yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-29 09:04:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add Poly1305 authenticator algorithm (RFC 7539)

Browse Source 
Test vectors are included from RFC 7539.

Poly1305 is also added to the benchmark program.
This commit is contained in:
Daniel King 2016-05-16 18:25:45 -03:00 committed by Manuel Pégourié-Gonnard
parent bd92062269
commit adc32c0b50
14 changed files with 798 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/mbedtls/config.h
View File

@ -283,6 +283,7 @@
//#define MBEDTLS_MD2_ALT //#define MBEDTLS_MD2_ALT
//#define MBEDTLS_MD4_ALT //#define MBEDTLS_MD4_ALT
//#define MBEDTLS_MD5_ALT //#define MBEDTLS_MD5_ALT
//#define MBEDTLS_POLY1305_ALT
//#define MBEDTLS_RIPEMD160_ALT //#define MBEDTLS_RIPEMD160_ALT
//#define MBEDTLS_RSA_ALT //#define MBEDTLS_RSA_ALT
//#define MBEDTLS_SHA1_ALT //#define MBEDTLS_SHA1_ALT
@ -2398,6 +2399,15 @@
*/ */
#define MBEDTLS_PLATFORM_C #define MBEDTLS_PLATFORM_C
/**
* \def MBEDTLS_POLY1305_C
*
* Enable the Poly1305 MAC algorithm.
*
* Module: library/poly1305.c
*/
#define MBEDTLS_POLY1305_C
/** /**
* \def MBEDTLS_RIPEMD160_C * \def MBEDTLS_RIPEMD160_C
* *

1
include/mbedtls/error.h
View File

@ -77,6 +77,7 @@
* SHA256 1 0x0037-0x0037 * SHA256 1 0x0037-0x0037
* SHA512 1 0x0039-0x0039 * SHA512 1 0x0039-0x0039
* CHACHA20 1 0x003B-0x003B * CHACHA20 1 0x003B-0x003B
* POLY1305 1 0x0041-0x0041
* *
* High-level module nr (3 bits - 0x0...-0x7...) * High-level module nr (3 bits - 0x0...-0x7...)
* Name ID Nr of Errors * Name ID Nr of Errors

142
include/mbedtls/poly1305.h Normal file
View File

@ -0,0 +1,142 @@
/**
* \file poly1305.h
*
* \brief Poly1305 authenticator algorithm.
*
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* This file is part of mbed TLS (https://tls.mbed.org)
*/
#ifndef MBEDTLS_POLY1305_H
#define MBEDTLS_POLY1305_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "mbedtls/config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#include <stdint.h>
#include <stddef.h>
#if !defined(MBEDTLS_POLY1305_ALT)
#define MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA -0x0041 /**< Invalid input parameter(s). */
typedef struct
{
uint32_t r[4]; /** Stores the value for 'r' (low 128 bits of the key) */
uint32_t s[4]; /** Stores the value for 's' (high 128 bits of the key) */
uint32_t acc[5]; /** Accumulator number */
uint8_t queue[16]; /** Stores partial block data */
size_t queue_len; /** Number of bytes stored in 'queue'. Always less than 16 */
}
mbedtls_poly1305_context;
/**
* \brief Initialize a Poly1305 context
*
* \param ctx The Poly1305 context to be initialized
*/
void mbedtls_poly1305_init( mbedtls_poly1305_context *ctx );
/**
* \brief Clear a Poly1305 context
*
* \param ctx The Poly1305 context to be cleared
*/
void mbedtls_poly1305_free( mbedtls_poly1305_context *ctx );
/**
* \brief Set the Poly1305 authentication key.
*
* \warning The key should be unique, and \b MUST be
* unpredictable for each invocation of Poly1305.
*
* \param ctx The Poly1305 context.
* \param key Buffer containing the 256-bit key.
*
* \return MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA is returned if ctx
* or key are NULL.
* Otherwise, 0 is returned to indicate success.
*/
int mbedtls_poly1305_setkey( mbedtls_poly1305_context *ctx,
const unsigned char key[32] );
/**
* \brief Process data with Poly1305.
*
* This function can be called multiple times to process
* a stream of data.
*
* \param ctx The Poly1305 context.
* \param ilen The input length (in bytes). Any value is accepted.
* \param input Buffer containing the input data to Process.
*
* \return MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA is returned if ctx
* or input are NULL.
* Otherwise, 0 is returned to indicate success.
*/
int mbedtls_poly1305_update( mbedtls_poly1305_context *ctx,
size_t ilen,
const unsigned char *input );
/**
* \brief Generate the Poly1305 MAC.
*
* \param ctx The Poly1305 context.
* \param mac Buffer to where the MAC is written. Must be big enough
* to hold the 16-byte MAC.
*
* \return MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA is returned if ctx
* or mac are NULL.
* Otherwise, 0 is returned to indicate success.
*/
int mbedtls_poly1305_finish( mbedtls_poly1305_context *ctx,
unsigned char mac[16] );
#else /* MBEDTLS_POLY1305_ALT */
#include "poly1305_alt.h"
#endif /* MBEDTLS_POLY1305_ALT */
/**
* \brief Generate the Poly1305 MAC of some data with the given key.
*
* \warning The key should be unique, and \b MUST be
* unpredictable for each invocation of Poly1305.
*
* \param key Buffer containing the 256-bit (32 bytes) key.
* \param ilen The length of the input data (in bytes).
* \param input Buffer containing the input data to process.
* \param mac Buffer to where the 128-bit (16 bytes) MAC is written.
*
* \return MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA is returned if key,
* input, or mac are NULL.
* Otherwise, 0 is returned to indicate success.
*/
int mbedtls_poly1305_mac( const unsigned char key[32],
size_t ilen,
const unsigned char *input,
unsigned char mac[16] );
/**
* \brief Checkup routine
*
* \return 0 if successful, or 1 if the test failed
*/
int mbedtls_poly1305_self_test( int verbose );
#endif /* MBEDTLS_POLY1305_H */

