ghash.ha (3926B)
1 // SPDX-License-Identifier: MPL-2.0 2 // (c) Hare authors <https://harelang.org> 3 4 // The following code was initially ported from BearSSL. 5 // 6 // Copyright (c) 2016 Thomas Pornin <pornin@bolet.org> 7 // 8 // Permission is hereby granted, free of charge, to any person obtaining a copy 9 // of this software and associated documentation files (the "Software"), to deal 10 // in the Software without restriction, including without limitation the rights 11 // to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 // copies of the Software, and to permit persons to whom the Software is 13 // furnished to do so, subject to the following conditions: 14 // 15 // The above copyright notice and this permission notice shall be included in 16 // all copies or substantial portions of the Software. 17 // 18 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 21 // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 24 // SOFTWARE. 25 use bytes; 26 use endian::{begetu64,beputu64}; 27 28 fn bmul64(x: u64, y: u64) u64 = { 29 const x0 = x & 0x1111111111111111; 30 const x1 = x & 0x2222222222222222; 31 const x2 = x & 0x4444444444444444; 32 const x3 = x & 0x8888888888888888; 33 const y0 = y & 0x1111111111111111; 34 const y1 = y & 0x2222222222222222; 35 const y2 = y & 0x4444444444444444; 36 const y3 = y & 0x8888888888888888; 37 let z0 = (x0 * y0) ^ (x1 * y3) ^ (x2 * y2) ^ (x3 * y1); 38 let z1 = (x0 * y1) ^ (x1 * y0) ^ (x2 * y3) ^ (x3 * y2); 39 let z2 = (x0 * y2) ^ (x1 * y1) ^ (x2 * y0) ^ (x3 * y3); 40 let z3 = (x0 * y3) ^ (x1 * y2) ^ (x2 * y1) ^ (x3 * y0); 41 z0 &= 0x1111111111111111; 42 z1 &= 0x2222222222222222; 43 z2 &= 0x4444444444444444; 44 z3 &= 0x8888888888888888; 45 return z0 | z1 | z2 | z3; 46 }; 47 48 49 fn rev64(x: u64) u64 = { 50 x = ((x & 0x5555555555555555) << 1) | ((x >> 1) & 0x5555555555555555); 51 x = ((x & 0x3333333333333333) << 2) | ((x >> 2) & 0x3333333333333333); 52 x = ((x & 0x0F0F0F0F0F0F0F0F) << 4) | ((x >> 4) & 0x0F0F0F0F0F0F0F0F); 53 x = ((x & 0x00FF00FF00FF00FF) << 8) | ((x >> 8) & 0x00FF00FF00FF00FF); 54 x = ((x & 0x0000FFFF0000FFFF) << 16) | ((x >> 16) & 0x0000FFFF0000FFFF); 55 return (x << 32) | (x >> 32); 56 }; 57 58 // GHASH implementation that relies on constant time 64bit multiplication 59 fn ghash_ctmul64(y: []u8, h: const []u8, data: const []u8) void = { 60 let buf = data[..]; 61 let tmp: [16]u8 = [0...]; 62 63 let y1 = begetu64(y); 64 let y0 = begetu64(y[8..]); 65 const h1 = begetu64(h); 66 const h0 = begetu64(h[8..]); 67 const h0r = rev64(h0); 68 const h1r = rev64(h1); 69 const h2 = h0 ^ h1; 70 const h2r = h0r ^ h1r; 71 72 for (len(buf) > 0) { 73 let src: []u8 = []; 74 75 if (len(buf) >= 16) { 76 src = buf[..16]; 77 buf = buf[16..]; 78 } else { 79 tmp[..len(buf)] = buf[..]; 80 bytes::zero(tmp[len(buf)..len(tmp)]); 81 src = tmp; 82 buf = []; 83 }; 84 y1 ^= begetu64(src); 85 y0 ^= begetu64(src[8..]); 86 87 const y0r = rev64(y0); 88 const y1r = rev64(y1); 89 const y2 = y0 ^ y1; 90 const y2r = y0r ^ y1r; 91 92 const z0 = bmul64(y0, h0); 93 const z1 = bmul64(y1, h1); 94 let z2 = bmul64(y2, h2); 95 let z0h = bmul64(y0r, h0r); 96 let z1h = bmul64(y1r, h1r); 97 let z2h = bmul64(y2r, h2r); 98 z2 ^= z0 ^ z1; 99 z2h ^= z0h ^ z1h; 100 z0h = rev64(z0h) >> 1; 101 z1h = rev64(z1h) >> 1; 102 z2h = rev64(z2h) >> 1; 103 104 105 let v0 = z0; 106 let v1 = z0h ^ z2; 107 let v2 = z1 ^ z2h; 108 let v3 = z1h; 109 110 v3 = (v3 << 1) | (v2 >> 63); 111 v2 = (v2 << 1) | (v1 >> 63); 112 v1 = (v1 << 1) | (v0 >> 63); 113 v0 = (v0 << 1); 114 115 v2 ^= v0 ^ (v0 >> 1) ^ (v0 >> 2) ^ (v0 >> 7); 116 v1 ^= (v0 << 63) ^ (v0 << 62) ^ (v0 << 57); 117 v3 ^= v1 ^ (v1 >> 1) ^ (v1 >> 2) ^ (v1 >> 7); 118 v2 ^= (v1 << 63) ^ (v1 << 62) ^ (v1 << 57); 119 120 y0 = v2; 121 y1 = v3; 122 }; 123 124 beputu64(y, y1); 125 beputu64(y[8..], y0); 126 };