Botan  1.10.16
bmw_512.cpp
Go to the documentation of this file.
1 /*
2 * Blue Midnight Wish 512 (Round 2 tweaked)
3 * (C) 2009 Jack Lloyd
4 *
5 * Distributed under the terms of the Botan license
6 */
7 
8 #include <botan/bmw_512.h>
9 #include <botan/loadstor.h>
10 #include <botan/rotate.h>
11 
12 namespace Botan {
13 
14 namespace {
15 
16 inline u64bit S0(u64bit X)
17  {
18  return (X >> 1) ^ (X << 3) ^ rotate_left(X, 4) ^ rotate_left(X, 37);
19  }
20 
21 inline u64bit S1(u64bit X)
22  {
23  return (X >> 1) ^ (X << 2) ^ rotate_left(X, 13) ^ rotate_left(X, 43);
24  }
25 
26 inline u64bit S2(u64bit X)
27  {
28  return (X >> 2) ^ (X << 1) ^ rotate_left(X, 19) ^ rotate_left(X, 53);
29  }
30 
31 inline u64bit S3(u64bit X)
32  {
33  return (X >> 2) ^ (X << 2) ^ rotate_left(X, 28) ^ rotate_left(X, 59);
34  }
35 
36 inline u64bit S4(u64bit X)
37  {
38  return (X >> 1) ^ X;
39  }
40 
41 /**
42 * Blue Midnight Wish 512 compression function
43 */
44 void BMW_512_compress(u64bit H[16], const u64bit M[16], u64bit Q[32])
45  {
46  const size_t EXPAND_1_ROUNDS = 2;
47 
48  for(size_t i = 0; i != 16; ++i)
49  Q[i] = H[i] ^ M[i];
50 
51  Q[16] = Q[ 5] - Q[ 7] + Q[10] + Q[13] + Q[14];
52  Q[17] = Q[ 6] - Q[ 8] + Q[11] + Q[14] - Q[15];
53  Q[18] = Q[ 0] + Q[ 7] + Q[ 9] - Q[12] + Q[15];
54  Q[19] = Q[ 0] - Q[ 1] + Q[ 8] - Q[10] + Q[13];
55  Q[20] = Q[ 1] + Q[ 2] + Q[ 9] - Q[11] - Q[14];
56  Q[21] = Q[ 3] - Q[ 2] + Q[10] - Q[12] + Q[15];
57  Q[22] = Q[ 4] - Q[ 0] - Q[ 3] - Q[11] + Q[13];
58  Q[23] = Q[ 1] - Q[ 4] - Q[ 5] - Q[12] - Q[14];
59  Q[24] = Q[ 2] - Q[ 5] - Q[ 6] + Q[13] - Q[15];
60  Q[25] = Q[ 0] - Q[ 3] + Q[ 6] - Q[ 7] + Q[14];
61  Q[26] = Q[ 8] - Q[ 1] - Q[ 4] - Q[ 7] + Q[15];
62  Q[27] = Q[ 8] - Q[ 0] - Q[ 2] - Q[ 5] + Q[ 9];
63  Q[28] = Q[ 1] + Q[ 3] - Q[ 6] - Q[ 9] + Q[10];
64  Q[29] = Q[ 2] + Q[ 4] + Q[ 7] + Q[10] + Q[11];
65  Q[30] = Q[ 3] - Q[ 5] + Q[ 8] - Q[11] - Q[12];
66  Q[31] = Q[12] - Q[ 4] - Q[ 6] - Q[ 9] + Q[13];
67 
68  Q[ 0] = S0(Q[16]) + H[ 1];
69  Q[ 1] = S1(Q[17]) + H[ 2];
70  Q[ 2] = S2(Q[18]) + H[ 3];
71  Q[ 3] = S3(Q[19]) + H[ 4];
72  Q[ 4] = S4(Q[20]) + H[ 5];
73  Q[ 5] = S0(Q[21]) + H[ 6];
74  Q[ 6] = S1(Q[22]) + H[ 7];
75  Q[ 7] = S2(Q[23]) + H[ 8];
76  Q[ 8] = S3(Q[24]) + H[ 9];
77  Q[ 9] = S4(Q[25]) + H[10];
78  Q[10] = S0(Q[26]) + H[11];
79  Q[11] = S1(Q[27]) + H[12];
80  Q[12] = S2(Q[28]) + H[13];
81  Q[13] = S3(Q[29]) + H[14];
