randombit/botan | Build 30328435581 | source/src/lib/stream/salsa20/salsa20.cpp | Coveralls

22

inline void salsa20_quarter_round(uint32_t& x1, uint32_t& x2, uint32_t& x3, uint32_t& x4) {

451,972,696✔

23

   x2 ^= rotl<7>(x1 + x4);

451,972,696✔

24

   x3 ^= rotl<9>(x2 + x1);

451,972,696✔

25

   x4 ^= rotl<13>(x3 + x2);

451,972,696✔

26

   x1 ^= rotl<18>(x4 + x3);

451,972,696✔

35

void Salsa20::hsalsa20(uint32_t output[8], const uint32_t input[16]) {

108✔

36

   uint32_t x00 = input[0];

108✔

37

   uint32_t x01 = input[1];

108✔

38

   uint32_t x02 = input[2];

108✔

39

   uint32_t x03 = input[3];

108✔

40

   uint32_t x04 = input[4];

108✔

41

   uint32_t x05 = input[5];

108✔

42

   uint32_t x06 = input[6];

108✔

43

   uint32_t x07 = input[7];

108✔

44

   uint32_t x08 = input[8];

108✔

45

   uint32_t x09 = input[9];

108✔

46

   uint32_t x10 = input[10];

108✔

47

   uint32_t x11 = input[11];

108✔

48

   uint32_t x12 = input[12];

108✔

49

   uint32_t x13 = input[13];

108✔

50

   uint32_t x14 = input[14];

108✔

51

   uint32_t x15 = input[15];

108✔

53

   for(size_t i = 0; i != 10; ++i) {

1,188✔

54

      salsa20_quarter_round(x00, x04, x08, x12);

1,080✔

55

      salsa20_quarter_round(x05, x09, x13, x01);

1,080✔

56

      salsa20_quarter_round(x10, x14, x02, x06);

1,080✔

57

      salsa20_quarter_round(x15, x03, x07, x11);

1,080✔

59

      salsa20_quarter_round(x00, x01, x02, x03);

1,080✔

60

      salsa20_quarter_round(x05, x06, x07, x04);

1,080✔

61

      salsa20_quarter_round(x10, x11, x08, x09);

1,080✔

62

      salsa20_quarter_round(x15, x12, x13, x14);

1,080✔

65

   output[0] = x00;

108✔

66

   output[1] = x05;

108✔

67

   output[2] = x10;

108✔

68

   output[3] = x15;

108✔

69

   output[4] = x06;

108✔

70

   output[5] = x07;

108✔

71

   output[6] = x08;

108✔

72

   output[7] = x09;

108✔

73

108✔

79

void Salsa20::salsa_core(uint8_t output[64], const uint32_t input[16], size_t rounds) {

112,990,336✔

80

   BOTAN_ASSERT_NOMSG(rounds % 2 == 0);

112,990,336✔

82

   uint32_t x00 = input[0];

112,990,336✔

83

   uint32_t x01 = input[1];

112,990,336✔

84

   uint32_t x02 = input[2];

112,990,336✔

85

   uint32_t x03 = input[3];

112,990,336✔

86

   uint32_t x04 = input[4];

112,990,336✔

87

   uint32_t x05 = input[5];

112,990,336✔

88

   uint32_t x06 = input[6];

112,990,336✔

89

   uint32_t x07 = input[7];

112,990,336✔

90

   uint32_t x08 = input[8];

112,990,336✔

91

   uint32_t x09 = input[9];

112,990,336✔

92

   uint32_t x10 = input[10];

112,990,336✔

93

   uint32_t x11 = input[11];

112,990,336✔

94

   uint32_t x12 = input[12];

112,990,336✔

95

   uint32_t x13 = input[13];

112,990,336✔

96

   uint32_t x14 = input[14];

112,990,336✔

97

   uint32_t x15 = input[15];

112,990,336✔

99

   for(size_t i = 0; i != rounds / 2; ++i) {

564,961,952✔

100

      salsa20_quarter_round(x00, x04, x08, x12);

