Skip to content

Commit d8d83d8

Browse files
zx2c4zx2c4
committed
lib/crypto: blake2s: move hmac construction into wireguard
Basically nobody should use blake2s in an HMAC construction; it already has a keyed variant. But unfortunately for historical reasons, Noise, used by WireGuard, uses HKDF quite strictly, which means we have to use this. Because this really shouldn't be used by others, this commit moves it into wireguard's noise.c locally, so that kernels that aren't using WireGuard don't get this superfluous code baked in. On m68k systems, this shaves off ~314 bytes. Cc: Herbert Xu <[email protected]> Tested-by: Geert Uytterhoeven <[email protected]> Acked-by: Ard Biesheuvel <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
1 parent e56e189 commit d8d83d8

File tree

4 files changed

+39
-77
lines changed

4 files changed

+39
-77
lines changed

‎drivers/net/wireguard/noise.c

Lines changed: 39 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,41 @@ void wg_noise_set_static_identity_private_key(
302302
static_identity->static_public, private_key);
303303
}
304304

305+
static void hmac(u8 *out, const u8 *in, const u8 *key, const size_t inlen, const size_t keylen)
306+
{
307+
struct blake2s_state state;
308+
u8 x_key[BLAKE2S_BLOCK_SIZE] __aligned(__alignof__(u32)) = { 0 };
309+
u8 i_hash[BLAKE2S_HASH_SIZE] __aligned(__alignof__(u32));
310+
int i;
311+
312+
if (keylen > BLAKE2S_BLOCK_SIZE) {
313+
blake2s_init(&state, BLAKE2S_HASH_SIZE);
314+
blake2s_update(&state, key, keylen);
315+
blake2s_final(&state, x_key);
316+
} else
317+
memcpy(x_key, key, keylen);
318+
319+
for (i = 0; i < BLAKE2S_BLOCK_SIZE; ++i)
320+
x_key[i] ^= 0x36;
321+
322+
blake2s_init(&state, BLAKE2S_HASH_SIZE);
323+
blake2s_update(&state, x_key, BLAKE2S_BLOCK_SIZE);
324+
blake2s_update(&state, in, inlen);
325+
blake2s_final(&state, i_hash);
326+
327+
for (i = 0; i < BLAKE2S_BLOCK_SIZE; ++i)
328+
x_key[i] ^= 0x5c ^ 0x36;
329+
330+
blake2s_init(&state, BLAKE2S_HASH_SIZE);
331+
blake2s_update(&state, x_key, BLAKE2S_BLOCK_SIZE);
332+
blake2s_update(&state, i_hash, BLAKE2S_HASH_SIZE);
333+
blake2s_final(&state, i_hash);
334+
335+
memcpy(out, i_hash, BLAKE2S_HASH_SIZE);
336+
memzero_explicit(x_key, BLAKE2S_BLOCK_SIZE);
337+
memzero_explicit(i_hash, BLAKE2S_HASH_SIZE);
338+
}
339+
305340
/* This is Hugo Krawczyk's HKDF:
306341
* - https://eprint.iacr.org/2010/264.pdf
307342
* - https://tools.ietf.org/html/rfc5869
@@ -322,32 +357,30 @@ static void kdf(u8 *first_dst, u8 *second_dst, u8 *third_dst, const u8 *data,
322357
((third_len || third_dst) && (!second_len || !second_dst))));
323358

324359
/* Extract entropy from data into secret */
325-
blake2s256_hmac(secret, data, chaining_key, data_len, NOISE_HASH_LEN);
360+
hmac(secret, data, chaining_key, data_len, NOISE_HASH_LEN);
326361

327362
if (!first_dst || !first_len)
328363
goto out;
329364

330365
/* Expand first key: key = secret, data = 0x1 */
331366
output[0] = 1;
332-
blake2s256_hmac(output, output, secret, 1, BLAKE2S_HASH_SIZE);
367+
hmac(output, output, secret, 1, BLAKE2S_HASH_SIZE);
333368
memcpy(first_dst, output, first_len);
334369

335370
if (!second_dst || !second_len)
336371
goto out;
337372

338373
/* Expand second key: key = secret, data = first-key || 0x2 */
339374
output[BLAKE2S_HASH_SIZE] = 2;
340-
blake2s256_hmac(output, output, secret, BLAKE2S_HASH_SIZE + 1,
341-
BLAKE2S_HASH_SIZE);
375+
hmac(output, output, secret, BLAKE2S_HASH_SIZE + 1, BLAKE2S_HASH_SIZE);
342376
memcpy(second_dst, output, second_len);
343377

344378
if (!third_dst || !third_len)
345379
goto out;
346380

347381
/* Expand third key: key = secret, data = second-key || 0x3 */
348382
output[BLAKE2S_HASH_SIZE] = 3;
349-
blake2s256_hmac(output, output, secret, BLAKE2S_HASH_SIZE + 1,
350-
BLAKE2S_HASH_SIZE);
383+
hmac(output, output, secret, BLAKE2S_HASH_SIZE + 1, BLAKE2S_HASH_SIZE);
351384
memcpy(third_dst, output, third_len);
352385

353386
out:

‎include/crypto/blake2s.h

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,4 @@ static inline void blake2s(u8 *out, const u8 *in, const u8 *key,
101101
blake2s_final(&state, out);
102102
}
103103

104-
void blake2s256_hmac(u8 *out, const u8 *in, const u8 *key, const size_t inlen,
105-
const size_t keylen);
106-
107104
#endif /* _CRYPTO_BLAKE2S_H */