82  Q[14] = S4(Q[30]) + H[15];
83  Q[15] = S0(Q[31]) + H[ 0];
84 
85  static const u64bit x55 = 0x0555555555555555;
86 
87  for(size_t i = 16; i != 16 + EXPAND_1_ROUNDS; ++i)
88  {
89  Q[i] = S1(Q[i-16]) + S2(Q[i-15]) + S3(Q[i-14]) + S0(Q[i-13]) +
90  S1(Q[i-12]) + S2(Q[i-11]) + S3(Q[i-10]) + S0(Q[i- 9]) +
91  S1(Q[i- 8]) + S2(Q[i- 7]) + S3(Q[i- 6]) + S0(Q[i- 5]) +
92  S1(Q[i- 4]) + S2(Q[i- 3]) + S3(Q[i- 2]) + S0(Q[i- 1]) +
93  ((rotate_left(M[(i-16) % 16], ((i-16)%16) + 1) +
94  rotate_left(M[(i-13) % 16], ((i-13)%16) + 1) -
95  rotate_left(M[(i- 6) % 16], ((i-6)%16) + 1) +
96  (x55 * i)) ^ H[(i-16+7)%16]);
97  }
98 
99  for(size_t i = 16 + EXPAND_1_ROUNDS; i != 32; ++i)
100  {
101  Q[i] = Q[i-16] + rotate_left(Q[i-15], 5) +
102  Q[i-14] + rotate_left(Q[i-13], 11) +
103  Q[i-12] + rotate_left(Q[i-11], 27) +
104  Q[i-10] + rotate_left(Q[i- 9], 32) +
105  Q[i- 8] + rotate_left(Q[i- 7], 37) +
106  Q[i- 6] + rotate_left(Q[i- 5], 43) +
107  Q[i- 4] + rotate_left(Q[i- 3], 53) +
108  S4(Q[i - 2]) + ((Q[i-1] >> 2) ^ Q[i-1]) +
109  ((rotate_left(M[(i-16) % 16], ((i-16)%16 + 1)) +
110  rotate_left(M[(i-13) % 16], ((i-13)%16 + 1)) -
111  rotate_left(M[(i- 6) % 16], ((i-6)%16 + 1)) +
112  (x55 * i)) ^ H[(i-16+7)%16]);
113  }
114 
115  u64bit XL = Q[16] ^ Q[17] ^ Q[18] ^ Q[19] ^
116  Q[20] ^ Q[21] ^ Q[22] ^ Q[23];
117 
118  u64bit XH = Q[24] ^ Q[25] ^ Q[26] ^ Q[27] ^
119  Q[28] ^ Q[29] ^ Q[30] ^ Q[31];
120 
121  XH ^= XL;
122 
123  H[ 0] = ((XH << 5) ^ (Q[16] >> 5) ^ M[0]) + (XL ^ Q[24] ^ Q[0]);
124  H[ 1] = ((XH >> 7) ^ (Q[17] << 8) ^ M[1]) + (XL ^ Q[25] ^ Q[1]);
125  H[ 2] = ((XH >> 5) ^ (Q[18] << 5) ^ M[2]) + (XL ^ Q[26] ^ Q[2]);
126  H[ 3] = ((XH >> 1) ^ (Q[19] << 5) ^ M[3]) + (XL ^ Q[27] ^ Q[3]);
127  H[ 4] = ((XH >> 3) ^ (Q[20] ) ^ M[4]) + (XL ^ Q[28] ^ Q[4]);
128  H[ 5] = ((XH << 6) ^ (Q[21] >> 6) ^ M[5]) + (XL ^ Q[29] ^ Q[5]);
129  H[ 6] = ((XH >> 4) ^ (Q[22] << 6) ^ M[6]) + (XL ^ Q[30] ^ Q[6]);
130  H[ 7] = ((XH >> 11) ^ (Q[23] << 2) ^ M[7]) + (XL ^ Q[31] ^ Q[7]);
131 
132  H[ 8] = rotate_left(H[4], 9) + (XH ^ Q[24] ^ M[ 8]) + ((XL << 8) ^ Q[23] ^ Q[ 8]);
133  H[ 9] = rotate_left(H[5], 10) + (XH ^ Q[25] ^ M[ 9]) + ((XL >> 6) ^ Q[16] ^ Q[ 9]);
134  H[10] = rotate_left(H[6], 11) + (XH ^ Q[26] ^ M[10]) + ((XL << 6) ^ Q[17] ^ Q[10]);
135  H[11] = rotate_left(H[7], 12) + (XH ^ Q[27] ^ M[11]) + ((XL << 4) ^ Q[18] ^ Q[11]);
