1// SPDX-License-Identifier: GPL-2.0 OR MIT
  2/*
  3 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  4 */
  5
  6#include <crypto/internal/blake2s.h>
  7#include <crypto/internal/simd.h>
  8#include <crypto/internal/hash.h>
  9
 10#include <linux/types.h>
 11#include <linux/jump_label.h>
 12#include <linux/kernel.h>
 13#include <linux/module.h>
 14
 15static int crypto_blake2s_setkey(struct crypto_shash *tfm, const u8 *key,
 16				 unsigned int keylen)
 17{
 18	struct blake2s_tfm_ctx *tctx = crypto_shash_ctx(tfm);
 19
 20	if (keylen == 0 || keylen > BLAKE2S_KEY_SIZE)
 21		return -EINVAL;
 22
 23	memcpy(tctx->key, key, keylen);
 24	tctx->keylen = keylen;
 25
 26	return 0;
 27}
 28
 29static int crypto_blake2s_init(struct shash_desc *desc)
 30{
 31	struct blake2s_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm);
 32	struct blake2s_state *state = shash_desc_ctx(desc);
 33	const int outlen = crypto_shash_digestsize(desc->tfm);
 34
 35	if (tctx->keylen)
 36		blake2s_init_key(state, outlen, tctx->key, tctx->keylen);
 37	else
 38		blake2s_init(state, outlen);
 39
 40	return 0;
 41}
 42
 43static int crypto_blake2s_update(struct shash_desc *desc, const u8 *in,
 44				 unsigned int inlen)
 45{
 46	struct blake2s_state *state = shash_desc_ctx(desc);
 47	const size_t fill = BLAKE2S_BLOCK_SIZE - state->buflen;
 48
 49	if (unlikely(!inlen))
 50		return 0;
 51	if (inlen > fill) {
 52		memcpy(state->buf + state->buflen, in, fill);
 53		blake2s_compress_generic(state, state->buf, 1, BLAKE2S_BLOCK_SIZE);
 54		state->buflen = 0;
 55		in += fill;
 56		inlen -= fill;
 57	}
 58	if (inlen > BLAKE2S_BLOCK_SIZE) {
 59		const size_t nblocks = DIV_ROUND_UP(inlen, BLAKE2S_BLOCK_SIZE);
 60		/* Hash one less (full) block than strictly possible */
 61		blake2s_compress_generic(state, in, nblocks - 1, BLAKE2S_BLOCK_SIZE);
 62		in += BLAKE2S_BLOCK_SIZE * (nblocks - 1);
 63		inlen -= BLAKE2S_BLOCK_SIZE * (nblocks - 1);
 64	}
 65	memcpy(state->buf + state->buflen, in, inlen);
 66	state->buflen += inlen;
 67
 68	return 0;
 69}
 70
 71static int crypto_blake2s_final(struct shash_desc *desc, u8 *out)
 72{
 73	struct blake2s_state *state = shash_desc_ctx(desc);
 74
 75	blake2s_set_lastblock(state);
 76	memset(state->buf + state->buflen, 0,
 77	       BLAKE2S_BLOCK_SIZE - state->buflen); /* Padding */
 78	blake2s_compress_generic(state, state->buf, 1, state->buflen);
 79	cpu_to_le32_array(state->h, ARRAY_SIZE(state->h));
 80	memcpy(out, state->h, state->outlen);
 81	memzero_explicit(state, sizeof(*state));
 82
 83	return 0;
 84}
 85
 86static struct shash_alg blake2s_algs[] = {{
 87	.base.cra_name		= "blake2s-128",
 88	.base.cra_driver_name	= "blake2s-128-generic",
 89	.base.cra_flags		= CRYPTO_ALG_OPTIONAL_KEY,
 90	.base.cra_ctxsize	= sizeof(struct blake2s_tfm_ctx),