451,971,616✔

101

      salsa20_quarter_round(x05, x09, x13, x01);

451,971,616✔

102

      salsa20_quarter_round(x10, x14, x02, x06);

451,971,616✔

103

      salsa20_quarter_round(x15, x03, x07, x11);

451,971,616✔

105

      salsa20_quarter_round(x00, x01, x02, x03);

451,971,616✔

106

      salsa20_quarter_round(x05, x06, x07, x04);

451,971,616✔

107

      salsa20_quarter_round(x10, x11, x08, x09);

451,971,616✔

108

      salsa20_quarter_round(x15, x12, x13, x14);

451,971,616✔

111

   store_le(x00 + input[0], output + 4 * 0);

112,990,336✔

112

   store_le(x01 + input[1], output + 4 * 1);

112,990,336✔

113

   store_le(x02 + input[2], output + 4 * 2);

112,990,336✔

114

   store_le(x03 + input[3], output + 4 * 3);

112,990,336✔

115

   store_le(x04 + input[4], output + 4 * 4);

112,990,336✔

116

   store_le(x05 + input[5], output + 4 * 5);

112,990,336✔

117

   store_le(x06 + input[6], output + 4 * 6);

112,990,336✔

118

   store_le(x07 + input[7], output + 4 * 7);

112,990,336✔

119

   store_le(x08 + input[8], output + 4 * 8);

112,990,336✔

120

   store_le(x09 + input[9], output + 4 * 9);

112,990,336✔

121

   store_le(x10 + input[10], output + 4 * 10);

112,990,336✔

122

   store_le(x11 + input[11], output + 4 * 11);

112,990,336✔

123

   store_le(x12 + input[12], output + 4 * 12);

112,990,336✔

124

   store_le(x13 + input[13], output + 4 * 13);

112,990,336✔

125

   store_le(x14 + input[14], output + 4 * 14);

112,990,336✔

126

   store_le(x15 + input[15], output + 4 * 15);

112,990,336✔

127

112,990,336✔

129

size_t Salsa20::parallelism() {

249✔

131

   if(CPUID::has(CPUID::Feature::AVX512)) {

249✔

137

   if(CPUID::has(CPUID::Feature::AVX2)) {

249✔

138

      return 8;

99✔

145

std::string Salsa20::provider() const {

51✔

147

   if(auto feat = CPUID::check(CPUID::Feature::AVX512)) {

51✔

153

   if(auto feat = CPUID::check(CPUID::Feature::AVX2)) {

51✔

154

      return *feat;

34✔

155

17✔

159

   if(auto feat = CPUID::check(CPUID::Feature::SIMD_4X32)) {

34✔

160

      return *feat;

34✔

161

17✔

164

   return "base";

17✔

168

void Salsa20::salsa20(uint8_t output[], size_t output_blocks, uint32_t state[16], size_t rounds) {

1,244✔

169

   BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds");

1,244✔

172

   if(CPUID::has(CPUID::Feature::AVX512)) {

1,244✔

182

   if(CPUID::has(CPUID::Feature::AVX2)) {

1,244✔

183

      while(output_blocks >= 8) {

776✔

184

         Salsa20::salsa20_avx2_x8(output, state, rounds);

388✔

185

         output += 8 * 64;

388✔

186

         output_blocks -= 8;

388✔

192

   if(CPUID::has(CPUID::Feature::SIMD_4X32)) {

1,244✔

193

      while(output_blocks >= 4) {

1,244✔

194

         Salsa20::salsa20_simd32_x4(output, state, rounds);

428✔

195

         output += 4 * 64;

428✔

196

         output_blocks -= 4;

428✔

201

   for(size_t i = 0; i != output_blocks; ++i) {

2,956✔

202

      salsa_core(output + 64 * i, state, rounds);

1,712✔

204

      ++state[8];

1,712✔

205

      if(state[8] == 0) {

1,712✔

206

         state[9] += 1;

7✔

209

1,244✔

214

void Salsa20::cipher_bytes(const uint8_t in[], uint8_t out[], size_t length) {

316✔

215

   assert_key_material_set();