1
library/CMakeLists.txt
View File

@ -48,6 +48,7 @@ set(src_crypto
pkwrite.c pkwrite.c
platform.c platform.c
platform_util.c platform_util.c
poly1305.c
ripemd160.c ripemd160.c
rsa.c rsa.c
rsa_internal.c rsa_internal.c

10
library/Makefile
View File

@ -63,11 +63,11 @@ OBJS_CRYPTO= aes.o aesni.o arc4.o \
padlock.o pem.o pk.o \ padlock.o pem.o pk.o \
pk_wrap.o pkcs12.o pkcs5.o \ pk_wrap.o pkcs12.o pkcs5.o \
pkparse.o pkwrite.o platform.o \ pkparse.o pkwrite.o platform.o \
platform_util.o ripemd160.o rsa_internal.o \ platform_util.o poly1305.o \
rsa.o sha1.o sha256.o \ ripemd160.o rsa_internal.o rsa.o \
sha512.o threading.o timing.o \ sha1.o sha256.o sha512.o \
version.o version_features.o \ threading.o timing.o version.o \
xtea.o version_features.o xtea.o
OBJS_X509= certs.o pkcs11.o x509.o \ OBJS_X509= certs.o pkcs11.o x509.o \
x509_create.o x509_crl.o x509_crt.o \ x509_create.o x509_crl.o x509_crt.o \

9
library/error.c
View File

@ -153,6 +153,10 @@
#include "mbedtls/pkcs5.h" #include "mbedtls/pkcs5.h"
#endif #endif
#if defined(MBEDTLS_POLY1305_C)
#include "mbedtls/poly1305.h"
#endif
#if defined(MBEDTLS_RIPEMD160_C) #if defined(MBEDTLS_RIPEMD160_C)
#include "mbedtls/ripemd160.h" #include "mbedtls/ripemd160.h"
#endif #endif
@ -774,6 +778,11 @@ void mbedtls_strerror( int ret, char *buf, size_t buflen )
mbedtls_snprintf( buf, buflen, "PADLOCK - Input data should be aligned" ); mbedtls_snprintf( buf, buflen, "PADLOCK - Input data should be aligned" );
#endif /* MBEDTLS_PADLOCK_C */ #endif /* MBEDTLS_PADLOCK_C */
#if defined(MBEDTLS_POLY1305_C)
if( use_ret == -(MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA) )
mbedtls_snprintf( buf, buflen, "POLY1305 - Invalid input parameter(s)" );
#endif /* MBEDTLS_POLY1305_C */
#if defined(MBEDTLS_RIPEMD160_C) #if defined(MBEDTLS_RIPEMD160_C)
if( use_ret == -(MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED) ) if( use_ret == -(MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED) )
mbedtls_snprintf( buf, buflen, "RIPEMD160 - RIPEMD160 hardware accelerator failed" ); mbedtls_snprintf( buf, buflen, "RIPEMD160 - RIPEMD160 hardware accelerator failed" );

