nx_hmac_sha512_wasm.nx source
↩ module page · 327 lines · 13458 B
1// nx_hmac_sha512_wasm.nx -- HMAC-SHA-512 (RFC 2104 + 4231) for WAT target.
2//
3// Same construction as nx_hmac_sha256 but block size B=128 (not 64),
4// output size 64 (not 32), inner hash = SHA-512 (not SHA-256).
5//
6// API:
7// nx_hmac_sha512_one_shot(key_ptr, key_len, msg_ptr, msg_len,
8// scratch_ptr, out_ptr) -> i64
9// scratch_ptr -- >= 2048 bytes
10// out_ptr -- 64 bytes
11//
12// Verified against RFC 4231 ยง4 SHA-512 test cases.
13//
14// license_tier: INDEPENDENT_REDERIVE
15// genealogy_id: international-research-sources/ietf/rfc_2104 + rfc_4231
16// lineage_id: nishi_hmac_sha512_wasm_q11
17
18const W_OFF: i64 = 200
19const HMAC_B: i64 = 128
20
21func _rotr64(x: i64, n: i64) -> i64 {
22 let nn: i64 = n & 63
23 let low_mask: i64 = (1 << (64 - nn)) - 1
24 let lo: i64 = (x >> nn) & low_mask
25 let hi: i64 = x << (64 - nn)
26 return lo | hi
27}
28
29func _be64_read(buf: *u8, off: i64) -> i64 {
30 let b0: i64 = buf[off]
31 let b1: i64 = buf[off + 1]
32 let b2: i64 = buf[off + 2]
33 let b3: i64 = buf[off + 3]
34 let b4: i64 = buf[off + 4]
35 let b5: i64 = buf[off + 5]
36 let b6: i64 = buf[off + 6]
37 let b7: i64 = buf[off + 7]
38 return (b0 << 56) | (b1 << 48) | (b2 << 40) | (b3 << 32) |
39 (b4 << 24) | (b5 << 16) | (b6 << 8) | b7
40}
41func _be64_write(buf: *u8, off: i64, v: i64) -> i64 {
42 buf[off] = (v >> 56) & 0xFF
43 buf[off + 1] = (v >> 48) & 0xFF
44 buf[off + 2] = (v >> 40) & 0xFF
45 buf[off + 3] = (v >> 32) & 0xFF
46 buf[off + 4] = (v >> 24) & 0xFF
47 buf[off + 5] = (v >> 16) & 0xFF
48 buf[off + 6] = (v >> 8) & 0xFF
49 buf[off + 7] = v & 0xFF
50 return 0
51}
52
53func _i64_le_get(buf: *u8, idx: i64) -> i64 {
54 let off: i64 = idx * 8
55 return (buf[off] as i64) | ((buf[off + 1] as i64) << 8) |
56 ((buf[off + 2] as i64) << 16) | ((buf[off + 3] as i64) << 24) |
57 ((buf[off + 4] as i64) << 32) | ((buf[off + 5] as i64) << 40) |
58 ((buf[off + 6] as i64) << 48) | ((buf[off + 7] as i64) << 56)
59}
60func _i64_le_set(buf: *u8, idx: i64, v: i64) -> i64 {
61 let off: i64 = idx * 8
62 buf[off] = v & 0xFF
63 buf[off + 1] = (v >> 8) & 0xFF
64 buf[off + 2] = (v >> 16) & 0xFF
65 buf[off + 3] = (v >> 24) & 0xFF
66 buf[off + 4] = (v >> 32) & 0xFF
67 buf[off + 5] = (v >> 40) & 0xFF
68 buf[off + 6] = (v >> 48) & 0xFF
69 buf[off + 7] = (v >> 56) & 0xFF
70 return 0
71}
72func _h_get(ctx: *u8, i: i64) -> i64 {
73 let off: i64 = 128 + i * 8
74 return (ctx[off] as i64) | ((ctx[off + 1] as i64) << 8) |
75 ((ctx[off + 2] as i64) << 16) | ((ctx[off + 3] as i64) << 24) |
76 ((ctx[off + 4] as i64) << 32) | ((ctx[off + 5] as i64) << 40) |
77 ((ctx[off + 6] as i64) << 48) | ((ctx[off + 7] as i64) << 56)
78}
79func _h_set(ctx: *u8, i: i64, v: i64) -> i64 {