316✔

217

   while(length >= m_buffer.size() - m_position) {

866✔

218

      const size_t available = m_buffer.size() - m_position;

336✔

220

      xor_buf(out, in, &m_buffer[m_position], available);

336✔

221

      salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);

336✔

223

      length -= available;

336✔

224

      in += available;

336✔

225

      out += available;

336✔

227

      m_position = 0;

336✔

230

   xor_buf(out, in, &m_buffer[m_position], length);

214✔

232

   m_position += length;

214✔

233

214✔

235

void Salsa20::generate_keystream(uint8_t out[], size_t length) {

368✔

236

   assert_key_material_set();

368✔

238

   while(length >= m_buffer.size() - m_position) {

910✔

239

      const size_t available = m_buffer.size() - m_position;

174✔

243

      copy_mem(out, &m_buffer[m_position], available);

174✔

244

      salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);

174✔

246

      length -= available;

174✔

247

      out += available;

174✔

248

      m_position = 0;

174✔

251

   copy_mem(out, &m_buffer[m_position], length);

368✔

253

   m_position += length;

368✔

254

368✔

256

void Salsa20::initialize_state() {

555✔

257

   static const uint32_t TAU[] = {0x61707865, 0x3120646e, 0x79622d36, 0x6b206574};

555✔

259

   static const uint32_t SIGMA[] = {0x61707865, 0x3320646e, 0x79622d32, 0x6b206574};

555✔

261

   m_state[1] = m_key[0];

555✔

262

   m_state[2] = m_key[1];

555✔

263

   m_state[3] = m_key[2];

555✔

264

   m_state[4] = m_key[3];

555✔

266

   if(m_key.size() == 4) {

555✔

267

      m_state[0] = TAU[0];

75✔

268

      m_state[5] = TAU[1];

75✔

269

      m_state[10] = TAU[2];

75✔

270

      m_state[15] = TAU[3];

75✔

271

      m_state[11] = m_key[0];

75✔

272

      m_state[12] = m_key[1];

75✔

273

      m_state[13] = m_key[2];

75✔

274

      m_state[14] = m_key[3];

75✔

276

      m_state[0] = SIGMA[0];

480✔

277

      m_state[5] = SIGMA[1];

480✔

278

      m_state[10] = SIGMA[2];

480✔

279

      m_state[15] = SIGMA[3];

480✔

280

      m_state[11] = m_key[4];

480✔

281

      m_state[12] = m_key[5];

480✔

282

      m_state[13] = m_key[6];

480✔

283

      m_state[14] = m_key[7];

480✔

286

   m_state[6] = 0;

555✔

287

   m_state[7] = 0;

555✔

288

   m_state[8] = 0;

555✔

289

   m_state[9] = 0;

555✔

291

   m_position = 0;

555✔

292

555✔

294

bool Salsa20::has_keying_material() const {

1,772✔

295

   return !m_state.empty();

1,772✔

298

size_t Salsa20::buffer_size() const {

51✔

299

   return 64;

51✔

305

void Salsa20::key_schedule(std::span<const uint8_t> key) {

249✔

306

   m_key.resize(key.size() / 4);

249✔

307

   load_le<uint32_t>(m_key.data(), key.data(), m_key.size());

249✔

309

   m_state.resize(16);

249✔

311

   const size_t salsa_block = 64;

249✔

312

   m_buffer.resize(parallelism() * salsa_block);

249✔

314

   set_iv(nullptr, 0);

249✔

315

249✔

320

void Salsa20::set_iv_bytes(const uint8_t iv[], size_t length) {

654✔

321

   assert_key_material_set();

654✔

323

   if(!valid_iv_length(length)) {

1,212✔

324

      throw Invalid_IV_Length(name(), length);

102✔

327

   initialize_state();

555✔

329

   if(length == 0) {

555✔

331

      m_state[6] = 0;

255✔

332

      m_state[7] = 0;