518
library/poly1305.c Normal file
View File

@ -0,0 +1,518 @@
/**
* \file poly1305.c
*
* \brief Poly1305 authentication algorithm.
*
* Copyright (C) 2006-2016, ARM Limited, All Rights Reserved
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* This file is part of mbed TLS (https://tls.mbed.org)
*/
#if !defined(MBEDTLS_CONFIG_FILE)
#include "mbedtls/config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#if defined(MBEDTLS_POLY1305_C)
#if !defined(MBEDTLS_POLY1305_ALT)
#include "mbedtls/poly1305.h"
#include <string.h>
#if defined(MBEDTLS_SELF_TEST)
#if defined(MBEDTLS_PLATFORM_C)
#include "mbedtls/platform.h"
#else
#include <stdio.h>
#define mbedtls_printf printf
#endif /* MBEDTLS_PLATFORM_C */
#endif /* MBEDTLS_SELF_TEST */
#define POLY1305_BLOCK_SIZE_BYTES ( 16U )
#define BYTES_TO_U32_LE( data, offset ) \
( (uint32_t)data[offset] | \
(uint32_t)( (uint32_t)data[(offset) + 1] << 8 ) | \
(uint32_t)( (uint32_t)data[(offset) + 2] << 16 ) | \
(uint32_t)( (uint32_t)data[(offset) + 3] << 24 ) \
)
/* Implementation that should never be optimized out by the compiler */
static void mbedtls_zeroize( void *v, size_t n ) {
volatile unsigned char *p = v; while( n-- ) *p++ = 0;
}
/**
* \brief Process blocks with Poly1305.
*
* \param ctx The Poly1305 context.
* \param nblocks Number of blocks to process. Note that this function
* only processes full blocks.
* \param input Buffer containing the input block(s).
* \param needs_padding Set to 0 if the padding bit has already been applied
* to the input data before calling this function.
* Otherwise, set this parameter to 1.
*/
static void mbedtls_poly1305_process( mbedtls_poly1305_context *ctx,
size_t nblocks,
const unsigned char *input,
uint32_t needs_padding )
{
uint64_t d0, d1, d2, d3;
uint32_t acc0, acc1, acc2, acc3, acc4;
uint32_t r0, r1, r2, r3;
uint32_t rs1, rs2, rs3;
size_t offset = 0U;
size_t i;
r0 = ctx->r[0];
r1 = ctx->r[1];
r2 = ctx->r[2];
r3 = ctx->r[3];
rs1 = r1 + ( r1 >> 2U );
rs2 = r2 + ( r2 >> 2U );
rs3 = r3 + ( r3 >> 2U );
acc0 = ctx->acc[0];
acc1 = ctx->acc[1];
acc2 = ctx->acc[2];
acc3 = ctx->acc[3];
acc4 = ctx->acc[4];
/* Process full blocks */
for ( i = 0U; i < nblocks; i++ )
{
/* Compute: acc += block */
/* Note that the input block is treated as a 128-bit little-endian integer */
d0 = (uint64_t)acc0 + BYTES_TO_U32_LE( input, offset + 0 );
d1 = (uint64_t)acc1 + BYTES_TO_U32_LE( input, offset + 4 ) + ( d0 >> 32U );
d2 = (uint64_t)acc2 + BYTES_TO_U32_LE( input, offset + 8 ) + ( d1 >> 32U );
d3 = (uint64_t)acc3 + BYTES_TO_U32_LE( input, offset + 12 ) + ( d2 >> 32U );
acc0 = (uint32_t)d0;
acc1 = (uint32_t)d1;
acc2 = (uint32_t)d2;
acc3 = (uint32_t)d3;
acc4 += (uint32_t)( d3 >> 32U ) + needs_padding;
/* Compute: acc *= r */
d0 = ( (uint64_t)acc0 * r0 ) +
( (uint64_t)acc1 * rs3 ) +
( (uint64_t)acc2 * rs2 ) +
( (uint64_t)acc3 * rs1 );
d1 = ( (uint64_t)acc0 * r1 ) +
( (uint64_t)acc1 * r0 ) +
( (uint64_t)acc2 * rs3 ) +
( (uint64_t)acc3 * rs2 ) +
( (uint64_t)acc4 * rs1 );
d2 = ( (uint64_t)acc0 * r2 ) +
( (uint64_t)acc1 * r1 ) +
( (uint64_t)acc2 * r0 ) +
( (uint64_t)acc3 * rs3 ) +
( (uint64_t)acc4 * rs2 );
d3 = ( (uint64_t)acc0 * r3 ) +
( (uint64_t)acc1 * r2 ) +
( (uint64_t)acc2 * r1 ) +
( (uint64_t)acc3 * r0 ) +
( (uint64_t)acc4 * rs3 );
acc4 *= r0;
/* Compute: acc %= (2^130 - 5) (partial remainder) */
d1 += ( d0 >> 32 );
d2 += ( d1 >> 32 );
d3 += ( d2 >> 32 );
acc0 = (uint32_t)d0;
acc1 = (uint32_t)d1;
acc2 = (uint32_t)d2;
acc3 = (uint32_t)d3;
acc4 = (uint32_t)( d3 >> 32 ) + acc4;
d0 = (uint64_t)acc0 + ( acc4 >> 2 ) + ( acc4 & 0xFFFFFFFCU );
acc4 &= 3U;
acc0 = (uint32_t)d0;
d0 = (uint64_t)acc1 + ( d0 >> 32U );
acc1 = (uint32_t)d0;
d0 = (uint64_t)acc2 + ( d0 >> 32U );
acc2 = (uint32_t)d0;
d0 = (uint64_t)acc3 + ( d0 >> 32U );
acc3 = (uint32_t)d0;
d0 = (uint64_t)acc4 + ( d0 >> 32U );
acc4 = (uint32_t)d0;
offset += POLY1305_BLOCK_SIZE_BYTES;
}
ctx->acc[0] = acc0;
ctx->acc[1] = acc1;
ctx->acc[2] = acc2;
ctx->acc[3] = acc3;
ctx->acc[4] = acc4;
}
/**
