Umfrage/Architekturfrage zur DEC

[Kas Ob.]

Zitat von rabatscher:

Here my progress so far..
It includes heavily edited base classes too (not sure if that stays that way) - it is a start and I'm not expecting
this to be anyway close to a final architecture/working example.

The poly1305 test case works, as well as the base chacha20 encoding.
The tag is still not working....

When this works I will add an AVX version of the chacha cipher and try to create simd versions of the poly1305 update...

Something is OFF, i didn't run the code, might be later, but this part is perplexing me

Delphi-Quellcode:

procedure TPoly1305.InitInternal(const InitVector: T32ByteArray);
begin
     FillChar(FH, sizeof(FH), 0);

     ///* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
//     st->r[0] = U8TOU32(&key[0]) & 0x0fffffff;
//     st->r[1] = U8TOU32(&key[4]) & 0x0ffffffc;
//     st->r[2] = U8TOU32(&key[8]) & 0x0ffffffc;
//     st->r[3] = U8TOU32(&key[12]) & 0x0ffffffc;
     FR[0] := U8ToU32(@initVector[0]) and $0fffffff;
     FR[1] := U8ToU32(@initVector[4]) and $0ffffffc;
     FR[2] := U8ToU32(@initVector[8]) and $0ffffffc;
     FR[3] := U8ToU32(@initVector[12]) and $0ffffffc;


     FNonce[0] := U8ToU32(@initVector[16]);
     FNonce[1] := U8ToU32(@initVector[20]);
     FNonce[2] := U8ToU32(@initVector[24]);
     FNonce[3] := U8ToU32(@initVector[28]);

     fNum := 0;
end;

And it is really from here https://github.com/openssl/openssl/b...305/poly1305.c
I see the clipingof the lower 2 bits for 4,8 and 12, but don't see the cliping of the highest 4 bits for 3,7,11 and 15.
From https://en.wikipedia.org/wiki/Poly13...on_of_Poly1305

Zitat:

The secret key r = ....

In all cases, use the standardized version from https://www.rfc-editor.org/rfc/rfc7539#section-2.5 this one is the most important and has the pseudo code in full, which also dictate :

Zitat:

o r[3], r[7], r[11], and r[15] are required to have their top four
bits clear (be smaller than 16)

o r[4], r[8], and r[12] are required to have their bottom two bits
clear (be divisible by 4)
...

void poly1305aes_test_clamp(unsigned char r[16])
{
r[3] &= 15;
r[7] &= 15;
r[11] &= 15;
r[15] &= 15;
r[4] &= 252;
r[8] &= 252;
r[12] &= 252;
}

So unless the code form OpenSSL is doing some arithmetic tricks and over optimized it is missing parts or has different implementation somewhere.