Momentum-Apps/flipbip/lib/crypto/hmac_drbg.c

/**
 * Copyright (c) 2019 Andrew R. Kozlik
 *
 * Permission is hereby granted, free of charge, to any person obtaining
 * a copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included
 * in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
 * OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 * OTHER DEALINGS IN THE SOFTWARE.
 */

#include "hmac_drbg.h"
#include <string.h>
#include "memzero.h"
#include "sha2.h"

static void update_k(
    HMAC_DRBG_CTX* ctx,
    uint8_t domain,
    const uint8_t* data1,
    size_t len1,
    const uint8_t* data2,
    size_t len2) {
    // Computes K = HMAC(K, V || domain || data1 || data 2).

    // First hash operation of HMAC.
    uint32_t h[SHA256_BLOCK_LENGTH / sizeof(uint32_t)] = {0};
    if(len1 + len2 == 0) {
        ctx->v[8] = 0x00800000;
        ctx->v[15] = (SHA256_BLOCK_LENGTH + SHA256_DIGEST_LENGTH + 1) * 8;
        sha256_Transform(ctx->idig, ctx->v, h);
        ctx->v[8] = 0x80000000;
        ctx->v[15] = (SHA256_BLOCK_LENGTH + SHA256_DIGEST_LENGTH) * 8;
    } else {
        SHA256_CTX sha_ctx = {0};
        memcpy(sha_ctx.state, ctx->idig, SHA256_DIGEST_LENGTH);
        for(size_t i = 0; i < SHA256_DIGEST_LENGTH / sizeof(uint32_t); i++) {
#if BYTE_ORDER == LITTLE_ENDIAN
            REVERSE32(ctx->v[i], sha_ctx.buffer[i]);
#else
            sha_ctx.buffer[i] = ctx->v[i];
#endif
        }
        ((uint8_t*)sha_ctx.buffer)[SHA256_DIGEST_LENGTH] = domain;
        sha_ctx.bitcount = (SHA256_BLOCK_LENGTH + SHA256_DIGEST_LENGTH + 1) * 8;
        sha256_Update(&sha_ctx, data1, len1);
        sha256_Update(&sha_ctx, data2, len2);
        sha256_Final(&sha_ctx, (uint8_t*)h);
#if BYTE_ORDER == LITTLE_ENDIAN
        for(size_t i = 0; i < SHA256_DIGEST_LENGTH / sizeof(uint32_t); i++) REVERSE32(h[i], h[i]);
#endif
    }

    // Second hash operation of HMAC.
    h[8] = 0x80000000;
    h[15] = (SHA256_BLOCK_LENGTH + SHA256_DIGEST_LENGTH) * 8;
    sha256_Transform(ctx->odig, h, h);

    // Precompute the inner digest and outer digest of K.
    h[8] = 0;
    h[15] = 0;
    for(size_t i = 0; i < SHA256_BLOCK_LENGTH / sizeof(uint32_t); i++) {
        h[i] ^= 0x36363636;
    }
    sha256_Transform(sha256_initial_hash_value, h, ctx->idig);

    for(size_t i = 0; i < SHA256_BLOCK_LENGTH / sizeof(uint32_t); i++) {
        h[i] = h[i] ^ 0x36363636 ^ 0x5c5c5c5c;
    }
    sha256_Transform(sha256_initial_hash_value, h, ctx->odig);
    memzero(h, sizeof(h));
}

static void update_v(HMAC_DRBG_CTX* ctx) {
    sha256_Transform(ctx->idig, ctx->v, ctx->v);
    sha256_Transform(ctx->odig, ctx->v, ctx->v);
}

void hmac_drbg_init(
    HMAC_DRBG_CTX* ctx,
    const uint8_t* entropy,
    size_t entropy_len,
    const uint8_t* nonce,
    size_t nonce_len) {
    uint32_t h[SHA256_BLOCK_LENGTH / sizeof(uint32_t)] = {0};

    // Precompute the inner digest and outer digest of K = 0x00 ... 0x00.
    memset(h, 0x36, sizeof(h));
    sha256_Transform(sha256_initial_hash_value, h, ctx->idig);
    memset(h, 0x5c, sizeof(h));
    sha256_Transform(sha256_initial_hash_value, h, ctx->odig);

    // Let V = 0x01 ... 0x01.
    memset(ctx->v, 1, SHA256_DIGEST_LENGTH);
    for(size_t i = 9; i < 15; i++) ctx->v[i] = 0;
    ctx->v[8] = 0x80000000;
    ctx->v[15] = (SHA256_BLOCK_LENGTH + SHA256_DIGEST_LENGTH) * 8;

    hmac_drbg_reseed(ctx, entropy, entropy_len, nonce, nonce_len);

    memzero(h, sizeof(h));
}

void hmac_drbg_reseed(
    HMAC_DRBG_CTX* ctx,
    const uint8_t* entropy,
    size_t len,
    const uint8_t* addin,
    size_t addin_len) {
    update_k(ctx, 0, entropy, len, addin, addin_len);
    update_v(ctx);
    if(len == 0) return;
    update_k(ctx, 1, entropy, len, addin, addin_len);
    update_v(ctx);
}

void hmac_drbg_generate(HMAC_DRBG_CTX* ctx, uint8_t* buf, size_t len) {
    size_t i = 0;
    while(i < len) {
        update_v(ctx);
        for(size_t j = 0; j < 8 && i < len; j++) {
            uint32_t r = ctx->v[j];
            for(int k = 24; k >= 0 && i < len; k -= 8) {
                buf[i++] = (r >> k) & 0xFF;
            }
        }
    }
    update_k(ctx, 0, NULL, 0, NULL, 0);
    update_v(ctx);
}