* \brief Compute the Poly1305 MAC
*
* \param ctx The Poly1305 context.
* \param mac The buffer to where the MAC is written. Must be
* big enough to contain the 16-byte MAC.
*/
static void mbedtls_poly1305_compute_mac( const mbedtls_poly1305_context *ctx,
unsigned char mac[16] )
{
uint64_t d;
uint32_t g0, g1, g2, g3, g4;
uint32_t acc0, acc1, acc2, acc3, acc4;
uint32_t mask;
uint32_t mask_inv;
acc0 = ctx->acc[0];
acc1 = ctx->acc[1];
acc2 = ctx->acc[2];
acc3 = ctx->acc[3];
acc4 = ctx->acc[4];
/* Before adding 's' we need to ensure that the accumulator is mod 2^130 - 5.
* We do this by calculating acc - (2^130 - 5), then checking if
* the 131st bit is set. If it is, then reduce: acc -= (2^130 - 5)
*/
/* Calculate acc + -(2^130 - 5) */
d = ( (uint64_t)acc0 + 5U );
g0 = (uint32_t)d;
d = ( (uint64_t)acc1 + ( d >> 32 ) );
g1 = (uint32_t)d;
d = ( (uint64_t)acc2 + ( d >> 32 ) );
g2 = (uint32_t)d;
d = ( (uint64_t)acc3 + ( d >> 32 ) );
g3 = (uint32_t)d;
g4 = acc4 + (uint32_t)( d >> 32U );
/* mask == 0xFFFFFFFF if 131st bit is set, otherwise mask == 0 */
mask = (uint32_t)0U - ( g4 >> 2U );
mask_inv = ~mask;
/* If 131st bit is set then acc=g, otherwise, acc is unmodified */
acc0 = ( acc0 & mask_inv ) | ( g0 & mask );
acc1 = ( acc1 & mask_inv ) | ( g1 & mask );
acc2 = ( acc2 & mask_inv ) | ( g2 & mask );
acc3 = ( acc3 & mask_inv ) | ( g3 & mask );
/* Add 's' */
d = (uint64_t)acc0 + ctx->s[0];
acc0 = (uint32_t)d;
d = (uint64_t)acc1 + ctx->s[1] + ( d >> 32U );
acc1 = (uint32_t)d;
d = (uint64_t)acc2 + ctx->s[2] + ( d >> 32U );
acc2 = (uint32_t)d;
acc3 += ctx->s[3] + (uint32_t)( d >> 32U );
/* Compute MAC (128 least significant bits of the accumulator) */
mac[0] = (uint8_t)acc0;
mac[1] = (uint8_t)( acc0 >> 8 );
mac[2] = (uint8_t)( acc0 >> 16 );
mac[3] = (uint8_t)( acc0 >> 24 );
mac[4] = (uint8_t)acc1;
mac[5] = (uint8_t)( acc1 >> 8 );
mac[6] = (uint8_t)( acc1 >> 16 );
mac[7] = (uint8_t)( acc1 >> 24 );
mac[8] = (uint8_t)acc2;
mac[9] = (uint8_t)( acc2 >> 8 );
mac[10] = (uint8_t)( acc2 >> 16 );
mac[11] = (uint8_t)( acc2 >> 24 );
mac[12] = (uint8_t)acc3;
mac[13] = (uint8_t)( acc3 >> 8 );
mac[14] = (uint8_t)( acc3 >> 16 );
mac[15] = (uint8_t)( acc3 >> 24 );
}
void mbedtls_poly1305_init( mbedtls_poly1305_context *ctx )
{
if ( ctx != NULL )
{
mbedtls_zeroize( ctx, sizeof(mbedtls_poly1305_context) );
}
}
void mbedtls_poly1305_free( mbedtls_poly1305_context *ctx )
{
if ( ctx != NULL )
{
mbedtls_zeroize( ctx, sizeof(mbedtls_poly1305_context) );
}
}
int mbedtls_poly1305_setkey( mbedtls_poly1305_context *ctx,
const unsigned char key[32] )
{
if ( ctx == NULL )
{
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
}
/* r &= 0x0ffffffc0ffffffc0ffffffc0fffffff */
ctx->r[0] = BYTES_TO_U32_LE( key, 0 ) & 0x0FFFFFFFU;
ctx->r[1] = BYTES_TO_U32_LE( key, 4 ) & 0x0FFFFFFCU;
ctx->r[2] = BYTES_TO_U32_LE( key, 8 ) & 0x0FFFFFFCU;
ctx->r[3] = BYTES_TO_U32_LE( key, 12 ) & 0x0FFFFFFCU;
ctx->s[0] = BYTES_TO_U32_LE( key, 16 );
ctx->s[1] = BYTES_TO_U32_LE( key, 20 );
ctx->s[2] = BYTES_TO_U32_LE( key, 24 );
ctx->s[3] = BYTES_TO_U32_LE( key, 28 );
/* Initial accumulator state */
ctx->acc[0] = 0U;
ctx->acc[1] = 0U;
ctx->acc[2] = 0U;
ctx->acc[3] = 0U;
return 0;
}
int mbedtls_poly1305_update( mbedtls_poly1305_context *ctx,
size_t ilen,
const unsigned char* input )
{
size_t offset = 0U;
size_t remaining = ilen;
size_t queue_free_len;
size_t nblocks;
if ( ( ctx == NULL ) || ( input == NULL ) )
{
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
}
if ( ctx->queue_len > 0U )
{
queue_free_len = ( POLY1305_BLOCK_SIZE_BYTES - ctx->queue_len );
if ( ilen < queue_free_len )
{
/* Not enough data to complete the block.
* Store this data with the other leftovers.
*/
memcpy( &ctx->queue[ctx->queue_len],
input,
ilen );
ctx->queue_len += ilen;
remaining = 0U;
}
else
{
/* Enough data to produce a complete block */
memcpy( &ctx->queue[ctx->queue_len],
input,
queue_free_len );
ctx->queue_len = 0U;
mbedtls_poly1305_process( ctx,
1U,
ctx->queue,
1U ); /* add padding bit */