80 let off: i64 = 128 + i * 8
81 ctx[off] = v & 0xFF
82 ctx[off + 1] = (v >> 8) & 0xFF
83 ctx[off + 2] = (v >> 16) & 0xFF
84 ctx[off + 3] = (v >> 24) & 0xFF
85 ctx[off + 4] = (v >> 32) & 0xFF
86 ctx[off + 5] = (v >> 40) & 0xFF
87 ctx[off + 6] = (v >> 48) & 0xFF
88 ctx[off + 7] = (v >> 56) & 0xFF
89 return 0
90}
91
92func _sha512_k(i: i64) -> i64 {
93 if i == 0 { return 0x428a2f98d728ae22 } if i == 1 { return 0x7137449123ef65cd }
94 if i == 2 { return 0xb5c0fbcfec4d3b2f } if i == 3 { return 0xe9b5dba58189dbbc }
95 if i == 4 { return 0x3956c25bf348b538 } if i == 5 { return 0x59f111f1b605d019 }
96 if i == 6 { return 0x923f82a4af194f9b } if i == 7 { return 0xab1c5ed5da6d8118 }
97 if i == 8 { return 0xd807aa98a3030242 } if i == 9 { return 0x12835b0145706fbe }
98 if i == 10 { return 0x243185be4ee4b28c } if i == 11 { return 0x550c7dc3d5ffb4e2 }
99 if i == 12 { return 0x72be5d74f27b896f } if i == 13 { return 0x80deb1fe3b1696b1 }
100 if i == 14 { return 0x9bdc06a725c71235 } if i == 15 { return 0xc19bf174cf692694 }
101 if i == 16 { return 0xe49b69c19ef14ad2 } if i == 17 { return 0xefbe4786384f25e3 }
102 if i == 18 { return 0x0fc19dc68b8cd5b5 } if i == 19 { return 0x240ca1cc77ac9c65 }
103 if i == 20 { return 0x2de92c6f592b0275 } if i == 21 { return 0x4a7484aa6ea6e483 }
104 if i == 22 { return 0x5cb0a9dcbd41fbd4 } if i == 23 { return 0x76f988da831153b5 }
105 if i == 24 { return 0x983e5152ee66dfab } if i == 25 { return 0xa831c66d2db43210 }
106 if i == 26 { return 0xb00327c898fb213f } if i == 27 { return 0xbf597fc7beef0ee4 }
107 if i == 28 { return 0xc6e00bf33da88fc2 } if i == 29 { return 0xd5a79147930aa725 }
108 if i == 30 { return 0x06ca6351e003826f } if i == 31 { return 0x142929670a0e6e70 }
109 if i == 32 { return 0x27b70a8546d22ffc } if i == 33 { return 0x2e1b21385c26c926 }
110 if i == 34 { return 0x4d2c6dfc5ac42aed } if i == 35 { return 0x53380d139d95b3df }
111 if i == 36 { return 0x650a73548baf63de } if i == 37 { return 0x766a0abb3c77b2a8 }
112 if i == 38 { return 0x81c2c92e47edaee6 } if i == 39 { return 0x92722c851482353b }
113 if i == 40 { return 0xa2bfe8a14cf10364 } if i == 41 { return 0xa81a664bbc423001 }
114 if i == 42 { return 0xc24b8b70d0f89791 } if i == 43 { return 0xc76c51a30654be30 }
115 if i == 44 { return 0xd192e819d6ef5218 } if i == 45 { return 0xd69906245565a910 }
116 if i == 46 { return 0xf40e35855771202a } if i == 47 { return 0x106aa07032bbd1b8 }
117 if i == 48 { return 0x19a4c116b8d2d0c8 } if i == 49 { return 0x1e376c085141ab53 }
118 if i == 50 { return 0x2748774cdf8eeb99 } if i == 51 { return 0x34b0bcb5e19b48a8 }
119 if i == 52 { return 0x391c0cb3c5c95a63 } if i == 53 { return 0x4ed8aa4ae3418acb }
120 if i == 54 { return 0x5b9cca4f7763e373 } if i == 55 { return 0x682e6ff3d6b2b8a3 }
121 if i == 56 { return 0x748f82ee5defb2fc } if i == 57 { return 0x78a5636f43172f60 }
