeccak_hmac_state *restrict state, const void *restrict msg_, size_t msglen,
+                      size_t bits, const char *restrict suffix, void *restrict hashsum)
+{
+	const unsigned char *restrict msg = msg_;
+	size_t hashsize = (size_t)(state->sponge.n >> 3);
+	char *tmp = malloc((size_t)((state->sponge.n + 7) >> 3) * sizeof(char));
+	unsigned char leftover[2];
+	size_t newlen;
+
+	if (!tmp)
+		return -1;
+
+	if (!(state->key_length & 7)) {
+		if (libkeccak_digest(&state->sponge, msg, msglen, bits, suffix, tmp) < 0)
+			goto fail;
+		goto stage_2;
+	}
+
+	if (libkeccak_hmac_update(state, msg, msglen) < 0)
+		goto fail;
+	leftover[0] = state->leftover;
+	if (bits) {
+		leftover[0] |= (unsigned char)(msg[msglen] >> (state->key_length & 7));
+		leftover[1] = (unsigned char)(msg[msglen] << (8 - (state->key_length & 7)));
+	}
+	newlen = (state->key_length & 7) + bits;
+	if (libkeccak_digest(&state->sponge, leftover, newlen >> 3, newlen & 7, suffix, tmp) < 0)
+		goto fail;
+
+stage_2:
+	bits = state->sponge.n & 7;
+	state->key_ipad = state->key_opad;
+	if (libkeccak_hmac_update(state, NULL, 0) < 0)
+		goto fail;
+
+	if (!(state->key_length & 7)) {
+		if (libkeccak_digest(&state->sponge, tmp, hashsize, bits, suffix, hashsum) < 0)
+			goto fail;
+		goto stage_3;
+	}
+
+	if (libkeccak_hmac_update(state, tmp, hashsize) < 0)
+		goto fail;
+	leftover[0] = state->leftover;
+	if (bits) {
+		leftover[0] |= (unsigned char)(tmp[hashsize] >> (state->key_length & 7));
+		leftover[1] = (unsigned char)(tmp[hashsize] << (8 - (state->key_length & 7)));
+	}
+	newlen = (state->key_length & 7) + bits;
+	if (libkeccak_digest(&state->sponge, leftover, newlen >> 3, newlen & 7, suffix, tmp) < 0)
+		goto fail;
+
+stage_3:
+	my_explicit_bzero(tmp, (size_t)((state->sponge.n + 7) >> 3) * sizeof(char));
+	free(tmp);
+	return 0;
+fail:
+	my_explicit_bzero(tmp, (size_t)((state->sponge.n + 7) >> 3) * sizeof(char));
+	free(tmp);
+	return -1;
+}
diff --git a/hmac/libkeccak_hmac_duplicate.c b/hmac/libkeccak_hmac_duplicate.c
new file mode 100644
index 0000000..959eae9
--- /dev/null
+++ b/hmac/libkeccak_hmac_duplicate.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline struct libkeccak_hmac_state *libkeccak_hmac_duplicate(const struct libkeccak_hmac_state *);
diff --git a/hmac/libkeccak_hmac_fast_destroy.c b/hmac/libkeccak_hmac_fast_destroy.c
new file mode 100644
index 0000000..7d9feab
--- /dev/null
+++ b/hmac/libkeccak_hmac_fast_destroy.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline void libkeccak_hmac_fast_destroy(struct libkeccak_hmac_state *);
diff --git a/hmac/libkeccak_hmac_fast_digest.c b/hmac/libkeccak_hmac_fast_digest.c
new file mode 100644
index 0000000..dc98136
--- /dev/null
+++ b/hmac/libkeccak_hmac_fast_digest.c
@@ -0,0 +1,78 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+/**
+ * Absorb the last part of the message and fetch the hash
+ * without wiping sensitive data when possible
+ * 
+ * You may use `&state->sponge` for continued squeezing
+ * 
+ * @param   state    The hashing state
+ * @param   msg_     The rest of the message, may be `NULL`, may be modified
+ * @param   msglen   The length of the partial message
+ * @param   bits     The number of bits at the end of the message not covered by `msglen`
+ * @param   suffix   The suffix concatenate to the message, only '1':s and '0':s, and NUL-termination
+ * @param   hashsum  Output parameter for the hashsum, may be `NULL`
+ * @return           Zero on success, -1 on error
+ */
+int
+libkeccak_hmac_fast_digest(struct libkeccak_hmac_state *restrict state, const void *restrict msg_, size_t msglen,
