Provide alternative HMAC interface, with context struct having just derived key and single hash state instead of three hash states at once.

Signed-off-by: Dmitry Eremin-Solenikov dbaryshkov@gmail.com --- hmac.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ hmac.h | 32 ++++++++++++++++++++++++++++ 2 files changed, 98 insertions(+)

diff --git a/hmac.c b/hmac.c index 6ac5e11a0686..6d57f8c9197c 100644 --- a/hmac.c +++ b/hmac.c @@ -115,3 +115,69 @@ hmac_digest(const void *outer, const void *inner, void *state,

memcpy(state, inner, hash->context_size); } + +static void +hmac2_reinit_state(void *state, void *derived_key, + const struct nettle_hash *hash, + uint8_t padc) +{ + TMP_DECL(pad, uint8_t, NETTLE_MAX_HASH_BLOCK_SIZE); + TMP_ALLOC(pad, hash->block_size); + + memset(pad, padc, hash->block_size); + memxor(pad, derived_key, hash->block_size); + + hash->init(state); + hash->update(state, hash->block_size, pad); +} + +void +hmac2_set_key(void *state, void *derived_key, + const struct nettle_hash *hash, + size_t key_length, const uint8_t *key) +{ + memset(derived_key, 0, hash->block_size); + + if (key_length > hash->block_size) + { + assert(hash->digest_size <= hash->block_size); + + /* Reduce key to the algorithm's hash size. Use the area pointed + * to by state for the temporary state. */ + hash->init(state); + hash->update(state, key_length, key); + hash->digest(state, hash->digest_size, derived_key); + } + else + { + memcpy(derived_key, key, key_length); + } + + hmac2_reinit_state(state, derived_key, hash, IPAD); +} + +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data) +{ + hash->update(state, length, data); +} + +void +hmac2_digest(void *state, void *derived_key, + const struct nettle_hash *hash, + size_t length, uint8_t *dst) +{ + TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + TMP_ALLOC(digest, hash->digest_size); + + hash->digest(state, hash->digest_size, digest); + + hmac2_reinit_state(state, derived_key, hash, OPAD); + + hash->update(state, hash->digest_size, digest); + hash->digest(state, length, dst); + + hmac2_reinit_state(state, derived_key, hash, IPAD); +} diff --git a/hmac.h b/hmac.h index 40a8e77aab6d..29a2798ffc21 100644 --- a/hmac.h +++ b/hmac.h @@ -49,6 +49,9 @@ extern "C" { #define hmac_set_key nettle_hmac_set_key #define hmac_update nettle_hmac_update #define hmac_digest nettle_hmac_digest +#define hmac2_set_key nettle_hmac2_set_key +#define hmac2_update nettle_hmac2_update +#define hmac2_digest nettle_hmac2_digest #define hmac_md5_set_key nettle_hmac_md5_set_key #define hmac_md5_update nettle_hmac_md5_update #define hmac_md5_digest nettle_hmac_md5_digest @@ -87,6 +90,24 @@ hmac_digest(const void *outer, const void *inner, void *state, size_t length, uint8_t *digest);

+void +hmac2_set_key(void *state, void *derived_key, + const struct nettle_hash *hash, + size_t length, const uint8_t *key); + +/* This function is not strictly needed, it's s just the same as the + * hash update or hmac2_update functions. */ +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data); + +void +hmac2_digest(void *state, void *derived_key, + const struct nettle_hash *hash, + size_t length, uint8_t *digest); + + #define HMAC_CTX(type) \ { type outer; type inner; type state; }

@@ -98,6 +119,17 @@ hmac_digest(const void *outer, const void *inner, void *state, hmac_digest( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ (hash), (length), (digest) )

+#define HMAC2_CTX(type, block_size) \ +{ type state; uint8_t key[block_size]; } + +#define HMAC2_SET_KEY(ctx, hash, length, key) \ + hmac2_set_key( &(ctx)->state, &(ctx)->key, \ + (hash), (length), (key) ) + +#define HMAC2_DIGEST(ctx, hash, length, digest) \ + hmac2_digest( &(ctx)->state, &(ctx)->key, \ + (hash), (length), (digest) ) + /* HMAC using specific hash functions */

/* hmac-md5 */

Dmitry Eremin-Solenikov dbaryshkov@gmail.com writes:

Hello colleagues,

I gave a little thought to Niels' idea:

5. Revamp hmac and underlying hash functions with a separate state struct. Probably low priority, but it is a bit silly that, e.g., hmac_sha512_ctx includes three 128-byte large block buffers.

I've implemented new approach using hmac2 prefix, but if you like this approach I can switch hmac2 prefix to just hmac and drop older API.

Nice!

diff --git a/hmac.c b/hmac.c index 6ac5e11a0686..6d57f8c9197c 100644 --- a/hmac.c +++ b/hmac.c @@ -115,3 +115,69 @@ hmac_digest(const void *outer, const void *inner, void *state,

memcpy(state, inner, hash->context_size); }

+static void +hmac2_reinit_state(void *state, void *derived_key,

•    const struct nettle_hash *hash,
  

•    uint8_t padc)
  

+{

• TMP_DECL(pad, uint8_t, NETTLE_MAX_HASH_BLOCK_SIZE);
• TMP_ALLOC(pad, hash->block_size);
• memset(pad, padc, hash->block_size);
• memxor(pad, derived_key, hash->block_size);
• hash->init(state);
• hash->update(state, hash->block_size, pad);

+}

This reinit function is used instead of a plain memcpy (of the complete ctx, including buffer). That's less efficient, since we'll get more calls to the heavy compression function for each message.

In principle, it should be possible to replace derived_key with the relevant part of hash context, except the buffer, and memcpy that. If it's possible to arrange it in that way without things getting too ugly, I think that might be worth the effort.

A typical context struct looks like

struct sha256_ctx { uint32_t state[_SHA256_DIGEST_LENGTH]; /* State variables */ uint64_t count; /* 64-bit block count */ uint8_t block[SHA256_BLOCK_SIZE]; /* SHA256 data buffer */ unsigned int index; /* index into buffer */ };

Here, we should first reorder fields so that the block buffer is last,

struct sha256_ctx { uint32_t state[_SHA256_DIGEST_LENGTH]; /* State variables */ uint64_t count; /* 64-bit block count */ unsigned int index; /* index into buffer */ uint8_t block[SHA256_BLOCK_SIZE]; /* SHA256 data buffer */ };

(and we can do that, since we're planning an abi break).

Then at the time reinit is called, we would memcpy the first three fields. state here depends on the key, while count will be always 1 and index always zero (but it's likely not a useful optimization to handle the constat part separately). To make reasonably clean, we may have to take out the non-block fields to a separate struct, say

struct sha256_state { uint32_t state[_SHA256_DIGEST_LENGTH]; /* State variables */ uint64_t count; /* 64-bit block count */ unsigned int index; /* index into buffer */ };

struct sha256_ctx { struct sha256_state state; uint8_t block[SHA256_BLOCK_SIZE]; /* SHA256 data buffer */ };

and let

struct hmac_sha256 { struct sha256_state inner; struct sha256_state outer; struct sha256_ctx hash_ctx; /* Initialized from key, updated as the message is processed */ };

We'd need to add a state_size field to struct nettle_hash, and then reinit would be

memcpy(&hmac_ctx->hash_ctx, hmac_ctx->inner /* or outer */, hash->state_size);

And the nice thing is that any hash function not matching this internal structure can let state_size == context_size, and things will keep working.

What do you think?

Regards, /Niels