122 if i == 58 { return 0x84c87814a1f0ab72 } if i == 59 { return 0x8cc702081a6439ec }
123 if i == 60 { return 0x90befffa23631e28 } if i == 61 { return 0xa4506cebde82bde9 }
124 if i == 62 { return 0xbef9a3f7b2c67915 } if i == 63 { return 0xc67178f2e372532b }
125 if i == 64 { return 0xca273eceea26619c } if i == 65 { return 0xd186b8c721c0c207 }
126 if i == 66 { return 0xeada7dd6cde0eb1e } if i == 67 { return 0xf57d4f7fee6ed178 }
127 if i == 68 { return 0x06f067aa72176fba } if i == 69 { return 0x0a637dc5a2c898a6 }
128 if i == 70 { return 0x113f9804bef90dae } if i == 71 { return 0x1b710b35131c471b }
129 if i == 72 { return 0x28db77f523047d84 } if i == 73 { return 0x32caab7b40c72493 }
130 if i == 74 { return 0x3c9ebe0a15c9bebc } if i == 75 { return 0x431d67c49c100d4c }
131 if i == 76 { return 0x4cc5d4becb3e42b6 } if i == 77 { return 0x597f299cfc657e2a }
132 if i == 78 { return 0x5fcb6fab3ad6faec }
133 return 0x6c44198c4a475817
134}
135
136func _sha512_compress(ctx: *u8) -> i64 {
137 var i: i64 = 0
138 while i < 16 {
139 let w: i64 = _be64_read(ctx, i * 8)
140 _i64_le_set(ctx, (W_OFF / 8) + i, w)
141 i = i + 1
142 }
143 i = 16
144 while i < 80 {
145 let w2: i64 = _i64_le_get(ctx, (W_OFF / 8) + i - 2)
146 let w15: i64 = _i64_le_get(ctx, (W_OFF / 8) + i - 15)
147 let w7: i64 = _i64_le_get(ctx, (W_OFF / 8) + i - 7)
148 let w16: i64 = _i64_le_get(ctx, (W_OFF / 8) + i - 16)
149 let w2_shr6: i64 = (w2 >> 6) & 0x03ffffffffffffff
150 let w15_shr7: i64 = (w15 >> 7) & 0x01ffffffffffffff
151 let s0: i64 = _rotr64(w15, 1) ^ _rotr64(w15, 8) ^ w15_shr7
152 let s1: i64 = _rotr64(w2, 19) ^ _rotr64(w2, 61) ^ w2_shr6
153 let wi: i64 = w16 + s0 + w7 + s1
154 _i64_le_set(ctx, (W_OFF / 8) + i, wi)
155 i = i + 1
156 }
157 var a: i64 = _h_get(ctx, 0)
158 var b: i64 = _h_get(ctx, 1)
159 var c: i64 = _h_get(ctx, 2)
160 var d: i64 = _h_get(ctx, 3)
161 var e: i64 = _h_get(ctx, 4)
162 var f: i64 = _h_get(ctx, 5)
163 var g: i64 = _h_get(ctx, 6)
164 var h: i64 = _h_get(ctx, 7)
165 i = 0
166 while i < 80 {
167 let w: i64 = _i64_le_get(ctx, (W_OFF / 8) + i)
168 let s1: i64 = _rotr64(e, 14) ^ _rotr64(e, 18) ^ _rotr64(e, 41)
169 let ch: i64 = (e & f) ^ ((~e) & g)
170 let temp1: i64 = h + s1 + ch + _sha512_k(i) + w
171 let s0: i64 = _rotr64(a, 28) ^ _rotr64(a, 34) ^ _rotr64(a, 39)
172 let maj: i64 = (a & b) ^ (a & c) ^ (b & c)
173 let temp2: i64 = s0 + maj
174 h = g; g = f; f = e
175 e = d + temp1
176 d = c; c = b; b = a
177 a = temp1 + temp2
178 i = i + 1
179 }
180 _h_set(ctx, 0, _h_get(ctx, 0) + a)
181 _h_set(ctx, 1, _h_get(ctx, 1) + b)
182 _h_set(ctx, 2, _h_get(ctx, 2) + c)
183 _h_set(ctx, 3, _h_get(ctx, 3) + d)
184 _h_set(ctx, 4, _h_get(ctx, 4) + e)
185 _h_set(ctx, 5, _h_get(ctx, 5) + f)
186 _h_set(ctx, 6, _h_get(ctx, 6) + g)