255✔

333

   } else if(length == 8) {

300✔

335

      m_state[6] = load_le<uint32_t>(iv, 0);

196✔

336

      m_state[7] = load_le<uint32_t>(iv, 1);

196✔

339

      m_state[6] = load_le<uint32_t>(iv, 0);

104✔

340

      m_state[7] = load_le<uint32_t>(iv, 1);

104✔

341

      m_state[8] = load_le<uint32_t>(iv, 2);

104✔

342

      m_state[9] = load_le<uint32_t>(iv, 3);

104✔

344

      secure_vector<uint32_t> hsalsa(8);

104✔

345

      hsalsa20(hsalsa.data(), m_state.data());

104✔

347

      m_state[1] = hsalsa[0];

104✔

348

      m_state[2] = hsalsa[1];

104✔

349

      m_state[3] = hsalsa[2];

104✔

350

      m_state[4] = hsalsa[3];

104✔

351

      m_state[6] = load_le<uint32_t>(iv, 4);

104✔

352

      m_state[7] = load_le<uint32_t>(iv, 5);

104✔

353

      m_state[11] = hsalsa[4];

104✔

354

      m_state[12] = hsalsa[5];

104✔

355

      m_state[13] = hsalsa[6];

104✔

356

      m_state[14] = hsalsa[7];

104✔

357

104✔

359

   m_state[8] = 0;

555✔

360

   m_state[9] = 0;

555✔

362

   salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);

555✔

363

   m_position = 0;

555✔

364

555✔

366

bool Salsa20::valid_iv_length(size_t iv_len) const {

759✔

367

   return (iv_len == 0 || iv_len == 8 || iv_len == 24);

759✔

370

size_t Salsa20::default_iv_length() const {

102✔

371

   return 24;

102✔

374

Key_Length_Specification Salsa20::key_spec() const {

363✔

375

   return Key_Length_Specification(16, 32, 16);

363✔

378

std::unique_ptr<StreamCipher> Salsa20::new_object() const {

69✔

379

   return std::make_unique<Salsa20>();

69✔

382

std::string Salsa20::name() const {

405✔

383

   return "Salsa20";

405✔

389

void Salsa20::clear() {

51✔

390

   zap(m_key);

51✔

391

   zap(m_state);

51✔

392

   zap(m_buffer);

51✔

393

   m_position = 0;

51✔

394

51✔

396

void Salsa20::seek(uint64_t offset) {

230✔

397

   assert_key_material_set();

230✔

399

   const uint64_t counter = offset / 64;

179✔

401

   m_state[8] = static_cast<uint32_t>(counter);

179✔

402

   m_state[9] = static_cast<uint32_t>(counter >> 32);

179✔

404

   salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);

179✔

406

   m_position = offset % 64;