 91	.base.cra_priority	= 200,
 92	.base.cra_blocksize     = BLAKE2S_BLOCK_SIZE,
 93	.base.cra_module	= THIS_MODULE,
 94
 95	.digestsize		= BLAKE2S_128_HASH_SIZE,
 96	.setkey			= crypto_blake2s_setkey,
 97	.init			= crypto_blake2s_init,
 98	.update			= crypto_blake2s_update,
 99	.final			= crypto_blake2s_final,
100	.descsize		= sizeof(struct blake2s_state),
101}, {
102	.base.cra_name		= "blake2s-160",
103	.base.cra_driver_name	= "blake2s-160-generic",
104	.base.cra_flags		= CRYPTO_ALG_OPTIONAL_KEY,
105	.base.cra_ctxsize	= sizeof(struct blake2s_tfm_ctx),
106	.base.cra_priority	= 200,
107	.base.cra_blocksize     = BLAKE2S_BLOCK_SIZE,
108	.base.cra_module	= THIS_MODULE,
109
110	.digestsize		= BLAKE2S_160_HASH_SIZE,
111	.setkey			= crypto_blake2s_setkey,
112	.init			= crypto_blake2s_init,
113	.update			= crypto_blake2s_update,
114	.final			= crypto_blake2s_final,
115	.descsize		= sizeof(struct blake2s_state),
116}, {
117	.base.cra_name		= "blake2s-224",
118	.base.cra_driver_name	= "blake2s-224-generic",
119	.base.cra_flags		= CRYPTO_ALG_OPTIONAL_KEY,
120	.base.cra_ctxsize	= sizeof(struct blake2s_tfm_ctx),
121	.base.cra_priority	= 200,
122	.base.cra_blocksize     = BLAKE2S_BLOCK_SIZE,
123	.base.cra_module	= THIS_MODULE,
124
125	.digestsize		= BLAKE2S_224_HASH_SIZE,
126	.setkey			= crypto_blake2s_setkey,
127	.init			= crypto_blake2s_init,
128	.update			= crypto_blake2s_update,
129	.final			= crypto_blake2s_final,
130	.descsize		= sizeof(struct blake2s_state),
131}, {
132	.base.cra_name		= "blake2s-256",
133	.base.cra_driver_name	= "blake2s-256-generic",
134	.base.cra_flags		= CRYPTO_ALG_OPTIONAL_KEY,
135	.base.cra_ctxsize	= sizeof(struct blake2s_tfm_ctx),
136	.base.cra_priority	= 200,
137	.base.cra_blocksize     = BLAKE2S_BLOCK_SIZE,
138	.base.cra_module	= THIS_MODULE,
139
140	.digestsize		= BLAKE2S_256_HASH_SIZE,
141	.setkey			= crypto_blake2s_setkey,
142	.init			= crypto_blake2s_init,
143	.update			= crypto_blake2s_update,
144	.final			= crypto_blake2s_final,
145	.descsize		= sizeof(struct blake2s_state),
146}};
147
148static int __init blake2s_mod_init(void)
149{
150	return crypto_register_shashes(blake2s_algs, ARRAY_SIZE(blake2s_algs));
151}
152
153static void __exit blake2s_mod_exit(void)
154{
155	crypto_unregister_shashes(blake2s_algs, ARRAY_SIZE(blake2s_algs));
156}
157
158subsys_initcall(blake2s_mod_init);
159module_exit(blake2s_mod_exit);
160
161MODULE_ALIAS_CRYPTO("blake2s-128");
162MODULE_ALIAS_CRYPTO("blake2s-128-generic");
163MODULE_ALIAS_CRYPTO("blake2s-160");
164MODULE_ALIAS_CRYPTO("blake2s-160-generic");
165MODULE_ALIAS_CRYPTO("blake2s-224");
166MODULE_ALIAS_CRYPTO("blake2s-224-generic");
167MODULE_ALIAS_CRYPTO("blake2s-256");
168MODULE_ALIAS_CRYPTO("blake2s-256-generic");
169MODULE_LICENSE("GPL v2");