norx_ref.go 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300
  1. // norx_ref.go - Reference (portable) implementation
  2. //
  3. // To the extent possible under law, Yawning Angel has waived all copyright
  4. // and related or neighboring rights to the software, using the Creative
  5. // Commons "CC0" public domain dedication. See LICENSE or
  6. // <http://creativecommons.org/publicdomain/zero/1.0/> for full details.
  7. package norx
  8. import (
  9. "encoding/binary"
  10. "math/bits"
  11. )
  12. func permuteRef(s *state, rounds int) {
  13. // The reference code uses a few macros and has much better
  14. // readability here, but Go does not have macros. The "idiomatic"
  15. // thing to do is to replace the macros with a bunch of functions,
  16. // but at least as of Go 1.10, the resulting quarter round routine
  17. // is over the inliner budget.
  18. // Performance: Explicitly load the state into temp vars, and write
  19. // it back on completion since the compiler will do all of the
  20. // loads/stores otherwise.
  21. s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15 := s.s[0], s.s[1], s.s[2], s.s[3], s.s[4], s.s[5], s.s[6], s.s[7], s.s[8], s.s[9], s.s[10], s.s[11], s.s[12], s.s[13], s.s[14], s.s[15]
  22. for i := 0; i < rounds; i++ {
  23. // Column step
  24. // G(S[ 0], S[ 4], S[ 8], S[12]);
  25. // G(S[ 1], S[ 5], S[ 9], S[13]);
  26. // G(S[ 2], S[ 6], S[10], S[14]);
  27. // G(S[ 3], S[ 7], S[11], S[15]);
  28. s0 = (s0 ^ s4) ^ ((s0 & s4) << 1)
  29. s12 ^= s0
  30. s12 = bits.RotateLeft64(s12, -paramR0)
  31. s8 = (s8 ^ s12) ^ ((s8 & s12) << 1)
  32. s4 ^= s8
  33. s4 = bits.RotateLeft64(s4, -paramR1)
  34. s0 = (s0 ^ s4) ^ ((s0 & s4) << 1)
  35. s12 ^= s0
  36. s12 = bits.RotateLeft64(s12, -paramR2)
  37. s8 = (s8 ^ s12) ^ ((s8 & s12) << 1)
  38. s4 ^= s8
  39. s4 = bits.RotateLeft64(s4, -paramR3)
  40. s1 = (s1 ^ s5) ^ ((s1 & s5) << 1)
  41. s13 ^= s1
  42. s13 = bits.RotateLeft64(s13, -paramR0)
  43. s9 = (s9 ^ s13) ^ ((s9 & s13) << 1)
  44. s5 ^= s9
  45. s5 = bits.RotateLeft64(s5, -paramR1)
  46. s1 = (s1 ^ s5) ^ ((s1 & s5) << 1)
  47. s13 ^= s1
  48. s13 = bits.RotateLeft64(s13, -paramR2)
  49. s9 = (s9 ^ s13) ^ ((s9 & s13) << 1)
  50. s5 ^= s9
  51. s5 = bits.RotateLeft64(s5, -paramR3)
  52. s2 = (s2 ^ s6) ^ ((s2 & s6) << 1)
  53. s14 ^= s2
  54. s14 = bits.RotateLeft64(s14, -paramR0)
  55. s10 = (s10 ^ s14) ^ ((s10 & s14) << 1)
  56. s6 ^= s10
  57. s6 = bits.RotateLeft64(s6, -paramR1)
  58. s2 = (s2 ^ s6) ^ ((s2 & s6) << 1)
  59. s14 ^= s2
  60. s14 = bits.RotateLeft64(s14, -paramR2)
  61. s10 = (s10 ^ s14) ^ ((s10 & s14) << 1)
  62. s6 ^= s10
  63. s6 = bits.RotateLeft64(s6, -paramR3)
  64. s3 = (s3 ^ s7) ^ ((s3 & s7) << 1)
  65. s15 ^= s3
  66. s15 = bits.RotateLeft64(s15, -paramR0)
  67. s11 = (s11 ^ s15) ^ ((s11 & s15) << 1)
  68. s7 ^= s11
  69. s7 = bits.RotateLeft64(s7, -paramR1)
  70. s3 = (s3 ^ s7) ^ ((s3 & s7) << 1)
  71. s15 ^= s3
  72. s15 = bits.RotateLeft64(s15, -paramR2)
  73. s11 = (s11 ^ s15) ^ ((s11 & s15) << 1)
  74. s7 ^= s11
  75. s7 = bits.RotateLeft64(s7, -paramR3)
  76. // Diagonal step
  77. // G(S[ 0], S[ 5], S[10], S[15]);
  78. // G(S[ 1], S[ 6], S[11], S[12]);
  79. // G(S[ 2], S[ 7], S[ 8], S[13]);
  80. // G(S[ 3], S[ 4], S[ 9], S[14]);
  81. s0 = (s0 ^ s5) ^ ((s0 & s5) << 1)
  82. s15 ^= s0
  83. s15 = bits.RotateLeft64(s15, -paramR0)
  84. s10 = (s10 ^ s15) ^ ((s10 & s15) << 1)
  85. s5 ^= s10
  86. s5 = bits.RotateLeft64(s5, -paramR1)
  87. s0 = (s0 ^ s5) ^ ((s0 & s5) << 1)
  88. s15 ^= s0
  89. s15 = bits.RotateLeft64(s15, -paramR2)
  90. s10 = (s10 ^ s15) ^ ((s10 & s15) << 1)
  91. s5 ^= s10
  92. s5 = bits.RotateLeft64(s5, -paramR3)
  93. s1 = (s1 ^ s6) ^ ((s1 & s6) << 1)
  94. s12 ^= s1
  95. s12 = bits.RotateLeft64(s12, -paramR0)
  96. s11 = (s11 ^ s12) ^ ((s11 & s12) << 1)
  97. s6 ^= s11
  98. s6 = bits.RotateLeft64(s6, -paramR1)
  99. s1 = (s1 ^ s6) ^ ((s1 & s6) << 1)
  100. s12 ^= s1
  101. s12 = bits.RotateLeft64(s12, -paramR2)
  102. s11 = (s11 ^ s12) ^ ((s11 & s12) << 1)
  103. s6 ^= s11
  104. s6 = bits.RotateLeft64(s6, -paramR3)
  105. s2 = (s2 ^ s7) ^ ((s2 & s7) << 1)
  106. s13 ^= s2
  107. s13 = bits.RotateLeft64(s13, -paramR0)
  108. s8 = (s8 ^ s13) ^ ((s8 & s13) << 1)
  109. s7 ^= s8
  110. s7 = bits.RotateLeft64(s7, -paramR1)
  111. s2 = (s2 ^ s7) ^ ((s2 & s7) << 1)
  112. s13 ^= s2
  113. s13 = bits.RotateLeft64(s13, -paramR2)
  114. s8 = (s8 ^ s13) ^ ((s8 & s13) << 1)
  115. s7 ^= s8
  116. s7 = bits.RotateLeft64(s7, -paramR3)
  117. s3 = (s3 ^ s4) ^ ((s3 & s4) << 1)
  118. s14 ^= s3
  119. s14 = bits.RotateLeft64(s14, -paramR0)
  120. s9 = (s9 ^ s14) ^ ((s9 & s14) << 1)
  121. s4 ^= s9
  122. s4 = bits.RotateLeft64(s4, -paramR1)
  123. s3 = (s3 ^ s4) ^ ((s3 & s4) << 1)
  124. s14 ^= s3
  125. s14 = bits.RotateLeft64(s14, -paramR2)
  126. s9 = (s9 ^ s14) ^ ((s9 & s14) << 1)
  127. s4 ^= s9
  128. s4 = bits.RotateLeft64(s4, -paramR3)
  129. }
  130. s.s[0], s.s[1], s.s[2], s.s[3], s.s[4], s.s[5], s.s[6], s.s[7], s.s[8], s.s[9], s.s[10], s.s[11], s.s[12], s.s[13], s.s[14], s.s[15] = s0, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, s13, s14, s15
  131. }
  132. func padRef(out *[bytesR]byte, in []byte) {
  133. // Note: This is only called with a zero initialized `out`.