179✔

407

179✔

randombit / botan / 30328435581

Source File
Press 'n' to go to next uncovered line, 'b' for previous

1	/*
2	* Salsa20 / XSalsa20
3	* (C) 1999-2010,2014 Jack Lloyd
4	*
5	* Botan is released under the Simplified BSD License (see license.txt)
6	*/
7
8	#include <botan/internal/salsa20.h>
9
10	#include <botan/exceptn.h>
11	#include <botan/internal/loadstor.h>
12	#include <botan/internal/rotate.h>
13
14	#if defined(BOTAN_HAS_CPUID)
15	#include <botan/internal/cpuid.h>
16	#endif
17
18	namespace Botan {
19
20	namespace {
21
22	inline void salsa20_quarter_round(uint32_t& x1, uint32_t& x2, uint32_t& x3, uint32_t& x4) {	451,972,696✔
23	x2 ^= rotl<7>(x1 + x4);	451,972,696✔
24	x3 ^= rotl<9>(x2 + x1);	451,972,696✔
25	x4 ^= rotl<13>(x3 + x2);	451,972,696✔
26	x1 ^= rotl<18>(x4 + x3);	451,972,696✔
27	}
28
29	} // namespace
30
31	/*
32	* Generate HSalsa20 cipher stream (for XSalsa20 IV setup)
33	*/
34	//static
35	void Salsa20::hsalsa20(uint32_t output[8], const uint32_t input[16]) {	108✔
36	uint32_t x00 = input[0];	108✔
37	uint32_t x01 = input[1];	108✔
38	uint32_t x02 = input[2];	108✔
39	uint32_t x03 = input[3];	108✔
40	uint32_t x04 = input[4];	108✔
41	uint32_t x05 = input[5];	108✔
42	uint32_t x06 = input[6];	108✔
43	uint32_t x07 = input[7];	108✔
44	uint32_t x08 = input[8];	108✔
45	uint32_t x09 = input[9];	108✔
46	uint32_t x10 = input[10];	108✔
47	uint32_t x11 = input[11];	108✔
48	uint32_t x12 = input[12];	108✔
49	uint32_t x13 = input[13];	108✔
50	uint32_t x14 = input[14];	108✔
51	uint32_t x15 = input[15];	108✔
52
53	for(size_t i = 0; i != 10; ++i) {	1,188✔
54	salsa20_quarter_round(x00, x04, x08, x12);	1,080✔
55	salsa20_quarter_round(x05, x09, x13, x01);	1,080✔
56	salsa20_quarter_round(x10, x14, x02, x06);	1,080✔
57	salsa20_quarter_round(x15, x03, x07, x11);	1,080✔
58
59	salsa20_quarter_round(x00, x01, x02, x03);	1,080✔
60	salsa20_quarter_round(x05, x06, x07, x04);	1,080✔
61	salsa20_quarter_round(x10, x11, x08, x09);	1,080✔
62	salsa20_quarter_round(x15, x12, x13, x14);	1,080✔
63	}
64
65	output[0] = x00;	108✔
66	output[1] = x05;	108✔
67	output[2] = x10;	108✔
68	output[3] = x15;	108✔
69	output[4] = x06;	108✔
70	output[5] = x07;	108✔
71	output[6] = x08;	108✔
72	output[7] = x09;	108✔
73	}	108✔
74
75	/*
76	* Generate Salsa20 cipher stream
77	*/
78	//static
79	void Salsa20::salsa_core(uint8_t output[64], const uint32_t input[16], size_t rounds) {	112,990,336✔
80	BOTAN_ASSERT_NOMSG(rounds % 2 == 0);	112,990,336✔
81
82	uint32_t x00 = input[0];	112,990,336✔
83	uint32_t x01 = input[1];	112,990,336✔
84	uint32_t x02 = input[2];	112,990,336✔
85	uint32_t x03 = input[3];	112,990,336✔
86	uint32_t x04 = input[4];	112,990,336✔
87	uint32_t x05 = input[5];	112,990,336✔
88	uint32_t x06 = input[6];	112,990,336✔
89	uint32_t x07 = input[7];	112,990,336✔
90	uint32_t x08 = input[8];	112,990,336✔
91	uint32_t x09 = input[9];	112,990,336✔
92	uint32_t x10 = input[10];	112,990,336✔
93	uint32_t x11 = input[11];	112,990,336✔
94	uint32_t x12 = input[12];	112,990,336✔
95	uint32_t x13 = input[13];	112,990,336✔
96	uint32_t x14 = input[14];	112,990,336✔