offset += queue_free_len;
remaining -= queue_free_len;
}
}
if ( remaining >= POLY1305_BLOCK_SIZE_BYTES )
{
nblocks = remaining / POLY1305_BLOCK_SIZE_BYTES;
mbedtls_poly1305_process( ctx, nblocks, &input[offset], 1U );
offset += nblocks * POLY1305_BLOCK_SIZE_BYTES;
remaining %= POLY1305_BLOCK_SIZE_BYTES;
}
if ( remaining > 0U )
{
/* Store partial block */
ctx->queue_len = remaining;
memcpy( ctx->queue, &input[offset], remaining );
}
return( 0 );
}
int mbedtls_poly1305_finish( mbedtls_poly1305_context *ctx,
unsigned char mac[16] )
{
if ( ( ctx == NULL ) || ( mac == NULL ) )
{
return( MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA );
}
/* Process any leftover data */
if ( ctx->queue_len > 0U )
{
/* Add padding bit */
ctx->queue[ctx->queue_len] = 1U;
ctx->queue_len++;
/* Pad with zeroes */
memset( &ctx->queue[ctx->queue_len],
0,
POLY1305_BLOCK_SIZE_BYTES - ctx->queue_len );
mbedtls_poly1305_process( ctx,
1U, /* Process 1 block */
ctx->queue,
0U ); /* Don't add padding bit (it was just added above) */
}
mbedtls_poly1305_compute_mac( ctx, mac );
return( 0 );
}
#endif /* MBEDTLS_POLY1305_ALT */
int mbedtls_poly1305_mac( const unsigned char key[32],
size_t ilen,
const unsigned char *input,
unsigned char mac[16] )
{
mbedtls_poly1305_context ctx;
int result;
mbedtls_poly1305_init( &ctx );
result = mbedtls_poly1305_setkey( &ctx, key );
if ( result != 0 )
goto cleanup;
result = mbedtls_poly1305_update( &ctx, ilen, input );
if ( result != 0 )
goto cleanup;
result = mbedtls_poly1305_finish( &ctx, mac );
cleanup:
mbedtls_poly1305_free( &ctx );
return( 0 );
}
#if defined(MBEDTLS_SELF_TEST)
static const unsigned char test_keys[2][32] =
{
{
0x85, 0xd6, 0xbe, 0x78, 0x57, 0x55, 0x6d, 0x33,
0x7f, 0x44, 0x52, 0xfe, 0x42, 0xd5, 0x06, 0xa8,
0x01, 0x03, 0x80, 0x8a, 0xfb, 0x0d, 0xb2, 0xfd,
0x4a, 0xbf, 0xf6, 0xaf, 0x41, 0x49, 0xf5, 0x1b
},
{
0x1c, 0x92, 0x40, 0xa5, 0xeb, 0x55, 0xd3, 0x8a,
0xf3, 0x33, 0x88, 0x86, 0x04, 0xf6, 0xb5, 0xf0,
0x47, 0x39, 0x17, 0xc1, 0x40, 0x2b, 0x80, 0x09,
0x9d, 0xca, 0x5c, 0xbc, 0x20, 0x70, 0x75, 0xc0
}
};
static const unsigned char test_data[2][127] =
{
{
0x43, 0x72, 0x79, 0x70, 0x74, 0x6f, 0x67, 0x72,
0x61, 0x70, 0x68, 0x69, 0x63, 0x20, 0x46, 0x6f,
0x72, 0x75, 0x6d, 0x20, 0x52, 0x65, 0x73, 0x65,
0x61, 0x72, 0x63, 0x68, 0x20, 0x47, 0x72, 0x6f,
0x75, 0x70
},
{
0x27, 0x54, 0x77, 0x61, 0x73, 0x20, 0x62, 0x72,
0x69, 0x6c, 0x6c, 0x69, 0x67, 0x2c, 0x20, 0x61,
0x6e, 0x64, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
0x6c, 0x69, 0x74, 0x68, 0x79, 0x20, 0x74, 0x6f,
0x76, 0x65, 0x73, 0x0a, 0x44, 0x69, 0x64, 0x20,
0x67, 0x79, 0x72, 0x65, 0x20, 0x61, 0x6e, 0x64,
0x20, 0x67, 0x69, 0x6d, 0x62, 0x6c, 0x65, 0x20,
0x69, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x77,
0x61, 0x62, 0x65, 0x3a, 0x0a, 0x41, 0x6c, 0x6c,
0x20, 0x6d, 0x69, 0x6d, 0x73, 0x79, 0x20, 0x77,
0x65, 0x72, 0x65, 0x20, 0x74, 0x68, 0x65, 0x20,
0x62, 0x6f, 0x72, 0x6f, 0x67, 0x6f, 0x76, 0x65,
0x73, 0x2c, 0x0a, 0x41, 0x6e, 0x64, 0x20, 0x74,
0x68, 0x65, 0x20, 0x6d, 0x6f, 0x6d, 0x65, 0x20,
0x72, 0x61, 0x74, 0x68, 0x73, 0x20, 0x6f, 0x75,
0x74, 0x67, 0x72, 0x61, 0x62, 0x65, 0x2e
}
};
static const size_t test_data_len[2] =
{
34U,
127U
};
static const unsigned char test_mac[2][16] =
{
{
0xa8, 0x06, 0x1d, 0xc1, 0x30, 0x51, 0x36, 0xc6,
0xc2, 0x2b, 0x8b, 0xaf, 0x0c, 0x01, 0x27, 0xa9
},
{
0x45, 0x41, 0x66, 0x9a, 0x7e, 0xaa, 0xee, 0x61,
0xe7, 0x08, 0xdc, 0x7c, 0xbc, 0xc5, 0xeb, 0x62
}
};
int mbedtls_poly1305_self_test( int verbose )
{
uint8_t mac[16];
size_t i;
int result;
for ( i = 0U; i < 2U; i++ )
{
result = mbedtls_poly1305_mac( test_keys[i],
test_data_len[i],
test_data[i],
mac );
if ( result != 0 )
{
if ( verbose != 0 )
{
mbedtls_printf( "Poly1305 test %zi error code: %i\n", i, result );
}
return( -1 );
}
if ( memcmp( mac, test_mac[i], 16U ) != 0 )
{
if ( verbose != 0 )
{
mbedtls_printf( "Poly1305 test %zi failed\n", i );
}
return( -1 );
}
}
return( 0 );
}
#endif /* MBEDTLS_SELF_TEST */
#endif /* MBEDTLS_POLY1305_C */