+                           size_t bits, const char *restrict suffix, void *restrict hashsum)
+{
+	const unsigned char *restrict msg = msg_;
+	size_t hashsize = (size_t)state->sponge.n >> 3;
+	unsigned char *tmp = malloc((size_t)((state->sponge.n + 7) >> 3) * sizeof(char));
+	unsigned char leftover[2];
+	size_t newlen;
+
+	if (!tmp)
+		return -1;
+
+	if (!(state->key_length & 7)) {
+		if (libkeccak_fast_digest(&state->sponge, msg, msglen, bits, suffix, tmp) < 0)
+			goto fail;
+		goto stage_2;
+	}
+
+	if (libkeccak_hmac_fast_update(state, msg, msglen) < 0)
+		goto fail;
+	leftover[0] = state->leftover;
+	if (bits) {
+		leftover[0] |= (unsigned char)(msg[msglen] >> (state->key_length & 7));
+		leftover[1] = (unsigned char)(msg[msglen] << (8 - (state->key_length & 7)));
+	}
+	newlen = (state->key_length & 7) + bits;
+	if (libkeccak_fast_digest(&state->sponge, leftover, newlen >> 3, newlen & 7, suffix, tmp) < 0)
+		goto fail;
+
+stage_2:
+	bits = state->sponge.n & 7;
+	state->key_ipad = state->key_opad;
+	if (libkeccak_hmac_fast_update(state, NULL, 0) < 0)
+		goto fail;
+
+	if (!(state->key_length & 7)) {
+		if (libkeccak_fast_digest(&state->sponge, tmp, hashsize, bits, suffix, hashsum) < 0)
+			goto fail;
+		goto stage_3;
+	}
+
+	if (libkeccak_hmac_fast_update(state, tmp, hashsize) < 0)
+		goto fail;
+	leftover[0] = state->leftover;
+	if (bits) {
+		leftover[0] |= (unsigned char)(tmp[hashsize] >> (state->key_length & 7));
+		leftover[1] = (unsigned char)(tmp[hashsize] << (8 - (state->key_length & 7)));
+	}
+	newlen = (state->key_length & 7) + bits;
+	if (libkeccak_fast_digest(&state->sponge, leftover, newlen >> 3, newlen & 7, suffix, tmp) < 0)
+		goto fail;
+
+stage_3:
+	free(tmp);
+	return 0;
+fail:
+	free(tmp);
+	return -1;
+}
diff --git a/hmac/libkeccak_hmac_fast_free.c b/hmac/libkeccak_hmac_fast_free.c
new file mode 100644
index 0000000..5a38207
--- /dev/null
+++ b/hmac/libkeccak_hmac_fast_free.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline void libkeccak_hmac_fast_free(struct libkeccak_hmac_state *);
diff --git a/hmac/libkeccak_hmac_fast_update.c b/hmac/libkeccak_hmac_fast_update.c
new file mode 100644
index 0000000..fe163b7
--- /dev/null
+++ b/hmac/libkeccak_hmac_fast_update.c
@@ -0,0 +1,52 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+/**
+ * Absorb more, or the first part, of the message
+ * without wiping sensitive data when possible
+ * 
+ * @param   state   The hashing state
+ * @param   msg_    The partial message
+ * @param   msglen  The length of the partial message, in bytes
+ * @return          Zero on success, -1 on error
+ */
+int
+libkeccak_hmac_fast_update(struct libkeccak_hmac_state *restrict state, const void *restrict msg_, size_t msglen)
+{
+	const unsigned char *restrict msg = msg_;
+	void *new;
+	size_t i;
+	int n, cn;
+
+	if (state->key_ipad) {
+		if (libkeccak_fast_update(&state->sponge, state->key_ipad, state->key_length >> 3) < 0)
+			return -1;
+		if (state->key_length & 7)
+			state->leftover = state->key_ipad[state->key_length >> 3];
+		state->key_ipad = NULL;
+	}
+
+	if (!msg || !msglen)
+		return 0;
+
+	if (!(state->key_length & 7))
+		return libkeccak_fast_update(&state->sponge, msg, msglen);
+
+	if (msglen != state->buffer_size) {
+		new = realloc(state->buffer, msglen);
+		if (!new)
+			return -1;
+		state->buffer = new;
+		state->buffer_size = msglen;
+	}
+
+	n = (int)(state->key_length & 7);
+	cn = 8 - n;
+	for (i = 1; i < msglen; i++)
+		state->buffer[i] = (unsigned char)((msg[i - 1] >> cn) | (msg[i] << n));
+	state->buffer[0] = (unsigned char)((state->leftover & ((1 << n) - 1)) | (msg[0] << n));