97	uint32_t x15 = input[15];	112,990,336✔
98
99	for(size_t i = 0; i != rounds / 2; ++i) {	564,961,952✔
100	salsa20_quarter_round(x00, x04, x08, x12);	451,971,616✔
101	salsa20_quarter_round(x05, x09, x13, x01);	451,971,616✔
102	salsa20_quarter_round(x10, x14, x02, x06);	451,971,616✔
103	salsa20_quarter_round(x15, x03, x07, x11);	451,971,616✔
104
105	salsa20_quarter_round(x00, x01, x02, x03);	451,971,616✔
106	salsa20_quarter_round(x05, x06, x07, x04);	451,971,616✔
107	salsa20_quarter_round(x10, x11, x08, x09);	451,971,616✔
108	salsa20_quarter_round(x15, x12, x13, x14);	451,971,616✔
109	}
110
111	store_le(x00 + input[0], output + 4 * 0);	112,990,336✔
112	store_le(x01 + input[1], output + 4 * 1);	112,990,336✔
113	store_le(x02 + input[2], output + 4 * 2);	112,990,336✔
114	store_le(x03 + input[3], output + 4 * 3);	112,990,336✔
115	store_le(x04 + input[4], output + 4 * 4);	112,990,336✔
116	store_le(x05 + input[5], output + 4 * 5);	112,990,336✔
117	store_le(x06 + input[6], output + 4 * 6);	112,990,336✔
118	store_le(x07 + input[7], output + 4 * 7);	112,990,336✔
119	store_le(x08 + input[8], output + 4 * 8);	112,990,336✔
120	store_le(x09 + input[9], output + 4 * 9);	112,990,336✔
121	store_le(x10 + input[10], output + 4 * 10);	112,990,336✔
122	store_le(x11 + input[11], output + 4 * 11);	112,990,336✔
123	store_le(x12 + input[12], output + 4 * 12);	112,990,336✔
124	store_le(x13 + input[13], output + 4 * 13);	112,990,336✔
125	store_le(x14 + input[14], output + 4 * 14);	112,990,336✔
126	store_le(x15 + input[15], output + 4 * 15);	112,990,336✔
127	}	112,990,336✔
128
129	size_t Salsa20::parallelism() {	249✔
130	#if defined(BOTAN_HAS_SALSA20_AVX512)
131	if(CPUID::has(CPUID::Feature::AVX512)) {	249✔
132	return 16;
133	}
134	#endif
135
136	#if defined(BOTAN_HAS_SALSA20_AVX2)
137	if(CPUID::has(CPUID::Feature::AVX2)) {	249✔
138	return 8;	99✔
139	}
140	#endif
141
142	return 4;
143	}
144
145	std::string Salsa20::provider() const {	51✔
146	#if defined(BOTAN_HAS_SALSA20_AVX512)
147	if(auto feat = CPUID::check(CPUID::Feature::AVX512)) {	51✔
148	return *feat;	×
149	}	×
150	#endif
151
152	#if defined(BOTAN_HAS_SALSA20_AVX2)
153	if(auto feat = CPUID::check(CPUID::Feature::AVX2)) {	51✔
154	return *feat;	34✔
155	}	17✔
156	#endif
157
158	#if defined(BOTAN_HAS_SALSA20_SIMD32)
159	if(auto feat = CPUID::check(CPUID::Feature::SIMD_4X32)) {	34✔
160	return *feat;	34✔
161	}	17✔
162	#endif
163
164	return "base";	17✔
165	}
166
167	//static
168	void Salsa20::salsa20(uint8_t output[], size_t output_blocks, uint32_t state[16], size_t rounds) {	1,244✔
169	BOTAN_ASSERT(rounds % 2 == 0, "Valid rounds");	1,244✔
170
171	#if defined(BOTAN_HAS_SALSA20_AVX512)
172	if(CPUID::has(CPUID::Feature::AVX512)) {	1,244✔
173	while(output_blocks >= 16) {	×
174	Salsa20::salsa20_avx512_x16(output, state, rounds);	×
175	output += 16 * 64;	×
176	output_blocks -= 16;	×
177	}
178	}
179	#endif
180
181	#if defined(BOTAN_HAS_SALSA20_AVX2)
182	if(CPUID::has(CPUID::Feature::AVX2)) {	1,244✔
183	while(output_blocks >= 8) {	776✔
184	Salsa20::salsa20_avx2_x8(output, state, rounds);	388✔
185	output += 8 * 64;	388✔