6
library/version_features.c
View File

@ -168,6 +168,9 @@ static const char *features[] = {
#if defined(MBEDTLS_SHA512_PROCESS_ALT) #if defined(MBEDTLS_SHA512_PROCESS_ALT)
"MBEDTLS_SHA512_PROCESS_ALT", "MBEDTLS_SHA512_PROCESS_ALT",
#endif /* MBEDTLS_SHA512_PROCESS_ALT */ #endif /* MBEDTLS_SHA512_PROCESS_ALT */
#if defined(MBEDTLS_POLY1305_ALT)
"MBEDTLS_POLY1305_ALT",
#endif /* MBEDTLS_POLY1305_ALT */
#if defined(MBEDTLS_DES_SETKEY_ALT) #if defined(MBEDTLS_DES_SETKEY_ALT)
"MBEDTLS_DES_SETKEY_ALT", "MBEDTLS_DES_SETKEY_ALT",
#endif /* MBEDTLS_DES_SETKEY_ALT */ #endif /* MBEDTLS_DES_SETKEY_ALT */
@ -639,6 +642,9 @@ static const char *features[] = {
#if defined(MBEDTLS_PLATFORM_C) #if defined(MBEDTLS_PLATFORM_C)
"MBEDTLS_PLATFORM_C", "MBEDTLS_PLATFORM_C",
#endif /* MBEDTLS_PLATFORM_C */ #endif /* MBEDTLS_PLATFORM_C */
#if defined(MBEDTLS_POLY1305_C)
"MBEDTLS_POLY1305_C",
#endif /* MBEDTLS_POLY1305_C */
#if defined(MBEDTLS_RIPEMD160_C) #if defined(MBEDTLS_RIPEMD160_C)
"MBEDTLS_RIPEMD160_C", "MBEDTLS_RIPEMD160_C",
#endif /* MBEDTLS_RIPEMD160_C */ #endif /* MBEDTLS_RIPEMD160_C */

