mirror of
https://github.com/restic/restic.git
synced 2024-08-21 11:53:22 +02:00
188 lines
4.2 KiB
Go
188 lines
4.2 KiB
Go
|
// Copyright 2016 The Go Authors. All rights reserved.
|
||
|
// Use of this source code is governed by a BSD-style
|
||
|
// license that can be found in the LICENSE file.
|
||
|
|
||
|
// Package blake2s implements the BLAKE2s hash algorithm defined by RFC 7693
|
||
|
// and the extendable output function (XOF) BLAKE2Xs.
|
||
|
//
|
||
|
// For a detailed specification of BLAKE2s see https://blake2.net/blake2.pdf
|
||
|
// and for BLAKE2Xs see https://blake2.net/blake2x.pdf
|
||
|
//
|
||
|
// If you aren't sure which function you need, use BLAKE2s (Sum256 or New256).
|
||
|
// If you need a secret-key MAC (message authentication code), use the New256
|
||
|
// function with a non-nil key.
|
||
|
//
|
||
|
// BLAKE2X is a construction to compute hash values larger than 32 bytes. It
|
||
|
// can produce hash values between 0 and 65535 bytes.
|
||
|
package blake2s // import "golang.org/x/crypto/blake2s"
|
||
|
|
||
|
import (
|
||
|
"encoding/binary"
|
||
|
"errors"
|
||
|
"hash"
|
||
|
)
|
||
|
|
||
|
const (
|
||
|
// The blocksize of BLAKE2s in bytes.
|
||
|
BlockSize = 64
|
||
|
|
||
|
// The hash size of BLAKE2s-256 in bytes.
|
||
|
Size = 32
|
||
|
|
||
|
// The hash size of BLAKE2s-128 in bytes.
|
||
|
Size128 = 16
|
||
|
)
|
||
|
|
||
|
var errKeySize = errors.New("blake2s: invalid key size")
|
||
|
|
||
|
var iv = [8]uint32{
|
||
|
0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
|
||
|
0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
|
||
|
}
|
||
|
|
||
|
// Sum256 returns the BLAKE2s-256 checksum of the data.
|
||
|
func Sum256(data []byte) [Size]byte {
|
||
|
var sum [Size]byte
|
||
|
checkSum(&sum, Size, data)
|
||
|
return sum
|
||
|
}
|
||
|
|
||
|
// New256 returns a new hash.Hash computing the BLAKE2s-256 checksum. A non-nil
|
||
|
// key turns the hash into a MAC. The key must between zero and 32 bytes long.
|
||
|
func New256(key []byte) (hash.Hash, error) { return newDigest(Size, key) }
|
||
|
|
||
|
// New128 returns a new hash.Hash computing the BLAKE2s-128 checksum given a
|
||
|
// non-empty key. Note that a 128-bit digest is too small to be secure as a
|
||
|
// cryptographic hash and should only be used as a MAC, thus the key argument
|
||
|
// is not optional.
|
||
|
func New128(key []byte) (hash.Hash, error) {
|
||
|
if len(key) == 0 {
|
||
|
return nil, errors.New("blake2s: a key is required for a 128-bit hash")
|
||
|
}
|
||
|
return newDigest(Size128, key)
|
||
|
}
|
||
|
|
||
|
func newDigest(hashSize int, key []byte) (*digest, error) {
|
||
|
if len(key) > Size {
|
||
|
return nil, errKeySize
|
||
|
}
|
||
|
d := &digest{
|
||
|
size: hashSize,
|
||
|
keyLen: len(key),
|
||
|
}
|
||
|
copy(d.key[:], key)
|
||
|
d.Reset()
|
||
|
return d, nil
|
||
|
}
|
||
|
|
||
|
func checkSum(sum *[Size]byte, hashSize int, data []byte) {
|
||
|
var (
|
||
|
h [8]uint32
|
||
|
c [2]uint32
|
||
|
)
|
||
|
|
||
|
h = iv
|
||
|
h[0] ^= uint32(hashSize) | (1 << 16) | (1 << 24)
|
||
|
|
||
|
if length := len(data); length > BlockSize {
|
||
|
n := length &^ (BlockSize - 1)
|
||
|
if length == n {
|
||
|
n -= BlockSize
|
||
|
}
|
||
|
hashBlocks(&h, &c, 0, data[:n])
|
||
|
data = data[n:]
|
||
|
}
|
||
|
|
||
|
var block [BlockSize]byte
|
||
|
offset := copy(block[:], data)
|
||
|
remaining := uint32(BlockSize - offset)
|
||
|
|
||
|
if c[0] < remaining {
|
||
|
c[1]--
|
||
|
}
|
||
|
c[0] -= remaining
|
||
|
|
||
|
hashBlocks(&h, &c, 0xFFFFFFFF, block[:])
|
||
|
|
||
|
for i, v := range h {
|
||
|
binary.LittleEndian.PutUint32(sum[4*i:], v)
|
||
|
}
|
||
|
}
|
||
|
|
||
|
type digest struct {
|
||
|
h [8]uint32
|
||
|
c [2]uint32
|
||
|
size int
|
||
|
block [BlockSize]byte
|
||
|
offset int
|
||
|
|
||
|
key [BlockSize]byte
|
||
|
keyLen int
|
||
|
}
|
||
|
|
||
|
func (d *digest) BlockSize() int { return BlockSize }
|
||
|
|
||
|
func (d *digest) Size() int { return d.size }
|
||
|
|
||
|
func (d *digest) Reset() {
|
||
|
d.h = iv
|
||
|
d.h[0] ^= uint32(d.size) | (uint32(d.keyLen) << 8) | (1 << 16) | (1 << 24)
|
||
|
d.offset, d.c[0], d.c[1] = 0, 0, 0
|
||
|
if d.keyLen > 0 {
|
||
|
d.block = d.key
|
||
|
d.offset = BlockSize
|
||
|
}
|
||
|
}
|
||
|
|
||
|
func (d *digest) Write(p []byte) (n int, err error) {
|
||
|
n = len(p)
|
||
|
|
||
|
if d.offset > 0 {
|
||
|
remaining := BlockSize - d.offset
|
||
|
if n <= remaining {
|
||
|
d.offset += copy(d.block[d.offset:], p)
|
||
|
return
|
||
|
}
|
||
|
copy(d.block[d.offset:], p[:remaining])
|
||
|
hashBlocks(&d.h, &d.c, 0, d.block[:])
|
||
|
d.offset = 0
|
||
|
p = p[remaining:]
|
||
|
}
|
||
|
|
||
|
if length := len(p); length > BlockSize {
|
||
|
nn := length &^ (BlockSize - 1)
|
||
|
if length == nn {
|
||
|
nn -= BlockSize
|
||
|
}
|
||
|
hashBlocks(&d.h, &d.c, 0, p[:nn])
|
||
|
p = p[nn:]
|
||
|
}
|
||
|
|
||
|
d.offset += copy(d.block[:], p)
|
||
|
return
|
||
|
}
|
||
|
|
||
|
func (d *digest) Sum(sum []byte) []byte {
|
||
|
var hash [Size]byte
|
||
|
d.finalize(&hash)
|
||
|
return append(sum, hash[:d.size]...)
|
||
|
}
|
||
|
|
||
|
func (d *digest) finalize(hash *[Size]byte) {
|
||
|
var block [BlockSize]byte
|
||
|
h := d.h
|
||
|
c := d.c
|
||
|
|
||
|
copy(block[:], d.block[:d.offset])
|
||
|
remaining := uint32(BlockSize - d.offset)
|
||
|
if c[0] < remaining {
|
||
|
c[1]--
|
||
|
}
|
||
|
c[0] -= remaining
|
||
|
|
||
|
hashBlocks(&h, &c, 0xFFFFFFFF, block[:])
|
||
|
for i, v := range h {
|
||
|
binary.LittleEndian.PutUint32(hash[4*i:], v)
|
||
|
}
|
||
|
}
|