186	output_blocks -= 8;	388✔
187	}
188	}
189	#endif
190
191	#if defined(BOTAN_HAS_SALSA20_SIMD32)
192	if(CPUID::has(CPUID::Feature::SIMD_4X32)) {	1,244✔
193	while(output_blocks >= 4) {	1,244✔
194	Salsa20::salsa20_simd32_x4(output, state, rounds);	428✔
195	output += 4 * 64;	428✔
196	output_blocks -= 4;	428✔
197	}
198	}
199	#endif
200
201	for(size_t i = 0; i != output_blocks; ++i) {	2,956✔
202	salsa_core(output + 64 * i, state, rounds);	1,712✔
203
204	++state[8];	1,712✔
205	if(state[8] == 0) {	1,712✔
206	state[9] += 1;	7✔
207	}
208	}
209	}	1,244✔
210
211	/*
212	* Combine cipher stream with message
213	*/
214	void Salsa20::cipher_bytes(const uint8_t in[], uint8_t out[], size_t length) {	316✔
215	assert_key_material_set();	316✔
216
217	while(length >= m_buffer.size() - m_position) {	866✔
218	const size_t available = m_buffer.size() - m_position;	336✔
219
220	xor_buf(out, in, &m_buffer[m_position], available);	336✔
221	salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);	336✔
222
223	length -= available;	336✔
224	in += available;	336✔
225	out += available;	336✔
226
227	m_position = 0;	336✔
228	}
229
230	xor_buf(out, in, &m_buffer[m_position], length);	214✔
231
232	m_position += length;	214✔
233	}	214✔
234
235	void Salsa20::generate_keystream(uint8_t out[], size_t length) {	368✔
236	assert_key_material_set();	368✔
237
238	while(length >= m_buffer.size() - m_position) {	910✔
239	const size_t available = m_buffer.size() - m_position;	174✔
240
241	// TODO: this could write directly to the output buffer
242	// instead of bouncing it through m_buffer first
243	copy_mem(out, &m_buffer[m_position], available);	174✔
244	salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);	174✔
245
246	length -= available;	174✔
247	out += available;	174✔
248	m_position = 0;	174✔
249	}
250
251	copy_mem(out, &m_buffer[m_position], length);	368✔
252
253	m_position += length;	368✔
254	}	368✔
255
256	void Salsa20::initialize_state() {	555✔
257	static const uint32_t TAU[] = {0x61707865, 0x3120646e, 0x79622d36, 0x6b206574};	555✔
258
259	static const uint32_t SIGMA[] = {0x61707865, 0x3320646e, 0x79622d32, 0x6b206574};	555✔
260
261	m_state[1] = m_key[0];	555✔
262	m_state[2] = m_key[1];	555✔
263	m_state[3] = m_key[2];	555✔
264	m_state[4] = m_key[3];	555✔
265
266	if(m_key.size() == 4) {	555✔
267	m_state[0] = TAU[0];	75✔
268	m_state[5] = TAU[1];	75✔
269	m_state[10] = TAU[2];	75✔
270	m_state[15] = TAU[3];	75✔
271	m_state[11] = m_key[0];	75✔
272	m_state[12] = m_key[1];	75✔
273	m_state[13] = m_key[2];	75✔
274	m_state[14] = m_key[3];	75✔
275	} else {
276	m_state[0] = SIGMA[0];	480✔
277	m_state[5] = SIGMA[1];	480✔
278	m_state[10] = SIGMA[2];	480✔
279	m_state[15] = SIGMA[3];	480✔
280	m_state[11] = m_key[4];	480✔
281	m_state[12] = m_key[5];	480✔
282	m_state[13] = m_key[6];	480✔
283	m_state[14] = m_key[7];	480✔
284	}
285
286	m_state[6] = 0;	555✔
287	m_state[7] = 0;	555✔
288	m_state[8] = 0;	555✔
289	m_state[9] = 0;	555✔
290
291	m_position = 0;	555✔
292	}	555✔
293
294	bool Salsa20::has_keying_material() const {	1,772✔
295	return !m_state.empty();	1,772✔
296	}
297