+	state->leftover = (unsigned char)(msg[msglen - 1] >> cn);
+
+	return libkeccak_fast_update(&state->sponge, state->buffer, msglen);
+}
diff --git a/hmac/libkeccak_hmac_free.c b/hmac/libkeccak_hmac_free.c
new file mode 100644
index 0000000..d31e3a8
--- /dev/null
+++ b/hmac/libkeccak_hmac_free.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline void libkeccak_hmac_free(volatile struct libkeccak_hmac_state *);
diff --git a/hmac/libkeccak_hmac_initialise.c b/hmac/libkeccak_hmac_initialise.c
new file mode 100644
index 0000000..ca71860
--- /dev/null
+++ b/hmac/libkeccak_hmac_initialise.c
@@ -0,0 +1,6 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline int
+libkeccak_hmac_initialise(struct libkeccak_hmac_state *restrict, const struct libkeccak_spec *restrict, const void *restrict, size_t);
diff --git a/hmac/libkeccak_hmac_marshal.c b/hmac/libkeccak_hmac_marshal.c
new file mode 100644
index 0000000..acd8f63
--- /dev/null
+++ b/hmac/libkeccak_hmac_marshal.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline size_t libkeccak_hmac_marshal(const struct libkeccak_hmac_state *restrict, void *restrict);
diff --git a/hmac/libkeccak_hmac_reset.c b/hmac/libkeccak_hmac_reset.c
new file mode 100644
index 0000000..b6eccf5
--- /dev/null
+++ b/hmac/libkeccak_hmac_reset.c
@@ -0,0 +1,5 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+extern inline int libkeccak_hmac_reset(struct libkeccak_hmac_state *restrict, const void *restrict, size_t);
diff --git a/hmac/libkeccak_hmac_set_key.c b/hmac/libkeccak_hmac_set_key.c
new file mode 100644
index 0000000..e329f5b
--- /dev/null
+++ b/hmac/libkeccak_hmac_set_key.c
@@ -0,0 +1,47 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+/**
+ * Change the HMAC-hashing key on the state
+ * 
+ * @param   state       The state that should be reset
+ * @param   key         The new key
+ * @param   key_length  The length of key, in bits
+ * @return              Zero on success, -1 on error
+ */
+int
+libkeccak_hmac_set_key(struct libkeccak_hmac_state *restrict state, const void *restrict key, size_t key_length)
+{
+	size_t i, size, new_key_length, key_bytes;
+	void *new;
+
+	size = (size_t)(state->sponge.r) > key_length ? (size_t)(state->sponge.r) : key_length;
+	new_key_length = size;
+	size = (size + 7) >> 3;
+	key_bytes = (key_length + 7) >> 3;
+
+	if (size != key_bytes) {
+		new = realloc(state->key_opad, 2 * size);
+		if (!new)
+			return -1;
+		state->key_opad = new;
+		state->key_ipad = state->key_opad + size;
+	}
+
+	memcpy(state->key_opad, key, key_bytes);
+	if (key_length & 7)
+		state->key_opad[(key_bytes >> 3) - 1] &= (unsigned char)((1 << (key_length & 7)) - 1);
+
+	if ((size_t)(state->sponge.r) > key_length)
+		__builtin_memset(state->key_opad + key_bytes, 0, size - key_bytes);
+
+	for (i = 0; i < size; i++) {
+		state->key_ipad[i] = state->key_opad[i] ^ HMAC_INNER_PAD;
+		state->key_opad[i] ^= HMAC_OUTER_PAD;
+	}
+
+	state->key_length = new_key_length;
+
+	return 0;
+}
diff --git a/hmac/libkeccak_hmac_unmarshal.c b/hmac/libkeccak_hmac_unmarshal.c
new file mode 100644
index 0000000..ddada17
--- /dev/null
+++ b/hmac/libkeccak_hmac_unmarshal.c
@@ -0,0 +1,59 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+#if defined(__clang__)
+# pragma clang diagnostic ignored "-Wcast-align"
+#endif
+
+
+/**
+ * Unmarshal a `struct libkeccak_hmac_state` from a buffer
+ * 
+ * @param   state  The slot for the unmarshalled state, must not be
+ *                 initialised (memory leak otherwise), can be `NULL`
+ * @param   data_  The input buffer
+ * @return         The number of bytes read from `data`, 0 on error
+ */
+size_t