14
programs/test/benchmark.c
View File

@ -63,6 +63,7 @@ int main( void )
#include "mbedtls/gcm.h" #include "mbedtls/gcm.h"
#include "mbedtls/ccm.h" #include "mbedtls/ccm.h"
#include "mbedtls/cmac.h" #include "mbedtls/cmac.h"
#include "mbedtls/poly1305.h"
#include "mbedtls/havege.h" #include "mbedtls/havege.h"
#include "mbedtls/ctr_drbg.h" #include "mbedtls/ctr_drbg.h"
#include "mbedtls/hmac_drbg.h" #include "mbedtls/hmac_drbg.h"
@ -95,7 +96,8 @@ int main( void )
#define OPTIONS \ #define OPTIONS \
"md4, md5, ripemd160, sha1, sha256, sha512,\n" \ "md4, md5, ripemd160, sha1, sha256, sha512,\n" \
"arc4, des3, des, camellia, blowfish, chacha20,\n" \ "arc4, des3, des, camellia, blowfish, chacha20,\n" \
"aes_cbc, aes_gcm, aes_ccm, aes_cmac, des3_cmac,\n" \ "aes_cbc, aes_gcm, aes_ccm,\n" \
"aes_cmac, des3_cmac, poly1305\n" \
"havege, ctr_drbg, hmac_drbg\n" \ "havege, ctr_drbg, hmac_drbg\n" \
"rsa, dhm, ecdsa, ecdh.\n" "rsa, dhm, ecdsa, ecdh.\n"
@ -231,6 +233,7 @@ typedef struct {
arc4, des3, des, arc4, des3, des,
aes_cbc, aes_gcm, aes_ccm, aes_cmac, des3_cmac, aes_cbc, aes_gcm, aes_ccm, aes_cmac, des3_cmac,
camellia, blowfish, chacha20, camellia, blowfish, chacha20,
poly1305,
havege, ctr_drbg, hmac_drbg, havege, ctr_drbg, hmac_drbg,
rsa, dhm, ecdsa, ecdh; rsa, dhm, ecdsa, ecdh;
} todo_list; } todo_list;
@ -289,6 +292,8 @@ int main( int argc, char *argv[] )
todo.blowfish = 1; todo.blowfish = 1;
else if( strcmp( argv[i], "chacha20" ) == 0 ) else if( strcmp( argv[i], "chacha20" ) == 0 )
todo.chacha20 = 1; todo.chacha20 = 1;
else if( strcmp( argv[i], "poly1305" ) == 0 )
todo.poly1305 = 1;
else if( strcmp( argv[i], "havege" ) == 0 ) else if( strcmp( argv[i], "havege" ) == 0 )
todo.havege = 1; todo.havege = 1;
else if( strcmp( argv[i], "ctr_drbg" ) == 0 ) else if( strcmp( argv[i], "ctr_drbg" ) == 0 )
@ -530,6 +535,13 @@ int main( int argc, char *argv[] )
} }
#endif #endif
#if defined(MBEDTLS_POLY1305_C)
if ( todo.poly1305 )
{
TIME_AND_TSC( "Poly1305", mbedtls_poly1305_mac( buf, BUFSIZE, buf, buf ) );
}
#endif
#if defined(MBEDTLS_BLOWFISH_C) && defined(MBEDTLS_CIPHER_MODE_CBC) #if defined(MBEDTLS_BLOWFISH_C) && defined(MBEDTLS_CIPHER_MODE_CBC)
if( todo.blowfish ) if( todo.blowfish )
{ {

2
scripts/generate_errors.pl
View File

@ -32,7 +32,7 @@ my $error_format_file = $data_dir.'/error.fmt';
my @low_level_modules = qw( AES ARC4 ASN1 BASE64 BIGNUM BLOWFISH my @low_level_modules = qw( AES ARC4 ASN1 BASE64 BIGNUM BLOWFISH
CAMELLIA CCM CHACHA20 CMAC CTR_DRBG DES CAMELLIA CCM CHACHA20 CMAC CTR_DRBG DES
ENTROPY GCM HMAC_DRBG MD2 MD4 MD5 ENTROPY GCM HMAC_DRBG MD2 MD4 MD5
NET OID PADLOCK PBKDF2 RIPEMD160 NET OID PADLOCK PBKDF2 POLY1305 RIPEMD160
SHA1 SHA256 SHA512 THREADING XTEA ); SHA1 SHA256 SHA512 THREADING XTEA );
my @high_level_modules = qw( CIPHER DHM ECP MD my @high_level_modules = qw( CIPHER DHM ECP MD
PEM PK PKCS12 PKCS5 PEM PK PKCS12 PKCS5

1
tests/CMakeLists.txt
View File

@ -98,6 +98,7 @@ add_test_suite(pkcs5)
add_test_suite(pk) add_test_suite(pk)
add_test_suite(pkparse) add_test_suite(pkparse)
add_test_suite(pkwrite) add_test_suite(pkwrite)
add_test_suite(poly1305)
add_test_suite(shax) add_test_suite(shax)
add_test_suite(ssl) add_test_suite(ssl)
add_test_suite(timing) add_test_suite(timing)