136  H[12] = rotate_left(H[0], 13) + (XH ^ Q[28] ^ M[12]) + ((XL >> 3) ^ Q[19] ^ Q[12]);
137  H[13] = rotate_left(H[1], 14) + (XH ^ Q[29] ^ M[13]) + ((XL >> 4) ^ Q[20] ^ Q[13]);
138  H[14] = rotate_left(H[2], 15) + (XH ^ Q[30] ^ M[14]) + ((XL >> 7) ^ Q[21] ^ Q[14]);
139  H[15] = rotate_left(H[3], 16) + (XH ^ Q[31] ^ M[15]) + ((XL >> 2) ^ Q[22] ^ Q[15]);
140  }
141 
142 }
143 
144 void BMW_512::compress_n(const byte input[], size_t blocks)
145  {
146  for(size_t i = 0; i != blocks; ++i)
147  {
148  load_le(&M[0], input, M.size());
149 
150  BMW_512_compress(&H[0], &M[0], &Q[0]);
151 
152  input += hash_block_size();
153  }
154  }
155 
156 /*
157 * Copy out the digest
158 */
159 void BMW_512::copy_out(byte output[])
160  {
161  u64bit final[16] = {
162  0xAAAAAAAAAAAAAAA0, 0xAAAAAAAAAAAAAAA1,
163  0xAAAAAAAAAAAAAAA2, 0xAAAAAAAAAAAAAAA3,
164  0xAAAAAAAAAAAAAAA4, 0xAAAAAAAAAAAAAAA5,
165  0xAAAAAAAAAAAAAAA6, 0xAAAAAAAAAAAAAAA7,
166  0xAAAAAAAAAAAAAAA8, 0xAAAAAAAAAAAAAAA9,
167  0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAB,
168  0xAAAAAAAAAAAAAAAC, 0xAAAAAAAAAAAAAAAD,
169  0xAAAAAAAAAAAAAAAE, 0xAAAAAAAAAAAAAAAF };
170 
171  BMW_512_compress(final, &H[0], &Q[0]);
172 
173  for(size_t i = 0; i != output_length(); i += 8)
174  store_le(final[8 + i/8], output + i);
175  }
176 
177 /*
178 * Clear memory of sensitive data
179 */
181  {
183  zeroise(M);
184  zeroise(Q);
185 
186  H[ 0] = 0x8081828384858687;
187  H[ 1] = 0x88898A8B8C8D8E8F;
188  H[ 2] = 0x9091929394959697;
189  H[ 3] = 0x98999A9B9C9D9E9F;
190  H[ 4] = 0xA0A1A2A3A4A5A6A7;
191  H[ 5] = 0xA8A9AAABACADAEAF;
192  H[ 6] = 0xB0B1B2B3B4B5B6B7;
193  H[ 7] = 0xB8B9BABBBCBDBEBF;
194  H[ 8] = 0xC0C1C2C3C4C5C6C7;
195  H[ 9] = 0xC8C9CACBCCCDCECF;
196  H[10] = 0xD0D1D2D3D4D5D6D7;
197  H[11] = 0xD8D9DADBDCDDDEDF;
198  H[12] = 0xE0E1E2E3E4E5E6E7;
199  H[13] = 0xE8E9EAEBECEDEEEF;
200  H[14] = 0xF0F1F2F3F4F5F6F7;
201  H[15] = 0xF8F9FAFBFCFDFEFF;
202  }
203 
204 }
T load_le(const byte in[], size_t off)
Definition: loadstor.h:116
void store_le(u16bit in, byte out[2])
Definition: loadstor.h:427
T rotate_left(T input, size_t rot)
Definition: rotate.h:21
unsigned char byte
Definition: types.h:22
unsigned long long u64bit
Definition: types.h:49
void clear()
Definition: bmw_512.cpp:180
size_t hash_block_size() const
Definition: mdx_hash.h:32
void zeroise(MemoryRegion< T > &vec)
Definition: secmem.h:415
size_t output_length() const
Definition: bmw_512.h:22