  134. copy(out[:], in)
  135. out[len(in)] = 0x01
  136. out[bytesR-1] |= 0x80
  137. }
  138. func absorbBlockRef(s *state, in []byte, tag uint64) {
  139. s.s[15] ^= tag
  140. permuteRef(s, s.rounds)
  141. for i := 0; i < wordsR; i++ {
  142. s.s[i] ^= binary.LittleEndian.Uint64(in[i*bytesW:])
  143. }
  144. }
  145. func absorbLastBlockRef(s *state, in []byte, tag uint64) {
  146. var lastBlock [bytesR]byte
  147. padRef(&lastBlock, in)
  148. absorbBlockRef(s, lastBlock[:], tag)
  149. }
  150. func encryptBlockRef(s *state, out, in []byte) {
  151. s.s[15] ^= tagPayload
  152. permuteRef(s, s.rounds)
  153. for i := 0; i < wordsR; i++ {
  154. s.s[i] ^= binary.LittleEndian.Uint64(in[i*bytesW:])
  155. binary.LittleEndian.PutUint64(out[i*bytesW:], s.s[i])
  156. }
  157. }
  158. func encryptLastBlockRef(s *state, out, in []byte) {
  159. var lastBlock [bytesR]byte
  160. padRef(&lastBlock, in)
  161. encryptBlockRef(s, lastBlock[:], lastBlock[:])
  162. copy(out, lastBlock[:len(in)])
  163. }
  164. func decryptBlockRef(s *state, out, in []byte) {
  165. s.s[15] ^= tagPayload
  166. permuteRef(s, s.rounds)
  167. for i := 0; i < wordsR; i++ {
  168. c := binary.LittleEndian.Uint64(in[i*bytesW:])
  169. binary.LittleEndian.PutUint64(out[i*bytesW:], s.s[i]^c)
  170. s.s[i] = c
  171. }
  172. }
  173. func decryptLastBlockRef(s *state, out, in []byte) {
  174. s.s[15] ^= tagPayload
  175. permuteRef(s, s.rounds)
  176. var lastBlock [bytesR]byte
  177. for i := 0; i < wordsR; i++ {
  178. binary.LittleEndian.PutUint64(lastBlock[i*bytesW:], s.s[i])
  179. }
  180. copy(lastBlock[:], in)
  181. lastBlock[len(in)] ^= 0x01
  182. lastBlock[bytesR-1] ^= 0x80
  183. for i := 0; i < wordsR; i++ {
  184. c := binary.LittleEndian.Uint64(lastBlock[i*bytesW:])
  185. binary.LittleEndian.PutUint64(lastBlock[i*bytesW:], s.s[i]^c)
  186. s.s[i] = c
  187. }
  188. copy(out, lastBlock[:len(in)])
  189. burnBytes(lastBlock[:])
  190. }
  191. func initRef(s *state, key, nonce []byte) {
  192. for i := 0; i < 4; i++ {
  193. s.s[i] = binary.LittleEndian.Uint64(nonce[i*bytesW:])
  194. s.s[i+4] = binary.LittleEndian.Uint64(key[i*bytesW:])
  195. }
  196. copy(s.s[8:], initializationConstants[8:])
  197. s.s[12] ^= paramW
  198. s.s[13] ^= uint64(s.rounds)
  199. s.s[14] ^= paramP
  200. s.s[15] ^= paramT
  201. permuteRef(s, s.rounds)
  202. for i := 0; i < 4; i++ {
  203. s.s[i+12] ^= binary.LittleEndian.Uint64(key[i*bytesW:])
  204. }
  205. }
  206. func absorbDataRef(s *state, in []byte, tag uint64) {
  207. inLen, off := len(in), 0
  208. if inLen == 0 {
  209. return
  210. }
  211. for inLen >= bytesR {
  212. absorbBlockRef(s, in[off:off+bytesR], tag)
  213. inLen, off = inLen-bytesR, off+bytesR
  214. }
  215. absorbLastBlockRef(s, in[off:], tag)
  216. }
  217. func encryptDataRef(s *state, out, in []byte) {
  218. inLen, off := len(in), 0
  219. if inLen == 0 {
  220. return
  221. }
  222. for inLen >= bytesR {
  223. encryptBlockRef(s, out[off:off+bytesR], in[off:off+bytesR])
  224. inLen, off = inLen-bytesR, off+bytesR
  225. }
  226. encryptLastBlockRef(s, out[off:], in[off:])
  227. }
  228. func decryptDataRef(s *state, out, in []byte) {
  229. inLen, off := len(in), 0
  230. if inLen == 0 {
  231. return
  232. }
  233. for inLen >= bytesR {
  234. decryptBlockRef(s, out[off:off+bytesR], in[off:off+bytesR])
  235. inLen, off = inLen-bytesR, off+bytesR
  236. }
  237. decryptLastBlockRef(s, out[off:], in[off:])
  238. }
  239. func finalizeRef(s *state, tag, key []byte) {
  240. var lastBlock [bytesC]byte
  241. s.s[15] ^= tagFinal
  242. permuteRef(s, s.rounds)
  243. for i := 0; i < 4; i++ {
  244. s.s[i+12] ^= binary.LittleEndian.Uint64(key[i*bytesW:])
  245. }
  246. permuteRef(s, s.rounds)
  247. for i := 0; i < 4; i++ {
  248. s.s[i+12] ^= binary.LittleEndian.Uint64(key[i*bytesW:])
  249. binary.LittleEndian.PutUint64(lastBlock[i*bytesW:], s.s[i+12])
  250. }
  251. copy(tag, lastBlock[:bytesT])
  252. burnBytes(lastBlock[:]) // burn buffer
  253. burnUint64s(s.s[:]) // at this point we can also burn the state
  254. }