298	size_t Salsa20::buffer_size() const {	51✔
299	return 64;	51✔
300	}
301
302	/*
303	* Salsa20 Key Schedule
304	*/
305	void Salsa20::key_schedule(std::span<const uint8_t> key) {	249✔
306	m_key.resize(key.size() / 4);	249✔
307	load_le<uint32_t>(m_key.data(), key.data(), m_key.size());	249✔
308
309	m_state.resize(16);	249✔
310
311	const size_t salsa_block = 64;	249✔
312	m_buffer.resize(parallelism() * salsa_block);	249✔
313
314	set_iv(nullptr, 0);	249✔
315	}	249✔
316
317	/*
318	* Set the Salsa IV
319	*/
320	void Salsa20::set_iv_bytes(const uint8_t iv[], size_t length) {	654✔
321	assert_key_material_set();	654✔
322
323	if(!valid_iv_length(length)) {	1,212✔
324	throw Invalid_IV_Length(name(), length);	102✔
325	}
326
327	initialize_state();	555✔
328
329	if(length == 0) {	555✔
330	// Salsa20 null IV
331	m_state[6] = 0;	255✔
332	m_state[7] = 0;	255✔
333	} else if(length == 8) {	300✔
334	// Salsa20
335	m_state[6] = load_le<uint32_t>(iv, 0);	196✔
336	m_state[7] = load_le<uint32_t>(iv, 1);	196✔
337	} else {
338	// XSalsa20
339	m_state[6] = load_le<uint32_t>(iv, 0);	104✔
340	m_state[7] = load_le<uint32_t>(iv, 1);	104✔
341	m_state[8] = load_le<uint32_t>(iv, 2);	104✔
342	m_state[9] = load_le<uint32_t>(iv, 3);	104✔
343
344	secure_vector<uint32_t> hsalsa(8);	104✔
345	hsalsa20(hsalsa.data(), m_state.data());	104✔
346
347	m_state[1] = hsalsa[0];	104✔
348	m_state[2] = hsalsa[1];	104✔
349	m_state[3] = hsalsa[2];	104✔
350	m_state[4] = hsalsa[3];	104✔
351	m_state[6] = load_le<uint32_t>(iv, 4);	104✔
352	m_state[7] = load_le<uint32_t>(iv, 5);	104✔
353	m_state[11] = hsalsa[4];	104✔
354	m_state[12] = hsalsa[5];	104✔
355	m_state[13] = hsalsa[6];	104✔
356	m_state[14] = hsalsa[7];	104✔
357	}	104✔
358
359	m_state[8] = 0;	555✔
360	m_state[9] = 0;	555✔
361
362	salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);	555✔
363	m_position = 0;	555✔
364	}	555✔
365
366	bool Salsa20::valid_iv_length(size_t iv_len) const {	759✔
367	return (iv_len == 0 \|\| iv_len == 8 \|\| iv_len == 24);	759✔
368	}
369
370	size_t Salsa20::default_iv_length() const {	102✔
371	return 24;	102✔
372	}
373
374	Key_Length_Specification Salsa20::key_spec() const {	363✔
375	return Key_Length_Specification(16, 32, 16);	363✔
376	}
377
378	std::unique_ptr<StreamCipher> Salsa20::new_object() const {	69✔
379	return std::make_unique<Salsa20>();	69✔
380	}
381
382	std::string Salsa20::name() const {	405✔
383	return "Salsa20";	405✔
384	}
385
386	/*
387	* Clear memory of sensitive data
388	*/
389	void Salsa20::clear() {	51✔
390	zap(m_key);	51✔
391	zap(m_state);	51✔
392	zap(m_buffer);	51✔
393	m_position = 0;	51✔
394	}	51✔
395
396	void Salsa20::seek(uint64_t offset) {	230✔
397	assert_key_material_set();	230✔
398
399	const uint64_t counter = offset / 64;	179✔
400
401	m_state[8] = static_cast<uint32_t>(counter);	179✔
402	m_state[9] = static_cast<uint32_t>(counter >> 32);	179✔
403
404	salsa20(m_buffer.data(), m_buffer.size() / 64, m_state.data(), 20);	179✔
405
406	m_position = offset % 64;	179✔
407	}	179✔
408	} // namespace Botan

randombit / botan / 30328435581

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous