poly1305

Imports

Imports # 

"encoding/binary"
"math/bits"
"golang.org/x/sys/cpu"
"crypto/subtle"

Constants & Variables

TagSize const #

TagSize is the size, in bytes, of a poly1305 authenticator.

const TagSize = 16

maskLow2Bits const # 

const maskLow2Bits uint64 = 0x0000000000000003

maskNotLow2Bits const # 

const maskNotLow2Bits uint64 = *ast.UnaryExpr

p0 const #

[p0, p1, p2] is 2¹³⁰ - 5 in little endian order.

const p0 = 0xFFFFFFFFFFFFFFFB

p1 const #

[p0, p1, p2] is 2¹³⁰ - 5 in little endian order.

const p1 = 0xFFFFFFFFFFFFFFFF

p2 const #

[p0, p1, p2] is 2¹³⁰ - 5 in little endian order.

const p2 = 0x0000000000000003

rMask0 const #

[rMask0, rMask1] is the specified Poly1305 clamping mask in little-endian. It clears some bits of the secret coefficient to make it possible to implement multiplication more efficiently.

const rMask0 = 0x0FFFFFFC0FFFFFFF

rMask1 const #

[rMask0, rMask1] is the specified Poly1305 clamping mask in little-endian. It clears some bits of the secret coefficient to make it possible to implement multiplication more efficiently.

const rMask1 = 0x0FFFFFFC0FFFFFFC

Structs

MAC struct #

MAC is an io.Writer computing an authentication tag of the data written to it. MAC cannot be used like common hash.Hash implementations, because using a poly1305 key twice breaks its security. Therefore writing data to a running MAC after calling Sum or Verify causes it to panic.

type MAC struct {
mac
finalized bool
}

mac struct #

mac is a wrapper for macGeneric that redirects calls that would have gone to updateGeneric to update. Its Write and Sum methods are otherwise identical to the macGeneric ones, but using function pointers would carry a major performance cost.

type mac struct {
macGeneric
}

mac struct #

mac is a replacement for macGeneric that uses a larger buffer and redirects calls that would have gone to updateGeneric to updateVX if the vector facility is installed. A larger buffer is required for good performance because the vector implementation has a higher fixed cost per call than the generic implementation.

type mac struct {
macState
buffer [*ast.BinaryExpr]byte
offset int
}

mac struct # 

type mac struct {
macGeneric
}

mac struct #

mac is a wrapper for macGeneric that redirects calls that would have gone to updateGeneric to update. Its Write and Sum methods are otherwise identical to the macGeneric ones, but using function pointers would carry a major performance cost.

type mac struct {
macGeneric
}

macGeneric struct # 

type macGeneric struct {
macState
buffer [TagSize]byte
offset int
}

macState struct #

macState holds numbers in saturated 64-bit little-endian limbs. That is, the value of [x0, x1, x2] is x[0] + x[1] * 2⁶⁴ + x[2] * 2¹²⁸.

type macState struct {
h [3]uint64
r [2]uint64
s [2]uint64
}

uint128 struct #

uint128 holds a 128-bit number as two 64-bit limbs, for use with the bits.Mul64 and bits.Add64 intrinsics.

type uint128 struct {
lo uint64
hi uint64
}

Functions

New function #

New returns a new MAC computing an authentication tag of all data written to it with the given key. This allows writing the message progressively instead of passing it as a single slice. Common users should use the Sum function instead. The key must be unique for each message, as authenticating two different messages with the same key allows an attacker to forge messages at will.

func New(key *[32]byte) *MAC

Size method #

Size returns the number of bytes Sum will return.

func (h *MAC) Size() int

Sum method # 

func (h *mac) Sum(out *[16]byte)

Sum method # 

func (h *mac) Sum(out *[16]byte)

Sum method #

Sum flushes the last incomplete chunk from the buffer, if any, and generates the MAC output. It does not modify its state, in order to allow for multiple calls to Sum, even if no Write is allowed after Sum.

func (h *macGeneric) Sum(out *[TagSize]byte)

Sum method #

Sum computes the authenticator of all data written to the message authentication code.

func (h *MAC) Sum(b []byte) []byte

Sum function #

Sum generates an authenticator for msg using a one-time key and puts the 16-byte result into out. Authenticating two different messages with the same key allows an attacker to forge messages at will.

func Sum(out *[16]byte, m []byte, key *[32]byte)

Sum method # 

func (h *mac) Sum(out *[TagSize]byte)

Verify method #

Verify returns whether the authenticator of all data written to the message authentication code matches the expected value.

func (h *MAC) Verify(expected []byte) bool

Verify function #

Verify returns true if mac is a valid authenticator for m with the given key.

func Verify(mac *[16]byte, m []byte, key *[32]byte) bool

Write method # 

func (h *mac) Write(p []byte) (int, error)

Write method #

Write splits the incoming message into TagSize chunks, and passes them to update. It buffers incomplete chunks.

func (h *macGeneric) Write(p []byte) (int, error)

Write method # 

func (h *mac) Write(p []byte) (int, error)

Write method #

Write adds more data to the running message authentication code. It never returns an error. It must not be called after the first call of Sum or Verify.

func (h *MAC) Write(p []byte) (n int, err error)

Write method # 

func (h *mac) Write(p []byte) (int, error)

add128 function # 

func add128(a uint128, b uint128) uint128

finalize function #

finalize completes the modular reduction of h and computes out = h + s mod 2¹²⁸

func finalize(out *[TagSize]byte, h *[3]uint64, s *[2]uint64)

initialize function #

initialize loads the 256-bit key into the two 128-bit secret values r and s.

func initialize(key *[32]byte, m *macState)

mul64 function # 

func mul64(a uint64, b uint64) uint128

newMACGeneric function # 

func newMACGeneric(key *[32]byte) macGeneric

select64 function #

select64 returns x if v == 1 and y if v == 0, in constant time.

func select64(v uint64, x uint64, y uint64) uint64

shiftRightBy2 function # 

func shiftRightBy2(a uint128) uint128

sumGeneric function # 

func sumGeneric(out *[TagSize]byte, msg []byte, key *[32]byte)

update function #

go:noescape

func update(state *macState, msg []byte)

update function #

go:noescape

func update(state *macState, msg []byte)

updateGeneric function #

updateGeneric absorbs msg into the state.h accumulator. For each chunk m of 128 bits of message, it computes h₊ = (h + m) * r mod 2¹³⁰ - 5 If the msg length is not a multiple of TagSize, it assumes the last incomplete chunk is the final one.

func updateGeneric(state *macState, msg []byte)

updateVX function #

updateVX is an assembly implementation of Poly1305 that uses vector instructions. It must only be called if the vector facility (vx) is available. go:noescape

func updateVX(state *macState, msg []byte)

Generated with Arrow