187 _h_set(ctx, 7, _h_get(ctx, 7) + h)
188 return 0
189}
190
191func _sha512_init(ctx: *u8) -> i64 {
192 _h_set(ctx, 0, 0x6a09e667f3bcc908)
193 _h_set(ctx, 1, 0xbb67ae8584caa73b)
194 _h_set(ctx, 2, 0x3c6ef372fe94f82b)
195 _h_set(ctx, 3, 0xa54ff53a5f1d36f1)
196 _h_set(ctx, 4, 0x510e527fade682d1)
197 _h_set(ctx, 5, 0x9b05688c2b3e6c1f)
198 _h_set(ctx, 6, 0x1f83d9abfb41bd6b)
199 _h_set(ctx, 7, 0x5be0cd19137e2179)
200 return 0
201}
202
203func _sha512_one_shot(in_ptr: *u8, in_len: i64, ctx: *u8, out_ptr: *u8) -> i64 {
204 _sha512_init(ctx)
205 var idx: i64 = 0
206 var bit_len: i64 = 0
207 var i: i64 = 0
208 while i < in_len {
209 ctx[idx] = in_ptr[i]
210 idx = idx + 1
211 bit_len = bit_len + 8
212 if idx == 128 {
213 _sha512_compress(ctx)
214 idx = 0
215 }
216 i = i + 1
217 }
218 ctx[idx] = 0x80
219 idx = idx + 1
220 if idx > 112 {
221 while idx < 128 { ctx[idx] = 0; idx = idx + 1 }
222 _sha512_compress(ctx)
223 idx = 0
224 }
225 while idx < 112 { ctx[idx] = 0; idx = idx + 1 }
226 ctx[112] = 0; ctx[113] = 0; ctx[114] = 0; ctx[115] = 0
227 ctx[116] = 0; ctx[117] = 0; ctx[118] = 0; ctx[119] = 0
228 ctx[120] = (bit_len >> 56) & 0xFF
229 ctx[121] = (bit_len >> 48) & 0xFF
230 ctx[122] = (bit_len >> 40) & 0xFF
231 ctx[123] = (bit_len >> 32) & 0xFF
232 ctx[124] = (bit_len >> 24) & 0xFF
233 ctx[125] = (bit_len >> 16) & 0xFF
234 ctx[126] = (bit_len >> 8) & 0xFF
235 ctx[127] = bit_len & 0xFF
236 _sha512_compress(ctx)
237 var k: i64 = 0
238 while k < 8 {
239 _be64_write(out_ptr, k * 8, _h_get(ctx, k))
240 k = k + 1
241 }
242 return 0
243}
244
245// ===== HMAC-SHA-512 =====
246//
247// scratch layout (>= 2048 bytes):
248// 0..127 : K' (block-sized key buffer)
249// 128..255 : K' XOR ipad
250// 256..383 : K' XOR opad
251// 384..447 : inner-hash output (64 bytes)
252// 512..1431 : SHA-512 ctx scratch (920 bytes; needs 128 + 64 + 8 + 640 = 840)
253// 1536..1727 : opad_block || inner_hash concat for outer (192 bytes)
254func nx_hmac_sha512_one_shot(key_ptr: *u8, key_len: i64,
255 msg_ptr: *u8, msg_len: i64,
256 scratch_ptr: *u8, out_ptr: *u8) -> i64 {
257 let kprime: *u8 = scratch_ptr
258 var j: i64 = 0
259 while j < HMAC_B { kprime[j] = 0; j = j + 1 }
260 if key_len > HMAC_B {
261 let h_ctx: *u8 = (scratch_ptr as i64 + 512) as *u8
262 _sha512_one_shot(key_ptr, key_len, h_ctx, kprime)
263 } else {
264 var ki: i64 = 0
265 while ki < key_len { kprime[ki] = key_ptr[ki]; ki = ki + 1 }
266 }
267 let ipad_blk: *u8 = (scratch_ptr as i64 + 128) as *u8
268 var ii: i64 = 0
269 while ii < HMAC_B { ipad_blk[ii] = kprime[ii] ^ 0x36; ii = ii + 1 }
270 let opad_blk: *u8 = (scratch_ptr as i64 + 256) as *u8
271 var oi: i64 = 0
272 while oi < HMAC_B { opad_blk[oi] = kprime[oi] ^ 0x5c; oi = oi + 1 }
273 // Inner hash: streaming SHA-512 of (ipad || msg).
274 let inner_ctx: *u8 = (scratch_ptr as i64 + 512) as *u8
275 _sha512_init(inner_ctx)
276 var inner_idx: i64 = 0
277 var inner_bits: i64 = 0
278 var ip: i64 = 0
279 while ip < HMAC_B {
280 inner_ctx[inner_idx] = ipad_blk[ip]
281 inner_idx = inner_idx + 1
282 inner_bits = inner_bits + 8
283 if inner_idx == 128 { _sha512_compress(inner_ctx); inner_idx = 0 }
284 ip = ip + 1
285 }
286 var mp: i64 = 0
287 while mp < msg_len {
288 inner_ctx[inner_idx] = msg_ptr[mp]
289 inner_idx = inner_idx + 1
290 inner_bits = inner_bits + 8
291 if inner_idx == 128 { _sha512_compress(inner_ctx); inner_idx = 0 }
292 mp = mp + 1
293 }
294 inner_ctx[inner_idx] = 0x80
295 inner_idx = inner_idx + 1
296 if inner_idx > 112 {
297 while inner_idx < 128 { inner_ctx[inner_idx] = 0; inner_idx = inner_idx + 1 }
298 _sha512_compress(inner_ctx)
299 inner_idx = 0
300 }
301 while inner_idx < 112 { inner_ctx[inner_idx] = 0; inner_idx = inner_idx + 1 }
302 inner_ctx[112] = 0; inner_ctx[113] = 0; inner_ctx[114] = 0; inner_ctx[115] = 0
303 inner_ctx[116] = 0; inner_ctx[117] = 0; inner_ctx[118] = 0; inner_ctx[119] = 0
304 inner_ctx[120] = (inner_bits >> 56) & 0xFF
305 inner_ctx[121] = (inner_bits >> 48) & 0xFF
306 inner_ctx[122] = (inner_bits >> 40) & 0xFF
307 inner_ctx[123] = (inner_bits >> 32) & 0xFF
308 inner_ctx[124] = (inner_bits >> 24) & 0xFF
309 inner_ctx[125] = (inner_bits >> 16) & 0xFF
310 inner_ctx[126] = (inner_bits >> 8) & 0xFF
311 inner_ctx[127] = inner_bits & 0xFF
312 _sha512_compress(inner_ctx)
313 let inner_out: *u8 = (scratch_ptr as i64 + 384) as *u8
314 var dk: i64 = 0
315 while dk < 8 {
316 _be64_write(inner_out, dk * 8, _h_get(inner_ctx, dk))
317 dk = dk + 1
318 }
319 // Outer hash: SHA-512(opad_blk || inner_out).
320 let outer_in: *u8 = (scratch_ptr as i64 + 1536) as *u8
321 var op: i64 = 0
322 while op < HMAC_B { outer_in[op] = opad_blk[op]; op = op + 1 }
323 var ohi: i64 = 0
324 while ohi < 64 { outer_in[HMAC_B + ohi] = inner_out[ohi]; ohi = ohi + 1 }
325 _sha512_one_shot(outer_in, HMAC_B + 64, inner_ctx, out_ptr)
326 return 0
327}