crypto/external/bsd/openssh/dist/umac.c

   1 /*      $NetBSD$        */
   2 /* $OpenBSD: umac.c,v 1.3 2008/05/12 20:52:20 pvalchev Exp $ */
   3 /* -----------------------------------------------------------------------
   4  *
   5  * umac.c -- C Implementation UMAC Message Authentication
   6  *
   7  * Version 0.93b of rfc4418.txt -- 2006 July 18
   8  *
   9  * For a full description of UMAC message authentication see the UMAC
  10  * world-wide-web page at http://www.cs.ucdavis.edu/~rogaway/umac
  11  * Please report bugs and suggestions to the UMAC webpage.
  12  *
  13  * Copyright (c) 1999-2006 Ted Krovetz
  14  *
  15  * Permission to use, copy, modify, and distribute this software and
  16  * its documentation for any purpose and with or without fee, is hereby
  17  * granted provided that the above copyright notice appears in all copies
  18  * and in supporting documentation, and that the name of the copyright
  19  * holder not be used in advertising or publicity pertaining to
  20  * distribution of the software without specific, written prior permission.
  21  *
  22  * Comments should be directed to Ted Krovetz (tdk@acm.org)
  23  *
  24  * ---------------------------------------------------------------------- */
  25
  26  /* ////////////////////// IMPORTANT NOTES /////////////////////////////////
  27   *
  28   * 1) This version does not work properly on messages larger than 16MB
  29   *
  30   * 2) If you set the switch to use SSE2, then all data must be 16-byte
  31   *    aligned
  32   *
  33   * 3) When calling the function umac(), it is assumed that msg is in
  34   * a writable buffer of length divisible by 32 bytes. The message itself
  35   * does not have to fill the entire buffer, but bytes beyond msg may be
  36   * zeroed.
  37   *
  38   * 4) Three free AES implementations are supported by this implementation of
  39   * UMAC. Paulo Barreto's version is in the public domain and can be found
  40   * at http://www.esat.kuleuven.ac.be/~rijmen/rijndael/ (search for
  41   * "Barreto"). The only two files needed are rijndael-alg-fst.c and
  42   * rijndael-alg-fst.h. Brian Gladman's version is distributed with the GNU
  43   * Public lisence at http://fp.gladman.plus.com/AES/index.htm. It
  44   * includes a fast IA-32 assembly version. The OpenSSL crypo library is
  45   * the third.
  46   *
  47   * 5) With FORCE_C_ONLY flags set to 0, incorrect results are sometimes
  48   * produced under gcc with optimizations set -O3 or higher. Dunno why.
  49   *
  50   /////////////////////////////////////////////////////////////////////// */
  51
  52 /* ---------------------------------------------------------------------- */
  53 /* --- User Switches ---------------------------------------------------- */
  54 /* ---------------------------------------------------------------------- */
  55
  56 #define UMAC_OUTPUT_LEN     8  /* Alowable: 4, 8, 12, 16                  */
  57 /* #define FORCE_C_ONLY        1  ANSI C and 64-bit integers req'd        */
  58 /* #define AES_IMPLEMENTAION   1  1 = OpenSSL, 2 = Barreto, 3 = Gladman   */
  59 /* #define SSE2                0  Is SSE2 is available?                   */
  60 /* #define RUN_TESTS           0  Run basic correctness/speed tests       */
  61 /* #define UMAC_AE_SUPPORT     0  Enable auhthenticated encrytion         */
  62
  63 /* ---------------------------------------------------------------------- */
  64 /* -- Global Includes --------------------------------------------------- */
  65 /* ---------------------------------------------------------------------- */
  66
  67 #include "includes.h"
  68 __RCSID("$NetBSD: umac.c,v 1.6 2009/02/16 20:53:55 christos Exp $");
  69 #include <sys/types.h>
  70 #include <sys/endian.h>
  71
  72 #include "xmalloc.h"
  73 #include "umac.h"
  74 #include <string.h>
  75 #include <stdlib.h>
  76 #include <stddef.h>
  77
  78 /* ---------------------------------------------------------------------- */
  79 /* --- Primitive Data Types ---                                           */
  80 /* ---------------------------------------------------------------------- */
  81
  82 /* The following assumptions may need change on your system */
  83 typedef u_int8_t        UINT8;  /* 1 byte   */
  84 typedef u_int16_t       UINT16; /* 2 byte   */
  85 typedef u_int32_t       UINT32; /* 4 byte   */
  86 typedef u_int64_t       UINT64; /* 8 bytes  */
  87 typedef unsigned int    UWORD;  /* Register */
  88
  89 /* ---------------------------------------------------------------------- */
  90 /* --- Constants -------------------------------------------------------- */
  91 /* ---------------------------------------------------------------------- */
  92
  93 #define UMAC_KEY_LEN           16  /* UMAC takes 16 bytes of external key */
  94
  95 /* Message "words" are read from memory in an endian-specific manner.     */
  96 /* For this implementation to behave correctly, __LITTLE_ENDIAN__ must    */
  97 /* be set true if the host computer is little-endian.                     */
  98
  99 #if BYTE_ORDER == LITTLE_ENDIAN
 100 #define __LITTLE_ENDIAN__ 1
 101 #else
 102 #define __LITTLE_ENDIAN__ 0
 103 #endif
 104
 105 /* ---------------------------------------------------------------------- */
 106 /* ---------------------------------------------------------------------- */
 107 /* ----- Architecture Specific ------------------------------------------ */
 108 /* ---------------------------------------------------------------------- */
 109 /* ---------------------------------------------------------------------- */
 110
 111
 112 /* ---------------------------------------------------------------------- */
 113 /* ---------------------------------------------------------------------- */
 114 /* ----- Primitive Routines --------------------------------------------- */
 115 /* ---------------------------------------------------------------------- */
 116 /* ---------------------------------------------------------------------- */
 117
 118
 119 /* ---------------------------------------------------------------------- */
 120 /* --- 32-bit by 32-bit to 64-bit Multiplication ------------------------ */
 121 /* ---------------------------------------------------------------------- */
 122
 123 #define MUL64(a,b) ((UINT64)((UINT64)(UINT32)(a) * (UINT64)(UINT32)(b)))
 124
 125 #if defined(__NetBSD__)
 126 #include <sys/endian.h>
 127 #define LOAD_UINT32_LITTLE(ptr) le32toh(*ptr)
 128 #define STORE_UINT32_BIG(ptr,x) (*(UINT32 *)(ptr) = htobe32(x))
 129 #define LOAD_UINT32_REVERSED(p)         (bswap32(*(UINT32 *)(p)))
 130 #define STORE_UINT32_REVERSED(p,v)      (*(UINT32 *)(p) = bswap32(v))
 131 #else /* !NetBSD */
 132
 133  /* ---------------------------------------------------------------------- */
 134  /* --- Endian Conversion --- Forcing assembly on some platforms           */
 135
 136 /* ---------------------------------------------------------------------- */
 137 /* --- Endian Conversion --- Forcing assembly on some platforms           */
 138 /* ---------------------------------------------------------------------- */
 139
 140 #if !defined(__OpenBSD__)
 141 static UINT32 LOAD_UINT32_REVERSED(void *ptr)
 142 {
 143     UINT32 temp = *(UINT32 *)ptr;
 144     temp = (temp >> 24) | ((temp & 0x00FF0000) >> 8 )
 145          | ((temp & 0x0000FF00) << 8 ) | (temp << 24);
 146     return (UINT32)temp;
 147 }
 148
 149 static void STORE_UINT32_REVERSED(void *ptr, UINT32 x)
 150 {
 151     UINT32 i = (UINT32)x;
 152     *(UINT32 *)ptr = (i >> 24) | ((i & 0x00FF0000) >> 8 )
 153                    | ((i & 0x0000FF00) << 8 ) | (i << 24);
 154 }
 155 #endif
 156
 157 #else
 158 /* The following definitions use the above reversal-primitives to do the right
 159  * thing on endian specific load and stores.
 160  */
 161
 162 #define LOAD_UINT32_REVERSED(p)         (swap32(*(UINT32 *)(p)))
 163 #define STORE_UINT32_REVERSED(p,v)      (*(UINT32 *)(p) = swap32(v))
 164 #endif
 165
 166 #if (__LITTLE_ENDIAN__)
 167 #define LOAD_UINT32_LITTLE(ptr)     (*(UINT32 *)(ptr))
 168 #define STORE_UINT32_BIG(ptr,x)     STORE_UINT32_REVERSED(ptr,x)
 169 #else
 170 #define LOAD_UINT32_LITTLE(ptr)     LOAD_UINT32_REVERSED(ptr)
 171 #define STORE_UINT32_BIG(ptr,x)     (*(UINT32 *)(ptr) = (UINT32)(x))
 172 #endif
 173 #endif /*!NetBSD*/
 174
 175
 176
 177 /* ---------------------------------------------------------------------- */
 178 /* ---------------------------------------------------------------------- */
 179 /* ----- Begin KDF & PDF Section ---------------------------------------- */
 180 /* ---------------------------------------------------------------------- */
 181 /* ---------------------------------------------------------------------- */
 182
 183 /* UMAC uses AES with 16 byte block and key lengths */
 184 #define AES_BLOCK_LEN  16
 185
 186 /* OpenSSL's AES */
 187 #include <openssl/aes.h>
 188 typedef AES_KEY aes_int_key[1];
 189 #define aes_encryption(in,out,int_key)                  \
 190   AES_encrypt((u_char *)(in),(u_char *)(out),(AES_KEY *)int_key)
 191 #define aes_key_setup(key,int_key)                      \
 192   AES_set_encrypt_key((u_char *)(key),UMAC_KEY_LEN*8,int_key)
 193
 194 /* The user-supplied UMAC key is stretched using AES in a counter
 195  * mode to supply all random bits needed by UMAC. The kdf function takes
 196  * an AES internal key representation 'key' and writes a stream of
 197  * 'nbytes' bytes to the memory pointed at by 'buffer_ptr'. Each distinct
 198  * 'ndx' causes a distinct byte stream.
 199  */
 200 static void kdf(void *buffer_ptr, aes_int_key key, UINT8 ndx, int nbytes)
 201 {
 202     UINT8 in_buf[AES_BLOCK_LEN] = {0};
 203     UINT8 out_buf[AES_BLOCK_LEN];
 204     UINT8 *dst_buf = (UINT8 *)buffer_ptr;
 205     int i;
 206
 207     /* Setup the initial value */
 208     in_buf[AES_BLOCK_LEN-9] = ndx;
 209     in_buf[AES_BLOCK_LEN-1] = i = 1;
 210
 211     while (nbytes >= AES_BLOCK_LEN) {
 212         aes_encryption(in_buf, out_buf, key);
 213         memcpy(dst_buf,out_buf,AES_BLOCK_LEN);
 214         in_buf[AES_BLOCK_LEN-1] = ++i;
 215         nbytes -= AES_BLOCK_LEN;
 216         dst_buf += AES_BLOCK_LEN;
 217     }
 218     if (nbytes) {
 219         aes_encryption(in_buf, out_buf, key);
 220         memcpy(dst_buf,out_buf,nbytes);
 221     }
 222 }
 223
 224 /* The final UHASH result is XOR'd with the output of a pseudorandom
 225  * function. Here, we use AES to generate random output and
 226  * xor the appropriate bytes depending on the last bits of nonce.
 227  * This scheme is optimized for sequential, increasing big-endian nonces.
 228  */
 229
 230 typedef struct {
 231     UINT8 cache[AES_BLOCK_LEN];  /* Previous AES output is saved      */
 232     UINT8 nonce[AES_BLOCK_LEN];  /* The AES input making above cache  */
 233     aes_int_key prf_key;         /* Expanded AES key for PDF          */
 234 } pdf_ctx;
 235
 236 static void pdf_init(pdf_ctx *pc, aes_int_key prf_key)
 237 {
 238     UINT8 buf[UMAC_KEY_LEN];
 239
 240     kdf(buf, prf_key, 0, UMAC_KEY_LEN);
 241     aes_key_setup(buf, pc->prf_key);
 242
 243     /* Initialize pdf and cache */
 244     memset(pc->nonce, 0, sizeof(pc->nonce));
 245     aes_encryption(pc->nonce, pc->cache, pc->prf_key);
 246 }
 247
 248 static void pdf_gen_xor(pdf_ctx *pc, UINT8 nonce[8], UINT8 buf[8])
 249 {
 250     /* 'ndx' indicates that we'll be using the 0th or 1st eight bytes
 251      * of the AES output. If last time around we returned the ndx-1st
 252      * element, then we may have the result in the cache already.
 253      */
 254
 255 #if (UMAC_OUTPUT_LEN == 4)
 256 #define LOW_BIT_MASK 3
 257 #elif (UMAC_OUTPUT_LEN == 8)
 258 #define LOW_BIT_MASK 1
 259 #elif (UMAC_OUTPUT_LEN > 8)
 260 #define LOW_BIT_MASK 0
 261 #endif
 262
 263     UINT8 tmp_nonce_lo[4];
 264 #if LOW_BIT_MASK != 0
 265     int ndx = nonce[7] & LOW_BIT_MASK;
 266 #endif
 267     *(UINT32 *)tmp_nonce_lo = ((UINT32 *)nonce)[1];
 268     tmp_nonce_lo[3] &= ~LOW_BIT_MASK; /* zero last bit */
 269
 270     if ( (((UINT32 *)tmp_nonce_lo)[0] != ((UINT32 *)pc->nonce)[1]) ||
 271          (((UINT32 *)nonce)[0] != ((UINT32 *)pc->nonce)[0]) )
 272     {
 273         ((UINT32 *)pc->nonce)[0] = ((UINT32 *)nonce)[0];
 274         ((UINT32 *)pc->nonce)[1] = ((UINT32 *)tmp_nonce_lo)[0];
 275         aes_encryption(pc->nonce, pc->cache, pc->prf_key);
 276     }
 277
 278 #if (UMAC_OUTPUT_LEN == 4)
 279     *((UINT32 *)buf) ^= ((UINT32 *)pc->cache)[ndx];
 280 #elif (UMAC_OUTPUT_LEN == 8)
 281     *((UINT64 *)buf) ^= ((UINT64 *)pc->cache)[ndx];
 282 #elif (UMAC_OUTPUT_LEN == 12)
 283     ((UINT64 *)buf)[0] ^= ((UINT64 *)pc->cache)[0];
 284     ((UINT32 *)buf)[2] ^= ((UINT32 *)pc->cache)[2];
 285 #elif (UMAC_OUTPUT_LEN == 16)
 286     ((UINT64 *)buf)[0] ^= ((UINT64 *)pc->cache)[0];
 287     ((UINT64 *)buf)[1] ^= ((UINT64 *)pc->cache)[1];
 288 #endif
 289 }
 290
 291 /* ---------------------------------------------------------------------- */
 292 /* ---------------------------------------------------------------------- */
 293 /* ----- Begin NH Hash Section ------------------------------------------ */
 294 /* ---------------------------------------------------------------------- */
 295 /* ---------------------------------------------------------------------- */
 296
 297 /* The NH-based hash functions used in UMAC are described in the UMAC paper
 298  * and specification, both of which can be found at the UMAC website.
 299  * The interface to this implementation has two
 300  * versions, one expects the entire message being hashed to be passed
 301  * in a single buffer and returns the hash result immediately. The second
 302  * allows the message to be passed in a sequence of buffers. In the
 303  * muliple-buffer interface, the client calls the routine nh_update() as
 304  * many times as necessary. When there is no more data to be fed to the
 305  * hash, the client calls nh_final() which calculates the hash output.
 306  * Before beginning another hash calculation the nh_reset() routine
 307  * must be called. The single-buffer routine, nh(), is equivalent to
 308  * the sequence of calls nh_update() and nh_final(); however it is
 309  * optimized and should be prefered whenever the multiple-buffer interface
 310  * is not necessary. When using either interface, it is the client's
 311  * responsability to pass no more than L1_KEY_LEN bytes per hash result.
 312  *
 313  * The routine nh_init() initializes the nh_ctx data structure and
 314  * must be called once, before any other PDF routine.
 315  */
 316
 317  /* The "nh_aux" routines do the actual NH hashing work. They
 318   * expect buffers to be multiples of L1_PAD_BOUNDARY. These routines
 319   * produce output for all STREAMS NH iterations in one call,
 320   * allowing the parallel implementation of the streams.
 321   */
 322
 323 #define STREAMS (UMAC_OUTPUT_LEN / 4) /* Number of times hash is applied  */
 324 #define L1_KEY_LEN         1024     /* Internal key bytes                 */
 325 #define L1_KEY_SHIFT         16     /* Toeplitz key shift between streams */
 326 #define L1_PAD_BOUNDARY      32     /* pad message to boundary multiple   */
 327 #define ALLOC_BOUNDARY       16     /* Keep buffers aligned to this       */
 328 #define HASH_BUF_BYTES       64     /* nh_aux_hb buffer multiple          */
 329
 330 typedef struct {
 331     UINT8  nh_key [L1_KEY_LEN + L1_KEY_SHIFT * (STREAMS - 1)]; /* NH Key */
 332     UINT8  data   [HASH_BUF_BYTES];    /* Incomming data buffer           */
 333     int next_data_empty;    /* Bookeeping variable for data buffer.       */
 334     int bytes_hashed;        /* Bytes (out of L1_KEY_LEN) incorperated.   */
 335     UINT64 state[STREAMS];               /* on-line state     */
 336 } nh_ctx;
 337
 338
 339 #if (UMAC_OUTPUT_LEN == 4)
 340
 341 static void nh_aux(void *kp, void *dp, void *hp, UINT32 dlen)
 342 /* NH hashing primitive. Previous (partial) hash result is loaded and
 343 * then stored via hp pointer. The length of the data pointed at by "dp",
 344 * "dlen", is guaranteed to be divisible by L1_PAD_BOUNDARY (32).  Key
 345 * is expected to be endian compensated in memory at key setup.
 346 */
 347 {
 348     UINT64 h;
 349     UWORD c = dlen / 32;
 350     UINT32 *k = (UINT32 *)kp;
 351     UINT32 *d = (UINT32 *)dp;
 352     UINT32 d0,d1,d2,d3,d4,d5,d6,d7;
 353     UINT32 k0,k1,k2,k3,k4,k5,k6,k7;
 354
 355     h = *((UINT64 *)hp);
 356     do {
 357         d0 = LOAD_UINT32_LITTLE(d+0); d1 = LOAD_UINT32_LITTLE(d+1);
 358         d2 = LOAD_UINT32_LITTLE(d+2); d3 = LOAD_UINT32_LITTLE(d+3);
 359         d4 = LOAD_UINT32_LITTLE(d+4); d5 = LOAD_UINT32_LITTLE(d+5);
 360         d6 = LOAD_UINT32_LITTLE(d+6); d7 = LOAD_UINT32_LITTLE(d+7);
 361         k0 = *(k+0); k1 = *(k+1); k2 = *(k+2); k3 = *(k+3);
 362         k4 = *(k+4); k5 = *(k+5); k6 = *(k+6); k7 = *(k+7);
 363         h += MUL64((k0 + d0), (k4 + d4));
 364         h += MUL64((k1 + d1), (k5 + d5));
 365         h += MUL64((k2 + d2), (k6 + d6));
 366         h += MUL64((k3 + d3), (k7 + d7));
 367
 368         d += 8;
 369         k += 8;
 370     } while (--c);
 371   *((UINT64 *)hp) = h;
 372 }
 373
 374 #elif (UMAC_OUTPUT_LEN == 8)
 375
 376 static void nh_aux(void *kp, void *dp, void *hp, UINT32 dlen)
 377 /* Same as previous nh_aux, but two streams are handled in one pass,
 378  * reading and writing 16 bytes of hash-state per call.
 379  */
 380 {
 381   UINT64 h1,h2;
 382   UWORD c = dlen / 32;
 383   UINT32 *k = (UINT32 *)kp;
 384   UINT32 *d = (UINT32 *)dp;
 385   UINT32 d0,d1,d2,d3,d4,d5,d6,d7;
 386   UINT32 k0,k1,k2,k3,k4,k5,k6,k7,
 387         k8,k9,k10,k11;
 388
 389   h1 = *((UINT64 *)hp);
 390   h2 = *((UINT64 *)hp + 1);
 391   k0 = *(k+0); k1 = *(k+1); k2 = *(k+2); k3 = *(k+3);
 392   do {
 393     d0 = LOAD_UINT32_LITTLE(d+0); d1 = LOAD_UINT32_LITTLE(d+1);
 394     d2 = LOAD_UINT32_LITTLE(d+2); d3 = LOAD_UINT32_LITTLE(d+3);
 395     d4 = LOAD_UINT32_LITTLE(d+4); d5 = LOAD_UINT32_LITTLE(d+5);
 396     d6 = LOAD_UINT32_LITTLE(d+6); d7 = LOAD_UINT32_LITTLE(d+7);
 397     k4 = *(k+4); k5 = *(k+5); k6 = *(k+6); k7 = *(k+7);
 398     k8 = *(k+8); k9 = *(k+9); k10 = *(k+10); k11 = *(k+11);
 399
 400     h1 += MUL64((k0 + d0), (k4 + d4));
 401     h2 += MUL64((k4 + d0), (k8 + d4));
 402
 403     h1 += MUL64((k1 + d1), (k5 + d5));
 404     h2 += MUL64((k5 + d1), (k9 + d5));
 405
 406     h1 += MUL64((k2 + d2), (k6 + d6));
 407     h2 += MUL64((k6 + d2), (k10 + d6));
 408
 409     h1 += MUL64((k3 + d3), (k7 + d7));
 410     h2 += MUL64((k7 + d3), (k11 + d7));
 411
 412     k0 = k8; k1 = k9; k2 = k10; k3 = k11;
 413
 414     d += 8;
 415     k += 8;
 416   } while (--c);
 417   ((UINT64 *)hp)[0] = h1;
 418   ((UINT64 *)hp)[1] = h2;
 419 }
 420
 421 #elif (UMAC_OUTPUT_LEN == 12)
 422
 423 static void nh_aux(void *kp, void *dp, void *hp, UINT32 dlen)
 424 /* Same as previous nh_aux, but two streams are handled in one pass,
 425  * reading and writing 24 bytes of hash-state per call.
 426 */
 427 {
 428     UINT64 h1,h2,h3;
 429     UWORD c = dlen / 32;
 430     UINT32 *k = (UINT32 *)kp;
 431     UINT32 *d = (UINT32 *)dp;
 432     UINT32 d0,d1,d2,d3,d4,d5,d6,d7;
 433     UINT32 k0,k1,k2,k3,k4,k5,k6,k7,
 434         k8,k9,k10,k11,k12,k13,k14,k15;
 435
 436     h1 = *((UINT64 *)hp);
 437     h2 = *((UINT64 *)hp + 1);
 438     h3 = *((UINT64 *)hp + 2);
 439     k0 = *(k+0); k1 = *(k+1); k2 = *(k+2); k3 = *(k+3);
 440     k4 = *(k+4); k5 = *(k+5); k6 = *(k+6); k7 = *(k+7);
 441     do {
 442         d0 = LOAD_UINT32_LITTLE(d+0); d1 = LOAD_UINT32_LITTLE(d+1);
 443         d2 = LOAD_UINT32_LITTLE(d+2); d3 = LOAD_UINT32_LITTLE(d+3);
 444         d4 = LOAD_UINT32_LITTLE(d+4); d5 = LOAD_UINT32_LITTLE(d+5);
 445         d6 = LOAD_UINT32_LITTLE(d+6); d7 = LOAD_UINT32_LITTLE(d+7);
 446         k8 = *(k+8); k9 = *(k+9); k10 = *(k+10); k11 = *(k+11);
 447         k12 = *(k+12); k13 = *(k+13); k14 = *(k+14); k15 = *(k+15);
 448
 449         h1 += MUL64((k0 + d0), (k4 + d4));
 450         h2 += MUL64((k4 + d0), (k8 + d4));
 451         h3 += MUL64((k8 + d0), (k12 + d4));
 452
 453         h1 += MUL64((k1 + d1), (k5 + d5));
 454         h2 += MUL64((k5 + d1), (k9 + d5));
 455         h3 += MUL64((k9 + d1), (k13 + d5));
 456
 457         h1 += MUL64((k2 + d2), (k6 + d6));
 458         h2 += MUL64((k6 + d2), (k10 + d6));
 459         h3 += MUL64((k10 + d2), (k14 + d6));
 460
 461         h1 += MUL64((k3 + d3), (k7 + d7));
 462         h2 += MUL64((k7 + d3), (k11 + d7));
 463         h3 += MUL64((k11 + d3), (k15 + d7));
 464
 465         k0 = k8; k1 = k9; k2 = k10; k3 = k11;
 466         k4 = k12; k5 = k13; k6 = k14; k7 = k15;
 467
 468         d += 8;
 469         k += 8;
 470     } while (--c);
 471     ((UINT64 *)hp)[0] = h1;
 472     ((UINT64 *)hp)[1] = h2;
 473     ((UINT64 *)hp)[2] = h3;
 474 }
 475
 476 #elif (UMAC_OUTPUT_LEN == 16)
 477
 478 static void nh_aux(void *kp, void *dp, void *hp, UINT32 dlen)
 479 /* Same as previous nh_aux, but two streams are handled in one pass,
 480  * reading and writing 24 bytes of hash-state per call.
 481 */
 482 {
 483     UINT64 h1,h2,h3,h4;
 484     UWORD c = dlen / 32;
 485     UINT32 *k = (UINT32 *)kp;
 486     UINT32 *d = (UINT32 *)dp;
 487     UINT32 d0,d1,d2,d3,d4,d5,d6,d7;
 488     UINT32 k0,k1,k2,k3,k4,k5,k6,k7,
 489         k8,k9,k10,k11,k12,k13,k14,k15,
 490         k16,k17,k18,k19;
 491
 492     h1 = *((UINT64 *)hp);
 493     h2 = *((UINT64 *)hp + 1);
 494     h3 = *((UINT64 *)hp + 2);
 495     h4 = *((UINT64 *)hp + 3);
 496     k0 = *(k+0); k1 = *(k+1); k2 = *(k+2); k3 = *(k+3);
 497     k4 = *(k+4); k5 = *(k+5); k6 = *(k+6); k7 = *(k+7);
 498     do {
 499         d0 = LOAD_UINT32_LITTLE(d+0); d1 = LOAD_UINT32_LITTLE(d+1);
 500         d2 = LOAD_UINT32_LITTLE(d+2); d3 = LOAD_UINT32_LITTLE(d+3);
 501         d4 = LOAD_UINT32_LITTLE(d+4); d5 = LOAD_UINT32_LITTLE(d+5);
 502         d6 = LOAD_UINT32_LITTLE(d+6); d7 = LOAD_UINT32_LITTLE(d+7);
 503         k8 = *(k+8); k9 = *(k+9); k10 = *(k+10); k11 = *(k+11);
 504         k12 = *(k+12); k13 = *(k+13); k14 = *(k+14); k15 = *(k+15);
 505         k16 = *(k+16); k17 = *(k+17); k18 = *(k+18); k19 = *(k+19);
 506
 507         h1 += MUL64((k0 + d0), (k4 + d4));
 508         h2 += MUL64((k4 + d0), (k8 + d4));
 509         h3 += MUL64((k8 + d0), (k12 + d4));
 510         h4 += MUL64((k12 + d0), (k16 + d4));
 511
 512         h1 += MUL64((k1 + d1), (k5 + d5));
 513         h2 += MUL64((k5 + d1), (k9 + d5));
 514         h3 += MUL64((k9 + d1), (k13 + d5));
 515         h4 += MUL64((k13 + d1), (k17 + d5));
 516
 517         h1 += MUL64((k2 + d2), (k6 + d6));
 518         h2 += MUL64((k6 + d2), (k10 + d6));
 519         h3 += MUL64((k10 + d2), (k14 + d6));
 520         h4 += MUL64((k14 + d2), (k18 + d6));
 521
 522         h1 += MUL64((k3 + d3), (k7 + d7));
 523         h2 += MUL64((k7 + d3), (k11 + d7));
 524         h3 += MUL64((k11 + d3), (k15 + d7));
 525         h4 += MUL64((k15 + d3), (k19 + d7));
 526
 527         k0 = k8; k1 = k9; k2 = k10; k3 = k11;
 528         k4 = k12; k5 = k13; k6 = k14; k7 = k15;
 529         k8 = k16; k9 = k17; k10 = k18; k11 = k19;
 530
 531         d += 8;
 532         k += 8;
 533     } while (--c);
 534     ((UINT64 *)hp)[0] = h1;
 535     ((UINT64 *)hp)[1] = h2;
 536     ((UINT64 *)hp)[2] = h3;
 537     ((UINT64 *)hp)[3] = h4;
 538 }
 539
 540 /* ---------------------------------------------------------------------- */
 541 #endif  /* UMAC_OUTPUT_LENGTH */
 542 /* ---------------------------------------------------------------------- */
 543
 544
 545 /* ---------------------------------------------------------------------- */
 546
 547 static void nh_transform(nh_ctx *hc, UINT8 *buf, UINT32 nbytes)
 548 /* This function is a wrapper for the primitive NH hash functions. It takes
 549  * as argument "hc" the current hash context and a buffer which must be a
 550  * multiple of L1_PAD_BOUNDARY. The key passed to nh_aux is offset
 551  * appropriately according to how much message has been hashed already.
 552  */
 553 {
 554     UINT8 *key;
 555
 556     key = hc->nh_key + hc->bytes_hashed;
 557     nh_aux(key, buf, hc->state, nbytes);
 558 }
 559
 560 /* ---------------------------------------------------------------------- */
 561
 562 #if (__LITTLE_ENDIAN__)
 563 #define endian_convert_if_le(x,y,z) endian_convert((x),(y),(z))
 564 static void endian_convert(void *buf, UWORD bpw, UINT32 num_bytes)
 565 /* We endian convert the keys on little-endian computers to               */
 566 /* compensate for the lack of big-endian memory reads during hashing.     */
 567 {
 568     UWORD iters = num_bytes / bpw;
 569     if (bpw == 4) {
 570         UINT32 *p = (UINT32 *)buf;
 571         do {
 572             *p = LOAD_UINT32_REVERSED(p);
 573             p++;
 574         } while (--iters);
 575     } else if (bpw == 8) {
 576         UINT32 *p = (UINT32 *)buf;
 577         UINT32 t;
 578         do {
 579             t = LOAD_UINT32_REVERSED(p+1);
 580             p[1] = LOAD_UINT32_REVERSED(p);
 581             p[0] = t;
 582             p += 2;
 583         } while (--iters);
 584     }
 585 }
 586 #if (__LITTLE_ENDIAN__)
 587 #define endian_convert_if_le(x,y,z) endian_convert((x),(y),(z))
 588 #else
 589 #define endian_convert_if_le(x,y,z) do{}while(0)  /* Do nothing */
 590 #endif
 591
 592 /* ---------------------------------------------------------------------- */
 593
 594 static void nh_reset(nh_ctx *hc)
 595 /* Reset nh_ctx to ready for hashing of new data */
 596 {
 597     hc->bytes_hashed = 0;
 598     hc->next_data_empty = 0;
 599     hc->state[0] = 0;
 600 #if (UMAC_OUTPUT_LEN >= 8)
 601     hc->state[1] = 0;
 602 #endif
 603 #if (UMAC_OUTPUT_LEN >= 12)
 604     hc->state[2] = 0;
 605 #endif
 606 #if (UMAC_OUTPUT_LEN == 16)
 607     hc->state[3] = 0;
 608 #endif
 609
 610 }
 611
 612 /* ---------------------------------------------------------------------- */
 613
 614 static void nh_init(nh_ctx *hc, aes_int_key prf_key)
 615 /* Generate nh_key, endian convert and reset to be ready for hashing.   */
 616 {
 617     kdf(hc->nh_key, prf_key, 1, sizeof(hc->nh_key));
 618     endian_convert_if_le(hc->nh_key, 4, sizeof(hc->nh_key));
 619     nh_reset(hc);
 620 }
 621
 622 /* ---------------------------------------------------------------------- */
 623
 624 static void nh_update(nh_ctx *hc, UINT8 *buf, UINT32 nbytes)
 625 /* Incorporate nbytes of data into a nh_ctx, buffer whatever is not an    */
 626 /* even multiple of HASH_BUF_BYTES.                                       */
 627 {
 628     UINT32 i,j;
 629
 630     j = hc->next_data_empty;
 631     if ((j + nbytes) >= HASH_BUF_BYTES) {
 632         if (j) {
 633             i = HASH_BUF_BYTES - j;
 634             memcpy(hc->data+j, buf, i);
 635             nh_transform(hc,hc->data,HASH_BUF_BYTES);
 636             nbytes -= i;
 637             buf += i;
 638             hc->bytes_hashed += HASH_BUF_BYTES;
 639         }
 640         if (nbytes >= HASH_BUF_BYTES) {
 641             i = nbytes & ~(HASH_BUF_BYTES - 1);
 642             nh_transform(hc, buf, i);
 643             nbytes -= i;
 644             buf += i;
 645             hc->bytes_hashed += i;
 646         }
 647         j = 0;
 648     }
 649     memcpy(hc->data + j, buf, nbytes);
 650     hc->next_data_empty = j + nbytes;
 651 }
 652
 653 /* ---------------------------------------------------------------------- */
 654
 655 static void zero_pad(UINT8 *p, int nbytes)
 656 {
 657 /* Write "nbytes" of zeroes, beginning at "p" */
 658     if (nbytes >= (int)sizeof(UWORD)) {
 659         while ((ptrdiff_t)p % sizeof(UWORD)) {
 660             *p = 0;
 661             nbytes--;
 662             p++;
 663         }
 664         while (nbytes >= (int)sizeof(UWORD)) {
 665             *(UWORD *)p = 0;
 666             nbytes -= sizeof(UWORD);
 667             p += sizeof(UWORD);
 668         }
 669     }
 670     while (nbytes) {
 671         *p = 0;
 672         nbytes--;
 673         p++;
 674     }
 675 }
 676
 677 /* ---------------------------------------------------------------------- */
 678
 679 static void nh_final(nh_ctx *hc, UINT8 *result)
 680 /* After passing some number of data buffers to nh_update() for integration
 681  * into an NH context, nh_final is called to produce a hash result. If any
 682  * bytes are in the buffer hc->data, incorporate them into the
 683  * NH context. Finally, add into the NH accumulation "state" the total number
 684  * of bits hashed. The resulting numbers are written to the buffer "result".
 685  * If nh_update was never called, L1_PAD_BOUNDARY zeroes are incorporated.
 686  */
 687 {
 688     int nh_len, nbits;
 689
 690     if (hc->next_data_empty != 0) {
 691         nh_len = ((hc->next_data_empty + (L1_PAD_BOUNDARY - 1)) &
 692                                                 ~(L1_PAD_BOUNDARY - 1));
 693         zero_pad(hc->data + hc->next_data_empty,
 694                                           nh_len - hc->next_data_empty);
 695         nh_transform(hc, hc->data, nh_len);
 696         hc->bytes_hashed += hc->next_data_empty;
 697     } else if (hc->bytes_hashed == 0) {
 698         nh_len = L1_PAD_BOUNDARY;
 699         zero_pad(hc->data, L1_PAD_BOUNDARY);
 700         nh_transform(hc, hc->data, nh_len);
 701     }
 702
 703     nbits = (hc->bytes_hashed << 3);
 704     ((UINT64 *)result)[0] = ((UINT64 *)hc->state)[0] + nbits;
 705 #if (UMAC_OUTPUT_LEN >= 8)
 706     ((UINT64 *)result)[1] = ((UINT64 *)hc->state)[1] + nbits;
 707 #endif
 708 #if (UMAC_OUTPUT_LEN >= 12)
 709     ((UINT64 *)result)[2] = ((UINT64 *)hc->state)[2] + nbits;
 710 #endif
 711 #if (UMAC_OUTPUT_LEN == 16)
 712     ((UINT64 *)result)[3] = ((UINT64 *)hc->state)[3] + nbits;
 713 #endif
 714     nh_reset(hc);
 715 }
 716
 717 /* ---------------------------------------------------------------------- */
 718
 719 static void nh(nh_ctx *hc, UINT8 *buf, UINT32 padded_len,
 720                UINT32 unpadded_len, UINT8 *result)
 721 /* All-in-one nh_update() and nh_final() equivalent.
 722  * Assumes that padded_len is divisible by L1_PAD_BOUNDARY and result is
 723  * well aligned
 724  */
 725 {
 726     UINT32 nbits;
 727
 728     /* Initialize the hash state */
 729     nbits = (unpadded_len << 3);
 730
 731     ((UINT64 *)result)[0] = nbits;
 732 #if (UMAC_OUTPUT_LEN >= 8)
 733     ((UINT64 *)result)[1] = nbits;
 734 #endif
 735 #if (UMAC_OUTPUT_LEN >= 12)
 736     ((UINT64 *)result)[2] = nbits;
 737 #endif
 738 #if (UMAC_OUTPUT_LEN == 16)
 739     ((UINT64 *)result)[3] = nbits;
 740 #endif
 741
 742     nh_aux(hc->nh_key, buf, result, padded_len);
 743 }
 744
 745 /* ---------------------------------------------------------------------- */
 746 /* ---------------------------------------------------------------------- */
 747 /* ----- Begin UHASH Section -------------------------------------------- */
 748 /* ---------------------------------------------------------------------- */
 749 /* ---------------------------------------------------------------------- */
 750
 751 /* UHASH is a multi-layered algorithm. Data presented to UHASH is first
 752  * hashed by NH. The NH output is then hashed by a polynomial-hash layer
 753  * unless the initial data to be hashed is short. After the polynomial-
 754  * layer, an inner-product hash is used to produce the final UHASH output.
 755  *
 756  * UHASH provides two interfaces, one all-at-once and another where data
 757  * buffers are presented sequentially. In the sequential interface, the
 758  * UHASH client calls the routine uhash_update() as many times as necessary.
 759  * When there is no more data to be fed to UHASH, the client calls
 760  * uhash_final() which
 761  * calculates the UHASH output. Before beginning another UHASH calculation
 762  * the uhash_reset() routine must be called. The all-at-once UHASH routine,
 763  * uhash(), is equivalent to the sequence of calls uhash_update() and
 764  * uhash_final(); however it is optimized and should be
 765  * used whenever the sequential interface is not necessary.
 766  *
 767  * The routine uhash_init() initializes the uhash_ctx data structure and
 768  * must be called once, before any other UHASH routine.
 769  */
 770
 771 /* ---------------------------------------------------------------------- */
 772 /* ----- Constants and uhash_ctx ---------------------------------------- */
 773 /* ---------------------------------------------------------------------- */
 774
 775 /* ---------------------------------------------------------------------- */
 776 /* ----- Poly hash and Inner-Product hash Constants --------------------- */
 777 /* ---------------------------------------------------------------------- */
 778
 779 /* Primes and masks */
 780 #define p36    ((UINT64)0x0000000FFFFFFFFBull)              /* 2^36 -  5 */
 781 #define p64    ((UINT64)0xFFFFFFFFFFFFFFC5ull)              /* 2^64 - 59 */
 782 #define m36    ((UINT64)0x0000000FFFFFFFFFull)  /* The low 36 of 64 bits */
 783
 784
 785 /* ---------------------------------------------------------------------- */
 786
 787 typedef struct uhash_ctx {
 788     nh_ctx hash;                          /* Hash context for L1 NH hash  */
 789     UINT64 poly_key_8[STREAMS];           /* p64 poly keys                */
 790     UINT64 poly_accum[STREAMS];           /* poly hash result             */
 791     UINT64 ip_keys[STREAMS*4];            /* Inner-product keys           */
 792     UINT32 ip_trans[STREAMS];             /* Inner-product translation    */
 793     UINT32 msg_len;                       /* Total length of data passed  */
 794                                           /* to uhash */
 795 } uhash_ctx;
 796 typedef struct uhash_ctx *uhash_ctx_t;
 797
 798 /* ---------------------------------------------------------------------- */
 799
 800
 801 /* The polynomial hashes use Horner's rule to evaluate a polynomial one
 802  * word at a time. As described in the specification, poly32 and poly64
 803  * require keys from special domains. The following implementations exploit
 804  * the special domains to avoid overflow. The results are not guaranteed to
 805  * be within Z_p32 and Z_p64, but the Inner-Product hash implementation
 806  * patches any errant values.
 807  */
 808
 809 static UINT64 poly64(UINT64 cur, UINT64 key, UINT64 data)
 810 {
 811     UINT32 key_hi = (UINT32)(key >> 32),
 812            key_lo = (UINT32)key,
 813            cur_hi = (UINT32)(cur >> 32),
 814            cur_lo = (UINT32)cur,
 815            x_lo,
 816            x_hi;
 817     UINT64 X,T,res;
 818
 819     X =  MUL64(key_hi, cur_lo) + MUL64(cur_hi, key_lo);
 820     x_lo = (UINT32)X;
 821     x_hi = (UINT32)(X >> 32);
 822
 823     res = (MUL64(key_hi, cur_hi) + x_hi) * 59 + MUL64(key_lo, cur_lo);
 824
 825     T = ((UINT64)x_lo << 32);
 826     res += T;
 827     if (res < T)
 828         res += 59;
 829
 830     res += data;
 831     if (res < data)
 832         res += 59;
 833
 834     return res;
 835 }
 836
 837
 838 /* Although UMAC is specified to use a ramped polynomial hash scheme, this
 839  * implementation does not handle all ramp levels. Because we don't handle
 840  * the ramp up to p128 modulus in this implementation, we are limited to
 841  * 2^14 poly_hash() invocations per stream (for a total capacity of 2^24
 842  * bytes input to UMAC per tag, ie. 16MB).
 843  */
 844 static void poly_hash(uhash_ctx_t hc, UINT32 data_in[])
 845 {
 846     int i;
 847     UINT64 *data=(UINT64*)data_in;
 848
 849     for (i = 0; i < STREAMS; i++) {
 850         if ((UINT32)(data[i] >> 32) == 0xfffffffful) {
 851             hc->poly_accum[i] = poly64(hc->poly_accum[i],
 852                                        hc->poly_key_8[i], p64 - 1);
 853             hc->poly_accum[i] = poly64(hc->poly_accum[i],
 854                                        hc->poly_key_8[i], (data[i] - 59));
 855         } else {
 856             hc->poly_accum[i] = poly64(hc->poly_accum[i],
 857                                        hc->poly_key_8[i], data[i]);
 858         }
 859     }
 860 }
 861
 862
 863 /* ---------------------------------------------------------------------- */
 864
 865
 866 /* The final step in UHASH is an inner-product hash. The poly hash
 867  * produces a result not neccesarily WORD_LEN bytes long. The inner-
 868  * product hash breaks the polyhash output into 16-bit chunks and
 869  * multiplies each with a 36 bit key.
 870  */
 871
 872 static UINT64 ip_aux(UINT64 t, UINT64 *ipkp, UINT64 data)
 873 {
 874     t = t + ipkp[0] * (UINT64)(UINT16)(data >> 48);
 875     t = t + ipkp[1] * (UINT64)(UINT16)(data >> 32);
 876     t = t + ipkp[2] * (UINT64)(UINT16)(data >> 16);
 877     t = t + ipkp[3] * (UINT64)(UINT16)(data);
 878
 879     return t;
 880 }
 881
 882 static UINT32 ip_reduce_p36(UINT64 t)
 883 {
 884 /* Divisionless modular reduction */
 885     UINT64 ret;
 886
 887     ret = (t & m36) + 5 * (t >> 36);
 888     if (ret >= p36)
 889         ret -= p36;
 890
 891     /* return least significant 32 bits */
 892     return (UINT32)(ret);
 893 }
 894
 895
 896 /* If the data being hashed by UHASH is no longer than L1_KEY_LEN, then
 897  * the polyhash stage is skipped and ip_short is applied directly to the
 898  * NH output.
 899  */
 900 static void ip_short(uhash_ctx_t ahc, UINT8 *nh_res, u_char *res)
 901 {
 902     UINT64 t;
 903     UINT64 *nhp = (UINT64 *)nh_res;
 904
 905     t  = ip_aux(0,ahc->ip_keys, nhp[0]);
 906     STORE_UINT32_BIG((UINT32 *)res+0, ip_reduce_p36(t) ^ ahc->ip_trans[0]);
 907 #if (UMAC_OUTPUT_LEN >= 8)
 908     t  = ip_aux(0,ahc->ip_keys+4, nhp[1]);
 909     STORE_UINT32_BIG((UINT32 *)res+1, ip_reduce_p36(t) ^ ahc->ip_trans[1]);
 910 #endif
 911 #if (UMAC_OUTPUT_LEN >= 12)
 912     t  = ip_aux(0,ahc->ip_keys+8, nhp[2]);
 913     STORE_UINT32_BIG((UINT32 *)res+2, ip_reduce_p36(t) ^ ahc->ip_trans[2]);
 914 #endif
 915 #if (UMAC_OUTPUT_LEN == 16)
 916     t  = ip_aux(0,ahc->ip_keys+12, nhp[3]);
 917     STORE_UINT32_BIG((UINT32 *)res+3, ip_reduce_p36(t) ^ ahc->ip_trans[3]);
 918 #endif
 919 }
 920
 921 /* If the data being hashed by UHASH is longer than L1_KEY_LEN, then
 922  * the polyhash stage is not skipped and ip_long is applied to the
 923  * polyhash output.
 924  */
 925 static void ip_long(uhash_ctx_t ahc, u_char *res)
 926 {
 927     int i;
 928     UINT64 t;
 929
 930     for (i = 0; i < STREAMS; i++) {
 931         /* fix polyhash output not in Z_p64 */
 932         if (ahc->poly_accum[i] >= p64)
 933             ahc->poly_accum[i] -= p64;
 934         t  = ip_aux(0,ahc->ip_keys+(i*4), ahc->poly_accum[i]);
 935         STORE_UINT32_BIG((UINT32 *)res+i,
 936                          ip_reduce_p36(t) ^ ahc->ip_trans[i]);
 937     }
 938 }
 939
 940
 941 /* ---------------------------------------------------------------------- */
 942
 943 /* ---------------------------------------------------------------------- */
 944
 945 /* Reset uhash context for next hash session */
 946 static int uhash_reset(uhash_ctx_t pc)
 947 {
 948     nh_reset(&pc->hash);
 949     pc->msg_len = 0;
 950     pc->poly_accum[0] = 1;
 951 #if (UMAC_OUTPUT_LEN >= 8)
 952     pc->poly_accum[1] = 1;
 953 #endif
 954 #if (UMAC_OUTPUT_LEN >= 12)
 955     pc->poly_accum[2] = 1;
 956 #endif
 957 #if (UMAC_OUTPUT_LEN == 16)
 958     pc->poly_accum[3] = 1;
 959 #endif
 960     return 1;
 961 }
 962
 963 /* ---------------------------------------------------------------------- */
 964
 965 /* Given a pointer to the internal key needed by kdf() and a uhash context,
 966  * initialize the NH context and generate keys needed for poly and inner-
 967  * product hashing. All keys are endian adjusted in memory so that native
 968  * loads cause correct keys to be in registers during calculation.
 969  */
 970 static void uhash_init(uhash_ctx_t ahc, aes_int_key prf_key)
 971 {
 972     int i;
 973     UINT8 buf[(8*STREAMS+4)*sizeof(UINT64)];
 974
 975     /* Zero the entire uhash context */
 976     memset(ahc, 0, sizeof(uhash_ctx));
 977
 978     /* Initialize the L1 hash */
 979     nh_init(&ahc->hash, prf_key);
 980
 981     /* Setup L2 hash variables */
 982     kdf(buf, prf_key, 2, sizeof(buf));    /* Fill buffer with index 1 key */
 983     for (i = 0; i < STREAMS; i++) {
 984         /* Fill keys from the buffer, skipping bytes in the buffer not
 985          * used by this implementation. Endian reverse the keys if on a
 986          * little-endian computer.
 987          */
 988         memcpy(ahc->poly_key_8+i, buf+24*i, 8);
 989         endian_convert_if_le(ahc->poly_key_8+i, 8, 8);
 990         /* Mask the 64-bit keys to their special domain */
 991         ahc->poly_key_8[i] &= ((UINT64)0x01ffffffu << 32) + 0x01ffffffu;
 992         ahc->poly_accum[i] = 1;  /* Our polyhash prepends a non-zero word */
 993     }
 994
 995     /* Setup L3-1 hash variables */
 996     kdf(buf, prf_key, 3, sizeof(buf)); /* Fill buffer with index 2 key */
 997     for (i = 0; i < STREAMS; i++)
 998           memcpy(ahc->ip_keys+4*i, buf+(8*i+4)*sizeof(UINT64),
 999                                                  4*sizeof(UINT64));
1000     endian_convert_if_le(ahc->ip_keys, sizeof(UINT64),
1001                                                   sizeof(ahc->ip_keys));
1002     for (i = 0; i < STREAMS*4; i++)
1003         ahc->ip_keys[i] %= p36;  /* Bring into Z_p36 */
1004
1005     /* Setup L3-2 hash variables    */
1006     /* Fill buffer with index 4 key */
1007     kdf(ahc->ip_trans, prf_key, 4, STREAMS * sizeof(UINT32));
1008     endian_convert_if_le(ahc->ip_trans, sizeof(UINT32),
1009                          STREAMS * sizeof(UINT32));
1010 }
1011
1012 /* ---------------------------------------------------------------------- */
1013
1014 #if 0
1015 static uhash_ctx_t uhash_alloc(u_char key[])
1016 {
1017 /* Allocate memory and force to a 16-byte boundary. */
1018     uhash_ctx_t ctx;
1019     u_char bytes_to_add;
1020     aes_int_key prf_key;
1021
1022     ctx = (uhash_ctx_t)malloc(sizeof(uhash_ctx)+ALLOC_BOUNDARY);
1023     if (ctx) {
1024         if (ALLOC_BOUNDARY) {
1025             bytes_to_add = ALLOC_BOUNDARY -
1026                               ((ptrdiff_t)ctx & (ALLOC_BOUNDARY -1));
1027             ctx = (uhash_ctx_t)((u_char *)ctx + bytes_to_add);
1028             *((u_char *)ctx - 1) = bytes_to_add;
1029         }
1030         aes_key_setup(key,prf_key);
1031         uhash_init(ctx, prf_key);
1032     }
1033     return (ctx);
1034 }
1035 #endif
1036
1037 /* ---------------------------------------------------------------------- */
1038
1039 #if 0
1040 static int uhash_free(uhash_ctx_t ctx)
1041 {
1042 /* Free memory allocated by uhash_alloc */
1043     u_char bytes_to_sub;
1044
1045     if (ctx) {
1046         if (ALLOC_BOUNDARY) {
1047             bytes_to_sub = *((u_char *)ctx - 1);
1048             ctx = (uhash_ctx_t)((u_char *)ctx - bytes_to_sub);
1049         }
1050         free(ctx);
1051     }
1052     return (1);
1053 }
1054 #endif
1055 /* ---------------------------------------------------------------------- */
1056
1057 static int uhash_update(uhash_ctx_t ctx, u_char *input, long len)
1058 /* Given len bytes of data, we parse it into L1_KEY_LEN chunks and
1059  * hash each one with NH, calling the polyhash on each NH output.
1060  */
1061 {
1062     UWORD bytes_hashed, bytes_remaining;
1063     UINT64 result_buf[STREAMS];
1064     UINT8 *nh_result = (UINT8 *)&result_buf;
1065
1066     if (ctx->msg_len + len <= L1_KEY_LEN) {
1067         nh_update(&ctx->hash, (UINT8 *)input, len);
1068         ctx->msg_len += len;
1069     } else {
1070
1071          bytes_hashed = ctx->msg_len % L1_KEY_LEN;
1072          if (ctx->msg_len == L1_KEY_LEN)
1073              bytes_hashed = L1_KEY_LEN;
1074
1075          if (bytes_hashed + len >= L1_KEY_LEN) {
1076
1077              /* If some bytes have been passed to the hash function      */
1078              /* then we want to pass at most (L1_KEY_LEN - bytes_hashed) */
1079              /* bytes to complete the current nh_block.                  */
1080              if (bytes_hashed) {
1081                  bytes_remaining = (L1_KEY_LEN - bytes_hashed);
1082                  nh_update(&ctx->hash, (UINT8 *)input, bytes_remaining);
1083                  nh_final(&ctx->hash, nh_result);
1084                  ctx->msg_len += bytes_remaining;
1085                  poly_hash(ctx,(UINT32 *)nh_result);
1086                  len -= bytes_remaining;
1087                  input += bytes_remaining;
1088              }
1089
1090              /* Hash directly from input stream if enough bytes */
1091              while (len >= L1_KEY_LEN) {
1092                  nh(&ctx->hash, (UINT8 *)input, L1_KEY_LEN,
1093                                    L1_KEY_LEN, nh_result);
1094                  ctx->msg_len += L1_KEY_LEN;
1095                  len -= L1_KEY_LEN;
1096                  input += L1_KEY_LEN;
1097                  poly_hash(ctx,(UINT32 *)nh_result);
1098              }
1099          }
1100
1101          /* pass remaining < L1_KEY_LEN bytes of input data to NH */
1102          if (len) {
1103              nh_update(&ctx->hash, (UINT8 *)input, len);
1104              ctx->msg_len += len;
1105          }
1106      }
1107
1108     return (1);
1109 }
1110
1111 /* ---------------------------------------------------------------------- */
1112
1113 static int uhash_final(uhash_ctx_t ctx, u_char *res)
1114 /* Incorporate any pending data, pad, and generate tag */
1115 {
1116     UINT64 result_buf[STREAMS];
1117     UINT8 *nh_result = (UINT8 *)&result_buf;
1118
1119     if (ctx->msg_len > L1_KEY_LEN) {
1120         if (ctx->msg_len % L1_KEY_LEN) {
1121             nh_final(&ctx->hash, nh_result);
1122             poly_hash(ctx,(UINT32 *)nh_result);
1123         }
1124         ip_long(ctx, res);
1125     } else {
1126         nh_final(&ctx->hash, nh_result);
1127         ip_short(ctx,nh_result, res);
1128     }
1129     uhash_reset(ctx);
1130     return (1);
1131 }
1132
1133 /* ---------------------------------------------------------------------- */
1134
1135 #if 0
1136 static int uhash(uhash_ctx_t ahc, u_char *msg, long len, u_char *res)
1137 /* assumes that msg is in a writable buffer of length divisible by */
1138 /* L1_PAD_BOUNDARY. Bytes beyond msg[len] may be zeroed.           */
1139 {
1140     UINT8 nh_result[STREAMS*sizeof(UINT64)];
1141     UINT32 nh_len;
1142     int extra_zeroes_needed;
1143
1144     /* If the message to be hashed is no longer than L1_HASH_LEN, we skip
1145      * the polyhash.
1146      */
1147     if (len <= L1_KEY_LEN) {
1148         if (len == 0)                  /* If zero length messages will not */
1149                 nh_len = L1_PAD_BOUNDARY;  /* be seen, comment out this case   */
1150         else
1151                 nh_len = ((len + (L1_PAD_BOUNDARY - 1)) & ~(L1_PAD_BOUNDARY - 1));
1152         extra_zeroes_needed = nh_len - len;
1153         zero_pad((UINT8 *)msg + len, extra_zeroes_needed);
1154         nh(&ahc->hash, (UINT8 *)msg, nh_len, len, nh_result);
1155         ip_short(ahc,nh_result, res);
1156     } else {
1157         /* Otherwise, we hash each L1_KEY_LEN chunk with NH, passing the NH
1158          * output to poly_hash().
1159          */
1160         do {
1161             nh(&ahc->hash, (UINT8 *)msg, L1_KEY_LEN, L1_KEY_LEN, nh_result);
1162             poly_hash(ahc,(UINT32 *)nh_result);
1163             len -= L1_KEY_LEN;
1164             msg += L1_KEY_LEN;
1165         } while (len >= L1_KEY_LEN);
1166         if (len) {
1167             nh_len = ((len + (L1_PAD_BOUNDARY - 1)) & ~(L1_PAD_BOUNDARY - 1));
1168             extra_zeroes_needed = nh_len - len;
1169             zero_pad((UINT8 *)msg + len, extra_zeroes_needed);
1170             nh(&ahc->hash, (UINT8 *)msg, nh_len, len, nh_result);
1171             poly_hash(ahc,(UINT32 *)nh_result);
1172         }
1173
1174         ip_long(ahc, res);
1175     }
1176
1177     uhash_reset(ahc);
1178     return 1;
1179 }
1180 #endif
1181
1182 /* ---------------------------------------------------------------------- */
1183 /* ---------------------------------------------------------------------- */
1184 /* ----- Begin UMAC Section --------------------------------------------- */
1185 /* ---------------------------------------------------------------------- */
1186 /* ---------------------------------------------------------------------- */
1187
1188 /* The UMAC interface has two interfaces, an all-at-once interface where
1189  * the entire message to be authenticated is passed to UMAC in one buffer,
1190  * and a sequential interface where the message is presented a little at a
1191  * time. The all-at-once is more optimaized than the sequential version and
1192  * should be preferred when the sequential interface is not required.
1193  */
1194 struct umac_ctx {
1195     uhash_ctx hash;          /* Hash function for message compression    */
1196     pdf_ctx pdf;             /* PDF for hashed output                    */
1197     void *free_ptr;          /* Address to free this struct via          */
1198 } umac_ctx;
1199
1200 /* ---------------------------------------------------------------------- */
1201
1202 #if 0
1203 int umac_reset(struct umac_ctx *ctx)
1204 /* Reset the hash function to begin a new authentication.        */
1205 {
1206     uhash_reset(&ctx->hash);
1207     return (1);
1208 }
1209 #endif
1210
1211 /* ---------------------------------------------------------------------- */
1212
1213 int umac_delete(struct umac_ctx *ctx)
1214 /* Deallocate the ctx structure */
1215 {
1216     if (ctx) {
1217         if (ALLOC_BOUNDARY)
1218             ctx = (struct umac_ctx *)ctx->free_ptr;
1219         xfree(ctx);
1220     }
1221     return (1);
1222 }
1223
1224 /* ---------------------------------------------------------------------- */
1225
1226 struct umac_ctx *umac_new(u_char key[])
1227 /* Dynamically allocate a umac_ctx struct, initialize variables,
1228  * generate subkeys from key. Align to 16-byte boundary.
1229  */
1230 {
1231     struct umac_ctx *ctx, *octx;
1232     size_t bytes_to_add;
1233     aes_int_key prf_key;
1234
1235     octx = ctx = xmalloc(sizeof(*ctx) + ALLOC_BOUNDARY);
1236     if (ctx) {
1237         if (ALLOC_BOUNDARY) {
1238             bytes_to_add = ALLOC_BOUNDARY -
1239                               ((ptrdiff_t)ctx & (ALLOC_BOUNDARY - 1));
1240             ctx = (struct umac_ctx *)((u_char *)ctx + bytes_to_add);
1241         }
1242         ctx->free_ptr = octx;
1243         aes_key_setup(key,prf_key);
1244         pdf_init(&ctx->pdf, prf_key);
1245         uhash_init(&ctx->hash, prf_key);
1246     }
1247
1248     return (ctx);
1249 }
1250
1251 /* ---------------------------------------------------------------------- */
1252
1253 int umac_final(struct umac_ctx *ctx, u_char tag[], u_char nonce[8])
1254 /* Incorporate any pending data, pad, and generate tag */
1255 {
1256     uhash_final(&ctx->hash, (u_char *)tag);
1257     pdf_gen_xor(&ctx->pdf, (UINT8 *)nonce, (UINT8 *)tag);
1258
1259     return (1);
1260 }
1261
1262 /* ---------------------------------------------------------------------- */
1263
1264 int umac_update(struct umac_ctx *ctx, u_char *input, long len)
1265 /* Given len bytes of data, we parse it into L1_KEY_LEN chunks and   */
1266 /* hash each one, calling the PDF on the hashed output whenever the hash- */
1267 /* output buffer is full.                                                 */
1268 {
1269     uhash_update(&ctx->hash, input, len);
1270     return (1);
1271 }
1272
1273 /* ---------------------------------------------------------------------- */
1274
1275 #if 0
1276 int umac(struct umac_ctx *ctx, u_char *input,
1277          long len, u_char tag[],
1278          u_char nonce[8])
1279 /* All-in-one version simply calls umac_update() and umac_final().        */
1280 {
1281     uhash(&ctx->hash, input, len, (u_char *)tag);
1282     pdf_gen_xor(&ctx->pdf, (UINT8 *)nonce, (UINT8 *)tag);
1283
1284     return (1);
1285 }
1286 #endif
1287
1288 /* ---------------------------------------------------------------------- */
1289 /* ---------------------------------------------------------------------- */
1290 /* ----- End UMAC Section ----------------------------------------------- */
1291 /* ---------------------------------------------------------------------- */
1292 /* ---------------------------------------------------------------------- */