5
tests/Makefile
View File

@ -82,6 +82,7 @@ APPS = test_suite_aes.ecb$(EXEXT) test_suite_aes.cbc$(EXEXT) \
test_suite_pkcs1_v21$(EXEXT) test_suite_pkcs5$(EXEXT) \ test_suite_pkcs1_v21$(EXEXT) test_suite_pkcs5$(EXEXT) \
test_suite_pkparse$(EXEXT) test_suite_pkwrite$(EXEXT) \ test_suite_pkparse$(EXEXT) test_suite_pkwrite$(EXEXT) \
test_suite_pk$(EXEXT) \ test_suite_pk$(EXEXT) \
test_suite_poly1305$(EXEXT) \
test_suite_rsa$(EXEXT) test_suite_shax$(EXEXT) \ test_suite_rsa$(EXEXT) test_suite_shax$(EXEXT) \
test_suite_ssl$(EXEXT) test_suite_timing$(EXEXT) \ test_suite_ssl$(EXEXT) test_suite_timing$(EXEXT) \
test_suite_x509parse$(EXEXT) test_suite_x509write$(EXEXT) \ test_suite_x509parse$(EXEXT) test_suite_x509write$(EXEXT) \
@ -414,6 +415,10 @@ test_suite_pk$(EXEXT): test_suite_pk.c $(DEP)
echo " CC $<" echo " CC $<"
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
test_suite_poly1305$(EXEXT): test_suite_poly1305.c $(DEP)
echo " CC $<"
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
test_suite_rsa$(EXEXT): test_suite_rsa.c $(DEP) test_suite_rsa$(EXEXT): test_suite_rsa.c $(DEP)
echo " CC $<" echo " CC $<"
$(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@ $(CC) $(LOCAL_CFLAGS) $(CFLAGS) $< $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@

51
tests/suites/test_suite_poly1305.data Normal file
View File

@ -0,0 +1,51 @@
Poly1305 RFC 7539 Example And Test Vector
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b":"a8061dc1305136c6c22b8baf0c0127a9":"43727970746f6772617068696320466f72756d2052657365617263682047726f7570"
Poly1305 RFC 7539 Test Vector #1
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0000000000000000000000000000000000000000000000000000000000000000":"00000000000000000000000000000000":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
Poly1305 RFC 7539 Test Vector #2
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0000000000000000000000000000000036e5f6b5c5e06070f0efca96227a863e":"36e5f6b5c5e06070f0efca96227a863e":"416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f"
Poly1305 RFC 7539 Test Vector #3
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"36e5f6b5c5e06070f0efca96227a863e00000000000000000000000000000000":"f3477e7cd95417af89a6b8794c310cf0":"416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f"
Poly1305 RFC 7539 Test Vector #4
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"4541669a7eaaee61e708dc7cbcc5eb62":"2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e"
Poly1305 RFC 7539 Test Vector #5
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0200000000000000000000000000000000000000000000000000000000000000":"03000000000000000000000000000000":"ffffffffffffffffffffffffffffffff"
Poly1305 RFC 7539 Test Vector #6
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"02000000000000000000000000000000ffffffffffffffffffffffffffffffff":"03000000000000000000000000000000":"02000000000000000000000000000000"
Poly1305 RFC 7539 Test Vector #7
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0100000000000000000000000000000000000000000000000000000000000000":"05000000000000000000000000000000":"fffffffffffffffffffffffffffffffff0ffffffffffffffffffffffffffffff11000000000000000000000000000000"
Poly1305 RFC 7539 Test Vector #8
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0100000000000000000000000000000000000000000000000000000000000000":"00000000000000000000000000000000":"fffffffffffffffffffffffffffffffffbfefefefefefefefefefefefefefefe01010101010101010101010101010101"
Poly1305 RFC 7539 Test Vector #9
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0200000000000000000000000000000000000000000000000000000000000000":"faffffffffffffffffffffffffffffff":"fdffffffffffffffffffffffffffffff"
Poly1305 RFC 7539 Test Vector #10
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0100000000000000040000000000000000000000000000000000000000000000":"14000000000000005500000000000000":"e33594d7505e43b900000000000000003394d7505e4379cd01000000000000000000000000000000000000000000000001000000000000000000000000000000"
Poly1305 RFC 7539 Test Vector #11
depends_on:MBEDTLS_POLY1305_C
mbedtls_poly1305:"0100000000000000040000000000000000000000000000000000000000000000":"13000000000000000000000000000000":"e33594d7505e43b900000000000000003394d7505e4379cd010000000000000000000000000000000000000000000000"
Poly1305 Selftest
depends_on:MBEDTLS_SELF_TEST:MBEDTLS_POLY1305_C
poly1305_selftest:

35
tests/suites/test_suite_poly1305.function Normal file
View File

@ -0,0 +1,35 @@
/* BEGIN_HEADER */
#include "mbedtls/poly1305.h"
#include <stddef.h>
/* END_HEADER */
/* BEGIN_CASE depends_on:MBEDTLS_POLY1305_C */
void mbedtls_poly1305( char *hex_key_string, char *hex_mac_string, char *hex_src_string )
{
unsigned char src_str[10000];
unsigned char mac_str[100];
unsigned char key[32];
unsigned char mac[16];
size_t src_len;
memset(src_str, 0x00, 10000);
memset(mac_str, 0x00, 100);
memset(key, 0x00, 32);
memset(mac, 0x00, 16);
src_len = unhexify( src_str, hex_src_string );
unhexify( key, hex_key_string );
mbedtls_poly1305_mac( key, src_len, src_str, mac );
hexify( mac_str, mac, 16 );
TEST_ASSERT( strcmp( (char *) mac_str, hex_mac_string ) == 0 );
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_POLY1305_C:MBEDTLS_SELF_TEST */
void poly1305_selftest()
{
TEST_ASSERT( mbedtls_poly1305_self_test( 0 ) == 0 );
}
/* END_CASE */