‎lib/crypto/blake2s-selftest.c

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
* #include <stdio.h>
1616
*
1717
* #include <openssl/evp.h>
18-
* #include <openssl/hmac.h>
1918
*
2019
* #define BLAKE2S_TESTVEC_COUNT 256
2120
*
@@ -58,16 +57,6 @@
5857
* }
5958
* printf("};\n\n");
6059
*
61-
* printf("static const u8 blake2s_hmac_testvecs[][BLAKE2S_HASH_SIZE] __initconst = {\n");
62-
*
63-
* HMAC(EVP_blake2s256(), key, sizeof(key), buf, sizeof(buf), hash, NULL);
64-
* print_vec(hash, BLAKE2S_OUTBYTES);
65-
*
66-
* HMAC(EVP_blake2s256(), buf, sizeof(buf), key, sizeof(key), hash, NULL);
67-
* print_vec(hash, BLAKE2S_OUTBYTES);
68-
*
69-
* printf("};\n");
70-
*
7160
* return 0;
7261
*}
7362
*/
@@ -554,15 +543,6 @@ static const u8 blake2s_testvecs[][BLAKE2S_HASH_SIZE] __initconst = {
554543
0xd6, 0x98, 0x6b, 0x07, 0x10, 0x65, 0x52, 0x65, },
555544
};
556545

557-
static const u8 blake2s_hmac_testvecs[][BLAKE2S_HASH_SIZE] __initconst = {
558-
{ 0xce, 0xe1, 0x57, 0x69, 0x82, 0xdc, 0xbf, 0x43, 0xad, 0x56, 0x4c, 0x70,
559-
0xed, 0x68, 0x16, 0x96, 0xcf, 0xa4, 0x73, 0xe8, 0xe8, 0xfc, 0x32, 0x79,
560-
0x08, 0x0a, 0x75, 0x82, 0xda, 0x3f, 0x05, 0x11, },
561-
{ 0x77, 0x2f, 0x0c, 0x71, 0x41, 0xf4, 0x4b, 0x2b, 0xb3, 0xc6, 0xb6, 0xf9,
562-
0x60, 0xde, 0xe4, 0x52, 0x38, 0x66, 0xe8, 0xbf, 0x9b, 0x96, 0xc4, 0x9f,
563-
0x60, 0xd9, 0x24, 0x37, 0x99, 0xd6, 0xec, 0x31, },
564-
};
565-
566546
bool __init blake2s_selftest(void)
567547
{
568548
u8 key[BLAKE2S_KEY_SIZE];
@@ -607,16 +587,5 @@ bool __init blake2s_selftest(void)
607587
}
608588
}
609589

610-
if (success) {
611-
blake2s256_hmac(hash, buf, key, sizeof(buf), sizeof(key));
612-
success &= !memcmp(hash, blake2s_hmac_testvecs[0], BLAKE2S_HASH_SIZE);
613-
614-
blake2s256_hmac(hash, key, buf, sizeof(key), sizeof(buf));
615-
success &= !memcmp(hash, blake2s_hmac_testvecs[1], BLAKE2S_HASH_SIZE);
616-
617-
if (!success)
618-
pr_err("blake2s256_hmac self-test: FAIL\n");
619-
}
620-
621590
return success;
622591
}

‎lib/crypto/blake2s.c

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -30,43 +30,6 @@ void blake2s_final(struct blake2s_state *state, u8 *out)
3030
}
3131
EXPORT_SYMBOL(blake2s_final);
3232

33-
void blake2s256_hmac(u8 *out, const u8 *in, const u8 *key, const size_t inlen,
34-
const size_t keylen)
35-
{
36-
struct blake2s_state state;
37-
u8 x_key[BLAKE2S_BLOCK_SIZE] __aligned(__alignof__(u32)) = { 0 };
38-
u8 i_hash[BLAKE2S_HASH_SIZE] __aligned(__alignof__(u32));
39-
int i;
40-
41-
if (keylen > BLAKE2S_BLOCK_SIZE) {
42-
blake2s_init(&state, BLAKE2S_HASH_SIZE);
43-
blake2s_update(&state, key, keylen);
44-
blake2s_final(&state, x_key);
45-
} else
46-
memcpy(x_key, key, keylen);
47-
48-
for (i = 0; i < BLAKE2S_BLOCK_SIZE; ++i)
49-
x_key[i] ^= 0x36;
50-
51-
blake2s_init(&state, BLAKE2S_HASH_SIZE);
52-
blake2s_update(&state, x_key, BLAKE2S_BLOCK_SIZE);
53-
blake2s_update(&state, in, inlen);
54-
blake2s_final(&state, i_hash);
55-
56-
for (i = 0; i < BLAKE2S_BLOCK_SIZE; ++i)
57-
x_key[i] ^= 0x5c ^ 0x36;
58-
59-
blake2s_init(&state, BLAKE2S_HASH_SIZE);
60-
blake2s_update(&state, x_key, BLAKE2S_BLOCK_SIZE);
61-
blake2s_update(&state, i_hash, BLAKE2S_HASH_SIZE);
62-
blake2s_final(&state, i_hash);
63-
64-
memcpy(out, i_hash, BLAKE2S_HASH_SIZE);
65-
memzero_explicit(x_key, BLAKE2S_BLOCK_SIZE);
66-
memzero_explicit(i_hash, BLAKE2S_HASH_SIZE);
67-
}
68-
EXPORT_SYMBOL(blake2s256_hmac);
69-
7033
static int __init blake2s_mod_init(void)
7134
{
7235
if (!IS_ENABLED(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS) &&

0 commit comments

Comments
 (0)