+libkeccak_hmac_unmarshal(struct libkeccak_hmac_state *restrict state, const void *restrict data_)
+{
+	const unsigned char *restrict data = data_;
+	size_t parsed, size, i;
+
+	state->key_opad = NULL;
+	state->key_ipad = NULL;
+
+	parsed = libkeccak_state_unmarshal(state ? &state->sponge : NULL, data);
+	if (!parsed)
+		return 0;
+	data += parsed;
+
+	__builtin_memcpy(&size, data, sizeof(size));
+	data += sizeof(size_t);
+	if (state)
+		size = state->key_length;
+	size = (state->key_length + 7) >> 3;
+
+	if (state) {
+		state->key_opad = malloc(2 * size);
+		if (!state->key_opad) {
+			libkeccak_state_destroy(&state->sponge);
+			return 0;
+		}
+		memcpy(state->key_opad, data, size);
+		data += size;
+
+		if (data[0]) {
+			state->key_ipad = &state->key_opad[size];
+			memcpy(state->key_ipad, state->key_opad, size);
+			for (i = 0; i < size; i++)
+				state->key_ipad[i] ^= (char)(HMAC_OUTER_PAD ^ HMAC_INNER_PAD);
+		}
+
+		state->leftover = data[1];
+		state->buffer = NULL;
+		state->buffer_size = 0;
+	}
+
+	return parsed + sizeof(size_t) + size + 2 * sizeof(char);
+}
diff --git a/hmac/libkeccak_hmac_update.c b/hmac/libkeccak_hmac_update.c
new file mode 100644
index 0000000..1717390
--- /dev/null
+++ b/hmac/libkeccak_hmac_update.c
@@ -0,0 +1,53 @@
+/* See LICENSE file for copyright and license details. */
+#define NEED_EXPLICIT_BZERO 1
+#include "../common.h"
+
+
+/**
+ * Absorb more, or the first part, of the message
+ * and wipe sensitive data when possible
+ * 
+ * @param   state   The hashing state
+ * @param   msg_    The partial message
+ * @param   msglen  The length of the partial message, in bytes
+ * @return          Zero on success, -1 on error
+ */
+int
+libkeccak_hmac_update(struct libkeccak_hmac_state *restrict state, const void *restrict msg_, size_t msglen)
+{
+	const unsigned char *restrict msg = msg_;
+	size_t i;
+	int n, cn, r;
+
+	if (state->key_ipad) {
+		if (libkeccak_update(&state->sponge, state->key_ipad, state->key_length >> 3) < 0)
+			return -1;
+		if (state->key_length & 7)
+			state->leftover = state->key_ipad[state->key_length >> 3];
+		state->key_ipad = NULL;
+	}
+
+	if (!msg || !msglen)
+		return 0;
+
+	if (!(state->key_length & 7))
+		return libkeccak_update(&state->sponge, msg, msglen);
+
+	if (msglen != state->buffer_size) {
+		free(state->buffer);
+		state->buffer = malloc(state->buffer_size = msglen);
+		if (!state->buffer)
+			return -1;
+	}
+
+	n = (int)(state->key_length & 7);
+	cn = 8 - n;
+	for (i = 1; i < msglen; i++)
+		state->buffer[i] = (unsigned char)((msg[i - 1] >> cn) | (msg[i] << n));
+	state->buffer[0] = (unsigned char)((state->leftover & ((1 << n) - 1)) | (msg[0] << n));
+	state->leftover = (unsigned char)(msg[msglen - 1] >> cn);
+
+	r = libkeccak_update(&state->sponge, state->buffer, msglen);
+	my_explicit_bzero(state->buffer, msglen);
+	return r;
+}
diff --git a/hmac/libkeccak_hmac_wipe.c b/hmac/libkeccak_hmac_wipe.c
new file mode 100644
index 0000000..ec0be2d
--- /dev/null
+++ b/hmac/libkeccak_hmac_wipe.c
@@ -0,0 +1,24 @@
+/* See LICENSE file for copyright and license details. */
+#include "../common.h"
+
+
+/**
+ * Wipe sensitive data wihout freeing any data
+ * 
+ * @param  state  The state that should be wipe
+ */
+void
+libkeccak_hmac_wipe(volatile struct libkeccak_hmac_state *state)
+{
+	volatile unsigned char *restrict key_pads;
+	size_t i, size;
+
+	key_pads = state->key_opad;
+	size = 2 * ((state->key_length + 7) >> 3);
+
+	libkeccak_state_wipe(&state->sponge);
+	for (i = 0; i < size; i++)
+		key_pads[i] = 0;
+	state->leftover = 0;
+	__builtin_memset(state->buffer, 0, state->buffer_size);
+}